Start for Free

Know every threat before it ships

200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.

All npm PyPI Go NuGet crates.io Maven RubyGems

41,911 vulnerabilities

CRITICAL 9.1
Maven

CVE-2025-55017

Apache IoTDB has a Path Traversal vulnerability
CRITICAL 9.1
Maven

CVE-2025-64152

Apache IoTDB has a Path Traversal vulnerability
MEDIUM 5.4
Go

CVE-2026-13426

github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
MEDIUM 6.5
Maven

CVE-2026-57914

Apache Kerby vulnerable to denial of service
MEDIUM 6.5
PyPI

CVE-2026-45339

Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
UNKNOWN
Maven

CVE-2026-56130

Apache Shiro's "remember me" cookie age is not verified on the server.
HIGH 7.5
Maven

CVE-2026-66274

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
UNKNOWN
Maven

CVE-2026-56091

Apache Shiro shiro-guice module vulnerable to authentication bypass
CRITICAL 9.9
PyPI

CVE-2026-5366

Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
CRITICAL 9.8
PyPI

CVE-2026-56121

Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
HIGH 7.8
PyPI

CVE-2026-115878

Stanza: RCE via pickle deserialization in the lemmatizer
MEDIUM 5.9
npm

CVE-2025-71332

FlowiseDB vulnerable to SQL Injection by authenticated users
MEDIUM 5.3
Go

CVE-2026-55686

Podman: WORKDIR symlink traversal vulnerability
HIGH 8.1
PyPI

CVE-2025-54550

Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag
HIGH 7.4
npm

CVE-2026-44265

Elo backends have code injection via unvalidated emission of programmatic AST fields
CRITICAL 9.8
npm

CVE-2026-44266

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
CRITICAL 9.8
npm

CVE-2026-44267

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
LOW 3.7
NuGet

CVE-2026-56367

ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
HIGH 8.1
Maven

CVE-2026-11800

Keycloak has authentication bypass via jwt algorithm confusion
HIGH 8.1
NuGet

GHSA-p3jp-9v83-76w9

Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
LOW 3.7
NuGet

GHSA-rg39-4fm5-hrp2

Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
CRITICAL 10.0
npm

CVE-2025-71338

Flowise allows arbitrary file write to RCE
HIGH 8.1
PyPI

GHSA-mq7r-vm99-p7vx

Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
HIGH 8.1
PyPI

CVE-2025-71340

Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
CRITICAL 9.8
npm

GHSA-w5r9-j49j-2m55

Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation
CRITICAL 9.8
npm

GHSA-q2xp-j85q-883h

Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP
CRITICAL 9.8
npm

CVE-2025-71336

Flowise has unsandboxed remote code execution via Custom MCP
HIGH 8.2
Go

CVE-2026-62331

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
CRITICAL 10.0
npm

GHSA-c3hj-m5hq-59xw

Duplicate Advisory : Flowise allows arbitrary file write to RCE
CRITICAL 9.8
npm

CVE-2025-71334

Flowise has arbitrary file access due to missing chat flow id validation
HIGH 8.1
Maven

GHSA-gqj5-2xp5-3qmp

Duplicate Advisory: Authentication bypass via jwt algorithm confusion
HIGH 8.1
NuGet

CVE-2026-70197

Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability
HIGH 8.8
NuGet

CVE-2026-102870

Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
CRITICAL 9.8
PyPI KEV

CVE-2026-111497

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
UNKNOWN
Go

GHSA-9ppr-wfw9-xvr2

Netfoil doesn't decrement TTL
HIGH 7.3
NuGet

CVE-2026-62848

Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution
HIGH 7.5
PyPI

CVE-2026-54279

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
HIGH 8.2
Go

CVE-2025-68939

Gitea allows attackers to add attachments with forbidden file extensions
UNKNOWN
Go

GHSA-m3qr-fvp4-78xj

Arc has unauthenticated application log disclosure via `/api/v1/logs`
UNKNOWN
PyPI

CVE-2024-27928

Vantage6: 2FA can be circumvented with hacked email access
UNKNOWN
PyPI

CVE-2024-24769

Vantage6: No limit on emails sent for password/MFA reset
CRITICAL 9.9
PyPI

CVE-2026-18948

Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
UNKNOWN
Maven

CVE-2026-24807

Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
CRITICAL 10.0
Go

CVE-2026-94603

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
MEDIUM 6.5
npm

CVE-2026-2950

lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt
MEDIUM 5.5
PyPI

CVE-2026-56074

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
HIGH 8.1
Go

CVE-2025-9566

podman kube play symlink traversal vulnerability
HIGH 7.2
PyPI

CVE-2026-120492

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
UNKNOWN
npm

CVE-2026-40895

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
HIGH 7.2
PyPI

CVE-2026-40961

Apache Airflow: Authenticated users can bypass the `is_safe_url` check
MEDIUM 6.5
npm

CVE-2026-63667

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
LOW 2.8
Go

CVE-2026-33762

go-git missing validation decoding Index v4 files leads to panic
UNKNOWN
Go

GO-2026-5932

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
MEDIUM 5.6
Maven

CVE-2026-113730

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
HIGH 7.0
PyPI

CVE-2026-81726

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots
HIGH 7.5
RubyGems

CVE-2026-47737

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
HIGH 7.5
RubyGems

CVE-2026-47736

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

UNKNOWN
RubyGems

CVE-2026-61666

websocket-driver-ruby: Denial of service via malformed Host header
HIGH 7.8
npm

CVE-2026-59176

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes