Browse CVEs by Ecosystem and Severity

Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL

@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters

Parse Server has role escalation and CLP bypass via direct `_Join` table write

Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter

Feathers has an OAuth Callback Account Takeover issue

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

Parse Server: SQL injection via dot-notation field name in PostgreSQL

OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline

Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

n8n: Expression Sandbox Escape Leads to RCE

n8n has Arbitrary Command Execution via File Write and Git Operations

n8n has Potential Remote Code Execution via Merge Node

n8n has a Sandbox Escape in its JavaScript Task Runner

n8n has Unauthenticated Expression Evaluation via Form Node

Parse Dashboard is Missing Authorization for its Agent Endpoint

Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud)

Parse Dashboard has incomplete authentication on AI Agent endpoint

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

@enclave-vm/core is vulnerable to Sandbox Escape

FUXA has JWT Authentication Bypass via HTTP Referer header spoofing

OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Prototype pollution in swiper

Ghost has a SQL injection in Content API

OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)

Nextcloud Talk allowlist bypass via actor.name display name spoofing

OpenClaw has a potential access-group authorization bypass if channel type lookup fails

OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated

set-in Affected by Prototype Pollution

CASL Ability is Vulnerable to Prototype Pollution

FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses

@nyariv/sandboxjs has a Sandbox Escape vulnerability

@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution