Start for Free

Know every threat before it ships

200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.

All npm PyPI Go NuGet crates.io Maven RubyGems

41,912 vulnerabilities

HIGH 7.5
Maven

CVE-2026-24734

Apache Tomcat has an Improper Input Validation vulnerability
CRITICAL 9.8
PyPI

CVE-2026-39892

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
HIGH 7.5
Maven

CVE-2026-5598

Bouncy Castle Has Covert Timing Channel Vulnerability
HIGH 8.6
PyPI

CVE-2026-0847

NLTK has a Path Traversal issue
HIGH 8.8
PyPI

CVE-2026-24747

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
MEDIUM 6.5
npm

CVE-2025-13465

Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions
MEDIUM 6.5
npm

CVE-2026-121425

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
MEDIUM 6.5
npm

CVE-2026-121426

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
MEDIUM 6.5
npm

CVE-2026-121424

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
HIGH 7.5
Maven

CVE-2026-42440

Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation
CRITICAL 9.1
Maven

CVE-2025-55017

Apache IoTDB has a Path Traversal vulnerability
CRITICAL 9.1
Maven

CVE-2025-64152

Apache IoTDB has a Path Traversal vulnerability
HIGH 7.3
Maven

CVE-2026-57915

Apache Kerby has a bypass the Kerberos pre-authentication check
MEDIUM 5.4
Go

CVE-2026-13426

github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
MEDIUM 6.5
Maven

CVE-2026-57914

Apache Kerby vulnerable to denial of service
MEDIUM 6.5
PyPI

CVE-2026-45339

Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
UNKNOWN
Maven

CVE-2026-56130

Apache Shiro's "remember me" cookie age is not verified on the server.
HIGH 7.5
Maven

CVE-2026-66274

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
UNKNOWN
Maven

CVE-2026-56091

Apache Shiro shiro-guice module vulnerable to authentication bypass
CRITICAL 9.9
PyPI

CVE-2026-5366

Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
CRITICAL 9.8
PyPI

CVE-2026-56121

Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
HIGH 7.8
PyPI

CVE-2026-115878

Stanza: RCE via pickle deserialization in the lemmatizer
MEDIUM 5.9
npm

CVE-2025-71332

FlowiseDB vulnerable to SQL Injection by authenticated users
MEDIUM 5.3
Go

CVE-2026-55686

Podman: WORKDIR symlink traversal vulnerability
HIGH 8.1
PyPI

CVE-2025-54550

Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag
HIGH 7.4
npm

CVE-2026-44265

Elo backends have code injection via unvalidated emission of programmatic AST fields
CRITICAL 9.8
npm

CVE-2026-44266

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
CRITICAL 9.8
npm

CVE-2026-44267

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
LOW 3.7
NuGet

CVE-2026-56367

ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
HIGH 8.1
Maven

CVE-2026-11800

Keycloak has authentication bypass via jwt algorithm confusion
HIGH 8.1
NuGet

GHSA-p3jp-9v83-76w9

Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
LOW 3.7
NuGet

GHSA-rg39-4fm5-hrp2

Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
CRITICAL 10.0
npm

CVE-2025-71338

Flowise allows arbitrary file write to RCE
HIGH 8.1
PyPI

GHSA-mq7r-vm99-p7vx

Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
HIGH 8.1
PyPI

CVE-2025-71340

Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
CRITICAL 9.8
npm

GHSA-w5r9-j49j-2m55

Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation
CRITICAL 9.8
npm

GHSA-q2xp-j85q-883h

Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP
CRITICAL 9.8
npm

CVE-2025-71336

Flowise has unsandboxed remote code execution via Custom MCP
HIGH 8.2
Go

CVE-2026-62331

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
CRITICAL 10.0
npm

GHSA-c3hj-m5hq-59xw

Duplicate Advisory : Flowise allows arbitrary file write to RCE
CRITICAL 9.8
npm

CVE-2025-71334

Flowise has arbitrary file access due to missing chat flow id validation
HIGH 8.1
Maven

GHSA-gqj5-2xp5-3qmp

Duplicate Advisory: Authentication bypass via jwt algorithm confusion
HIGH 8.1
NuGet

CVE-2026-70197

Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability
HIGH 8.8
NuGet

CVE-2026-102870

Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
CRITICAL 9.8
PyPI KEV

CVE-2026-111497

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
UNKNOWN
Go

GHSA-9ppr-wfw9-xvr2

Netfoil doesn't decrement TTL
HIGH 7.3
NuGet

CVE-2026-62848

Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution
HIGH 7.5
PyPI

CVE-2026-54279

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence
HIGH 8.2
Go

CVE-2025-68939

Gitea allows attackers to add attachments with forbidden file extensions
UNKNOWN
Go

GHSA-m3qr-fvp4-78xj

Arc has unauthenticated application log disclosure via `/api/v1/logs`
UNKNOWN
PyPI

CVE-2024-27928

Vantage6: 2FA can be circumvented with hacked email access
UNKNOWN
PyPI

CVE-2024-24769

Vantage6: No limit on emails sent for password/MFA reset
CRITICAL 9.9
PyPI

CVE-2026-18948

Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs
UNKNOWN
Maven

CVE-2026-24807

Quick-Media Batik Codec FIX Package has Vulnerability in PNG Codec
CRITICAL 10.0
Go

CVE-2026-94603

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
MEDIUM 6.5
npm

CVE-2026-2950

lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt
MEDIUM 5.5
PyPI

CVE-2026-56074

PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
HIGH 8.1
Go

CVE-2025-9566

podman kube play symlink traversal vulnerability
HIGH 7.2
PyPI

CVE-2026-120492

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes