Browse CVEs by Ecosystem and Severity
324 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-33409
Parse Server has an auth provider validation bypass on login via partial authData
HIGH
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
HIGH
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
HIGH
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
HIGH
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
HIGH
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
HIGH
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
HIGH
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
HIGH
CVE-2026-32915
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
HIGH
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
HIGH
CVE-2026-31800
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
HIGH
CVE-2026-30948
Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
HIGH
CVE-2026-31861
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
HIGH
CVE-2026-26118
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
HIGH
CVE-2026-30944
StudioCMS has Privilege Escalation via Insecure API Token Generation
HIGH
CVE-2026-32913
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
HIGH
CVE-2026-30823
Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
HIGH
CVE-2026-30820
Flowise has Authorization Bypass via Spoofed x-request-from Header
HIGH
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
HIGH
CVE-2026-28363
OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode
HIGH
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
HIGH
CVE-2026-27904
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
HIGH
CVE-2026-27148
Storybook Dev Server is Vulnerable to WebSocket Hijacking
HIGH
CVE-2026-27606
Rollup 4 has Arbitrary File Write via Path Traversal
HIGH
CVE-2026-27494
n8n has Arbitrary File Read via Python Code Node Sandbox Escape
HIGH
CVE-2026-32060
OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace
HIGH
CVE-2026-26996
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
HIGH
CVE-2026-26318
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
HIGH
CVE-2026-26960EPSS 0.0%
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
HIGH
CVE-2026-29610
OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)
HIGH
CVE-2026-28469
OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting
HIGH
CVE-2026-28470
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes
HIGH
CVE-2026-28391
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
HIGH
CVE-2026-0969
next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content
HIGH
CVE-2026-25639EPSS 0.0%
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
HIGH
CVE-2026-1615
jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions
HIGH
CVE-2026-25055
n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
HIGH
CVE-2026-25051
n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
HIGH
CVE-2025-69983
FUXA allows Remote Code Execution (RCE) via the project import functionality.
HIGH
CVE-2025-69981
FUXA contains an Unrestricted File Upload vulnerability
HIGH
CVE-2025-69970
FUXA contains an insecure default configuration vulnerability
HIGH
CVE-2026-25253
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
HIGH
CVE-2026-24763
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable
HIGH
CVE-2026-23864
React Server Components have multiple Denial of Service Vulnerabilities
HIGH
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
HIGH
CVE-2026-24842EPSS 0.0%
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
HIGH
CVE-2026-24778
Ghost vulnerable to XSS via malicious Portal preview links
HIGH
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
HIGH
CVE-2026-23950EPSS 0.0%
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
HIGH
CVE-2026-23745EPSS 0.0%
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization