Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds

DNN: Same HostGUID for all new installs

Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend

Wasmtime has out-of-bounds write or crash when transcoding component model strings

Wasmtime has host panic when Winch compiler executes `table.fill`

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime has a possible panic when lifting `flags` component value

Wasmtime: Panic when transcoding misaligned utf-16 strings

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

rdiscount has an Out-of-bounds Read

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Rack has Content-Length mismatch in Rack::Files error responses

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

Rack:: Static header_rules bypass via URL-encoded paths

OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

OpenClaw: Zalo channel downloads media before sender authorization

phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

ImageMagick has an Out-of-bounds Write via InterpretImageFilename

n8n Vulnerable to XSS via Binary Data Inline HTML Rendering

OpenFGA has an Authorization Bypass through cached keys

ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction

Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

Scriban has Multiple Denial-of-Service Vectors via Unbounded Resource Consumption During Expression Evaluation

Scriban: Denial of Service via Unbounded Cumulative Template Output Bypassing LimitToString

iCalendar has ICS injection via unsanitized URI property values

Rails Active Storage has possible glob injection in its DiskService

Rails Active Support has a possible DoS vulnerability in its number helpers

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Rails Active Storage has possible content type bypass via metadata in direct uploads

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

tar-rs `unpack_in` can chmod arbitrary directories by following symlinks

tar-rs incorrectly ignores PAX size headers if header size is nonzero

bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

Avo has a XSS vulnerability on `return_to` param

The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

Katello: Denial of Service and potential information disclosure via SQL injection

rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

Scan your dependencies for these CVEs