Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment

AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

WeChat Pay callback signature verification bypassed when Host header is localhost

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

AVideo has Unauthenticated SSRF via plugin/Live/test.php

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

Statamic has Stored XSS via SVG Sanitization Bypass

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

File Upload(RCE) Vulnerability in admidio

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

Winter vulnerable to privilege escalation by authenticated backend users

Shopware vulnerable to a potential take over of app credentials

Shopware: Unauthenticated data extraction possible through store-api.order endpoint

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

Sylius has a Promotion Usage Limit Bypass via Race Condition

Sylius has an Open Redirect via Referer Header

Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

CVE-2026-100857

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

Craft CMS has unauthenticated activation email trigger with potential user enumeration

Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal

Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

Scan your dependencies for these CVEs