Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

GitHub Kanban MCP Server vulnerable to Command Injection

docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

@clerk/backend Performs Insufficient Verification of Data Authenticity

mcp-remote exposed to OS command injection via untrusted MCP server connections

@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix

@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling

pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

billboard.js allows prototype pollution via the function generate

radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

samlify SAML Signature Wrapping attack

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

@alizeait/unflatto Prototype Pollution

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Authorization Bypass in Next.js Middleware

Flowise allows arbitrary file write to RCE

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Flowise Pre-auth Arbitrary File Upload

canvg Prototype Pollution vulnerability

Vue I18n Allows Prototype Pollution in `handleFlatJson`

CVE-2025-27152EPSS 0.1%

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

FlowiseAI Flowise arbitrary file upload vulnerability

DocsGPT Allows Remote Code Execution

JSONPath Plus allows Remote Code Execution

Inefficient Regular Expression Complexity in koa

Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Mongoose search injection vulnerability

path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Astro's server source code is exposed to the public if sourcemaps are enabled

Angular Expressions - Remote Code Execution when using locals

Mongoose search injection vulnerability

happy-dom allows for server side code to be executed by a <script> tag

Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

angular-base64-upload vulnerable to unauthenticated remote code execution

DOMpurify has a nesting-based mXSS

JSONPath Plus Remote Code Execution (RCE) Vulnerability

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Heap-based Buffer Overflow in sqlite-vec

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

CVE-2024-43796EPSS 0.1%

express vulnerable to XSS via response.redirect()

Scan your dependencies for these CVEs