Browse CVEs by Ecosystem and Severity
596 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-2635
MLflow Use of Default Password Authentication Bypass Vulnerability
HIGH
CVE-2026-27194
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint
CRITICAL
CVE-2026-26030
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
CRITICAL
CVE-2025-14009
NLTK has a Zip Slip Vulnerability
CRITICAL
CVE-2026-21531
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
CRITICAL
CVE-2026-1709
Keylime Missing Authentication for Critical Function and Improper Authentication
CRITICAL
CVE-2026-25592
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
CRITICAL
CVE-2026-25632
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
CRITICAL
CVE-2025-64712
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
HIGH
CVE-2026-1287
Django has an SQL Injection issue
HIGH
CVE-2026-1207
Django has an SQL Injection issue
CRITICAL
CVE-2026-25505
Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
HIGH
CVE-2026-53874
picklescan missing detection by simple obfuscation of a `builtins.eval` call
CRITICAL
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
CRITICAL
CVE-2026-22778
vLLM has RCE In Video Processing
CRITICAL
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
CRITICAL
CVE-2026-25130
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
HIGH
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
MEDIUM
CVE-2020-36962
Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field
CRITICAL
CVE-2026-22696
dcap-qvl has Missing Verification for QE Identity
HIGH
CVE-2026-0770
Langflow affected by Remote Code Execution via validate_code() exec()
CRITICAL
CVE-2026-26216
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
CRITICAL
CVE-2026-22584
Salesforce Uni2TS has a Code Injection vulnerability
HIGH
CVE-2026-22612
Fickling vulnerable to detection bypass due to "builtins" blindness
HIGH
CVE-2026-22609
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
HIGH
CVE-2026-22608
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
HIGH
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
HIGH
CVE-2026-22606
Fickling has a bypass via runpy.run_path() and runpy.run_module()
CRITICAL
CVE-2025-61492
terminal-controller-mcp vulnerable to Command Injection
HIGH
CVE-2026-21445
Langflow Missing Authentication on Critical API Endpoints
HIGH
CVE-2025-71367
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
HIGH
CVE-2025-71375
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
HIGH
CVE-2025-71372
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
HIGH
CVE-2025-71362
Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
HIGH
CVE-2025-71320
Picklescan has Incomplete List of Disallowed Inputs
HIGH
CVE-2025-71323
Picklescan does not block ctypes
HIGH
CVE-2025-71321
Picklescan vulnerable to Arbitrary File Writing
CRITICAL
CVE-2025-14931
Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
CRITICAL
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
MEDIUM
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
MEDIUM
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
CRITICAL
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
MEDIUM
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
CRITICAL
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
CRITICAL
CVE-2025-65896
asyncmy is vulnerable to SQL injection via crafted dict keys
HIGH
CVE-2025-12060
Keras Directory Traversal Vulnerability
CRITICAL
CVE-2025-34351
Ray's New Token Authentication is Disabled By Default
CRITICAL
CVE-2025-62593
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack
CRITICAL
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
CRITICAL
CVE-2025-55449
AstrBot is vulnerable to RCE with hard-coded JWT signing keys