Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Browse Security Advisories

Security Advisories

Unspecified security issues. CPANSA-MySQL-Admin-1-1

cpan MySQL-Admin
Moderate
about 16 hours ago

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks GSA_kwCzR0hTQS1yNGo1LTl4cHAtMzk4Nc4AB_4z

pypi tornado
Low
about 16 hours ago

Tornado: Open redirect in RedirectHandler via protocol-relative URLs GSA_kwCzR0hTQS1wdzlwLXY3cjYtZ3g0cM4AB_4y

pypi tornado
Moderate
about 16 hours ago

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding GSA_kwCzR0hTQS1wY2cyLWc2Y2otcTkyY84AB_4x

pypi tornado
Moderate
about 16 hours ago

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass GSA_kwCzR0hTQS1wcTRnLThyeGYtNGcyOc4AB_4w

rubygems crass
High
about 16 hours ago

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks GSA_kwCzR0hTQS0zZjdqLTdqd2MtZnhmas4AB_4v

npm systeminformation
Moderate
about 16 hours ago

Backstage catalog rules can be bypassed for URL locations using encoded path segments GSA_kwCzR0hTQS13NjU4LW1oOXAtd3c4Zs4AB_4u

npm @backstage/plugin-catalog-backend
Critical
about 17 hours ago

Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it GSA_kwCzR0hTQS02anA0LTh2NDgtY2M1ds4AB_4L

pypi electrum
Moderate
about 17 hours ago

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion GSA_kwCzR0hTQS0yaHc0LWM5bTQtZjJmas4AB_4K

go knative.dev/pkg
Moderate
about 17 hours ago

Waline login accepts a non-string email as a match-all MongoDB query GSA_kwCzR0hTQS1qZjc1LXE2NHEtZzY1cs4AB_4J

npm @waline/vercel
Moderate
about 17 hours ago

Seroval: Code injection through a typed array's own constructor property GSA_kwCzR0hTQS1mODZwLWg0ajItN3Fnas4AB_4I

npm seroval
Moderate
about 17 hours ago

Seroval: Script injection through RegExp sources in serialized output GSA_kwCzR0hTQS05d3g5LTVwdjktMzM0Oc4AB_4H

npm seroval
High
about 17 hours ago

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) GSA_kwCzR0hTQS05N3IyLXFoOW0tNDc0aM4AB_4G

npm seroval
High
about 17 hours ago

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length GSA_kwCzR0hTQS13cDk3LXg0aHYtcXZocM4AB_4F

npm seroval
High
about 17 hours ago

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check GSA_kwCzR0hTQS03cnY1LW1yeHYteGNyOc4AB_4E

npm seroval
Moderate
about 17 hours ago

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) GSA_kwCzR0hTQS01MzI0LTN3NTgtcXBwMs4AB_4D

npm, pypi mem0ai
Moderate
about 17 hours ago

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim GSA_kwCzR0hTQS1oMnI1LXg1bTctMzkzNc4AB_4C

pypi social-auth-core
Moderate
about 17 hours ago

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank GSA_kwCzR0hTQS02cHdtLXgzNHAtZnZqMs4AB_4B

pypi onnx
Moderate
about 17 hours ago

ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs GSA_kwCzR0hTQS1xNjlnLWY0ZjUtdjhtN84AB_4A

pypi onnx
Moderate
about 17 hours ago

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute GSA_kwCzR0hTQS1tNHByLTZ2M2MtNmZncs4AB_3_

pypi onnx
Moderate
about 17 hours ago

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) GSA_kwCzR0hTQS00OG00LTI0Y3EtMzdxZs4AB_3-

pypi onnx
Low
about 17 hours ago

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server GSA_kwCzR0hTQS12dnBnLXJyd3ctd3BtaM4AB_39

pypi vllm
Moderate
about 17 hours ago

vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine GSA_kwCzR0hTQS04Mzk3LThxZjYtZjJnbc4AB_38

pypi vllm
Moderate
about 17 hours ago

vLLM DeepSeek-OCR image processing vulnerable to denial of service GSA_kwCzR0hTQS1ncTVxLTg5Yzctdmh2eM4AB_37

pypi vllm
High
about 17 hours ago

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE GSA_kwCzR0hTQS1oM3JjLWo4MnAtMmMzaM4AB_36

pypi vllm
High
about 17 hours ago

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled GSA_kwCzR0hTQS02NzU3LWhnZ20taHAyd84AB_35

pypi vllm
Moderate
about 17 hours ago

vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) GSA_kwCzR0hTQS1xOTdjLXAzNjgtNzVjNM4AB_34

pypi vllm
Moderate
about 17 hours ago

vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs GSA_kwCzR0hTQS14NTY3LTQ5ZzUtcDRjZs4AB_33

pypi vllm
Moderate
about 17 hours ago

vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool GSA_kwCzR0hTQS01NDJtLTkyMzQtOGd2Zs4AB_32

pypi vllm
Critical
about 17 hours ago

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction GSA_kwCzR0hTQS1tZ2hmLXdqZnAtcDV4bc4AB_31

cargo wasmtime
Moderate
about 17 hours ago

Go JOSE: Panics in JSON parsing GSA_kwCzR0hTQS12dm04LWdmNzgtMjhnNM4AB_30

go github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4
Moderate
about 17 hours ago

Go JOSE: Panic during CBC-HMAC processing GSA_kwCzR0hTQS00dzNnLWpmajItY3cycc4AB_3z

go github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4
Low
about 17 hours ago

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net GSA_kwCzR0hTQS00dmpnLXZ4NzItcXE0Z84AB_3y

npm systeminformation
Moderate
about 17 hours ago

systeminformation has prototype pollution in `networkStats()` via the interface name GSA_kwCzR0hTQS03NjQ4LWptd2Ytdnc3as4AB_3x

npm systeminformation
Moderate
about 17 hours ago

LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output GSA_kwCzR0hTQS04cHJyLWY1ODItanFxM84AB_3w

pypi langgraph-cli
High
about 17 hours ago

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service GSA_kwCzR0hTQS14OHJtLWY1NzYtZ3E2N84AB_3v

npm graphql-scalars
Moderate
about 17 hours ago

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) GSA_kwCzR0hTQS1wamg2LWM4bWctM3g3bc4AB_3u

pypi autobahn
Low
about 17 hours ago

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string GSA_kwCzR0hTQS0zY214LXhqd3ctNTgzeM4AB_3t

npm i18next-http-backend
High
about 17 hours ago

RE2JS: Quadratic-time denial of service in re2js lookbehind matching GSA_kwCzR0hTQS1nZzZoLTg5NHctNG05Y84AB_3s

npm re2js
Critical
about 17 hours ago

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE GSA_kwCzR0hTQS1tNjY1LXY3cG0tN2dyas4AB_3r

cargo zip
High
about 17 hours ago

LangGraph JavaScript custom authentication may permit cross-user Store access GSA_kwCzR0hTQS00aG02LXc2cXEtdzczds4AB_3q

pypi langgraph-api
Low
about 17 hours ago

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock GSA_kwCzR0hTQS13ZmhxLXE0ajItYzM3bc4AB_3p

pypi filelock
Moderate
about 17 hours ago

filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold GSA_kwCzR0hTQS02NjI3LW0zeHctOTNtcM4AB_3o

pypi filelock
Moderate
about 17 hours ago

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion GSA_kwCzR0hTQS05YzR4LWdtOHYtd2djNM4AB_3n

pypi filelock
Moderate
about 17 hours ago

filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL GSA_kwCzR0hTQS04bXg1LTdtNW0tcjc3Z84AB_3m

pypi filelock
Moderate
about 17 hours ago

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout GSA_kwCzR0hTQS1jd3FyLWhoMzMtZ2g0NM4AB_3l

pypi filelock
Moderate
about 17 hours ago

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker GSA_kwCzR0hTQS1yZnBjLXFjdzUtM3BjNM4AB_3k

pypi filelock
Low
about 17 hours ago

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker GSA_kwCzR0hTQS05ajZxLXd2ajUtamdqZ84AB_3j

pypi filelock
Moderate
about 17 hours ago

filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path GSA_kwCzR0hTQS02OWhqLWY2OGotMjg3Oc4AB_3i

