Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

Fastify's connection header abuse enables stripping of proxy-added headers

Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Froxlor has Local File Inclusion via path traversal in API `def_language` parameter leads to Remote Code Execution

Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)

Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()

Pyroscope Exposes Storage Secret

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

Velociraptor vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token

Upsonic: remote code execution vulnerability in its MCP server/task creation functionality

NietThijmen ShoppingCart: Command injection in the connect function

Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

ImageMagick has a memory leak in PNG encoder when writing a MNG image

ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

ImageMagick has a heap buffer overflow read in magnify operation via unrecognized magnify:method value

GHSA-98cp-rj9f-6v5g

ImageMagick has has a stack-buffer-overflow in MNG encoder with oversized pallete

ImageMagick has has an off-by-one origin validation in allows out-of-bounds read in morphology processing

ImageMagick has a heap-buffer-overflow in FTXT encoder

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection

Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles

Oxia has an OIDC token audience validation bypass via SkipClientIDCheck

WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials

WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks

WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)

@vendure/core has a SQL Injection vulnerability

Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access

XWiki's REST APIs can list all pages/spaces, leading to unavailability

Expression Injection in OpenRemote

OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode

goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access

goshs has an empty-username SFTP password authentication bypass

SFTP root escape via prefix-based path validation in goshs

Decidim amendments can be accepted or rejected by anyone

Composer has a command injection via malicious perforce reference

ImageMagick has an off-by-one error in MSL decoder could result in crash

ImageMagick has a heap-use-after-free via XMP profile could result in a crash when printing the values.

ImageMagick has a heap out-of-bounds write in JP2 encoder

ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float

ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.

ImageMagick has an out-of-bounds read in sample operation

ImageMagick has a Stack Overflow via Recursive FX Expression Parsing

Webkul Krayin CRM has Server-Side Request Forgery (SSRF)

Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

Scan your dependencies for these CVEs