Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-49444
n8n: Python sandbox escape
CRITICAL
CVE-2026-50880
YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution
CRITICAL
CVE-2026-30120
Remotion: remote code execution (RCE) vulnerability
CRITICAL
CVE-2026-30121
Remotion: arbitrary file write vulnerability
CRITICAL
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
CRITICAL
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
HIGH
CVE-2026-50556
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
MEDIUM
CVE-2026-53632
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
HIGH
CVE-2026-50168
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
CRITICAL
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
HIGH
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
CRITICAL
CVE-2026-48063
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
HIGH
CVE-2026-48034
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
HIGH
CVE-2026-48033
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
HIGH
CVE-2026-11572
degit has a Command Injection issue
CRITICAL
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
HIGH
CVE-2026-47761
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
HIGH
CVE-2026-47762
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
HIGH
CVE-2026-47759
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
HIGH
CVE-2026-47760
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
HIGH
CVE-2026-48017
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
CRITICAL
CVE-2026-47670
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
CRITICAL
CVE-2026-47669
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
CRITICAL
CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
HIGH
CVE-2026-49143
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
CRITICAL
CVE-2026-47428
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
CRITICAL
CVE-2026-47429
When Vitest UI server is listening, arbitrary file can be read and executed
HIGH
CVE-2026-47139
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
CRITICAL
CVE-2026-47140
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
CRITICAL
CVE-2026-47210
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
CRITICAL
CVE-2026-47137
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
HIGH
CVE-2026-47209
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
HIGH
CVE-2026-47135
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
CRITICAL
CVE-2026-47208
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
CRITICAL
CVE-2026-47131
vm2 has a Sandbox Escape issue
HIGH
CVE-2026-44494
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
HIGH
CVE-2026-44492
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
HIGH
CVE-2026-48527
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
CRITICAL
CVE-2026-45618
LiquidJS is Vulnerable to Remote Code Execution
HIGH
CVE-2026-44974
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
HIGH
CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
HIGH
CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
HIGH
CVE-2026-42089
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
HIGH
CVE-2026-28445
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
CRITICAL
CVE-2026-46703
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
CRITICAL
CVE-2026-46695
BoxLite: Permission Bypass Allows Modification of Read-Only Files
HIGH
CVE-2026-46681
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
CRITICAL
CVE-2026-82856
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
HIGH
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
CRITICAL
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm