Browse CVEs by Ecosystem and Severity

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

`zbus_polkit`: authorization bypass via PID reuse

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

Filesystem sandbox escape when paths or symlinks contain trailing slashes

nimiq-blockchain: Validity store off by one error

Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Prompty: Arbitrary file read via file reference expansion

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

mkfifo: permissions of an existing file are changed after FIFO creation fails

chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)

jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache

SurrealDB has Denial of Service in JSON parser due to nested objects

SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation

SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Deno: Miller-Rabin Primality Test Allows Zero Rounds

Deno: Command Injection via spawnSync & spawn on Windows

Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

Routinator has cache path traversal when processing the module component of rsync URIs

Routinator crashes when encountering maliciously crafted RRDP XML files

Routinator crashes when sending a maliciously crafted select-asn query parameter

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Russh: Unchecked CryptoVec allocation and growth handling is reachable

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item

nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT