Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Spring Cloud Config vulnerable to Path Traversal

vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution

vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape

vm2 Access to Host Object Enables Sandbox Escape

vm2 has a Sandbox Escape Vulnerability

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

Compromise of PyTorch Lightning PyPi Package Versions

fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha

phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

Apache Wicket has a Session Fixation issue

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

django-s3file is vulnerable to relative path traversal

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

S3-Proxy has Security Issues in its Resource Path Matching Implementation

Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

Langflow Knowledge Bases API is Vulnerable to Path Traversal

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Codechecker has an authentication bypass for certain API calls

VM2 Has a WASM Sandbox Escape

VM2 Has a Sandbox Escape Issue via SuppressedError

VM2 Has Sandbox Breakout Through Inspect Function

VM2 Has Sandbox Breakout Through Promise Species

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Pelican Web UI Affected by a Privilege Escalation Attack

phpVMS has an /importer authorization bypass causing full database wipe

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

OpenMRS has Stored Velocity SSTI to RCE via ConceptReferenceRange

Apache Polaris has an Improper Input Validation Issue

Apache OpenNLP ExtensionLoader Vulnerable to Arbitrary Class Instantiation via Model Manifest

Apache Polaris has an Improper Input Validation issue

Apache Polaris has an Improper Input Validation Issue

Apache Polaris has an Improper Input Validation issue

Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing

Scan your dependencies for these CVEs