Browse CVEs by Ecosystem and Severity

Arbitrary code execution in protobufjs

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

electerm: electerm_install_script_CommandInjection Vulnerability Report

Flowise: Authenticated RCE Via MCP Adapters

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

Fastify's connection header abuse enables stripping of proxy-added headers

@vendure/core has a SQL Injection vulnerability

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

SandboxJS: Sandbox integrity escape

Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Axios npm Supply Chain Incident Impacting @usebruno/cli

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

parse-server has cloud function validator bypass via prototype chain traversal

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

MikroORM is vulnerable to SQL Injection via specially crafted object

OpenClaw: Silent privilege escalation via gateway shared-auth reconnect

OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

Handlebars.js has JavaScript Injection via AST Type Confusion

OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve

Convict has Prototype Pollution via startsWith() function

Convict has prototype pollution via load(), loadFile(), and schema initialization

n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE

n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter

textract is vulnerable to OS Command Injection

thumbler allows OS Command Injection

pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation

ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

jsPDF has HTML Injection in New Window paths

OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

OneUptime ClickHouse SQL Injection via Aggregate Query Parameters

Locutus vulnerable to RCE via unsanitized input in create_function()

OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE

OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

SandboxJS affected by a Sandbox Escape

TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS