Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Statamic vulnerable to privilege escalation via stored cross-site scripting

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Statamic is vulnerable to account takeover via password reset link injection

Formwork Improperly Managed Privileges in User creation

Statamic affected by privilege escalation via stored cross-site scripting

LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

Known affected by Account Takeover via Password Reset Token Leakage

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

Craft CMS: GraphQL Asset Mutation Privilege Escalation

Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

OpenSTAManager has a SQL Injection in the Prima Nota module

OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module

OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

OpenSTAManager has a SQL Injection in Scadenzario Print Template

OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

OpenSTAManager has an OS Command Injection in P7M File Processing

OpenSTAManager has an SQL Injection in the Stampe Module

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

FacturaScripts has SQL Injection in Autocomplete Actions

Moodle Affected by Improper Restriction of Excessive Authentication Attempts

Moodle authentication bypass vulnerability

Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

RaspAP raspap-webgui contains an OS Command Injection vulnerability

EGroupware has SQL Injection in Nextmatch Filter Processing

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Moodle affected by a code injection vulnerability

phpPgAdmin contains a remote command execution vulnerability

mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

Laravel Redis Horizontal Scaling Insecure Deserialization

alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass

Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

Pimcore Has an Incomplete Patch for CVE-2023-30848

Concrete5 CMS contains an XPath injection vulnerability

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

Unauthenticated Craft CMS users can trigger a database backup

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto Missing Authentication on Installer API Endpoints

FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Cadmium CMS has a background arbitrary file upload vulnerability

Kimai contains a SameSite cookie vulnerability

phpMyFAQ contains a CSV injection vulnerability

Scan your dependencies for these CVEs