Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Miniscript allows stack consumption

Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability

REXML DoS vulnerability

REXML DoS vulnerability

IdentityServer Open Redirect vulnerability

SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder

SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User

Decidim cross-site scripting (XSS) in the admin panel

Decidim cross-site scripting (XSS) in the pagination

Decidim vulnerable to data disclosure through the embed feature

RailsAdmin Cross-site Scripting vulnerability in the list view

Rack ReDoS Vulnerability in HTTP Accept Headers Parsing

MongoDB Rust driver may issue unintended commands

TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option

TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Missing security headers in Action Pack on non-HTML responses

ActionText ContentAttachment can Contain Unsanitized HTML

Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality

Kaminari Insecure File Permissions Vulnerability

gix refs and paths with reserved Windows device names access the devices

Umbraco CMS Open Redirect Bypass Protection

CVE-2024-35195EPSS 0.0%

Requests `Session` object does not verify requests after making first request with verify=False

REXML contains a denial of service vulnerability

Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-30045 | .NET Remote code Execution Vulnerability

Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability

Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

Bouncy Castle crafted signature and public key can be used to trigger an infinite loop

Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")

Trix Editor Arbitrary Code Execution Vulnerability

Sidekiq vulnerable to a Reflected XSS in Queues Web Page

Umbraco Workflow's Backoffice users can execute arbitrary SQL

SixLabors.ImageSharp vulnerable to data leakage

SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value

gix-transport indirect code execution via malicious username

Magento Open Source allows Cross-Site Scripting (XSS)

Azure Identity Library for .NET Information Disclosure Vulnerability

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

CVE-2024-29041EPSS 0.1%

Express.js Open Redirect in malformed URLs

CVE-2024-28863EPSS 0.4%

Denial of service while parsing a tar file due to lack of folders count validation

ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

YARD's default template vulnerable to Cross-site Scripting in generated frames.html

Rails has possible Sensitive Session Information Leak in Active Storage

Rails has possible XSS Vulnerability in Action Controller

Uncaught Exception in Macro Expecting Native Function to Exist

Uncaught Exception Handling Parsing Errors on Line Terminators

Cross-site scripting (XSS) in the dynamic file uploads

Possibility to circumvent the invitation token expiry period

Scan your dependencies for these CVEs