Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Possible DoS by memory exhaustion in net-imap

GHSA-f8mx-cwfh-7hr2

TShock allows chat while not fully connected, possible ban evasion

Snowflake.Data has weak temporary files permissions

XSS/HTML Injection Vulnerability in Umbraco Preview Badge

Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes

XSS/HTML Injection Vulnerability in Umbraco Backoffice Components

Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length

OpenFGA Authorization Bypass

CVE-2025-22145EPSS 0.1%

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Oqtane Framework Insecure Direct Object Reference vulnerability

Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications

rustls network-reachable panic in `Acceptor::accept`

SurrealDB has an Uncaught Exception Sorting Tables by Random Order

SurrealDB has an Uncaught Exception in Function Generating Random Time

decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds

wasm3 uncontrolled memory allocation vulnerability

HTTP Client uses incorrect token after refresh

Langflow vulnerable to remote code execution

Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected

MPXJ has a Potential Path Traversal Vulnerability

REXML ReDoS vulnerability

camaleon_cms affected by cross site scripting

Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Security Update for the OPC UA .NET Standard Stack

Possible ReDoS vulnerability in block_format in Action Mailer

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

Magento Open Source Improper Input Validation vulnerability

Magento Open Source Cross-Site Scripting (XSS) vulnerability

wasmtime has a runtime crash when combining tail calls with trapping imports

CVE-2024-45231EPSS 0.2%

Django allows enumeration of user e-mail addresses

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

Puma's header normalization allows for client to clobber proxy set headers

Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

OpenShift Controller Manager Improper Privilege Management

OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

Twig has a possible sandbox bypass

DOM clobbering could escalate to Cross-site Scripting (XSS)

CRLF Injection in RestSharp's `RestRequest.AddHeader` method

Serilog Client IP Spoofing vulnerability

request_store has Incorrect Default Permissions

Umbraco CMS Improper Access Control vulnerability

fugit parse and parse_nat stall on lengthy input

Scan your dependencies for these CVEs