VulnScope — 以套件為主體的 CVE 查詢工具

搜尋

6,670 筆結果

嚴重程度:CRITICAL HIGH MEDIUM LOW|生態系:npm PyPI Maven Debian Alpine|⚠ 只看 KEV

HIGH7.3CVE-2026-11417aws-cdk-lib: OS Command Injection in NodejsFunction Bundling2026/6/15
MEDIUM5.3markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations2026/6/15
MEDIUM5.3OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation2026/6/15
MEDIUM5.3UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`2026/6/15
HIGH8.2protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names2026/6/15
MEDIUM5.3protobufjs: Memory amplification from preserved unknown fields in binary decode2026/6/15
MEDIUM6.1DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks2026/6/15
MEDIUM6.1DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM2026/6/15
HIGH7.5protobufjs: Denial of service through unbounded Any expansion during JSON conversion2026/6/15
MEDIUM5.3protobufjs : Schema-derived names can shadow runtime-significant properties2026/6/15
MEDIUM5.3JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases2026/6/15
HIGH8.2tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template2026/6/15
HIGH7.5ws: Memory exhaustion DoS from tiny fragments and data chunks2026/6/15
MEDIUM5.4Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization2026/6/12
HIGH7.5form-data: CRLF injection in form-data via unescaped multipart field names and filenames2026/6/12
HIGH8.1Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL2026/6/12
HIGH7.5Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema2026/6/12
MEDIUM6.5Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker2026/6/12
HIGH7.7Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection2026/6/12
MEDIUM6.7LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access2026/6/12
HIGH7.3Vim is an open source, command line text editor.2026/6/11
HIGH7.5Vim is an open source, command line text editor.2026/6/11
MEDIUM6.9Vim is an open source, command line text editor.2026/6/11
MEDIUM5.3@hapi/inert has a static-file confinement bypass via sibling-prefix path2026/6/11
HIGH7.5@grpc/grpc-js: A malformed request can cause a server crash2026/6/11

第 1 / 267 頁下一頁 →