Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

XWiki Blog Application home page vulnerable to Stored XSS via Post Title

Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

AWS-LC has PKCS7_verify Signature Validation Bypass

AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

PickleScan has multiple stdlib modules with direct RCE not in blocklist

PickleScan's pkgutil.resolve_name has a universal blocklist bypass

PickleScan's profile.run blocklist mismatch allows exec() bypass

WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

OpenClaw's config env vars allowed startup env injection into service runtime

OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode

OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

Rancher cloud credentials can be used through proxy API by users without access

Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

Rancher doesn't properly sanitize credentials in cluster template answers

Apache Ranger has a Code Injection vulnerability

OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

Idno Vulnerable to Remote Code Execution via Chained Import File Write and Template Path Traversal

Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php

theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution

Statamic vulnerable to privilege escalation via stored cross-site scripting

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass

Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

Vitess users with backup storage access can write to arbitrary file paths on restore

Langflow has Remote Code Execution in CSV Agent

rubyipmi is vulnerable to OS Command Injection through malicious usernames

uv has ZIP payload obfuscation through parsing differentials

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

Vitess users with backup storage access can gain unauthorized access to production deployment environments

WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

Storybook Dev Server is Vulnerable to WebSocket Hijacking

Scan your dependencies for these CVEs