Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

TkEasyGUI Vulnerable to OS Command Injection

Argo CD's Project API Token Exposes Repository Credentials

DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more

frost-core: refresh shares with smaller min_signers will reduce security of group

XWiki configuration files can be accessed through jsx and sx endpoints

XWiki configuration files can be accessed through the webjars API

GHSA-3632-54q8-m96x

arenavec has multiple memory corruption vulnerabilities in safe APIs

Google Sign-In for Rails allowed redirect to protocol-relative URI

Harness Allows Arbitrary File Write in Gitness LFS server

Rancher affected by unauthenticated Denial of Service

Valtimo scripting engine can be used to gain access to sensitive data or resources

FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability

NeuVector admin account has insecure default password

Google Sign-In for Rails allowed redirects to malformed URLs

The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

devalue prototype pollution vulnerability

Badaso CMS file upload vulnerability

ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow

ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution

ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree

imagemagick: integer overflows in MNG magnification

imagemagick: heap-buffer overflow read in MNG magnification with alpha

ImageMagick has a Memory Leak in magick stream

ImageMagick has a Heap Buffer Overflow in InterpretImageFilename

ImageMagick has a Stack Buffer Overflow in image.c

Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)

Adminer PHP Object Injection issue leads to Denial of Service

gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks

UnoPim has CSV Injection on Quick Export feature

hippo4j Includes Hard Coded Secret Key in JWT Creation

sha.js is missing type checks leading to hash rewind and passing on crafted data

cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Spree Commerce is vulnerable to RCE through Search API

screenshot-desktop vulnerable to command Injection via `format` option

OpenFGA Authorization Bypass

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.

Flowise OS command remote code execution

Active Storage allowed transformation methods that were potentially unsafe

Active Record logging vulnerable to ANSI escape injection

Spree has Remote Command Execution vulnerability in search functionality

Magento Cross-Site Request Forgery (CSRF) vulnerability

Magento has incorrect authorization issue that leads to arbitrary file system read

Magento Cross-site Scripting vulnerability

Magento vulnerable to denial of service

content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass

Scan your dependencies for these CVEs