pypi filelock
Moderate
about 17 hours ago

filelock: ReadWriteLock follows a symlink at the lock path into SQLite GSA_kwCzR0hTQS1qOGY3LXJqeGMtbXI1Ns4AB_3h

pypi filelock
Moderate
about 17 hours ago

filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses GSA_kwCzR0hTQS1tNDYyLTdyeHctd3ZwZ84AB_3g

pypi filelock
Moderate
about 17 hours ago

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record GSA_kwCzR0hTQS1majk1LWZyNmMtaDg0Nc4AB_3f

pypi filelock
Moderate
about 17 hours ago

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders GSA_kwCzR0hTQS1mcTU2LTNjeDMtZmp4cM4AB_3e

pypi filelock
Low
about 17 hours ago

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) GSA_kwCzR0hTQS05amhqLXd2bXctY2Z4Nc4AB_3d

npm i18next-http-backend
Moderate
about 17 hours ago

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing GSA_kwCzR0hTQS1jY3JqLWd3OHItODU0bc4AB_3c

maven io.opentelemetry:opentelemetry-api
High
about 17 hours ago

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML GSA_kwCzR0hTQS1jOHA0LWo5N2gtM3ZnOM4AB_3b

npm happy-dom
Low
about 17 hours ago

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list GSA_kwCzR0hTQS04cmMyLTQyOHEtN3d3M84AB_3a

npm @intlify/vue-i18n-core, petite-vue-i18n, @intlify/core-base, @intlify/core, vue-i18n
High
about 17 hours ago

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages GSA_kwCzR0hTQS04M3JtLTZjOHItZzcyOM4AB_3Z

npm @intlify/shared, @intlify/vue-i18n-core, @intlify/core, @intlify/core-base, petite-vue-i18n, vue-i18n
Moderate
about 17 hours ago

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies GSA_kwCzR0hTQS01ZnBxLTI2Z2YtcXdjcs4AB_3Y

npm happy-dom
Moderate
about 17 hours ago

LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests GSA_kwCzR0hTQS0zZngyLWNxdzkteHIzY84AB_3X

pypi langgraph, langgraph-sdk
High
about 17 hours ago

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications GSA_kwCzR0hTQS00MzRtLTVoY2otcHhmM84AB_3W

npm @graphql-tools/executor-legacy-ws
Moderate
about 17 hours ago

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller GSA_kwCzR0hTQS1tcDY2LTh3dzItcGN3bc4AB_3V

npm @graphql-tools/executor-legacy-ws
Moderate
about 17 hours ago

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths GSA_kwCzR0hTQS1ybXhtLTNmZzYtcHg0Zs4AB_3U

npm @hono/node-server
Moderate
about 17 hours ago

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers GSA_kwCzR0hTQS0yZmZxLWcyeGctYzIycM4AB_3T

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 17 hours ago

Echo static file middleware route protection bypass via encoded dot-dot traversal GSA_kwCzR0hTQS0zcG14LWNmOWYtMzR4cs4AB_3S

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 17 hours ago

Echo has a Static Middleware Double-Unescape Path Traversal GSA_kwCzR0hTQS14d3E1LTZjcXAtdng5Ns4AB_3R

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 17 hours ago

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI GSA_kwCzR0hTQS12NzUzLWc0Y3ctam00OM4AB_3Q

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 17 hours ago

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto GSA_kwCzR0hTQS0yM3dmLTkyY3AtOHBjas4AB_3P

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
High
about 18 hours ago

Highcharts Grid: `javascript:` URL in credits.href runs script on click GSA_kwCzR0hTQS02aGdwLWZtaHItbXJnNM4AB_3N

npm @highcharts/grid-pro, @highcharts/dashboards
High
about 18 hours ago

Highcharts Grid parses pagination language options as HTML GSA_kwCzR0hTQS1yNXdnLXE4ZmMtcDZ3Ms4AB_3M

npm @highcharts/grid-pro, @highcharts/grid-lite
High
about 18 hours ago

Highcharts Dashboards parses fullscreen labels as HTML GSA_kwCzR0hTQS01OGc3LTdmNTItaDkyY84AB_3L

npm @highcharts/dashboards
High
about 18 hours ago

Highcharts Dashboards parses sidebar component labels as HTML GSA_kwCzR0hTQS1yY3FmLWY2aDItY2NnOc4AB_3K

