Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

596 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

pgAdmin 4 Vulnerable to Remote Code Execution

InvokeAI Deserialization of Untrusted Data vulnerability

vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

AgentScope Deserialization Vulnerability

llama-index-packs-finchat SQL Injection vulnerability

LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection

vLLM Deserialization of Untrusted Data vulnerability

H2O Deserialization of Untrusted Data Vulnerability

Qiskit allows arbitrary code execution decoding QPY format versions < 13

Spacy-LLM Server-Side Template Injection (SSTI) vulnerability

LTI JupyterHub Authenticator does not properly validate JWT Signature

PandasAI interactive prompt function Remote Code Execution (RCE)

Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Rasa Allows Remote Code Execution via Remote Model Loading

pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Django SQL injection in HasKey(lhs, rhs) on Oracle

cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

wasm3 uncontrolled memory allocation vulnerability

codechecker vulnerable to authentication bypass when using specifically crafted URLs

Langflow vulnerable to remote code execution

langflow has vulnerability in PythonCodeTool component

MPXJ has a Potential Path Traversal Vulnerability

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

CVE-2024-45231EPSS 0.2%

Django allows enumeration of user e-mail addresses

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Heap-based Buffer Overflow in sqlite-vec

LangChain Experimental Eval Injection vulnerability

AutoGPT bypass of the shell commands denylist settings

pyload-ng vulnerable to RCE with js2py sandbox escape

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

LlamaIndex includes an exec call for `import {cls_name}`

TorchServe vulnerable to bypass of allowed_urls configuration

CVE-2024-39689EPSS 21.2%

Certifi removes GLOBALTRUST root certificate

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

CVE-2024-35195EPSS 0.0%

Requests `Session` object does not verify requests after making first request with verify=False

Remote Code Execution vulnerability in Apache IoTDB via UDF

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

pubnub Insufficient Entropy vulnerability

Microsoft Common Data Model SDK Denial of Service Vulnerability

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

libwebp: OOB write in BuildHuffmanTable

Excessive Iteration in gRPC

gRPC Reachable Assertion issue

Connection confusion in gRPC

Scan your dependencies for these CVEs