Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

CVE-2025-68161EPSS 0.3%

Apache Log4j does not verify the TLS hostname in its Socket Appender

AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

Amazon S3 Encryption Client for .NET has a Key Commitment Issue

phpMyFAQ contains a CSV injection vulnerability

mcp-server-git has missing path validation when using --repository flag

mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

ABP Account Module has an Open Redirect through Improper validation in its register function

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

sd changes the group ownership of the source file

XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication

Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality

Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`

OpenFGA Improper Policy Enforcement

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)

ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)

Piranha CMS vulnerable to stored cross-site scripting (XSS)

Mammoth is vulnerable to Directory Traversal

Smidge is vulnerable to Path Traversal

Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability

Rack has a Possible Information Disclosure Vulnerability

FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

PiranhaCMS stored XSS

astral-tokio-tar has a path traversal in tar extraction

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field

DNN allows loading unused themes on anonymous clients through query parameters

DragonFly vulnerable to arbitrary file read and write on a peer machine

Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain

httpsig-rs: HMAC verification is vulnerable to timing attack

SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

frost-core: refresh shares with smaller min_signers will reduce security of group

Google Sign-In for Rails allowed redirect to protocol-relative URI

FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability

Google Sign-In for Rails allowed redirects to malformed URLs

ImageMagick has Undefined Behavior (function-type-mismatch) in CloneSplayTree

OpenFGA Authorization Bypass

Active Record logging vulnerable to ANSI escape injection

Apache CXF: Untrusted JMS configuration can lead to RCE

russh is missing overflow checks during channel windows adjust

IPX Allows Path Traversal via Prefix Matching Bypass

SixLabors ImageSharp Has Infinite Loop in GIF Decoder When Skipping Malformed Comment Extension Blocks

Ruby SAML DOS vulnerability with large SAML response

Umbraco Delivery API allows for cached requests to be returned with an invalid API key

Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

resolv vulnerable to DoS via insufficient DNS domain name length validation

Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation

HashiCorp Vagrant has code injection vulnerability through default synced folders

Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

Umbraco CMS disclosure of configured password requirements

Scan your dependencies for these CVEs