Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Signal K set-system-time plugin vulnerable to RCE - Command Injection

vLLM has RCE In Video Processing

H2O has an External Control of File Name or Path vulnerability

Orval has Code Injection via unsanitized x-enum-descriptions using JS comments

CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection

deepHas vulnerable to Prototype Pollution via constructor.prototype

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

DotNetNuke.Core Vulnerable to Stored XSS via Module Title

GHSA-5w5r-mf82-595p

Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema

SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor

Kyverno Cross-Namespace Privilege Escalation via Policy apiCall

n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution

vm2 has a Sandbox Escape

dcap-qvl has Missing Verification for QE Identity

Apache Continuum vulnerable to Command Injection through Installations REST API

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value

sm-crypto Affected by Private Key Recovery in SM2-PKE

Laravel Redis Horizontal Scaling Insecure Deserialization

Orval has a code injection via unsanitized x-enum-descriptions in enum generation

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

XDocReport affected by an XML External Entity (XXE) vulnerability

XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

REC in MCPJam inspector due to HTTP Endpoint exposes

Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter

Deno node:crypto doesn't finalize cipher

Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

Malicious website can execute commands on the local system through XSS in the OpenCode web UI

UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation

orval MCP client is vulnerable to a code injection attack.

openc3-api Vulnerable to Unauthenticated Remote Code Execution

Salesforce Uni2TS has a Code Injection vulnerability

WeKnora has Command Injection in MCP stdio test

XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

FASTJSON Includes Functionality from Untrusted Control Sphere

React Router has Path Traversal in File Session Storage

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

terminal-controller-mcp vulnerable to Command Injection

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware

Bypassing Kyverno Policies via Double Policy Exceptions

n8n Vulnerable to RCE via Arbitrary File Write

Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer

AdonisJS Path Traversal in Multipart File Handling

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

RustFS has a gRPC Hardcoded Token Authentication Bypass

apidoc-core has a prototype pollution vulnerability

Scan your dependencies for these CVEs