Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

fastjson has a remote code execution (RCE) vulnerability

Gitea: Public-only repository tokens can update private PR head branches

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Snowflake Connector for Python improperly verifies TLS hostnames

GPT Researcher MCP STDIO configuration allows remote command execution

websocket-driver: Message corruption via abuse of protocol length headers

MantisBT: Reflected XSS in admin/install.php via unescaped printf

MantisBT: Reflected XSS in admin/install.php

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`

SAP Approuter Vulnerable to HTTP Request Smuggling

FacturaScripts: Account takeover of any 2FA-enabled user

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

Ajenti has an authorization bypass during custom package installation

Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content

prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE

SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

File Browser: Authentication Bypass via Proxy Auth Header Forgery

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()

YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Cognee allows non-superusers to overwrite global LLM configuration

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

Scan your dependencies for these CVEs