Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Privileged OpenBao Operator May Execute Code on the Underlying Host

Apache Seata: Deserialization of untrusted Data in Apache Seata Server

Apache CXF: Untrusted JMS configuration can lead to RCE

ExecuTorch integer overflow vulnerability

ExecuTorch heap buffer overflow vulnerability

ExecuTorch out-of-bounds access vulnerability

ExecuTorch integer overflow vulnerability

ExecuTorch vulnerable to Heap-based Buffer Overflow

JWE is missing AES-GCM authentication tag validation in encrypted JWE

quiche connection ID retirement can trigger an infinite loop

RISC Zero Underconstrained Vulnerability: Division

ThinkPHP Path Traversal Vulnerability

RatPanel can perform remote command execution without authorization

russh is missing overflow checks during channel windows adjust

js-toml Prototype Pollution Vulnerability

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

The ADOdb sqlite3 driver allows SQL injection

IPX Allows Path Traversal via Prefix Matching Bypass

@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers

Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration

CVE-2025-45769EPSS 0.0%

php-jwt contains weak encryption

MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion

vproxy Divide by Zero DoS Vulnerability

SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

Ruby SAML DOS vulnerability with large SAML response

BentoML SSRF Vulnerability in File Upload Processing

Umbraco Delivery API allows for cached requests to be returned with an invalid API key

Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

z-push/z-push-dev SQL Injection Vulnerability

Node-SAML SAML Signature Verification Vulnerability

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module

Node-SAML SAML Authentication Bypass

XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

eKuiper API endpoints handling SQL queries with user-controlled table names.

ImageMagick has XMP profile write that triggers hang due to unbounded loop

Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources

NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access

nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability

form-data uses unsafe random function in form-data for choosing boundary

simogeo/filemanager arbitrary file upload vulnerability

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path

CVE-2025-54068KEV

Livewire is vulnerable to remote command execution during component property update hydration

GHSA-7mcq-f592-pf7v

Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs

GitHub Kanban MCP Server vulnerable to Command Injection

pyLoad vulnerable to XSS through insecure CAPTCHA

SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite

resolv vulnerable to DoS via insufficient DNS domain name length validation

Scan your dependencies for these CVEs