Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

Sylius has a Promotion Usage Limit Bypass via Race Condition

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

StudioCMS has Privilege Escalation via Insecure API Token Generation

CVE-2026-100857

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

Flowise has Authorization Bypass via Spoofed x-request-from Header

Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

Keycloak SAML Broken has Authentication Bypass by Primary Weakness

Pingora vulnerable to cache poisoning via insecure-by-default cache key

OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

Gogs: Stored XSS via data URI in issue comments

Gokapi has Stored XSS in SVG Hotlinks

ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication

Immutable is vulnerable to Prototype Pollution

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

Craft CMS has unauthenticated activation email trigger with potential user enumeration

Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

XWiki Blog Application home page vulnerable to Stored XSS via Post Title

OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

AWS-LC has PKCS7_verify Signature Validation Bypass

AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal

theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

Statamic vulnerable to privilege escalation via stored cross-site scripting

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

rubyipmi is vulnerable to OS Command Injection through malicious usernames

Vitess users with backup storage access can gain unauthorized access to production deployment environments

WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Storybook Dev Server is Vulnerable to WebSocket Hijacking

esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

RustFS: Missing Post Policy Validation leads to Arbitrary Object Write

Rollup 4 has Arbitrary File Write via Path Traversal

Scan your dependencies for these CVEs