Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle

Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution

NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1

rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

rust-openssl has incorrect bounds assertion in aes key wrap

rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

monetr: Server-side request forgery in Lunch Flow link creation and refresh

RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks

nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils has an Untrusted Search Path

uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API

CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE

CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Brillig: Heap corruption in foreign call results with nested tuple arrays

OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution

Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL

Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

Neko has a Self-service Privilege Escalation for Authenticated Users

Dolibarr Allows Code Injection through its Website Module

Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions

Spinnaker: RCE via expression parsing due to unrestricted context handling

Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths

Apache Kafka does not validate JWT tokens in its OAUTHBEARER authentication implementation

Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients

Zebra has rk Identity Point Panic in Transaction Verification

MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade

Wish has SCP Path Traversal that allows arbitrary file read/write

Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass

Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability

Scan your dependencies for these CVEs