Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

ingress-nginx controller - configuration injection via unsanitized auth-url annotation

ingress-nginx admission controller RCE escalation

ingress-nginx controller - configuration injection via unsanitized mirror annotations

OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request

GHSA-vgmh-mqm4-8j88

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

PipeCD Vulnerable to Privilege Escalation

InvokeAI Deserialization of Untrusted Data vulnerability

Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

Authorization Bypass in Next.js Middleware

kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace

vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

AgentScope Deserialization Vulnerability

llama-index-packs-finchat SQL Injection vulnerability

LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection

vLLM Deserialization of Untrusted Data vulnerability

H2O Deserialization of Untrusted Data Vulnerability

The WikiManager REST API allows any user to create wikis

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write

Qiskit allows arbitrary code execution decoding QPY format versions < 13

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

Flowise allows arbitrary file write to RCE

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

Flowise Pre-auth Arbitrary File Upload

Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

graphql allows remote code execution when loading a crafted GraphQL schema

Out-of-bounds Read in Ruby JSON Parser

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Below has Incorrect Permission Assignment for Critical Resource

Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability

The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding

Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

Vela Server Has Insufficient Webhook Payload Data Verification

Local File Inclusion in Rack::Static

CVE-2025-24813KEV

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

canvg Prototype Pollution vulnerability

Crash due to uncontrolled recursion in protobuf crate

Some AES functions may panic when overflow checking is enabled in ring

Microsoft Security Advisory CVE-2025-24043 | WinDbg Remote Code Execution Vulnerability

com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations

Vue I18n Allows Prototype Pollution in `handleFlatJson`

CVE-2025-27152EPSS 0.1%

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

GHSA-vc29-vg52-6643

DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api

Out-of-bounds Write in SixLabors ImageSharp

Scan your dependencies for these CVEs