npm @highcharts/dashboards
High
about 18 hours ago

Highcharts: `javascript:` URL in credits.href runs script on click GSA_kwCzR0hTQS01NzkzLXgycTMtYzNxN84AB_3J

npm highcharts
High
about 18 hours ago

Highcharts: dotted series.keys paths write to Object.prototype GSA_kwCzR0hTQS1ybXFjLXh2cjMtdjQ2Y84AB_3I

npm highcharts
High
about 18 hours ago

Highcharts: series column construction writes to Object.prototype GSA_kwCzR0hTQS1nZnZ4LTJjMmctMzh3cc4AB_3H

npm highcharts
High
about 18 hours ago

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes GSA_kwCzR0hTQS0zNXJyLXh3ZmgteDc4Oc4AB_3G

npm highcharts
High
about 18 hours ago

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` GSA_kwCzR0hTQS01Z2h3LTltZ3ItanZ4Ms4AB_3F

npm @highcharts/dashboards, @highcharts/grid-pro
High
about 18 hours ago

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` GSA_kwCzR0hTQS02ZzNjLXA0ZmcteHY0N84AB_3E

npm @highcharts/grid-pro, @highcharts/grid-lite
High
about 18 hours ago

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace GSA_kwCzR0hTQS1ncmo3LXI0anYtcHc5as4AB_3D

npm @highcharts/dashboards
Moderate
about 18 hours ago

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. GSA_kwCzR0hTQS1jNzV4LTl4OWgtMjhybc4AB_3C

npm @highcharts/grid-pro, @highcharts/dashboards
Moderate
about 18 hours ago

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` GSA_kwCzR0hTQS1qcWdoLXczY2MtN2pxd84AB_3B

npm @highcharts/dashboards
High
about 18 hours ago

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing GSA_kwCzR0hTQS02NWhnLWNmM2YtNW0zOc4AB_3A

npm highcharts
High
about 18 hours ago

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts GSA_kwCzR0hTQS1tdzRmLWdqNXgtNnhyNM4AB_2_

npm highcharts
High
about 18 hours ago

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path GSA_kwCzR0hTQS0zNzVwLTVxaHgtOHdxNM4AB_2-

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 18 hours ago

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob GSA_kwCzR0hTQS1oOWc1LTI4bW0taHgzZ84AB_29

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 19 hours ago

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration GSA_kwCzR0hTQS0yNDZwLWNwd3YtdjNqcc4AB_28

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 19 hours ago

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method GSA_kwCzR0hTQS1yN3c5LTU5MnEtOXZnNM4AB_27

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
Moderate
about 19 hours ago

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default GSA_kwCzR0hTQS05OWpoLTZoN3AtcHAzNs4AB_26

go github.com/labstack/echo/v4, github.com/labstack/echo/v5
High
about 19 hours ago

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 GSA_kwCzR0hTQS00bWZnLXIzOHctdzhmZ84AB_25

npm mcp-sanitizer
High
about 19 hours ago

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths GSA_kwCzR0hTQS03dzgyLTZmOWotdjlqcM4AB_24

npm mcp-sanitizer
High
about 19 hours ago

rucio has an Authorization Bypass on REST API endpoint for signing URLs GSA_kwCzR0hTQS01ajlyLWZ4NHgtcnB2Z84AB_23

pypi rucio
Moderate
about 19 hours ago

MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified) GSA_kwCzR0hTQS00NzNxLW04OWMtZ2hmOM4AB_22

nuget MySqlConnector
Low
about 19 hours ago

Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through GSA_kwCzR0hTQS04cXg3LWoydjIteDZxNc4AB_21

go github.com/caddyserver/caddy/v2
High
1 day ago

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit EEF-CVE-2026-116078

hex bandit
High
1 day ago

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source GSA_kwCzR0hTQS1tNjVwLTlqN3EtNnczM84AB_rF

pypi mlflow
Moderate
1 day ago

MLflow CrewAI autologging records LLM provider API keys in logged trace spans GSA_kwCzR0hTQS1qN3FxLXZyOGMteHZ3M84AB_rE

