Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-25896
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
HIGH
CVE-2026-32060
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace
CRITICAL
CVE-2026-27212
Prototype pollution in swiper
HIGH
CVE-2026-26996
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
HIGH
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
CRITICAL
CVE-2026-26980
Ghost has a SQL injection in Content API
HIGH
CVE-2026-26960EPSS 0.0%
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
HIGH
CVE-2026-29610
OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)
HIGH
CVE-2026-28469
OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting
CRITICAL
CVE-2026-28446
OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)
CRITICAL
CVE-2026-28474
Nextcloud Talk allowlist bypass via actor.name display name spoofing
CRITICAL
CVE-2026-28454
OpenClaw has a potential access-group authorization bypass if channel type lookup fails
HIGH
CVE-2026-28470
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes
HIGH
CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
CRITICAL
CVE-2026-28472
OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated
HIGH
CVE-2026-0969
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
CRITICAL
CVE-2026-26021
set-in Affected by Prototype Pollution
CRITICAL
CVE-2026-1774
CASL Ability is Vulnerable to Prototype Pollution
CRITICAL
CVE-2026-25939
FUXA Unauthenticated Remote Arbitrary Scheduler Write
CRITICAL
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
CRITICAL
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
HIGH
CVE-2026-25639EPSS 0.0%
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
HIGH
CVE-2026-1615
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
CRITICAL
CVE-2026-25641
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses
CRITICAL
CVE-2026-25587
@nyariv/sandboxjs has a Sandbox Escape vulnerability
CRITICAL
CVE-2026-25586
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
CRITICAL
CVE-2026-25544
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
CRITICAL
CVE-2026-25520
@nyariv/sandboxjs has a Sandbox Escape issue
MEDIUM
CVE-2026-25533
Sandbox escape via infinite recursion and error objects
CRITICAL
CVE-2026-25752
FUXA Unauthenticated Remote Arbitrary Device Tag Write
CRITICAL
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
CRITICAL
CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
CRITICAL
CVE-2026-25751
FUXA Unauthenticated Exposure of Plaintext Database Credentials
CRITICAL
CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
CRITICAL
CVE-2026-25630
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
CRITICAL
CVE-2026-25115
n8n has a Python sandbox escape
CRITICAL
CVE-2026-25056
n8n Merge Node has Arbitrary File Write leading to RCE
HIGH
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
CRITICAL
CVE-2026-25053
n8n has OS Command Injection in Git Node
CRITICAL
CVE-2026-25052
n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
HIGH
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
CRITICAL
CVE-2026-25049
n8n Has Expression Escape Vulnerability Leading to RCE
CRITICAL
CVE-2026-21893
n8n Vulnerable to Command Injection in Community Package Installation
CRITICAL
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
HIGH
CVE-2025-69983
FUXA allows Remote Code Execution (RCE) via the project import functionality.
HIGH
CVE-2025-69981
FUXA contains an Unrestricted File Upload vulnerability
HIGH
CVE-2025-69970
FUXA contains an insecure default configuration vulnerability
HIGH
CVE-2026-25253
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
HIGH
CVE-2026-24763
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable
CRITICAL
CVE-2026-25521
locutus is vulnerable to Prototype Pollution