Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated

Rack has a Directory Traversal via Rack:Directory

Known affected by Account Takeover via Password Reset Token Leakage

MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

Statamic CMS vulnerable to privilege escalation via stored cross-site scripting

set-in Affected by Prototype Pollution

Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability

Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

CASL Ability is Vulnerable to Prototype Pollution

Apache Druid Vulnerable to Authentication Bypass

FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Keycloak affected by improper invitation token validation

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

Craft CMS: GraphQL Asset Mutation Privilege Escalation

Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`

CVE-2026-25639EPSS 0.0%

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

Antrea has invalid enforcement order for network policy rules caused by integer overflow

Keylime Missing Authentication for Critical Function and Improper Authentication

GHSA-w67g-2h6v-vjgq

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

OpenSTAManager has a SQL Injection in the Prima Nota module

OpenSTAManager has a SQL Injection vulnerability in the Scadenzario bulk operations module

OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

OpenSTAManager has a SQL Injection in Scadenzario Print Template

OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)

OpenSTAManager has an OS Command Injection in P7M File Processing

Gogs Vulnerable to 2FA Bypass via Recovery Code

Gogs's update .git/config file allows remote command execution

OpenFGA Improper Policy Enforcement

@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses

qdrant has arbitrary file write via `/logger` endpoint

Unauthenticated Spree Commerce users can access all guest addresses

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

@nyariv/sandboxjs has a Sandbox Escape vulnerability

@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Scan your dependencies for these CVEs