pypi mlflow
Critical
1 day ago

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules GSA_kwCzR0hTQS0yNnA4LTJqcTktM3ZxOc4AB_rD

pypi mlflow
High
1 day ago

dd-trace: ReDOS in URL query string obfuscation GSA_kwCzR0hTQS14OTRnLXc3M3EtaHBjd84AB_rC

npm dd-trace
High
1 day ago

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization GSA_kwCzR0hTQS1tZjJwLWg2aGYtZmN3bc4AB_rB

packagist, nuget, npm tinymce/tinymce, TinyMCE, tinymce
Moderate
1 day ago

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server GSA_kwCzR0hTQS13NGZoLXF2djktM3YyM84AB_rA

pypi mcp

Filter by Severity

Moderate 15,948 High 13,455 Critical 4,830 Low 2,706 Medium 139

Filter by Source

CPAN Security Advisory Database 1,183 Erlang Ecosystem Foundation 376 GitHub Advisory Database 37,427

Filter by Ecosystem

maven 8,629 npm 8,341 pypi 7,690 packagist 7,244 go 5,870 nuget 5,283 cargo 2,087 cpan 1,182 rubygems 1,145 hex 422 swift 63 actions 58 pub 12

Filter by Package

openclaw 592 moodle/moodle 437 tensorflow 433 tensorflow-gpu 427 tensorflow-cpu 423 magento/community-edition 361 org.jenkins-ci.main:jenkins-core 259 Microsoft.ChakraCore 247 github.com/mattermost/mattermost/server/v8 207 github.com/mattermost/mattermost-server 192 typo3/cms 189 Magick.NET-Q16-AnyCPU 164 Magick.NET-Q8-AnyCPU 164 Magick.NET-Q16-HDRI-AnyCPU 164 Magick.NET-Q16-HDRI-x86 163 org.apache.tomcat:tomcat 162 Magick.NET-Q16-x86 162 Magick.NET-Q8-x86 162 magento/project-community-edition 161 Magick.NET-Q16-OpenMP-x64 160 open-webui 160 Magick.NET-Q16-arm64 160 Magick.NET-Q16-OpenMP-arm64 160 Magick.NET-Q16-HDRI-x64 160 Magick.NET-Q16-HDRI-OpenMP-arm64 160 Magick.NET-Q8-arm64 159 Magick.NET-Q8-OpenMP-arm64 159 com.liferay.portal:release.portal.bom 159 Magick.NET-Q16-HDRI-arm64 159 Magick.NET-Q8-OpenMP-x64 156 n8n 156 Magick.NET-Q16-x64 155 Magick.NET-Q8-x64 153 apache-airflow 146 wwbn/avideo 144 pimcore/pimcore 136 typo3/cms-core 128 craftcms/cms 127 Django 127 dolibarr/dolibarr 127 com.liferay.portal:release.dxp.bom 125 concrete5/concrete5 121 parse-server 116 flowise 114 github.com/siyuan-note/siyuan/kernel 113 thorsten/phpmyfaq 112 drupal/core 111 code.gitea.io/gitea 109 phpmyadmin/phpmyadmin 107 microweber/microweber 106 librenms/librenms 106 symfony/symfony 102 getgrav/grav 99 org.keycloak:keycloak-services 98 Magick.NET-Q16-HDRI-OpenMP-x64 95 silverstripe/framework 93 vllm 89 mlflow 87 com.fasterxml.jackson.core:jackson-databind 86 drupal/drupal 83 snipe/snipe-it 81 vm2 78 org.apache.tomcat.embed:tomcat-embed-core 78 electron 78 next 77 gogs.io/gogs 76 github.com/usememos/memos 75 shopware/platform 74 mantisbt/mantisbt 74 Plone 72 Magick.NET-Q16-OpenMP-x86 68 salt 67 code.vikunja.io/api 67 github.com/grafana/grafana 67 apache-superset 66 ansible 65 shopware/core 65 Pillow 63 actionpack 62 ghost 62 pypdf 62 github.com/rancher/rancher 61 github.com/traefik/traefik/v3 60 froxlor/froxlor 60 org.apache.struts:struts2-core 60 picklescan 59 django 59 github.com/traefik/traefik/v2 59 directus 58 nokogiri 57 pyload-ng 57 mautic/core 57 baserproject/basercms 56 undici 55 axios 55 aiohttp 55 github.com/hashicorp/vault 55 surrealdb 54 nocodb 54 pillow 53 PraisonAI 52 praisonai 52 hono 52 nltk 52 getkirby/cms 51 gradio 50 admidio/admidio 50 rack 50 org.keycloak:keycloak-core 50 praisonaiagents 50 nova 49 perl 49 vyper 47 phpmyfaq/phpmyfaq 47 github.com/zitadel/zitadel 47 github.com/mattermost/mattermost-server/v6 47 org.xwiki.platform:xwiki-platform-oldcore 46 DBD-SQLite 45 matrix-synapse 45 litellm 44 statamic/cms 44 wasmtime 43 rdiffweb 43 github.com/filebrowser/filebrowser/v2 43 langflow 43 k8s.io/kubernetes 43 nilsteampassnet/teampass 42 showdoc/showdoc 42 intelliants/subrion 42 @budibase/server 42 org.apache.tomcat:tomcat-catalina 41 plone 41 org.elasticsearch:elasticsearch 41 contao/core-bundle 40 GitPython 39 net.mingsoft:ms-mcms 39 github.com/cilium/cilium 39 github.com/argoproj/argo-cd/v2 39 keystone 39 io.undertow:undertow-core 39 MT 38 github.com/0xJacky/Nginx-UI 37 com.thoughtworks.xstream:xstream 37 org.jenkins-ci.plugins:script-security 37 DotNetNuke.Core 36 ci4-cms-erp/ci4ms 36 deno 36 com.jfinal:jfinal 36 github.com/docker/docker 35 phpoffice/phpspreadsheet 35 Microsoft.AspNetCore.App.Runtime.win-x64 35 apostrophe 35 moin 35 ash 35 zendframework/zendframework1 34 github.com/answerdev/answer 34 Microsoft.AspNetCore.App.Runtime.win-x86 34 github.com/hashicorp/nomad 34 org.apache.tomcat:tomcat-coyote 34 github.com/argoproj/argo-cd 34 shopware/shopware 34 github.com/openbao/openbao 33 kimai/kimai 33 dompurify 33 Microsoft.AspNetCore.App.Runtime.linux-x64 32 pnpm 32 github.com/hashicorp/consul 32 bandit 31 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 31 flowise-components 31 prestashop/prestashop 31 Microsoft.AspNetCore.App.Runtime.linux-arm64 31 Microsoft.AspNetCore.App.Runtime.osx-x64 31 org.apache.solr:solr-core 31 Microsoft.AspNetCore.App.Runtime.linux-arm 31 org.springframework.security:spring-security-core 31 opencv-python 31 Microsoft.AspNetCore.App.Runtime.win-arm64 31 org.opencms:opencms-core 31 yeswiki/yeswiki 31 opencv-contrib-python 31 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 30 payload 30 github.com/fleetdm/fleet/v4 30 mcp-atlassian 30 pocketmine/pocketmine-mp 30 wagtail 30 github.com/rclone/rclone 29 astro 29 org.eclipse.jetty:jetty-server 29 github.com/traefik/traefik 29 Microsoft.AspNetCore.App.Runtime.win-arm 29 @anthropic-ai/claude-code 29 mediawiki/core 28 vite 28 laravel/framework 28 github.com/coder/coder/v2 28 nodemailer 27 github.com/nats-io/nats-server/v2 27 tornado 27

Filter by Repository

https://github.com/tensorflow/tensorflow 433 https://github.com/moodle/moodle 250 https://github.com/xwiki/xwiki-platform 222 https://github.com/chakra-core/ChakraCore 214 https://github.com/jenkinsci/jenkins 178 https://github.com/liferay/liferay-portal 170 https://github.com/django/django 121 https://github.com/jquery/jquery 118 https://github.com/apache/tomcat 118 https://github.com/pimcore/pimcore 116 https://github.com/apache/airflow 105 https://github.com/TYPO3/typo3 93 https://github.com/microweber/microweber 90 https://github.com/keycloak/keycloak 90 https://github.com/librenms/librenms 77 https://github.com/FasterXML/jackson-databind 70 https://github.com/rails/rails 70 https://github.com/thorsten/phpmyfaq 69 https://github.com/usememos/memos 68 https://github.com/silverstripe/silverstripe-framework 68 https://github.com/kubernetes/kubernetes 66 https://github.com/symfony/symfony 64 https://github.com/Dolibarr/dolibarr 60 https://github.com/mattermost/mattermost 59 https://github.com/erlang/otp 59 https://github.com/ansible/ansible 59 https://github.com/python-pillow/Pillow 52 https://github.com/spring-projects/spring-framework 51 https://github.com/argoproj/argo-cd 50 https://github.com/grafana/grafana 47 https://github.com/apache/struts 47 https://github.com/rancher/rancher 46 https://github.com/mautic/mautic 46 https://github.com/phpmyadmin/phpmyadmin 45 https://github.com/vyperlang/vyper 44 https://github.com/concretecms/concretecms 44 https://github.com/saltstack/salt 42 https://github.com/mantisbt/mantisbt 42 https://github.com/ikus060/rdiffweb 42 https://github.com/shopware/platform 42 https://github.com/directus/directus 41 https://github.com/craftcms/cms 41 https://github.com/shopware/shopware 40 https://github.com/star7th/showdoc 39 https://github.com/mmaitre314/picklescan 39 https://github.com/openstack/nova 38 https://github.com/dotnet/runtime 38 https://github.com/magento/magento2 38 https://github.com/gradio-app/gradio 38 https://github.com/plone/Products.CMFPlone 37 https://github.com/x-stream/xstream 37 https://github.com/octobercms/october 36 https://github.com/mlflow/mlflow 36 https://github.com/sparklemotion/nokogiri 35 https://github.com/ash-project/ash 35 https://github.com/umbraco/Umbraco-CMS 35 https://github.com/parse-community/parse-server 34 https://github.com/answerdev/answer 34 https://github.com/apache/activemq 34 https://github.com/go-gitea/gitea 32 https://github.com/matrix-org/synapse 32 https://github.com/opencv/opencv 32 https://github.com/apache/inlong 31 https://github.com/cilium/cilium 31 https://github.com/PaddlePaddle/Paddle 31 https://github.com/contao/contao 30 https://github.com/snipe/snipe-it 30 https://github.com/rack/rack 29 https://github.com/CVEProject/cvelist 28 https://github.com/FlowiseAI/Flowise 28 https://github.com/Perl/perl5 28 https://github.com/gogs/gogs 28 https://github.com/strapi/strapi 28 https://github.com/openstack/keystone 28 https://github.com/electron/electron 28 https://github.com/netty/netty 27 https://github.com/zitadel/zitadel 26 https://github.com/apache/nifi 26 https://github.com/github/advisory-database 26 https://github.com/baserproject/basercms 26 https://github.com/geoserver/geoserver 26 https://github.com/froxlor/froxlor 26 https://github.com/vllm-project/vllm 25 https://github.com/surrealdb/surrealdb 25 https://github.com/pmmp/PocketMine-MP 25 https://github.com/bcgit/bc-java 25 https://github.com/vercel/next.js 25 https://github.com/denoland/deno 25 https://github.com/langchain-ai/langchain 25 https://github.com/traefik/traefik 25 https://github.com/getgrav/grav 24 https://github.com/run-llama/llama_index 24 https://github.com/pyload/pyload 24 https://github.com/mtrudel/bandit 24 https://github.com/hashicorp/consul 24 https://github.com/apache/cxf 24 https://github.com/dnnsoftware/Dnn.Platform 23 https://github.com/nilsteampassnet/TeamPass 23 https://github.com/moby/moby 23 https://github.com/eclipse/jetty.project 23 https://github.com/bytecodealliance/wasmtime 23 