Browse CVEs by Ecosystem and Severity

Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise RCE via SQLite Record Manager Node

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise RCE via TypeORM DataSource

Sequelize: SQL Injection (Oracle DB)

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Russh: Channel-scoped server callbacks can be reached without an open channel

Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

guard-livereload has a directory traversal vulnerability

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow

Savon::Model evaluates WSDL operation names as Ruby source

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Wings exposes node configuration secrets through egg configuration-file templating

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

Logging operator has Fluentd configuration injection that allows remote code execution

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Pagy I18n locale option is not validated before being used in a file path

Style Dictionary - Prototype Pollution in convertTokenData utility function