Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

letmein connection limiter allows an arbitrary amount of simultaneous connections

DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed

DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects

Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates

Apache Tomcat installer for Windows has an untrusted search path vulnerability

XWiki does not require right warnings for notification displayer objects

CVE-2024-47081EPSS 0.1%

Requests vulnerable to .netrc credentials leak via malicious URLs

ReDoS Vulnerability in Rack::Multipart handle_mime_head

CVE-2025-48432EPSS 0.1%

Django Improper Output Neutralization for Logs vulnerability

Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

OpenFGA Authorization Bypass

DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline

Reflected Cross-Site Scripting (XSS) in module actions in edit mode

Insufficient input sanitization in ejson2env

JRuby-OpenSSL has hostname verification disabled by default

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

OpenFGA Authorization Bypass

Apache Tomcat Denial of Service via invalid HTTP priority header

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Pleezer resource exhaustion through uncollected hook script processes

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB vulnerable to memory exhaustion via nested functions and scripts

Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

gitoxide does not detect SHA-1 collision attacks

Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability

Drupal Open Social Missing Authorization vulnerability

Drupal AI Cross-Site Request Forgery (CSRF) vulnerability

Pitchfork HTTP Request/Response Splitting vulnerability

GHSA-vgmh-mqm4-8j88

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Crash due to uncontrolled recursion in protobuf crate

Some AES functions may panic when overflow checking is enabled in ring

OpenTelemetry .NET has Denial of Service (DoS) Vulnerability in API Package

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

CGI has Denial of Service (DoS) potential in Cookie.parse

Security Update for the OPC UA .NET Standard Stack

Security Update for the OPC UA .NET Standard Stack

Phusion Passenger denial of service

AutoQueryable leaks sensitive information

OpenFGA Authorization Bypass

Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

Possible Log Injection in Rack::CommonLogger

Hickory DNS's DNSSEC validation may accept broken authentication chains

Scan your dependencies for these CVEs