Browse CVEs by Ecosystem and Severity

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

microsandbox: Secret values exposed in world-readable process arguments

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

RMCP: Custom HTTP headers leak to cross-origin redirect targets

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

gix-sec safe.directory protections absent for elevated administrators

SWC HTML minifier may allow script element breakout when minifying embedded JSON

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

SurrealDB allows bypass of deny-net flags via DNS resolution

Hurl: Cookies in Cookies section leak when redirecting to a different host

`zbus_polkit`: authorization bypass via PID reuse

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Filesystem sandbox escape when paths or symlinks contain trailing slashes

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

nimiq-blockchain: Validity store off by one error

Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

Russh: Channel-scoped server callbacks can be reached without an open channel

lettre has TLS hostname verification disabled when using Boring TLS backend

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Prompty: Arbitrary file read via file reference expansion

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

mkfifo: permissions of an existing file are changed after FIFO creation fails

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)

install -D: symlink race in directory creation allows arbitrary file overwrite