Browse CVEs by Ecosystem and Severity

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Nx: Zip-Slip in the self-hosted remote cache

Mermaid Architecture diagrams are vulnerable to prototype pollution

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise RCE via SQLite Record Manager Node

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise RCE via TypeORM DataSource

Sequelize: SQL Injection (Oracle DB)

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

Style Dictionary - Prototype Pollution in convertTokenData utility function

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Shescape: Shell injection via unescaped parentheses on Windows with CMD