Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

ImageMagick has Heap Use-After-Free in ImageMagick MSL decoder

ImageMagick: Write heap-buffer-overflow in PCL encoder via undersized output buffer

ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays

ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder

Winter vulnerable to privilege escalation by authenticated backend users

ImageMagick: Heap overflow in pcd decoder leads to out of bounds read.

ImageMagick has heap buffer overflow in YUV 4:2:2 decoder

ImageMagick has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)

ImageMagick: MSL - Stack overflow in ProcessMSLScript

ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption

ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.

SGLang's encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module

SGLang's multimodal generation module is vulnerable to unauthenticated remote code execution through the ZMQ broker

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

.NET Elevation of Privilege Vulnerability

Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode

Shopware vulnerable to a potential take over of app credentials

Shopware: Unauthenticated data extraction possible through store-api.order endpoint

CraftCMS has an RCE vulnerability via relational conditionals in the control panel

Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks

Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering

@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection

Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL

@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters

Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server has role escalation and CLP bypass via direct `_Join` table write

Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

Sylius has a Promotion Usage Limit Bypass via Race Condition

Sylius has an Open Redirect via Referer Header

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing

SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes

SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

ImageMagick is vulnerable to heap buffer over-write on 32-bit systems in SFW decoder

ImageMagick is vulnerable to Heap Overflow when writing extremely large image profile in the PNG encoder

Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Feathers has an OAuth Callback Account Takeover issue

ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

ImageMagick has a Path Policy TOCTOU symlink race bypass

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Scan your dependencies for these CVEs