Browse CVEs by Ecosystem and Severity

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

KubeVela Terraform remote loader DoS via unbounded file read

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Wings exposes node configuration secrets through egg configuration-file templating

Logging operator has Fluentd configuration injection that allows remote code execution

prebid-server's request forgery vulnerability allows for possible host environment data extraction

openhole-server vulnerable to path traversal via URL-decoded request path

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Public-only repository tokens can update private PR head branches