Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Rancher cloud credentials can be used through proxy API by users without access

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

Rancher doesn't properly sanitize credentials in cluster template answers

Apache Ranger has a Code Injection vulnerability

OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Vitess users with backup storage access can write to arbitrary file paths on restore

Langflow has Remote Code Execution in CSV Agent

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

n8n: Expression Sandbox Escape Leads to RCE

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

n8n has Arbitrary Command Execution via File Write and Git Operations

n8n has Potential Remote Code Execution via Merge Node

n8n has a Sandbox Escape in its JavaScript Task Runner

n8n has Unauthenticated Expression Evaluation via Form Node

Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection

Parse Dashboard is Missing Authorization for its Agent Endpoint

Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

Parse Dashboard has incomplete authentication on AI Agent endpoint

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

@enclave-vm/core is vulnerable to Sandbox Escape

OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks

Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering

Statamic is vulnerable to account takeover via password reset link injection

FUXA has JWT Authentication Bypass via HTTP Referer header spoofing

OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

ormar is vulnerable to SQL Injection through aggregate functions min() and max()

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

MLflow Use of Default Password Authentication Bypass Vulnerability

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Prototype pollution in swiper

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

carbon-apimgt does not properly restrict uploaded files

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

Scan your dependencies for these CVEs