Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-63704
query-parser-string is vulnerable to Prototype Pollution
CRITICAL
CVE-2025-63703
parse-ini is vulnerable to Prototype Pollution in index.js()
CRITICAL
CVE-2025-63706
next-npm-version is vulnerable to Command injection
HIGH
CVE-2025-63705
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
CRITICAL
CVE-2026-44007
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
HIGH
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
CRITICAL
CVE-2026-43999
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
CRITICAL
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
CRITICAL
CVE-2026-43997
vm2 Access to Host Object Enables Sandbox Escape
CRITICAL
CVE-2026-44006
vm2 has a Sandbox Escape Vulnerability
HIGH
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CRITICAL
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
CRITICAL
CVE-2026-42281
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
HIGH
CVE-2026-45006
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
HIGH
CVE-2026-42047
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
CRITICAL
CVE-2026-26956
VM2 Has a WASM Sandbox Escape
CRITICAL
CVE-2026-26332
VM2 Has a Sandbox Escape Issue via SuppressedError
CRITICAL
CVE-2026-24781
VM2 Has Sandbox Breakout Through Inspect Function
CRITICAL
CVE-2026-24120
VM2 Has Sandbox Breakout Through Promise Species
MEDIUM
CVE-2026-44116
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
CRITICAL
CVE-2026-24118
VM2 Sandbox Breakout Through __lookupGetter__
HIGH
CVE-2026-42349
Clerk has an authorization bypass when combining organization, billing, or reverification checks
CRITICAL
CVE-2026-42232
n8n has XML Node Prototype Pollution that to RCE
CRITICAL
CVE-2026-42231
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
HIGH
CVE-2026-42235
n8n Vulnerable to XSS via MCP OAuth client
HIGH
CVE-2026-42226
n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
MEDIUM
CVE-2026-42233
n8n has SQL Injection in Oracle Database Node via Limit Field
HIGH
CVE-2026-6951
simple-git is vulnerable to Remote Code Execution
CRITICAL
CVE-2026-41501
electerm has Command Injection via runLinux funtion
CRITICAL
CVE-2026-12537
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
HIGH
CVE-2026-41900
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
HIGH
CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
CRITICAL
CVE-2026-42076
Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
CRITICAL
CVE-2026-41264
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
HIGH
CVE-2026-39861
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
CRITICAL
CVE-2026-41265
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
CRITICAL
CVE-2026-44109
OpenClaw: Feishu webhook and card-action validation now fail closed
CRITICAL
CVE-2026-41507
Remote Code Execution (RCE) via String Literal Injection into math-codegen
HIGH
CVE-2026-43530
OpenClaw: busybox and toybox applet execution weakened exec approval binding
HIGH
CVE-2026-42434
OpenClaw: Sandboxed agents could escape exec routing via host=node override
HIGH
CVE-2026-43569
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
HIGH
CVE-2026-43571
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
MEDIUM
CVE-2026-43531
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables
MEDIUM
CVE-2026-43534
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input
HIGH
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
MEDIUM
CVE-2026-43566
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events
HIGH
CVE-2026-41277
Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
CRITICAL
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
HIGH
CVE-2026-41208
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
HIGH
CVE-2026-41427
OAuth 2.1 Provider: Unprivileged users can register OAuth clients