Browse CVEs by Ecosystem and Severity

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

9router: Missing Authorization and OS Command Injection

electerm has Command Injection in File System Operations (rmrf, mv, cp)

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

OpenClaw: Matrix allowFrom could bind to mutable display names

OpenClaw: Combined POSIX shell options could confuse exec revalidation

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

OpenClaw: Node pairing reconnection could confuse approval scope state

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

OpenClaw: Shell wrapper argv could change between approval and execution

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

deepstream is vulnerable to prototype pollution

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Budibase has nonymous NoSQL operator injection via published-app query templates

expr-eval vulnerable to Code Execution

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

scimPatch vulnerable to prototype pollution via unfiltered keys in patch

jupyterlab-git extension: Stored XSS leading to RCE

Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

Network-AI: Improper Neutralization of Special Elements used in an OS Command

Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests

gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

@acastellon/auth: Authentication bypass via spoofable headers in validateToken()

npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

npm PraisonAI AgentLoop onToolCall approval runs after tool execution

npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call

npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

npm PraisonAI codeMode sandbox escape via Function constructor

OpenClaw: Pairing-scoped device session could restore revoked node token authority

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

n8n: Credential Exfiltration via Permission Bypass

LobeHub: Unauthenticated SSRF in `/webapi/proxy`

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes