Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

480 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Langflow has Authenticated Code Execution in Agentic Assistant Validation

Langflow has an Arbitrary File Write (RCE) via v2 API

Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker

PickleScan has multiple stdlib modules with direct RCE not in blocklist

PickleScan's pkgutil.resolve_name has a universal blocklist bypass

PickleScan's profile.run blocklist mismatch allows exec() bypass

Langflow has Remote Code Execution in CSV Agent

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

ormar is vulnerable to SQL Injection through aggregate functions min() and max()

MLflow Use of Default Password Authentication Bypass Vulnerability

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

NLTK has a Zip Slip Vulnerability

Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

Keylime Missing Authentication for Critical Function and Improper Authentication

Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

Langroid has WAF Bypass Leading to RCE in TableChatAgent

vLLM has RCE In Video Processing

H2O has an External Control of File Name or Path vulnerability

CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection

dcap-qvl has Missing Verification for QE Identity

Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

Salesforce Uni2TS has a Code Injection vulnerability

terminal-controller-mcp vulnerable to Command Injection

Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context

Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool

asyncmy is vulnerable to SQL injection via crafted dict keys

Ray's New Token Authentication is Disabled By Default

Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack

Modular Max Serve has Unsafe Deserialization vulnerability

Scan your dependencies for these CVEs