Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

596 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Remote unauthenticated attackers able to upload files in Onionshare

wolfSSL Python module vulnerable to Improper Authentication

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

Apache Airflow: JWT token still valid after logout

PraisonAI Has Authentication Bypass via OAuthManager.validate_token()

PraisonAI Has Missing Authentication in WebSocket Gateway

Authlib JWS JWK Header Injection: Signature Verification Bypass

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

External Control of File Name or Path in h2oai/h2o-3

MLflow Server-Side Request Forgery (SSRF)

MLFlow Path Traversal Vulnerability

PandasAI vulnerable to arbitrary code execution

Excessive Attack Surface in pyload-ng

Code Injection in pyload-ng

Heap-based buffer overflow in ZBar

Apache Airflow Hive Provider Beeline remote code execution with Principal

Langchain SQL Injection vulnerability

MLflow authentication requirement bypass can allow a user to arbitrarily create an account

Remote Code Execution due to Full Controled File Write in mlflow

MLflow allowed arbitrary files to be PUT onto the server

postgraas-server vulnerable to SQL injection

pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

Ray has arbitrary code execution via jobs submission API

Ray OS Command Injection vulnerability

ReportLab vulnerable to remote code execution via paraparser

TorchServe Server-Side Request Forgery vulnerability

Apache Airflow Hive Provider vulnerable to code injection

Apache Airflow Hive Provider Improper Input Validation vulnerability

Apache Airflow Sqoop Provider Improper Input Validation vulnerability

Apache Airflow Google Provider Improper Input Validation vulnerability

Ckan remote code execution and private information access via crafted resource ids

Use of hard-coded, security-relevant constants in deepset-ai/haystack

Remote code execution in pytorch lightning

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

toui allows user-specific variables to be shared between users

Header injection in TurboGears

vanna vulnerable to remote code execution caused by prompt injection

weixin-python XML External Entity vulnerability

Cross-site Scripting in Apache superset

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

litellm vulnerable to remote code execution based on using eval unsafely

Unsafe yaml deserialization in llama-hub

Remote Code Execution via path traversal bypass in lollms

parisneo/lollms Local File Inclusion (LFI) attack

Scan your dependencies for these CVEs