Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

480 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

django-s3file is vulnerable to relative path traversal

Langflow Knowledge Bases API is Vulnerable to Path Traversal

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Codechecker has an authentication bypass for certain API calls

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Sentry's improper authentication on SAML SSO process allows user identity linking

NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system

LiteLLM has SQL Injection in Proxy API key verification

Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes

Sentry: Improper authentication on SAML SSO process allows user identity linking

UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

Upsonic: remote code execution vulnerability in its MCP server/task creation functionality

excel-mcp-server has a Path Traversal issue

Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability

aws-mcp has a Command Injection Remote Code Execution Vulnerability

gramps-webapi: Zip Slip Path Traversal in Media Archive Import

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

PraisonAI has critical RCE via `type: job` workflow YAML

PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`

PraisonAI Vulnerable Untrusted Remote Template Code Execution

parisneo/lollms vulnerable to stored XSS in the social feature

PraisonAI Vulnerable to OS Command Injection

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

LoLLMs is vulnerable to Improper Access Control through weak secret key

changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

Agno is vulnerable to Eval Injection

PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

SciTokens is vulnerable to SQL Injection in KeyCache

Mlflow: Command Injection when serving models with enable_mlserver=True

MLflow Command Injection vulnerability

MLFlow path traversal vulnerability

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Scan your dependencies for these CVEs