Browse CVEs by Ecosystem and Severity

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

openhole-server vulnerable to path traversal via URL-decoded request path

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

Gitea has insufficient permission checks for Composer package source links

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

melange: Incomplete package integrity verification allows data section substitution

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover

Gogs has Stored XSS in `.ipynb` Preview

Grafana: Pre-authentication denial of service in the public dashboard query handler

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

containerd CRI checkpoint restore CDI annotation smuggling

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Heimdall: IP Spoofing via Unvalidated Forwarding Headers

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Gogs: Overwriting critical files results in a denial of service

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

statping-ng allows attackers to escalate privileges to Administrator and access sensitive components

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path