Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

340 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

WeChat Pay callback signature verification bypassed when Host header is localhost

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

Statamic has Stored XSS via SVG Sanitization Bypass

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

File Upload(RCE) Vulnerability in admidio

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

Shopware vulnerable to a potential take over of app credentials

Shopware: Unauthenticated data extraction possible through store-api.order endpoint

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

Sylius has a Promotion Usage Limit Bypass via Race Condition

Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

CVE-2026-100857

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

Craft CMS has unauthenticated activation email trigger with potential user enumeration

Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal

Statamic vulnerable to privilege escalation via stored cross-site scripting

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Formwork Improperly Managed Privileges in User creation

Statamic affected by privilege escalation via stored cross-site scripting

LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

Craft CMS: GraphQL Asset Mutation Privilege Escalation

Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

OpenSTAManager has a SQL Injection in the Prima Nota module

OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module

OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

OpenSTAManager has a SQL Injection in Scadenzario Print Template

OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

OpenSTAManager has an SQL Injection in the Stampe Module

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

FacturaScripts has SQL Injection in Autocomplete Actions

Scan your dependencies for these CVEs