Start for Free

Know every threat before it ships

200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.

All npm PyPI Go NuGet crates.io Maven RubyGems

41,912 vulnerabilities

HIGH 7.5
NuGet

CVE-2026-50524

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
HIGH 7.5
NuGet

CVE-2026-50651

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
HIGH 7.5
NuGet

CVE-2026-57108

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
HIGH 7.8
NuGet

CVE-2026-50650

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
HIGH 8.8
NuGet

CVE-2026-69522

Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
UNKNOWN
Go

CVE-2026-72815

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`
HIGH 7.8
Maven

CVE-2026-40048

Camel-PQC Vulnerable to Deserialization of Untrusted Data
CRITICAL 9.8
npm

CVE-2026-44009

vm2 has Sandbox Breakout Through Null Proto Exception
CRITICAL 9.8
npm

CVE-2026-26332

VM2 Has a Sandbox Escape Issue via SuppressedError
CRITICAL 9.8
npm

CVE-2026-44008

vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
HIGH 7.5
npm

CVE-2026-12151

undici WebSocket client vulnerable to denial of service via fragment count bypass
CRITICAL 9.8
npm

CVE-2026-24118

VM2 Sandbox Breakout Through __lookupGetter__
HIGH 7.5
npm

CVE-2026-45109

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
CRITICAL 9.8
npm

CVE-2026-24781

VM2 Has Sandbox Breakout Through Inspect Function
CRITICAL 9.1
npm

CVE-2026-44007

vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
HIGH 7.5
npm

CVE-2026-49293

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
HIGH 7.5
Maven

CVE-2026-24734

Apache Tomcat has an Improper Input Validation vulnerability
CRITICAL 9.8
PyPI

CVE-2026-39892

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
HIGH 7.5
PyPI

CVE-2026-27489

onnx Vulnerable to Path Traversal via Symlink
HIGH 7.5
Maven

CVE-2026-5598

Bouncy Castle Has Covert Timing Channel Vulnerability
HIGH 8.8
Go

CVE-2026-33433

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
HIGH 8.1
PyPI

CVE-2026-33236

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
HIGH 8.6
PyPI

CVE-2026-0847

NLTK has a Path Traversal issue
HIGH 8.8
PyPI

CVE-2026-24747

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
MEDIUM 6.5
npm

CVE-2025-13465

Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions
MEDIUM 6.5
npm

CVE-2026-121425

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
MEDIUM 6.5
npm

CVE-2026-121426

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
MEDIUM 6.5
npm

CVE-2026-121424

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
HIGH 7.5
Maven

CVE-2026-42440

Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation
CRITICAL 9.1
Maven

CVE-2025-55017

Apache IoTDB has a Path Traversal vulnerability
CRITICAL 9.1
Maven

CVE-2025-64152

Apache IoTDB has a Path Traversal vulnerability
HIGH 7.3
Maven

CVE-2026-57915

Apache Kerby has a bypass the Kerberos pre-authentication check
MEDIUM 5.4
Go

CVE-2026-13426

github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction
MEDIUM 6.5
Maven

CVE-2026-57914

Apache Kerby vulnerable to denial of service
MEDIUM 6.5
PyPI

CVE-2026-45339

Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints
UNKNOWN
Maven

CVE-2026-56130

Apache Shiro's "remember me" cookie age is not verified on the server.
HIGH 7.5
Maven

CVE-2026-66274

Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
UNKNOWN
Maven

CVE-2026-56091

Apache Shiro shiro-guice module vulnerable to authentication bypass
CRITICAL 9.9
PyPI

CVE-2026-5366

Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
CRITICAL 9.8
PyPI

CVE-2026-56121

Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto
HIGH 7.8
PyPI

CVE-2026-115878

Stanza: RCE via pickle deserialization in the lemmatizer
MEDIUM 5.9
npm

CVE-2025-71332

FlowiseDB vulnerable to SQL Injection by authenticated users
MEDIUM 5.3
Go

CVE-2026-55686

Podman: WORKDIR symlink traversal vulnerability
HIGH 8.1
PyPI

CVE-2025-54550

Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag
HIGH 7.4
npm

CVE-2026-44265

Elo backends have code injection via unvalidated emission of programmatic AST fields
CRITICAL 9.8
npm

CVE-2026-44266

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels
CRITICAL 9.8
npm

CVE-2026-44267

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
LOW 3.7
NuGet

CVE-2026-56367

ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
HIGH 8.1
Maven

CVE-2026-11800

Keycloak has authentication bypass via jwt algorithm confusion
HIGH 8.1
NuGet

GHSA-p3jp-9v83-76w9

Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability
LOW 3.7
NuGet

GHSA-rg39-4fm5-hrp2

Duplicate Advisory: ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds
CRITICAL 10.0
npm

CVE-2025-71338

Flowise allows arbitrary file write to RCE
HIGH 8.1
PyPI

GHSA-mq7r-vm99-p7vx

Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
HIGH 8.1
PyPI

CVE-2025-71340

Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode
CRITICAL 9.8
npm

GHSA-w5r9-j49j-2m55

Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation
CRITICAL 9.8
npm

GHSA-q2xp-j85q-883h

Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP
CRITICAL 9.8
npm

CVE-2025-71336

Flowise has unsandboxed remote code execution via Custom MCP
HIGH 8.2
Go

CVE-2026-62331

praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)
CRITICAL 10.0
npm

GHSA-c3hj-m5hq-59xw

Duplicate Advisory : Flowise allows arbitrary file write to RCE
CRITICAL 9.8
npm

CVE-2025-71334

Flowise has arbitrary file access due to missing chat flow id validation

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes