Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

n8n has Arbitrary File Read via Python Code Node Sandbox Escape

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed

ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder

ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field

ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy

ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions

ImageMagick: Infinite loop vulnerability when parsing a PCD file

ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Formwork Improperly Managed Privileges in User creation

Statamic affected by privilege escalation via stored cross-site scripting

D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation

LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

CVE-2026-26960EPSS 0.0%

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)

OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting

Apache Tomcat has an Improper Input Validation vulnerability

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

Rack has a Directory Traversal via Rack:Directory

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content

Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Keycloak affected by improper invitation token validation

Craft CMS: GraphQL Asset Mutation Privilege Escalation

Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

CVE-2026-25639EPSS 0.0%

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

Antrea has invalid enforcement order for network policy rules caused by integer overflow

GHSA-w67g-2h6v-vjgq

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

OpenSTAManager has a SQL Injection in the Prima Nota module

OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module

OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

OpenSTAManager has a SQL Injection in Scadenzario Print Template

Scan your dependencies for these CVEs