Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
CRITICAL
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
CRITICAL
CVE-2026-25141
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
CRITICAL
CVE-2026-25047
deepHas vulnerable to Prototype Pollution via constructor.prototype
HIGH
CVE-2026-23864
React Server Components have multiple Denial of Service Vulnerabilities
HIGH
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
HIGH
CVE-2026-24842EPSS 0.0%
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
HIGH
CVE-2026-24778
Ghost vulnerable to XSS via malicious Portal preview links
CRITICAL
CVE-2026-23830
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
CRITICAL
CVE-2026-1470
n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
CRITICAL
CVE-2026-22709
vm2 has a Sandbox Escape
CRITICAL
CVE-2026-22696
dcap-qvl has Missing Verification for QE Identity
MEDIUM
CVE-2025-13465EPSS 0.0%
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
HIGH
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
CRITICAL
CVE-2026-23966
sm-crypto Affected by Private Key Recovery in SM2-PKE
HIGH
CVE-2026-23950EPSS 0.0%
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
CRITICAL
CVE-2026-23947
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
CRITICAL
CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
HIGH
CVE-2026-23745EPSS 0.0%
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
CRITICAL
CVE-2026-23744
REC in MCPJam inspector due to HTTP Endpoint exposes
HIGH
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
HIGH
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
CRITICAL
CVE-2026-22686
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain
CRITICAL
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
HIGH
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
CRITICAL
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
HIGH
CVE-2026-22610
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
HIGH
GHSA-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
CRITICAL
CVE-2025-61686
React Router has Path Traversal in File Session Storage
HIGH
CVE-2026-22028
Preact has JSON VNode Injection issue
CRITICAL
CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
HIGH
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
HIGH
CVE-2025-9611
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
CRITICAL
CVE-2026-21877
n8n Vulnerable to RCE via Arbitrary File Write
CRITICAL
CVE-2026-21440
AdonisJS Path Traversal in Multipart File Handling
CRITICAL
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
CRITICAL
CVE-2025-66398
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
CRITICAL
CVE-2025-13158
apidoc-core has a prototype pollution vulnerability
CRITICAL
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
HIGH
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
CRITICAL
CVE-2025-68613KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
HIGH
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
MEDIUM
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
HIGH
CVE-2025-67779
Denial of Service Vulnerability in React Server Components
HIGH
CVE-2025-55184
Denial of Service Vulnerability in React Server Components
CRITICAL
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
CRITICAL
CVE-2025-65964
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
CRITICAL
CVE-2025-55182KEV
React Server Components are Vulnerable to RCE
HIGH
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
CRITICAL
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL