Browse CVEs by Ecosystem and Severity

Mattermost has a Path Traversal issue

Caddy Defender trusted proxy client IP bypass

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Kopia: RCE via SSH ProxyCommand Injection

zrok copy writes attacker-controlled WebDAV paths outside the destination root

Algernon: handler.lua discovery walks parent directories above the server root

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

Arcane Backend: Unauthenticated reflected XSS via SVG color parameter enables admin account takeover

Arcane Backend: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs

Mattermost doesn't sanitize sensitive configuration fields in the Mattermost Calls plugin

Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation

Crabbox: environment variable exposure vulnerability

Crabbox: authentication bypass vulnerability that allows impersonation of others by spoofing identity headers

go-billy has path traversal vulnerabilities

Portainer has an endpoint security bypass via Swarm service create/update

Portainer Has an Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

Portainer has a bind-mount restriction bypass via HostConfig.Mounts

Portainer missing authorization on Docker plugin endpoints, which allows host RCE

SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload

HashiCorp Nomad vulnerable to a path traversal

Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option

Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

Local Path Provisioner Vulnerable to HelperPod Template Injection

CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE

Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication

Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass

free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)

SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE

Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering

Rancher Extensions have arbitrary file access via path traversal

Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook

Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection

Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS

Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

S3-Proxy has Security Issues in its Resource Path Matching Implementation

Pelican Web UI Affected by a Privilege Escalation Attack