Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

check-branches is vulnerable to command Injection

PiranhaCMS stored XSS

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

Rancher CLI SAML authentication is vulnerable to phishing attacks

Hutool allows remote code execution (RCE) via the QLExpressEngine class

Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

cors-anywhere vulnerable to server-side request forgery

Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

Command Injection in adb-mcp MCP Server

astral-tokio-tar has a path traversal in tar extraction

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

DNN allows loading unused themes on anonymous clients through query parameters

H2O affected by a deserialization vulnerability

Mattermost Path Traversal vulnerability

InvokeAI has External Control of File Name or Path

DragonFly vulnerable to arbitrary file read and write on a peer machine

jinjava has Sandbox Bypass via JavaType-Based Deserialization

Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain

JasperReports has a Java deserialisation vulnerability

Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

Flowise has unsandboxed remote code execution via Custom MCP

Flowise has arbitrary file access due to missing chat flow id validation

Flowise has Remote Code Execution vulnerability

FlowiseAI Pre-Auth Arbitrary Code Execution

mcp-kubernetes-server has an OS Command Injection vulnerability

Chaos Controller Manager is vulnerable to OS command injection

Chaos Controller Manager is vulnerable to OS command injection

Chaos Controller Manager is vulnerable to OS command injection

httpsig-rs: HMAC verification is vulnerable to timing attack

Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

CVE-2025-58754EPSS 0.1%

Axios is vulnerable to DoS attack through lack of data size check

Prebid-universal-creative latest on npm briefly compromised

interactive-git-checkout has a Command Injection vulnerability

Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation

Apache DolphinScheduler vulnerable to Alert Script Attack

CVE-2025-54236KEV

Magento Community Edition Improper Input Validation vulnerability

GHSA-pfp7-vxgr-83pw

toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

pREST has a Systemic SQL Injection Vulnerability

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API

CodeceptJS's incomprehensive sanitation can lead to Command Injection

CVE-2025-57833EPSS 0.0%

Django is subject to SQL injection through its column aliases

internetarchive Vulnerable to Directory Traversal in File.download()

ImageMagick BlobStream Forward-Seek Under-Allocation

Scan your dependencies for these CVEs