Browse CVEs by Ecosystem and Severity

Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Arbitrary code execution in protobufjs

@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

Flowise: resetPassword Authentication Bypass Vulnerability

Flowise: Cypher Injection in GraphCypherQAChain

Flowise: Code Injection in CSVAgent leads to Authenticated RCE

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

electerm: electerm_install_script_CommandInjection Vulnerability Report

Flowise: Authenticated RCE Via MCP Adapters

Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

@fastify/express's middleware path doubling causes authentication bypass in child plugin scopes

Fastify's connection header abuse enables stripping of proxy-added headers

Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

@vendure/core has a SQL Injection vulnerability

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

React Server Components have a Denial of Service Vulnerability

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

Directus: Missing Cross-Origin Opener Policy

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

Budibase: Command Injection in Bash Automation Step

SandboxJS: Sandbox integrity escape

Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Axios npm Supply Chain Incident Impacting @usebruno/cli

@payloadcms/next has Stored XSS in Admin Panel

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

OpenClaw: Zalo channel downloads media before sender authorization

OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

parse-server has cloud function validator bypass via prototype chain traversal

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node