Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-56274
Flowise has an MCP Security Bypass that Enables RCE
HIGH
CVE-2026-41249
CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration
HIGH
CVE-2026-45137
Anchor: Program<'info, System> is not properly validated
HIGH
CVE-2026-44697
Klever-Go MultiDataInterceptor has remote OOM via crafted compressed P2P payload
HIGH
CVE-2026-7474
HashiCorp Nomad vulnerable to a path traversal
HIGH
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive
HIGH
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure
HIGH
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
HIGH
CVE-2026-45089
Dalfox Server Mode has an Unauthenticated Arbitrary File Create/Append via `output` Option
HIGH
CVE-2026-44295
protobuf.js: Code injection in pbjs static output from crafted schema names
HIGH
CVE-2026-44293
protobuf.js: Code injection through bytes field defaults in generated toObject code
HIGH
CVE-2026-41713
Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor
HIGH
CVE-2026-41712
Spring AI: ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
HIGH
CVE-2026-40596
MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference
HIGH
CVE-2026-44543
Local Path Provisioner Vulnerable to HelperPod Template Injection
HIGH
CVE-2026-44521
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
HIGH
CVE-2026-44578
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
HIGH
CVE-2026-23870
Facebook React has a Denial of Service Vulnerability in React Server Components
HIGH
CVE-2026-44985
Dozzle's Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpointsbypasses authentication
HIGH
CVE-2026-42595
Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass
HIGH
CVE-2026-41705
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs
HIGH
CVE-2026-44895
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
HIGH
CVE-2026-44983
smallbitvec: Integer overflow in safe API leads to heap buffer overflow
HIGH
CVE-2026-44832
Snipe-IT has Privilege Escalation via API Permissions Assignment
HIGH
CVE-2026-44499
Zebra has Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning
HIGH
CVE-2026-43943
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
HIGH
CVE-2026-43941
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click
HIGH
CVE-2026-39816
Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
HIGH
CVE-2025-63705
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
HIGH
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
HIGH
CVE-2026-44511
katalyst-koi: Session cookies can be replayed after user logout
HIGH
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
HIGH
CVE-2026-25705
Rancher Extensions have arbitrary file access via path traversal
HIGH
CVE-2026-44471
gix-fs: Symlink prefix-reuse allows worktree escape during checkout
HIGH
CVE-2026-46689
scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion
HIGH
CVE-2026-44375
Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
HIGH
CVE-2026-44335
PraisonAI has an SSRF bypass
HIGH
CVE-2026-42559
rmcp Streamable HTTP server transport has a DNS rebinding vulnerability
HIGH
CVE-2026-42557
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content
HIGH
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
HIGH
CVE-2026-42548
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
HIGH
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
HIGH
CVE-2026-44302
Snappier has an infinite loop during SnappyStream decompression with malformed framed input
HIGH
CVE-2025-71261
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
HIGH
CVE-2026-79770
Nokogiri CSS selector tokenizer has regular expression backtracking
HIGH
CVE-2026-42327
rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
HIGH
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
HIGH
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
HIGH
CVE-2026-42612
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
HIGH
CVE-2026-42843
Grav API Privilege Escalation to Super Admin