Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

456 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

@nyariv/sandboxjs has a Sandbox Escape issue

FUXA Unauthenticated Remote Arbitrary Device Tag Write

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

FUXA Unauthenticated Exposure of Plaintext Database Credentials

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

n8n has a Python sandbox escape

n8n Merge Node has Arbitrary File Write leading to RCE

n8n has OS Command Injection in Git Node

n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

n8n Has Expression Escape Vulnerability Leading to RCE

n8n Vulnerable to Command Injection in Community Package Installation

Prototype Pollution via FormData Processing in Qwik City

locutus is vulnerable to Prototype Pollution

SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE

Signal K set-system-time plugin vulnerable to RCE - Command Injection

Orval has Code Injection via unsanitized x-enum-descriptions using JS comments

deepHas vulnerable to Prototype Pollution via constructor.prototype

SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution

vm2 has a Sandbox Escape

dcap-qvl has Missing Verification for QE Identity

sm-crypto Affected by Private Key Recovery in SM2-PKE

Orval has a code injection via unsanitized x-enum-descriptions in enum generation

Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)

REC in MCPJam inspector due to HTTP Endpoint exposes

enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

Malicious website can execute commands on the local system through XSS in the OpenCode web UI

orval MCP client is vulnerable to a code injection attack.

React Router has Path Traversal in File Session Storage

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

n8n Vulnerable to RCE via Arbitrary File Write

AdonisJS Path Traversal in Multipart File Handling

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

apidoc-core has a prototype pollution vulnerability

n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

CVE-2025-68613KEV

n8n Vulnerable to Remote Code Execution via Expression Injection

@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

CVE-2025-55182KEV

React Server Components are Vulnerable to RCE

MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

@hpke/core reuses AEAD nonces

CVE-2025-11953KEV

@react-native-community/cli has arbitrary OS command injection

happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Happy DOM: VM Context Escape can lead to Remote Code Execution

Flowise is vulnerable to arbitrary file write through its WriteFileTool

Scan your dependencies for these CVEs