Browse CVEs by Ecosystem and Severity

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

statping-ng allows attackers to escalate privileges to Administrator and access sensitive components

MCP Toolbox for Databases has an Origin Validation Error

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

DevGuard has improper authorization on public assets

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

authentik's XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename

Casdoor doesn't verify that a JWT used for token exchange is still active

Calico Inserts Sensitive Information into Log File

Casdoor does not validate the AudienceRestriction element in SAML assertions

Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

Casdoor has an authentication bypass

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

MCP Toolbox for Databases vulnerable to DNS rebinding attacks

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

KubeVirt has a Link Following vulnerability

Mattermost doesn't enforce request body size limits on plugin HTTP endpoints

Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

Arcane: Missing admin authorization on global variables endpoint

Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

containerd user ID handling bypass allows runAsNonRoot evasion

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives

Apache Camel K: Kubernetes namespace authorized users can create a Build resource