Browse CVEs by Ecosystem and Severity

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Orval: Import-time RCE via schema default -> zod module-level template literal

Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise RCE via SQLite Record Manager Node

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise RCE via TypeORM DataSource

Sequelize: SQL Injection (Oracle DB)

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Shescape: Shell injection via unescaped parentheses on Windows with CMD

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: SQL Injection via `multipleStatements: true`

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

websocket-driver: Message corruption via abuse of protocol length headers

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

SAP Approuter Vulnerable to HTTP Request Smuggling

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints