Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Argo CD's Project API Token Exposes Repository Credentials

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

XWiki configuration files can be accessed through jsx and sx endpoints

XWiki configuration files can be accessed through the webjars API

Valtimo scripting engine can be used to gain access to sensitive data or resources

NeuVector admin account has insecure default password

The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

sha.js is missing type checks leading to hash rewind and passing on crafted data

cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Spree Commerce is vulnerable to RCE through Search API

screenshot-desktop vulnerable to command Injection via `format` option

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

Flowise OS command remote code execution

Active Storage allowed transformation methods that were potentially unsafe

Spree has Remote Command Execution vulnerability in search functionality

Privileged OpenBao Operator May Execute Code on the Underlying Host

ExecuTorch integer overflow vulnerability

ExecuTorch heap buffer overflow vulnerability

ExecuTorch out-of-bounds access vulnerability

ExecuTorch integer overflow vulnerability

ExecuTorch vulnerable to Heap-based Buffer Overflow

JWE is missing AES-GCM authentication tag validation in encrypted JWE

ThinkPHP Path Traversal Vulnerability

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

The ADOdb sqlite3 driver allows SQL injection

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion

BentoML SSRF Vulnerability in File Upload Processing

Node-SAML SAML Signature Verification Vulnerability

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

Node-SAML SAML Authentication Bypass

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

form-data uses unsafe random function in form-data for choosing boundary

simogeo/filemanager arbitrary file upload vulnerability

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

CVE-2025-54068KEV

Livewire is vulnerable to remote command execution during component property update hydration

pyLoad vulnerable to XSS through insecure CAPTCHA

XWiki Rendering is vulnerable to RCE attacks when processing nested macros

XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax

LaRecipe is vulnerable to Server-Side Template Injection attacks

Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token

mcp-remote exposed to OS command injection via untrusted MCP server connections

Conductor vulnerable to OS command injection through unrestricted access to Java classes

Scan your dependencies for these CVEs