Browse CVEs by Ecosystem and Severity

rpc.py vulnerable to Deserialization of Untrusted Data

Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control

Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely

wger vulnerable to brute force attempts

Server-Side Request Forgery in calibreweb

SQL injection in calibreweb

Server-Side Request Forgery in calibreweb

Cobbler has Exposed Dangerous Method or Function

Cobbler vulnerable to arbitrary code execution

Cobbler Improper Validation of Security Tokens

OpenStack Murano Code Execution

OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

OpenStack Nova logs sensitive context from notification exceptions

OpenStack Octavia Amphora-Agent not requiring Client-Certificate

Openstack Magnum Unsafe Credential Handling

OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning

Plone Unauthenticated Write Vulnerability

Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

ReviewBoard and Djblets library are vulnerable to code execution

OpenStack Object Storage (swift) Code Injection vulnerability

web2py is vulnerable to password brute-force attack

web2py remote code execution via hardcoded encryption key in session.connect function

mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

python-statemachine SCXML <data expr> Eval Injection

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation

PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

LiteLLM: Authentication Bypass via Host Header Injection

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Langflow: Unauthenticated RCE in Shareable Playgrounds

ChromaDB has a code injection vulnerability

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token