Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2026-73490
Loofah: SVG `href` attribute bypasses local-reference restriction
HIGH
CVE-2026-27775
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
CRITICAL
CVE-2026-58443
Gitea: Public-only repository tokens can update private PR head branches
CRITICAL
CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
HIGH
CVE-2026-58424
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
CRITICAL
CVE-2026-20896
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
CRITICAL
CVE-2026-22874
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
HIGH
CVE-2026-56654
Gitea: Privilege Escalation via Access Token Scope Escalation in API
CRITICAL
CVE-2026-56750
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
HIGH
CVE-2026-73650
SVGO removeScripts plugin leaves some executable scripts intact
CRITICAL
CVE-2026-73653
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
CRITICAL
CVE-2026-59891
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
HIGH
CVE-2026-57894
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
HIGH
CVE-2026-61666
websocket-driver-ruby: Denial of service via malformed Host header
CRITICAL
CVE-2026-64825
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
HIGH
CVE-2026-56170
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50526
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
HIGH
CVE-2026-47300
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
HIGH
CVE-2026-47303
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
HIGH
CVE-2026-50527
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50650
Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
LOW
CVE-2026-73491
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
HIGH
CVE-2026-50651
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
MEDIUM
CVE-2026-50659
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
HIGH
CVE-2026-50525
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50528
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
HIGH
CVE-2026-50648
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50524
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-47304
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
HIGH
CVE-2026-47302
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-57108
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
CRITICAL
CVE-2026-61740
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
CRITICAL
CVE-2026-61736
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
HIGH
CVE-2026-55667
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
MEDIUM
CVE-2026-54570
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
HIGH
CVE-2026-53597
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
HIGH
CVE-2026-53598
Prompty: Arbitrary file read via file reference expansion
HIGH
CVE-2026-27771
Gitea has insufficient permission checks for Composer package source links
HIGH
CVE-2026-67341
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
CRITICAL
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
HIGH
CVE-2026-55578
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
MEDIUM
CVE-2026-18679
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured
HIGH
CVE-2026-54540
Pheditor has an authenticated terminal command whitelist bypass
CRITICAL
CVE-2026-53713
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
MEDIUM
CVE-2026-18678
kumactl connects to control plane without verifying TLS certificate when no CA is configured
CRITICAL
CVE-2026-15925
Snowflake Connector for Python improperly verifies TLS hostnames
CRITICAL
CVE-2025-65720
GPT Researcher MCP STDIO configuration allows remote command execution
HIGH
CVE-2026-54504
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
HIGH
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux