Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Wish has SCP Path Traversal that allows arbitrary file read/write

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

OpenClaw: Feishu webhook and card-action validation now fail closed

Remote Code Execution (RCE) via String Literal Injection into math-codegen

PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection

OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes

Sentry: Improper authentication on SAML SSO process allows user identity linking

Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Arbitrary code execution in protobufjs

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

electerm: electerm_install_script_CommandInjection Vulnerability Report

Flowise: Authenticated RCE Via MCP Adapters

ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents

Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints

goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files

UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

MsQuic has a Remote Elevation of Privilege Vulnerability

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

Fastify's connection header abuse enables stripping of proxy-added headers

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

Pyroscope Exposes Storage Secret

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

Upsonic: remote code execution vulnerability in its MCP server/task creation functionality

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

@vendure/core has a SQL Injection vulnerability

Expression Injection in OpenRemote

OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

goshs has an empty-username SFTP password authentication bypass

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

excel-mcp-server has a Path Traversal issue

Decidim has a cross-site scripting (XSS) in user name

Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability

aws-mcp has a Command Injection Remote Code Execution Vulnerability

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Juju: CloudSpec method leaking cloud credentials

gramps-webapi: Zip Slip Path Traversal in Media Archive Import

goshs has a file-based ACL authorization bypass in goshs state-changing routes

Scan your dependencies for these CVEs