Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

ImageMagick has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

ImageMagick: Heap overflow in sun decoder on 32-bit systems may result in out of bounds write

ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

ImageMagick: Code Injection via PostScript header in ps coders

ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

ImageMagick has memory leak in msl encoder

ImageMagick: Possible memory leak in ASHLAR encoder

ImageMagick: Out of bounds read in multiple coders read raw pixel data

ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

Kata Container to Guest micro VM privilege escalation

Nokogiri does not check the return value from xmlC14NExecute

Apache Tomcat - Client certificate verification bypass

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

OpenFGA Improper Policy Enforcement

Sandbox escape via infinite recursion and error objects

HtmlSanitizer has a bypass via template tag

bytes has integer overflow in BytesMut::reserve

Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac

Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field

DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer

XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages

CVE-2025-13465EPSS 0.0%

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport

ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML

ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript

AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails

GHSA-mpwp-4h2m-765c

Active Job - Object injection security vulnerability

Umbraco CMS contains a server-side request forgery vulnerability

Concrete5 CMS contains an XPath injection vulnerability

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

gix-date can create non-utf8 string with `TimeBuf::as_str`

Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

Bagisto has HTML Filter Bypass that Enables Stored XSS

ImageMagick's failure to limit MVG mutual causes Stack Overflow

ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack

Umbraco CMS has an arbitrary file upload vulnerability

Scan your dependencies for these CVEs