Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto doesn't enforce invoking key constraints

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

ImageMagick: Policy Bypass can read disallowed files via symlink

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems

ImageMagick Vulnerable to Stack Overflow in its MVG Decoder

ImageMagick has an Infinite Loop in subimage-search with crafted image

ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

OpenAM has Unsafe Java Deserialization via SNS

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Mise's local credential_command executes untrusted config

Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

Budibase has nonymous NoSQL operator injection via published-app query templates

Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

CVE-2026-55255KEV

Gogs has Path Traversal in organization name that results in RCE through Git hooks

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

Scan your dependencies for these CVEs