Browse CVEs by Ecosystem and Severity

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

Decompress: Archive extraction can create files and links outside of the target directory

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

9router: Missing Authorization and OS Command Injection

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

deepstream is vulnerable to prototype pollution

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Budibase has nonymous NoSQL operator injection via published-app query templates

expr-eval vulnerable to Code Execution

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

scimPatch vulnerable to prototype pollution via unfiltered keys in patch

Network-AI: Improper Neutralization of Special Elements used in an OS Command

Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

@acastellon/auth: Authentication bypass via spoofable headers in validateToken()

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

npm PraisonAI codeMode sandbox escape via Function constructor

LobeHub: Unauthenticated SSRF in `/webapi/proxy`

YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

Remotion: remote code execution (RCE) vulnerability

Remotion: arbitrary file write vulnerability

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

When Vitest UI server is listening, arbitrary file can be read and executed

NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

vm2 is Vulnerable to Sandbox Breakout Through Promise Species

vm2 has a Sandbox Escape issue

LiquidJS is Vulnerable to Remote Code Execution

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

BoxLite: Permission Bypass Allows Modification of Read-Only Files

@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

HAXcms: Private Key Disclosure via Broken HMAC Implementation