Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing

Improper Access Control in Gitea

Privilege Escalation in kubevirt

Zend Framework SQL injection vulnerability

CVE-2018-7602KEV

Drupal Core Remote Code Execution Vulnerability

OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)

MySQL2 for Node Arbitrary Code Injection

CVE-2024-27348KEV

Apache HugeGraph-Server: Command execution in gremlin

@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

AWS Amplify CLI has incorrect trust policy management

mysql2 Remote Code Execution (RCE) via the readCodeFor function

Evmos transaction execution not accounting for all state transition after interaction with precompiles

WWBN AVideo Remote Code Execution

LocalAI Command Injection in audioToWav

XWiki Platform remote code execution from account through UIExtension parameters

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

XWiki Platform CSRF remote code execution through the realtime HTML Converter API

XWiki Platform remote code execution from account via custom skins support

XWiki Platform CSRF remote code execution through scheduler job's document reference

XWiki Platform: Remote code execution through space title and Solr space facet

XWiki Platform: Remote code execution from edit in multilingual wikis via translations

XWiki Platform: Remote code execution as guest via DatabaseSearch

XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

Apache Zeppelin remote code execution by adding malicious JDBC connection string

Improper escaping in Apache Zeppelin

MailDev Remote Code Execution

StringIO buffer overread vulnerability

@thi.ng/paths Prototype Pollution vulnerability

Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss

FitNesse allows execution of arbitrary OS commands

Cross-site scripting on application summary component

Pterodactyl Wings vulnerable to improper isolation of server file access

SSRF vulnerability using the Aegis DataBinding in Apache CXF

discordrb OS Command Injection vulnerability

Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

nGrinder vulnerable to unsafe Java objects deserialization

HTTP Handling Vulnerability in the Bare server

JSONata expression can pollute the "Object" prototype

Authorization Bypass Through User-Controlled Key in go-zero

ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection

Apache James server: Privilege escalation via JMX pre-authentication deserialization

Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

org.postgresql:postgresql vulnerable to SQL Injection via line comment generation

Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting

Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting

Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting

Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting

Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting

Scan your dependencies for these CVEs