Browse CVEs by Ecosystem and Severity

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

Handlebars: JavaScript Injection via Own Property Check Bypass

Payload Form Builder has an RCE issue

Payload: Unauthorized update to collection documents

Payload authentication token field handling issue

vm2 contains a sandbox escape vulnerability

Backstage: Sensitive information exposure in Scaffolder

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Payload: Prototype pollution in Payload Import Export plugin

Payload: SQL Injection in SQLite and Postgres

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

vm2: NodeVM custom resolution bypasses external path boundaries

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool: Prototype Pollution Gadget to RCE in run() options

vm2: Sandbox Escape (NodeVM)

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

vm2 crypto builtin loads attacker native code through setEngine

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

vm2 NodeVM can replace the host process TLS trust store

@xhmikosr/decompress: Path traversal via symlink chain

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

SunEditor: Critical XSS vulnerability - sanitizer bypass

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

yayson: Prototype pollution in Store/LegacyStore deserialization

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning