Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

Gogs Vulnerable to 2FA Bypass via Recovery Code

qdrant has arbitrary file write via `/logger` endpoint

Unauthenticated Spree Commerce users can access all guest addresses

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

OpenCloud Reva has a Public Link Exploit

Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage

n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node

Alist vulnerable to Path Traversal in multiple file operation handlers

n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS

ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx

OpenSTAManager has an SQL Injection in the Stampe Module

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

FUXA allows Remote Code Execution (RCE) via the project import functionality.

FUXA contains an Unrestricted File Upload vulnerability

FUXA contains an insecure default configuration vulnerability

FacturaScripts has SQL Injection in Autocomplete Actions

RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

Decidim's private data exports can lead to data leaks

Django has an SQL Injection issue

Django has an SQL Injection issue

Moodle Affected by Improper Restriction of Excessive Authentication Attempts

Moodle authentication bypass vulnerability

OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

picklescan missing detection by simple obfuscation of a `builtins.eval` call

OpenList vulnerable to Path Traversal in file copy and remove handlers

foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

RaspAP raspap-webgui contains an OS Command Injection vulnerability

Rancher CLI skips TLS verification on Rancher CLI login command

AutoGPT is Vulnerable to RCE via Disabled Block Execution

React Server Components have multiple Denial of Service Vulnerabilities

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

EGroupware has SQL Injection in Nextmatch Filter Processing

CVE-2026-24842EPSS 0.0%

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal

DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes

Clatter has a PSK Validity Rule Violation issue

soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

Ghost vulnerable to XSS via malicious Portal preview links

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Cassandra Web - Remote File Read

Moodle affected by a code injection vulnerability

Langflow affected by Remote Code Execution via validate_code() exec()

Incus container image templating arbitrary host file read and write

Incus container environment configuration newline injection

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

Dragonfly Manager Job API Unauthenticated Access

Scan your dependencies for these CVEs