Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Fickling Blocklist Bypass: cProfile.run()

Fickling has a bypass via runpy.run_path() and runpy.run_module()

WeKnora has Command Injection in MCP stdio test

Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

XWiki Full Calendar Macro vulnerable to SQL injection through Calendar.JSONService

FASTJSON Includes Functionality from Untrusted Control Sphere

Spree API has Unauthenticated IDOR - Guest Address

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

Salvo is vulnerable to reflected XSS in the list_html function

Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names

GHSA-96qw-h329-v5rg

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

React Router has Path Traversal in File Session Storage

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE

Preact has JSON VNode Injection issue

n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

terminal-controller-mcp vulnerable to Command Injection

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

RustFS Path Traversal Vulnerability

Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools

OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware

Bypassing Kyverno Policies via Double Policy Exceptions

n8n Vulnerable to RCE via Arbitrary File Write

Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer

Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

gix-date can create non-utf8 string with `TimeBuf::as_str`

Unauthenticated Craft CMS users can trigger a database backup

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Apache Kyuubi Server vulnerable to Path Traversal

listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users

Bagisto has Normal & Blind SSTI from low-privilege user when ordering product

Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto Missing Authentication on Installer API Endpoints

Langflow Missing Authentication on Critical API Endpoints

AdonisJS Path Traversal in Multipart File Handling

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

theshit vulnerable to unsafe loading of user-owned Python rules when running as root

ImageMagick's failure to limit MVG mutual causes Stack Overflow

RustFS has a gRPC Hardcoded Token Authentication Bypass

ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack

URI Credential Leakage Bypass over CVE-2025-27221

FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload

Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter

Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller

Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef

Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef

Scan your dependencies for these CVEs