Browse CVEs by Ecosystem and Severity

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

Contao: Cross-site scripting in the comments bundle

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Hazelcast allows arbitrary member memory access by low-privileged client

Hazelcast has an authorization bypass in IMap Predicates API

Mechanize sends credential headers to another origin after a meta refresh

Mechanize sends credential headers to another host after an HTTP redirect

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Handlebars: JavaScript Injection via Own Property Check Bypass

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

Ghost: Remote Code Execution via Bookmark Card Images

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Payload: SQL injection in SQLite/Postgres

Payload: Bypassed sanitization of user uploaded SVGs

Payload Form Builder has an RCE issue

Payload: Unauthorized update to collection documents

Payload authentication token field handling issue

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

ImageSharp: ICC LUT16 output channel count can write beyond Vector4

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

vm2 contains a sandbox escape vulnerability

Backstage: Improper validation of TechDocs MkDocs configuration

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage: Sensitive information exposure in Scaffolder

Backstage: Scaffolder action input authorization bypass

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Payload Ecommerce has an order confirmation validation issue

Payload: Insufficient Access Control in Stripe REST Proxy

Payload: Prototype pollution in Payload Import Export plugin

Payload: SQL Injection in SQLite and Postgres

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL