Ecosystem
Wolfi
8,505 known vulnerabilities.
Most affected packages
chromium 3,268
chromium-docker-selenium-compat 1,659
chromium-lang 1,659
firefox 662
open-webui 266
langfuse-3-worker 248
katib-suggestion-hyperopt 237
katib-earlystopping 228
katib-suggestion-hyperband 222
katib-suggestion-pbt-enas 222
katib-suggestion-optuna-enas 222
katib-suggestion-skopt-enas 222
katib-suggestion-nas-darts 220
katib-suggestion-goptuna-compat 217
druid 214
katib-suggestion-nas-enas 210
katib-tfevent-metricscollector 208
renovate 199
thingsboard-tb-node 190
zot 182
kubescape 179
thingsboard-tb-mqtt-transport 178
prism 175
kots 171
zarf 164
k3d 162
openjdk-9-jre 162
opensearch-dashboards-3 158
skaffold 150
aactl 146
trivy 145
langfuse-3 145
k3s 144
kubeflow-pipelines-apiserver 143
scorecard 142
trino 142
airflow-3 141
k3s-static 141
helm-3 136
lerna 134
3,537 results · Clear filters · Feed
-
High 7.4
Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker …
-
High 8.2
Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
High 8.3CVE-2026-106378 Public exploit
Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had comp…
-
High 7.6
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypa…
-
High 8.8
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code ins…
-
High 7.3
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging soc…
-
High 8.8
Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social e…
-
High 8.8
Use after free in Streaming in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social enginee…
-
High 8.8
Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitr…
-
High 8.8
Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensit…
-
High 8.3
Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compr…
-
High 8.8
Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary…
-
High 8.3
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rende…
-
High 8.8
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code …
-
High 8.8
Use after free in HTML in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code insi…
-
High 8.8
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineerin…
-
High 8.3
Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the ren…
-
High 8.8
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code in…
-
High 8.3
Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the ren…
-
High 8.8
Use after free in Bindings in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code …
-
High 8.8
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary…
-
High 8.8
Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging s…
-
High 8.3
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitr…
-
High 8.3
Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rende…
-
High 8.3
Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised …
-
High 8.3
Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rende…
-
High 8.8
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attac…
-
High 7.5CVE-2026-104850 Public exploit
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authoriza…
-
High 8.2
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not exclude __proto__, …
-
High 7.1
BLS12-381 key validation accepts a public key built on a foreign curve
In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and ProofOfPossession verify and aggregateVerify that gate on it, accepted a public key built on a foreign ECCurv…