Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-57131
PraisonAI: Jobs API exposes agent-execution endpoints with no authentication
CRITICAL
CVE-2026-57127
praisonai: recipe serve auth middleware silently disables itself when no secret is set
CRITICAL
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
CRITICAL
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
CRITICAL
CVE-2026-55742
Cotonti: Cross-Site Request Forgery in the administration rights handler
CRITICAL
CVE-2026-55518
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
CRITICAL
CVE-2026-55471
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
CRITICAL
CVE-2026-55450
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
CRITICAL
CVE-2026-50203
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
CRITICAL
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
CRITICAL
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
CRITICAL
CVE-2026-49980
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
CRITICAL
CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection
CRITICAL
CVE-2026-54157
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
CRITICAL
CVE-2026-56260
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
CRITICAL
CVE-2026-53753
Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API
CRITICAL
CVE-2026-48519
Langflow: Unauthenticated RCE in Shareable Playgrounds
CRITICAL
CVE-2026-50880
YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution
CRITICAL
CVE-2026-50886
Project Firefly III has incorrect access control in the webhook management component
CRITICAL
CVE-2026-50887
shlink has a Server-Side Request Forgery issue
CRITICAL
CVE-2026-39006
SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component
CRITICAL
CVE-2026-30120
Remotion: remote code execution (RCE) vulnerability
CRITICAL
CVE-2026-30121
Remotion: arbitrary file write vulnerability
CRITICAL
CVE-2026-54257
Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
CRITICAL
CVE-2026-53633
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
CRITICAL
CVE-2026-11624
MCP Toolbox for Databases has an Origin Validation Error
CRITICAL
CVE-2026-45833
ChromaDB has a code injection vulnerability
CRITICAL
CVE-2026-48150
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
CRITICAL
CVE-2026-44172
CRITICAL
CVE-2026-50632
Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
CRITICAL
CVE-2026-50633
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
CRITICAL
CVE-2026-50627
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
CRITICAL
CVE-2026-50628
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
CRITICAL
CVE-2026-49875
Apache CXF has Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
CRITICAL
CVE-2026-48039
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
CRITICAL
CVE-2026-48063
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
CRITICAL
CVE-2026-53471
Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation
CRITICAL
CVE-2026-53469
Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API
CRITICAL
CVE-2026-53476
Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution
CRITICAL
CVE-2026-53475
Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication
CRITICAL
CVE-2026-53470
Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs
CRITICAL
CVE-2026-53474
Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands
CRITICAL
CVE-2026-48031
Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery
CRITICAL
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
CRITICAL
CVE-2026-47724
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
CRITICAL
CVE-2026-47252
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
CRITICAL
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
CRITICAL
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
CRITICAL
CVE-2026-47744
Shopper: Authorization bypass and RBAC privilege escalation in team settings