Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Apache Cocoon SQL Injection vulnerability

Capsule Proxy Authentication bypass using an empty token

openssl npm package vulnerable to command execution

Run Shell Command allows Cross-Site Request Forgery

Cookies are sent to external images in rendered diff (and server side request forgery)

Apache Derby: LDAP injection vulnerability in authenticator

Liferay Portal XSS with `p_l_back_url_title` on edit content page

Froxlor Improper Input Validation vulnerability

XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu

XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest

XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token

OpenCRX allows a remote attacker to execute arbitrary code via a crafted request

CVE-2023-46604KEV

Apache ActiveMQ is vulnerable to Remote Code Execution

XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages

XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

XWiki Platform XSS vulnerability from account in the create page form via template provider

org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter

org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

SaToken privilege escalation vulnerability

Sureness uses hardcoded key

Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter

CSRF Token Reuse Vulnerability

Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class

Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page

XWiki Change Request Application UI XSS and remote code execution through change request title

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Authorization Bypass in Apache InLong

Server-Side Request Forgery (SSRF) in vriteio/vrite

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper

JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Puppet Bolt privilege escalation vulnerability

geokit-rails Command Injection vulnerability

sing-box vulnerable to improper authentication in the SOCKS inbound

SQL injection in jeecgboot

systeminformation SSID Command Injection Vulnerability

SQLpage vulnerable to public exposure of database credentials

Yii2 allows attackers to execute any local .php file via a relative path in the view parameter

Cross Site Scripting vulnerability in Dolibarr ERP CRM

CVE-2022-24816KEV

Improper Control of Generation of Code ('Code Injection') in jai-ext

NATS nats-server allows directory traversal via unintended path to a management action

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

Craft CMS Remote Code Execution vulnerability

NLnet Labs’ Routinator vulnerable to path traversal

OpenRefine Remote Code execution in project import with mysql jdbc url attack

Argo CD cluster secret might leak in cluster details page

hutool Buffer Overflow vulnerability

hutool Buffer Overflow vulnerability

Scan your dependencies for these CVEs