Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints

Parse Server has an auth provider validation bypass on login via partial authData

Scriban has an Infinite Recursion during Object Rendering Leads to Stack Overflow and Process Crash (Denial of Service)

Scriban has Uncontrolled Recursion in Parser Leads to Stack Overflow and Process Crash (Denial of Service)

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass

MinIO has JWT Algorithm Confusion in OIDC Authentication

bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

Langflow has an Arbitrary File Write (RCE) via v2 API

Prototype Pollution via parse() in NodeJS flatted

Juju has unauthorized access to out-of-scope Kubernetes secrets

qui CORS Misconfiguration: Arbitrary Origins Trusted

step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)

Ruby JSON has a format string injection vulnerability

Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing

Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass

Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview

Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod

gRPC-Go has an authorization bypass via missing leading slash in :path

HAPI FHIR HTTP authentication leak in redirects

Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py

Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion

Statamic has Stored XSS via SVG Sanitization Bypass

Gossipsub PRUNE.backoff Duration Overflow

Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)

ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

Jenkins has a link following vulnerability allows arbitrary file creation

Avo has a XSS vulnerability on `return_to` param

GHSA-46fp-8f5p-pf2m

Improper detection of disallowed URIs by Loofah `allowed_uri?`

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

SQL Injection in Spring AI MariaDBFilterExpressionConverter

JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

jsPDF has HTML Injection in New Window paths

Katello: Denial of Service and potential information disclosure via SQL injection

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion

File Upload(RCE) Vulnerability in admidio

lz4_flex's decompression can leak information from uninitialized memory or reused output buffer

Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Romeo is vulnerable to Archive Slip due to missing checks in sanitization

Monitoring is vulnerable to Archive Slip due to missing checks in sanitization

Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace

Scan your dependencies for these CVEs