Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

456 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

vm2 Has a Sandbox Breakout Using Async Generator

DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

n8n Has an XML Node Prototype Pollution Patch Bypass

n8n Has an Arbitrary File Read via Git Node

n8n: HTTP Request Node Pagination Prototype Pollution to RCE

FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

Strapi Vulnerable to SQL Injection in Content Type Builder

SillyTavern has a Path Traversal issue

SillyTavern has Authentication Bypass via SSO Header Injection

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

CVE-2026-45321KEV

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

SandboxJS has a sandbox escape via Function.caller leakage of internal call op

WebdriverIO BrowserStack Service has a Command Injection issue

Angular Expressions - Remote Code Execution using filters

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Electerm users can run dangrous code through link or command line

Electerm runWidget has a path traversal that leads to arbitrary code execution

vm2 has Sandbox Breakout Through Null Proto Exception

vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`

query-parser-string is vulnerable to Prototype Pollution

parse-ini is vulnerable to Prototype Pollution in index.js()

next-npm-version is vulnerable to Command injection

vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution

vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape

vm2 Access to Host Object Enables Sandbox Escape

vm2 has a Sandbox Escape Vulnerability

fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

VM2 Has a WASM Sandbox Escape

VM2 Has a Sandbox Escape Issue via SuppressedError

VM2 Has Sandbox Breakout Through Inspect Function

VM2 Has Sandbox Breakout Through Promise Species

VM2 Sandbox Breakout Through __lookupGetter__

n8n has XML Node Prototype Pollution that to RCE

n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE

electerm has Command Injection via runLinux funtion

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

OpenClaw: Feishu webhook and card-action validation now fail closed

Remote Code Execution (RCE) via String Literal Injection into math-codegen

Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Scan your dependencies for these CVEs