Browse CVEs by Ecosystem and Severity

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

lettre has TLS hostname verification disabled when using Boring TLS backend

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser

Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output

Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs

Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer

Zebra's Block Validator Undercounts Coinbase and P2SH Sigops

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

Brillig: Heap corruption in foreign call results with nested tuple arrays

Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling

Zebra has rk Identity Point Panic in Transaction Verification

nimiq-blockchain is missing a wall-clock upper bound on block timestamps

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

mpp has multiple payment bypass and griefing vulnerabilities

Zebra node crash — V5 transaction hash panic (P2P reachable)

RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade

zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

Nonce Reuse in HPKE Context

Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema

dcap-qvl has Missing Verification for QE Identity

Deno node:crypto doesn't finalize cipher

RustFS has a gRPC Hardcoded Token Authentication Bypass

libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)

cggmp21 has a missing check in the ZK proof used in CGGMP21

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

SurrealDB server-takeover via SurrealQL injection on backup import

Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`

Namada-apps allows Excessive Computation in Mempool Validation

Namada-apps can Crash with Excessive Computation in Mempool Validation

ismp-grandpa crate accepted incorrect signatures

jj vulnerable to path traversal via crafted Git repositories

panic on parsing crafted phonenumber inputs

Unable to generate the correct character set

qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint

Spin applications with specific configuration vulnerable to potential network sandbox escape

Apollo Router vulnerable to Critical Regression In Query Plan Cache

SQLpage vulnerable to public exposure of database credentials

NLnet Labs’ Routinator vulnerable to path traversal