Browse CVEs by Ecosystem and Severity

openhole-server vulnerable to path traversal via URL-decoded request path

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

OAuth: Cross-origin token-request redirects can expose signed request metadata

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

lettre has TLS hostname verification disabled when using Boring TLS backend

WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

Shescape: Shell injection via unescaped parentheses on Windows with CMD

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: SQL Injection via `multipleStatements: true`

Budibase: Privilege escalation via public role assignment API missing app-level authorization

react-server-dom: Denial of Service in Server Functions

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds

ImageMagick: Heap Buffer Over-Write in fx operation

ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided

Trix: Stored XSS via HTMLParser attribute injection on paste

Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator

Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator

Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection

ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified

ImageMagick: Memory Leak in ICON decoder when allocation fails

ImageMagick: Memory leak in VIFF encoder when allocation fails

ImageMagick: Memory Leak in MIFF encoder when allocaton fails

ImageMagick: Memory Leak in YUV decoder when opening of blob fails