https://github.com/livehelperchat/livehelperchat 23 https://github.com/firefly-iii/firefly-iii 23 https://github.com/PrestaShop/PrestaShop 23 https://github.com/TYPO3/TYPO3.CMS 23 https://github.com/PHPOffice/PhpSpreadsheet 22 https://github.com/nervosnetwork/ckb 22 https://github.com/jenkinsci/script-security-plugin 22 https://github.com/getkirby/kirby 22 https://github.com/helm/helm 22 https://github.com/undertow-io/undertow 21 https://github.com/hashicorp/vault 21 https://github.com/goharbor/harbor 21 https://github.com/laravel/framework 21 https://github.com/OpenZeppelin/openzeppelin-contracts 21 https://github.com/jeecgboot/jeecg-boot 20 https://github.com/ethyca/fides 20 https://github.com/opencast/opencast 20 https://github.com/funadmin/funadmin 20 https://github.com/OpenNMS/opennms 20 https://github.com/nilsteampassnet/teampass 19 https://github.com/TYPO3-CMS/core 19 https://github.com/team-alembic/ash_authentication 19 https://github.com/huggingface/transformers 19 https://github.com/intelliants/subrion 19 https://github.com/alkacon/opencms-core 19 https://github.com/containerd/containerd 19 https://github.com/backstage/backstage 19 https://github.com/simplesamlphp/simplesamlphp 19 https://github.com/cloudfoundry/uaa 19 https://github.com/opencontainers/runc 18 https://github.com/vaadin/platform 18 https://github.com/perl5-dbi/dbi 18 https://github.com/OpenMage/magento-lts 18 https://github.com/apache/camel 18 https://github.com/rubygems/rubygems 18 https://github.com/benoitc/hackney 17 https://github.com/liufee/cms 17 https://github.com/vantage6/vantage6 17 https://github.com/openfga/openfga 17 https://github.com/apache/kylin 17 https://github.com/ethereum/go-ethereum 17 https://github.com/mindsdb/mindsdb 17 https://github.com/forkcms/forkcms 16 https://github.com/rusqlite/rusqlite 16 https://github.com/tinymce/tinymce 16 https://github.com/quarkusio/quarkus 16 https://github.com/vitejs/vite 16 https://github.com/sequelize/sequelize 16 https://github.com/dotnet/aspnetcore 16 https://github.com/twbs/bootstrap 16 https://github.com/ImageMagick/ImageMagick 16 https://github.com/pyca/cryptography 16 https://github.com/mojolicious/mojo 16 https://github.com/etcd-io/etcd 16 https://github.com/hashicorp/nomad 16 https://github.com/yetiforcecompany/yetiforcecrm 16 https://github.com/nodejs/undici 15 https://github.com/PHPMailer/PHPMailer 15 https://github.com/cobbler/cobbler 15 https://github.com/MobSF/Mobile-Security-Framework-MobSF 15 https://github.com/sqlite/sqlite 15 https://github.com/drupal/core 15 https://github.com/zendframework/zendframework 15 https://github.com/puppetlabs/puppet 15 https://github.com/ckeditor/ckeditor4 15 https://github.com/dompdf/dompdf 15 https://github.com/OPCFoundation/UA-.NETStandard 15 https://github.com/containers/podman 15 https://github.com/spring-projects/spring-security 15 https://github.com/centreon/centreon 15 https://github.com/xuxueli/xxl-job 15 https://github.com/aio-libs/aiohttp 15 https://github.com/decidim/decidim 15 https://github.com/thorsten/phpMyFAQ 15 https://github.com/janeczku/calibre-web 14 https://github.com/cockpit-hq/cockpit 14 https://github.com/elixir-mint/mint 14 https://github.com/Graylog2/graylog2-server 14 https://github.com/apache/superset 14 https://github.com/rails/rails-html-sanitizer 14 https://github.com/dpgaspar/Flask-AppBuilder 14 https://github.com/TryGhost/Ghost 14 https://github.com/tonycoz/imager 14 https://github.com/apache/zeppelin 14 https://github.com/golang/go 14 https://github.com/twisted/twisted 14 https://github.com/ming-soft/MCMS 14 https://github.com/urllib3/urllib3 14 https://github.com/pimcore/admin-ui-classic-bundle 14 https://github.com/publify/publify 14 https://github.com/cosmos/cosmos-sdk 14 https://github.com/pgadmin-org/pgadmin4 14 https://sourceforge.net/projects/sourceforge.net 13 https://github.com/swagger-api/swagger-ui 13 https://github.com/ZenHive/mpp 13 https://github.com/h2oai/h2o-3 13 https://github.com/1Panel-dev/1Panel 13 https://github.com/OctoPrint/OctoPrint 13