Browse CVEs by Ecosystem and Severity

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

Casdoor doesn't verify that a JWT used for token exchange is still active

Casdoor does not validate the AudienceRestriction element in SAML assertions

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

Casdoor has an authentication bypass

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

KubeVirt has a Link Following vulnerability

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Kopia: RCE via SSH ProxyCommand Injection

Algernon: handler.lua discovery walks parent directories above the server root

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Crabbox: environment variable exposure vulnerability

Portainer has an endpoint security bypass via Swarm service create/update

Portainer missing authorization on Docker plugin endpoints, which allows host RCE

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

S3-Proxy has Security Issues in its Resource Path Matching Implementation

Pelican Web UI Affected by a Privilege Escalation Attack

auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

Note Mark: OIDC-registered users authenticated by submitting password "null"

Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field