Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer

bagisto has CSV Formula Injection in Create New Product

PrestaShop Checkout allows customer account takeover via email

Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability

happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability

Happy DOM: VM Context Escape can lead to Remote Code Execution

BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE

BBOT's various issues in unarchive.py can cause arbitrary file write and RCE

Flowise is vulnerable to arbitrary file write through its WriteFileTool

Melis Platform CMS Unauthenticated File Upload Leading to RCE

Melis Platform CMS SQL Injection

Melis Platform CMS Unauthenticated Admin Account Creation

Akka.Remote TLS did not properly implement certificate-based authentication

SillyTavern Web Interface Vulnerable DNS Rebinding

XWiki Platform is vulnerable to HQL injection via wiki and space search REST API

XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Flowise vulnerable to RCE via Dynamic function constructor injection

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

Apache Pyfory python is vulnerable to deserialization of untrusted data

check-branches is vulnerable to command Injection

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

cors-anywhere vulnerable to server-side request forgery

Command Injection in adb-mcp MCP Server

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

H2O affected by a deserialization vulnerability

InvokeAI has External Control of File Name or Path

jinjava has Sandbox Bypass via JavaType-Based Deserialization

Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

Flowise has arbitrary file access due to missing chat flow id validation

Flowise has Remote Code Execution vulnerability

FlowiseAI Pre-Auth Arbitrary Code Execution

mcp-kubernetes-server has an OS Command Injection vulnerability

Chaos Controller Manager is vulnerable to OS command injection

Chaos Controller Manager is vulnerable to OS command injection

Chaos Controller Manager is vulnerable to OS command injection

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

Prebid-universal-creative latest on npm briefly compromised

interactive-git-checkout has a Command Injection vulnerability

Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

CVE-2025-54236KEV

Magento Community Edition Improper Input Validation vulnerability

pREST has a Systemic SQL Injection Vulnerability

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

CodeceptJS's incomprehensive sanitation can lead to Command Injection

internetarchive Vulnerable to Directory Traversal in File.download()

TkEasyGUI Vulnerable to OS Command Injection

Scan your dependencies for these CVEs