Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

Apache camel-coap allows header injection that can lead to remote code execution

Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)

Apache MINA vulnerable to Deserialization of Untrusted Data

Apache Camel has an incomplete fix for CVE-2025-27636

Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

Camel-MINA Vulnerable to Deserialization of Untrusted Data

Note Mark: OIDC-registered users authenticated by submitting password "null"

Cillium exposes sensitive information included in the cilium-bugtool debug archive

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Heimdall has an authorization bypass via path normalization mismatch

Heimdall: Case-sensitive host matching may lead to policy bypass

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

simple-git is vulnerable to Remote Code Execution

electerm has Command Injection via runLinux funtion

Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses

ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

LiteLLM has SQL Injection in Proxy API key verification

Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

Lemmy has SSRF in /api/v3/post via Webmention dispatch

Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image

Contour has Lua code injection via Cookie Path Rewrite Policy

Apache ActiveMQ Vulnerable to Code Injection

Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection

OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers

Kirby has XML injection in its XML creator toolkit

Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function

Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database

Scan your dependencies for these CVEs