Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

BuildKit's Malicious frontend can cause file escape outside of storage root

n8n has SQL Injection in Data Table Node via orderByColumn Expression

AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment

AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL

n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

WeChat Pay callback signature verification bypassed when Host header is localhost

AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException

Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service

Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix

NATS has MQTT plaintext password disclosure

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

Rails Active Storage has possible Path Traversal in DiskService

Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

etcd: Authorization bypasses in multiple APIs

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

CRL Distribution Point Scope Check Logic Error in AWS-LC

Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config

Spring Boot has an Authentication Bypass under Actuator Health groups paths

ingress-nginx comment-based nginx configuration injection

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Parse Server has an auth provider validation bypass on login via partial authData

Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)

Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)

Prototype Pollution via parse() in NodeJS flatted

Juju has unauthorized access to out-of-scope Kubernetes secrets

Ruby JSON has a format string injection vulnerability

Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

Statamic has Stored XSS via SVG Sanitization Bypass

Gossipsub PRUNE.backoff Duration Overflow

Scan your dependencies for these CVEs