Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Infinite loop condition in Amazon.IonDotnet

Traefik has a possible vulnerability with its path matchers

MCMS allows arbitrary file uploads in the ueditor component

Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

Pycel allows code injection via a crafted formula

Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

NATS Server may fail to authorize certain Jetstream admin APIs

Dpanel's hard-coded JWT secret leads to remote code execution

DevDojo Voyager Argument Injection vulnerability

Pleezer resource exhaustion through uncollected hook script processes

Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR

GHSA-f87w-3j5w-v58p

CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB CPU exhaustion via custom functions result in total DoS

SurrealDB memory exhaustion via string::replace using regex

SurrealDB server-takeover via SurrealQL injection on backup import

SurrealDB vulnerable to memory exhaustion via nested functions and scripts

SurrealDB has uncaught exception in Net module that leads to database crash

CVE-2024-58136KEV

yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

DotNetNuke.Core Vulnerable to Server-Side Request Forgery (SSRF)

Umbraco has a Management API Vulnerability to Path Traversal With Authenticated Users

RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

Apollo Compiler Named Fragment Processing Vulnerability

Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass

gitoxide does not detect SHA-1 collision attacks

BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

pgAdmin 4 Vulnerable to Remote Code Execution

Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component

@alizeait/unflatto Prototype Pollution

jooby-pac4j: deserialization of untrusted data

Rancher: Restricted Administrator can change Administrator's passwords

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

Apache Pinot Vulnerable to Authentication Bypass

Drupal OAuth2 Server Missing Authorization vulnerability

Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability

Drupal Open Social Missing Authorization vulnerability

Drupal Authenticator Login Missing Authorization vulnerability

Drupal AI Cross-Site Request Forgery (CSRF) vulnerability

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

Pitchfork HTTP Request/Response Splitting vulnerability

ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

Scan your dependencies for these CVEs