Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Autolab Misconfigured Reset Password Permissions

Remote code execution in php-heic-to-jpg

Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

camaleon_cms affected by cross site scripting

Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget

Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor

Umbraco has a Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice

Security Update for the OPC UA .NET Standard Stack

GHSA-qm9f-c3v9-wphv

Security Update for the OPC UA .NET Standard Stack

Grafana Command Injection And Local File Inclusion Via Sql Expressions

Improper Authentication vulnerability in Apache Solr

Possible ReDoS vulnerability in block_format in Action Mailer

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

pac4j-core affected by a Java deserialization vulnerability

angular-base64-upload vulnerable to unauthenticated remote code execution

DOMpurify has a nesting-based mXSS

SSOReady has an XML Signature Bypass via differential XML parsing

JSONPath Plus Remote Code Execution (RCE) Vulnerability

Magento Open Source Improper Input Validation vulnerability

Magento Open Source Cross-Site Scripting (XSS) vulnerability

wasmtime has a runtime crash when combining tail calls with trapping imports

SurrealDB: Improper Authorization in Select Permissions

SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings

Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability

CVE-2024-45231EPSS 0.2%

Django allows enumeration of user e-mail addresses

Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability

async-graphql Directive Overload

PAM module may allow accessing with the credentials of another user

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

Decidim has a cross-site scripting vulnerability in the version control page

Heap-based Buffer Overflow in sqlite-vec

Mellium allows Authentication Bypass by Spoofing

Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting

DataEase's H2 datasource has a remote command execution risk

HTTP Request Smuggling in ruby webrick

Puma's header normalization allows for client to clobber proxy set headers

Scan your dependencies for these CVEs