Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Snipe-IT: Stored DOM XSS via table selected-count IDs

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

LibreNMS Vulnerable to Remote Code Execution via AboutController

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

jmespath.php has CompilerRuntime code injection via unescaped function names

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Winter: Authenticated backend users can bypass Users controller permission checks

Winter: Stored XSS through Editor Settings custom styles

Winter: Stored XSS through Brand Settings custom styles

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Statamic: Account takeover via OAuth email matching without email-verification check

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor has an authenticated terminal command whitelist bypass

MantisBT: Reflected XSS in admin/install.php via unescaped printf

MantisBT: Reflected XSS in admin/install.php

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

FacturaScripts: Account takeover of any 2FA-enabled user

Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NukeViet: Unauthenticated Reflected XSS in Comment Module

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki has Authenticated SQL Injection via ReactionManager

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

EGroupware has a Remote Code Execution Vulnerability

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Formie Hidden field defaults vulnerable to Server-Side Template Injection

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Mautic vulnerable to Path Traversal via Campaign Import

Mautic has Server-Side Template Injection (SSTI) in Theme Templates

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Scan your dependencies for these CVEs