Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

TYPO3 CMS: Destructive Actions on File Mount Folders

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

TYPO3 CMS has Broken Access Control in its Form Framework

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

DevGuard has improper authorization on public assets

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

Spring for GraphQL: Cross-Site WebSocket Hijacking

Spring for GraphQL: Unsafe Deserialization

Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey has a SQL Injection issue

degit has a Command Injection issue

Spring Framework Unsafe Deserialization via Jackson JMS Converters

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Micrometer HTTP server instrumentations DoS

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Routinator has cache path traversal when processing the module component of rsync URIs

Routinator crashes when encountering maliciously crafted RRDP XML files

Routinator crashes when sending a maliciously crafted select-asn query parameter

Twig: Possible sandbox bypass when using a source policy

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Scan your dependencies for these CVEs