Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
LOW
CVE-2026-61867
ImageMagick: Memory Leak in TIFF encoder when an allocation fails
LOW
CVE-2026-61866
ImageMagick: Memory Leak in JNG encoder when a blob could not be opened
LOW
CVE-2026-61865
ImageMagick: Memory Leak in hough lines operation when an operation fails
LOW
CVE-2026-61864
ImageMagick: Memory Leak in color transformation to log colorspace when operation fails
LOW
CVE-2026-61863
ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.
LOW
CVE-2026-61862
ImageMagick: Information Disclosure when printing profiles with debug enabled
LOW
CVE-2026-61861
ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
LOW
CVE-2026-61860
ImageMagick: Use-After-Free when freetype initialization fails
LOW
CVE-2026-61859
ImageMagick: Policy Bypass in script operation due to missing checks
LOW
CVE-2026-61858
ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
LOW
CVE-2026-61857
ImageMagick: Heap-use-after-free via XMP profile could result in a crash
MEDIUM
GHSA-hc76-7mpc-qjqh
ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
LOW
CVE-2026-61465
ImageMagick: Policy Bypass possible with matrix-backed operations
HIGH
CVE-2026-25800
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
MEDIUM
CVE-2026-55628
ImageMagick: Policy Bypass in concatenate operation due to missing checks
MEDIUM
CVE-2026-55597
ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
MEDIUM
CVE-2026-55595
ImageMagick: Infinite Loop in connected-components when providing invalid arguments
MEDIUM
CVE-2026-55594
ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
MEDIUM
CVE-2026-55510
ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
MEDIUM
CVE-2026-53467
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
HIGH
CVE-2026-59933
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
HIGH
CVE-2026-59932
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
HIGH
CVE-2026-59931
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CRITICAL
CVE-2026-73421
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
CRITICAL
CVE-2026-73420
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
CRITICAL
CVE-2026-16723
fastjson has a remote code execution (RCE) vulnerability
MEDIUM
CVE-2026-72750
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
MEDIUM
CVE-2026-72775
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
MEDIUM
CVE-2026-72764
n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner
HIGH
CVE-2026-73417
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
HIGH
CVE-2026-64645
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
HIGH
CVE-2026-10050
Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution
MEDIUM
CVE-2026-65590
n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows
MEDIUM
CVE-2026-59257
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
HIGH
CVE-2026-72763
n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
HIGH
CVE-2026-72774
n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
HIGH
CVE-2026-72765
n8n: Expression sandbox escape via arrow-function bodies enabling command execution
HIGH
CVE-2026-72767
n8n: Authenticated code execution in the n8n Git node
MEDIUM
CVE-2026-72768
n8n: SSRF Protection Bypass via MCP Client Node
HIGH
CVE-2026-72772
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
HIGH
CVE-2026-65016
n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
HIGH
CVE-2026-65591
n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
MEDIUM
CVE-2026-65593
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
HIGH
CVE-2026-65595
n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
HIGH
CVE-2026-59206
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
HIGH
CVE-2026-65592
n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
HIGH
CVE-2026-65598
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
HIGH
CVE-2026-65015
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
MEDIUM
CVE-2026-73648
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
LOW
CVE-2026-73492
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons