Browse CVEs by Ecosystem and Severity

OS Command Injection in Apache Airflow

Apache Airflow Hive Provider vulnerable to Command Injection

Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks

calibre-web is vulnerable to Business Logic Errors

ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function

Openstack Keystone Incorrect Authorization vulnerability

SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely

PaddlePaddle vulnerable to code injection via winstr

WMAgent arbitrary code execution via a crafted dbs-client package

rpc.py vulnerable to Deserialization of Untrusted Data

Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control

Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely

wger vulnerable to brute force attempts

Server-Side Request Forgery in calibreweb

SQL injection in calibreweb

Server-Side Request Forgery in calibreweb

Cobbler has Exposed Dangerous Method or Function

Cobbler vulnerable to arbitrary code execution

Cobbler Improper Validation of Security Tokens

OpenStack Murano Code Execution

OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

OpenStack Nova logs sensitive context from notification exceptions

OpenStack Octavia Amphora-Agent not requiring Client-Certificate

Openstack Magnum Unsafe Credential Handling

OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning

Plone Unauthenticated Write Vulnerability

Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

ReviewBoard and Djblets library are vulnerable to code execution

OpenStack Object Storage (swift) Code Injection vulnerability

web2py is vulnerable to password brute-force attack

web2py remote code execution via hardcoded encryption key in session.connect function

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

jupyterlab-git extension: Stored XSS leading to RCE

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

python-statemachine SCXML <data expr> Eval Injection

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass