Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

PraisonAI Has Missing Authentication in WebSocket Gateway

Authlib JWS JWK Header Injection: Signature Verification Bypass

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`

External Control of File Name or Path in h2oai/h2o-3

MLflow Server-Side Request Forgery (SSRF)

MLFlow Path Traversal Vulnerability

PandasAI vulnerable to arbitrary code execution

Excessive Attack Surface in pyload-ng

Code Injection in pyload-ng

Heap-based buffer overflow in ZBar

Apache Airflow Hive Provider Beeline remote code execution with Principal

Langchain SQL Injection vulnerability

MLflow authentication requirement bypass can allow a user to arbitrarily create an account

Remote Code Execution due to Full Controled File Write in mlflow

MLflow allowed arbitrary files to be PUT onto the server

postgraas-server vulnerable to SQL injection

pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

Ray has arbitrary code execution via jobs submission API

Ray OS Command Injection vulnerability

ReportLab vulnerable to remote code execution via paraparser

TorchServe Server-Side Request Forgery vulnerability

Apache Airflow Hive Provider vulnerable to code injection

Apache Airflow Hive Provider Improper Input Validation vulnerability

Apache Airflow Sqoop Provider Improper Input Validation vulnerability

Apache Airflow Google Provider Improper Input Validation vulnerability

Ckan remote code execution and private information access via crafted resource ids

Use of hard-coded, security-relevant constants in deepset-ai/haystack

Remote code execution in pytorch lightning

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

toui allows user-specific variables to be shared between users

Header injection in TurboGears

vanna vulnerable to remote code execution caused by prompt injection

weixin-python XML External Entity vulnerability

Cross-site Scripting in Apache superset

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

litellm vulnerable to remote code execution based on using eval unsafely

Unsafe yaml deserialization in llama-hub

Remote Code Execution via path traversal bypass in lollms

parisneo/lollms Local File Inclusion (LFI) attack

Code execution in pandasai

qdrant input validation failure

Deserialization of untrusted data in synthcity

Improper Certificate Validation in apache airflow mongo hook

CraftBeerPi 4 allows arbitrary code execution

ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command

Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID

Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service

LangChain Experimental vulnerable to arbitrary code execution

Scan your dependencies for these CVEs