Browse CVEs by Ecosystem and Severity
758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-32693
Juju has unauthorized access to out-of-scope Kubernetes secrets
CRITICAL
CVE-2026-30924
qui CORS Misconfiguration: Arbitrary Origins Trusted
CRITICAL
CVE-2026-30836
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
CRITICAL
CVE-2026-33211
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
CRITICAL
CVE-2026-33186
gRPC-Go has an authorization bypass via missing leading slash in :path
CRITICAL
CVE-2026-32940
SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
CRITICAL
CVE-2026-32938
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
HIGH
CVE-2026-32769
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace
HIGH
CVE-2026-32805
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
HIGH
CVE-2026-32771
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
HIGH
CVE-2026-32737
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
HIGH
CVE-2026-32768
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
CRITICAL
CVE-2026-32767
SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
CRITICAL
CVE-2026-32760
File Browser Signup Grants Admin When Default Permissions Include Admin
HIGH
CVE-2026-24458
Mattermost fails to properly handle very long passwords
HIGH
CVE-2026-32720
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control
CRITICAL
CVE-2026-32301
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
CRITICAL
CVE-2026-31886
Dagu: Path Traversal via `dagRunId` in Inline DAG Execution
HIGH
CVE-2026-32246
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
CRITICAL
CVE-2026-32136
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass
HIGH
CVE-2026-32110
SiYuan has a Full-Read SSRF via /api/network/forwardProxy
HIGH
CVE-2026-31892
Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
HIGH
CVE-2026-31817
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files
MEDIUM
CVE-2026-31809
SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
MEDIUM
CVE-2026-31807
SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS
HIGH
CVE-2026-30934
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
HIGH
CVE-2026-28513
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange
CRITICAL
CVE-2026-30869
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
CRITICAL
CVE-2026-30861
WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
CRITICAL
CVE-2026-30860
WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
CRITICAL
CVE-2026-30855
WeKnora Vulnerable to Broken Access Control in Tenant Management
CRITICAL
CVE-2026-30832
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
HIGH
CVE-2026-30223
OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes
HIGH
CVE-2026-26022
Gogs: Stored XSS via data URI in issue comments
CRITICAL
CVE-2026-25921
Gogs: Cross-repository LFS object overwrite via missing content hash verification
HIGH
CVE-2026-28683
Gokapi has Stored XSS in SVG Hotlinks
CRITICAL
CVE-2026-27944
Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure
HIGH
CVE-2026-29193
ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication
CRITICAL
CVE-2026-29191
ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint
CRITICAL
CVE-2026-29188
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check
CRITICAL
CVE-2026-29183
SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
HIGH
CVE-2026-29042
Nuclio Shell Runtime Command Injection Leading to Privilege Escalation
CRITICAL
CVE-2021-25320
Rancher cloud credentials can be used through proxy API by users without access
CRITICAL
CVE-2022-31247
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
CRITICAL
CVE-2021-36783
Rancher doesn't properly sanitize credentials in cluster template answers
CRITICAL
CVE-2026-28268
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
CRITICAL
CVE-2026-27969
Vitess users with backup storage access can write to arbitrary file paths on restore
HIGH
CVE-2026-27965
Vitess users with backup storage access can gain unauthorized access to production deployment environments
HIGH
CVE-2026-27899
WireGuard Portal is Vulnerable to Privilege Escalation via User Self-Update to Admin Level
HIGH
CVE-2026-27896
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity