Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
CRITICAL
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
HIGH
CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
CRITICAL
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
CRITICAL
CVE-2026-106445
Handlebars: JavaScript Injection via Own Property Check Bypass
HIGH
CVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
HIGH
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
HIGH
CVE-2026-105856
Payload: SQL injection in SQLite/Postgres
HIGH
CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
CRITICAL
CVE-2026-105857
Payload Form Builder has an RCE issue
CRITICAL
CVE-2026-105859
Payload: Unauthorized update to collection documents
CRITICAL
CVE-2026-105863
Payload authentication token field handling issue
CRITICAL
CVE-2026-93605
vm2 contains a sandbox escape vulnerability
HIGH
CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
HIGH
CVE-2026-106486
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
CRITICAL
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
HIGH
CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
CRITICAL
CVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
CRITICAL
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
HIGH
CVE-2026-105850
Payload Ecommerce has an order confirmation validation issue
MEDIUM
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
CRITICAL
CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
CRITICAL
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
CRITICAL
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
CRITICAL
CVE-2026-90711
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
CRITICAL
CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
MEDIUM
CVE-2026-100723
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
CRITICAL
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
CRITICAL
CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
CRITICAL
CVE-2026-104849
Tinypool: Prototype Pollution Gadget to RCE in run() options
CRITICAL
CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
CRITICAL
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
CRITICAL
CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
CRITICAL
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
CRITICAL
CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
CRITICAL
CVE-2026-92956
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
CRITICAL
CVE-2026-10032
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
CRITICAL
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
HIGH
CVE-2026-92950
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
CRITICAL
CVE-2026-92940
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
CRITICAL
CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
CRITICAL
CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
CRITICAL
CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
CRITICAL
CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
CRITICAL
CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
CRITICAL
CVE-2026-92939
vm2 crypto builtin loads attacker native code through setEngine
CRITICAL
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
CRITICAL
CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
MEDIUM
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
MEDIUM
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders