Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

LibreNMS has an Authenticated OS Command Injection

Improper Restriction of XML External Entity Reference in dompdf/dompdf

Deserialization of Untrusted Data in dompdf/dompdf

.NET Remote Code Execution Vulnerability

jj vulnerable to path traversal via crafted Git repositories

codechecker vulnerable to authentication bypass when using specifically crafted URLs

happy-dom allows for server side code to be executed by a <script> tag

Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Rancher Remote Code Execution via Cluster/Node Drivers

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Grafana Command Injection And Local File Inclusion Via Sql Expressions

Improper Authentication vulnerability in Apache Solr

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

pac4j-core affected by a Java deserialization vulnerability

angular-base64-upload vulnerable to unauthenticated remote code execution

SSOReady has an XML Signature Bypass via differential XML parsing

JSONPath Plus Remote Code Execution (RCE) Vulnerability

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Mellium allows Authentication Bypass by Spoofing

DataEase's H2 datasource has a remote command execution risk

Dragonfly2 has hard coded cyptographic key

LangChain Experimental Eval Injection vulnerability

Chaosblade vulnerable to OS command execution

GHSA-cvp8-5r8g-fhvq

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

AutoGPT bypass of the shell commands denylist settings

SAML authentication bypass via Incorrect XPath selector

ThinkPHP deserialization vulnerability

pyload-ng vulnerable to RCE with js2py sandbox escape

H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

LlamaIndex includes an exec call for `import {cls_name}`

GoAuthentik vulnerable to Insufficient Authorization for several API endpoints

Apache Dolphinscheduler Code Injection vulnerability

XWiki Platform allows XSS through XClass name in string properties

SQL injection in github.com/stashapp/stash

Command Injection in sequenceserver

Prototype pollution in izatop bunt

CometVisu Backend for openHAB affected by RCE through path traversal

Gitea Cross-site Scripting Vulnerability

Redisson vulnerable to Deserialization of Untrusted Data

Mattermost allows unsolicited invites to expose access to local channels

Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel

XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution

Scan your dependencies for these CVEs