Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Image Magick has a Memory Leak in coders/ashlar.c

ImageMagick: Stack buffer overflow in FTXT reader via oversized integer field

ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access

ImageMagick: Policy bypass through path traversal allows reading restricted content despite secured policy

ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write

ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

ImageMagick: Code Injection via PostScript header in ps coders

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions

ImageMagick has memory leak in msl encoder

ImageMagick: Possible memory leak in ASHLAR encoder

ImageMagick: Out of bounds read in multiple coders read raw pixel data

ImageMagick: Infinite loop vulnerability when parsing a PCD file

ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

ormar is vulnerable to SQL Injection through aggregate functions min() and max()

Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

MLflow Use of Default Password Authentication Bypass Vulnerability

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Formwork Improperly Managed Privileges in User creation

Statamic affected by privilege escalation via stored cross-site scripting

D-Tale affected by Remote Code Execution through the /save-column-filter endpoint

Prototype pollution in swiper

Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution

carbon-apimgt does not properly restrict uploaded files

Kata Container to Guest micro VM privilege escalation

Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation

LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php

Nokogiri does not check the return value from xmlC14NExecute

Ghost has a SQL injection in Content API

NLTK has a Zip Slip Vulnerability

opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path

CVE-2026-26960EPSS 0.0%

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)

OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting

OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)

Nextcloud Talk allowlist bypass via actor.name display name spoofing

OpenClaw has a potential access-group authorization bypass if channel type lookup fails

Apache Tomcat - Client certificate verification bypass

Apache Tomcat has an Improper Input Validation vulnerability

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

Scan your dependencies for these CVEs