Browse CVEs by Ecosystem and Severity

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: SQL Injection via `multipleStatements: true`

Budibase: Privilege escalation via public role assignment API missing app-level authorization

react-server-dom: Denial of Service in Server Functions

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Trix: Stored XSS via HTMLParser attribute injection on paste

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

n8n: Authenticated code execution in the n8n Git node

n8n: SSRF Protection Bypass via MCP Client Node

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

SVGO removeScripts plugin leaves some executable scripts intact

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Directus: Authorization-dependent response served from unsegmented cache key

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Prompty: Arbitrary file read via file reference expansion

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

websocket-driver: Message corruption via abuse of protocol length headers

TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

SAP Approuter Vulnerable to HTTP Request Smuggling

@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

Decompress: Archive extraction can create files and links outside of the target directory