Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

OPA server Data API HTTP path injection of Rego

Any user with view access to the XWiki space can change the authenticator

Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution

Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository

Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository

Rancher users who can create Projects can gain access to arbitrary projects

Infinite loop condition in Amazon.IonDotnet

Traefik has a possible vulnerability with its path matchers

Pycel allows code injection via a crafted formula

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

GHSA-f87w-3j5w-v58p

CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows

SurrealDB CPU exhaustion via custom functions result in total DoS

SurrealDB memory exhaustion via string::replace using regex

SurrealDB has uncaught exception in Net module that leads to database crash

Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

Apollo Compiler Named Fragment Processing Vulnerability

Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component

@alizeait/unflatto Prototype Pollution

jooby-pac4j: deserialization of untrusted data

Drupal OAuth2 Server Missing Authorization vulnerability

Drupal Authenticator Login Missing Authorization vulnerability

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

ingress-nginx controller - configuration injection via unsanitized auth-url annotation

ingress-nginx controller - configuration injection via unsanitized mirror annotations

PipeCD Vulnerable to Privilege Escalation

Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

The WikiManager REST API allows any user to create wikis

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

Out-of-bounds Read in Ruby JSON Parser

Below has Incorrect Permission Assignment for Critical Resource

Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability

The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

Vela Server Has Insufficient Webhook Payload Data Verification

Local File Inclusion in Rack::Static

canvg Prototype Pollution vulnerability

Microsoft Security Advisory CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability

Vue I18n Allows Prototype Pollution in `handleFlatJson`

CVE-2025-27152EPSS 0.1%

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

GHSA-vc29-vg52-6643

DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api

Out-of-bounds Write in SixLabors ImageSharp

Scan your dependencies for these CVEs