Browse CVEs by Ecosystem and Severity
324 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
HIGH
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
HIGH
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
HIGH
CVE-2026-22610
Angular has XSS Vulnerability via Unsanitized SVG Script Attributes
HIGH
GHSA-96qw-h329-v5rg
Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles
HIGH
CVE-2026-22028
Preact has JSON VNode Injection issue
HIGH
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
HIGH
CVE-2025-9611
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
HIGH
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
HIGH
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
HIGH
CVE-2025-67779
Denial of Service Vulnerability in React Server Components
HIGH
CVE-2025-55184
Denial of Service Vulnerability in React Server Components
HIGH
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
HIGH
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
HIGH
CVE-2025-66035
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
HIGH
CVE-2025-65966
OneUptime Unauthorized User Creation via API
HIGH
CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
HIGH
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
HIGH
CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
HIGH
CVE-2025-62726
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
HIGH
CVE-2025-62713
Kottster app reinitialization can be re-triggered allowing command injection in development mode
HIGH
CVE-2025-34267
Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages
HIGH
CVE-2025-71380
n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host
HIGH
CVE-2025-71336
Flowise has unsandboxed remote code execution via Custom MCP
HIGH
CVE-2025-58754EPSS 0.1%
Axios is vulnerable to DoS attack through lack of data size check
HIGH
CVE-2025-59037
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
HIGH
CVE-2025-57820
devalue prototype pollution vulnerability
HIGH
CVE-2025-55164
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
HIGH
CVE-2025-54803
js-toml Prototype Pollution Vulnerability
HIGH
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
HIGH
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity
HIGH
CVE-2025-53110
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
HIGH
CVE-2025-53109
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
HIGH
CVE-2025-6087
OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint
HIGH
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
HIGH
CVE-2024-38988
@alizeait/unflatto Prototype Pollution
HIGH
CVE-2024-38985
depath and cool-path vulnerable to Prototype Pollution via `set()` Method
HIGH
CVE-2025-25977
canvg Prototype Pollution vulnerability
HIGH
CVE-2025-27597
Vue I18n Allows Prototype Pollution in `handleFlatJson`
HIGH
CVE-2025-27152EPSS 0.1%
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
HIGH
CVE-2025-26319
FlowiseAI Flowise arbitrary file upload vulnerability
HIGH
CVE-2025-1302
JSONPath Plus allows Remote Code Execution
HIGH
CVE-2024-56734
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
HIGH
CVE-2024-56159
Astro's server source code is exposed to the public if sourcemaps are enabled
HIGH
CVE-2024-53900
Mongoose search injection vulnerability
HIGH
CVE-2024-47875
DOMpurify has a nesting-based mXSS
HIGH
CVE-2024-46488
Heap-based Buffer Overflow in sqlite-vec
HIGH
CVE-2024-43414
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
HIGH
CVE-2024-40453
squirrelly Code Injection vulnerability
HIGH
CVE-2024-39338EPSS 2.9%
Server-Side Request Forgery in axios