Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload

pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

Scriban has Uncontrolled Recursion in `object.to_json` Causing Unrecoverable Process Crash via StackOverflowException

Scriban: Uncontrolled Memory Allocation via string.pad_left/pad_right Allows Remote Denial of Service

Scriban: Built-in operations bypass LoopLimit and delay cancellation, enabling Denial of Service

Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse

Scriban has an authorization bypass due to stale include cache surviving TemplateContext.Reset()

Scriban has a Stack Overflow via Nested Array Initializers That Bypass the ExpressionDepthLimit Fix

NATS has MQTT plaintext password disclosure

iCalendar has ICS injection via unsanitized URI property values

CVE-2026-33634KEV

Trivy ecosystem supply chain was briefly compromised

Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API

Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access

Rails Active Storage has possible glob injection in its DiskService

Rails Active Storage has possible Path Traversal in DiskService

Rails Active Support has a possible DoS vulnerability in its number helpers

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Rails has a possible XSS vulnerability in its Action View tag helpers

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin

Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View

Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin

MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL

DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint

Harbor allows the use of the default password for web UI login

jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction

AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)

AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload

AVideo has Unauthenticated SSRF via plugin/Live/test.php

Ory Oathkeeper has a path traversal authorization bypass

etcd: Authorization bypasses in multiple APIs

MinIO LDAP login brute-force via user enumeration and missing rate limit

AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy

AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

CRL Distribution Point Scope Check Logic Error in AWS-LC

tar-rs `unpack_in` can chmod arbitrary directories by following symlinks

tar-rs incorrectly ignores PAX size headers if header size is nonzero

Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config

Spring Boot has an Authentication Bypass under Actuator Health groups paths

ingress-nginx comment-based nginx configuration injection

Spring Security HTTP Headers Are not Written Under Some Conditions

Scan your dependencies for these CVEs