Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

842 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

ImageMagick: Heap Buffer Over-Write in distributed pixel cache server

ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse

ImageMagick: Division by Zero in binomial kernel

GHSA-jqq5-8px3-9m6m

ImageMagick: Heap Buffer Over-Write in json and yaml encoder of a single byte due to incorrect fix

Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog

Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString

ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.

ImageMagick: Stack overflow in fx operation

ImageMagick: Use-After-Free in MSL decoder.

ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

ImageMagick: Policy Bypass in MNG coder could

ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

ImageMagick: Policy Bypass in PSD decoder

ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

GHSA-5r97-79vw-qvm4

Microsoft DirectX12: .spritefont multiply overflow only in 32-bit builds

GHSA-c55g-rp4x-fx84

Microsoft DirectX: .spritefont multiply overflow only in 32-bit builds

ImageMagick: Heap Buffer Over-Read in IPTC encoder

Marten has an injection vulnerability in its full-text search regConfig parameter

SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)

OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException

Snappier has an infinite loop during SnappyStream decompression with malformed framed input

OpAMP client reads unbounded HTTP response bodies

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter

OneCollector exporter reads unbounded HTTP response bodies

OpenTelemetry.Resources.Azure has an unbounded HTTP response body read

OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure

ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

GHSA-f5v8-v6q3-q4h6

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents

Scan your dependencies for these CVEs