Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

456 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

SillyTavern Web Interface Vulnerable DNS Rebinding

Flowise vulnerable to RCE via Dynamic function constructor injection

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

check-branches is vulnerable to command Injection

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

cors-anywhere vulnerable to server-side request forgery

Command Injection in adb-mcp MCP Server

Flowise has arbitrary file access due to missing chat flow id validation

Flowise has Remote Code Execution vulnerability

FlowiseAI Pre-Auth Arbitrary Code Execution

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

Prebid-universal-creative latest on npm briefly compromised

interactive-git-checkout has a Command Injection vulnerability

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

CodeceptJS's incomprehensive sanitation can lead to Command Injection

sha.js is missing type checks leading to hash rewind and passing on crafted data

cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

screenshot-desktop vulnerable to command Injection via `format` option

Flowise OS command remote code execution

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

Node-SAML SAML Signature Verification Vulnerability

Node-SAML SAML Authentication Bypass

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

form-data uses unsafe random function in form-data for choosing boundary

docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

mcp-remote exposed to OS command injection via untrusted MCP server connections

pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

billboard.js allows prototype pollution via the function generate

samlify SAML Signature Wrapping attack

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

Authorization Bypass in Next.js Middleware

Flowise allows arbitrary file write to RCE

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Flowise Pre-auth Arbitrary File Upload

DocsGPT Allows Remote Code Execution

Inefficient Regular Expression Complexity in koa

Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Mongoose search injection vulnerability

path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Angular Expressions - Remote Code Execution when using locals

happy-dom allows for server side code to be executed by a <script> tag

Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

angular-base64-upload vulnerable to unauthenticated remote code execution

Scan your dependencies for these CVEs