Browse CVEs by Ecosystem and Severity
317 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-31892
Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
HIGH
CVE-2026-31817
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files
HIGH
CVE-2026-30934
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
HIGH
CVE-2026-28513
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange
HIGH
CVE-2026-30223
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
HIGH
CVE-2026-26022
Gogs: Stored XSS via data URI in issue comments
HIGH
CVE-2026-28683
Gokapi has Stored XSS in SVG Hotlinks
HIGH
CVE-2026-29193
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication
HIGH
CVE-2026-29042
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation
HIGH
CVE-2026-27965
Vitess users with backup storage access can gain unauthorized access to production deployment environments
HIGH
CVE-2026-27899
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level
HIGH
CVE-2026-27896
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
HIGH
CVE-2026-27730
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
HIGH
CVE-2026-27590
Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
HIGH
CVE-2026-27586
Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed
HIGH
CVE-2026-26205
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path
HIGH
CVE-2026-26056
Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC
HIGH
CVE-2026-24895
FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP
HIGH
CVE-2026-25804
Antrea has invalid enforcement order for network policy rules caused by integer overflow
HIGH
CVE-2025-64175
Gogs Vulnerable to 2FA Bypass via Recovery Code
HIGH
CVE-2026-23989
OpenCloud Reva has a Public Link Exploit
HIGH
CVE-2026-25538
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage
HIGH
CVE-2026-25161
Alist vulnerable to Path Traversal in multiple file operation handlers
HIGH
CVE-2026-1580
ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx
HIGH
CVE-2026-24512
ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx
HIGH
CVE-2026-25059
OpenList vulnerable to Path Traversal in file copy and remove handlers
HIGH
CVE-2025-67601
Rancher CLI skips TLS verification on Rancher CLI login command
HIGH
CVE-2026-23954
Incus container image templating arbitrary host file read and write
HIGH
CVE-2026-23953
Incus container environment configuration newline injection
HIGH
CVE-2026-24124
Dragonfly Manager Job API Unauthenticated Access
HIGH
CVE-2026-24058
Soft Serve Affected by an Authentication Bypass
HIGH
CVE-2026-23742
Skipper is vulnerable to arbitrary code execution through lua filters
HIGH
CVE-2026-22771
Envoy Extension Policy lua scripts injection causes arbitrary command execution
HIGH
CVE-2025-14443
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References
HIGH
CVE-2025-11393
Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access
HIGH
CVE-2025-66001
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
HIGH
CVE-2025-8110KEV
Gogs vulnerable to a bypass of CVE-2024-55947
HIGH
CVE-2025-66626
RCE via ZipSlip and symbolic links in argoproj/argo-workflows
HIGH
CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
HIGH
CVE-2026-29067
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login
HIGH
CVE-2025-64443
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode
HIGH
CVE-2025-13353
gokey allows secret recovery from a seed file without the master password
HIGH
CVE-2025-65109
Minder does not sandbox http.send in Rego programs
HIGH
CVE-2025-64523
File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function
HIGH
CVE-2025-64507
Incus vulnerable to local privilege escalation through custom storage volumes
HIGH
CVE-2025-64186
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves
HIGH
CVE-2025-64484
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation
HIGH
CVE-2025-2843
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack
HIGH
CVE-2025-64431
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
HIGH
CVE-2025-64103
Zitadel May Bypass Second Authentication Factor