Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-50276
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
HIGH
CVE-2026-50273
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
MEDIUM
CVE-2026-54497
ViewComponent: Reused Component Instances Retain Stale Render Context
HIGH
CVE-2026-54498
ViewComponent: around_render HTML-Safety Bypass
CRITICAL
CVE-2026-54466
websocket-driver: Message corruption via abuse of protocol length headers
MEDIUM
CVE-2026-54465
websocket-driver: Memory exhaustion in HTTP header parser
MEDIUM
CVE-2026-54464
websocket-driver: Resource limit bypass via message compression
MEDIUM
CVE-2026-54463
websocket-driver: Memory exhaustion via abuse of protocol length headers
CRITICAL
CVE-2026-52881
MantisBT: Reflected XSS in admin/install.php via unescaped printf
CRITICAL
CVE-2026-52847
MantisBT: Reflected XSS in admin/install.php
CRITICAL
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
HIGH
CVE-2026-54628
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
CRITICAL
CVE-2026-14722
TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution
CRITICAL
CVE-2026-54052
n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments
CRITICAL
CVE-2026-50006
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
HIGH
CVE-2026-50131
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
CRITICAL
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
HIGH
CVE-2026-44300
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
CRITICAL
CVE-2026-27690
SAP Approuter Vulnerable to HTTP Request Smuggling
CRITICAL
CVE-2026-47677
FacturaScripts: Account takeover of any 2FA-enabled user
HIGH
CVE-2026-49970
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
CRITICAL
CVE-2026-61667
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
HIGH
CVE-2026-54065
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
HIGH
CVE-2026-54064
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
HIGH
CVE-2026-49259
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
HIGH
CVE-2026-48118
NukeViet: Unauthenticated Reflected XSS in Comment Module
CRITICAL
CVE-2026-45579
DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
MEDIUM
CVE-2026-45573
Decidim: Push subscriptions can be abused for server-side requests
MEDIUM
CVE-2026-45572
Decidim: HTML content blocks allow stored script execution
MEDIUM
CVE-2026-45415
Decidim: CSV census record endpoints improper authorization
HIGH
CVE-2026-45414
Decidim: JWT-backed authentication can be replayed across organizations
HIGH
CVE-2026-45378
Decidim: Verification documents can be downloaded through reusable links
MEDIUM
CVE-2026-45377
Decidim: Private exports can be downloaded through reusable links
MEDIUM
CVE-2026-45376
Decidim: Admin user search allows SQL injection through similarity-based sorting
MEDIUM
CVE-2026-45330
Decidim: Verification admins can access supplied IDs from other organizations
MEDIUM
CVE-2026-45086
Decidim: Forms admin question editor lacks authorization
CRITICAL
CVE-2026-35175
Ajenti has an authorization bypass during custom package installation
CRITICAL
CVE-2026-2472
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
HIGH
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
CRITICAL
CVE-2026-61459
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials
MEDIUM
CVE-2026-54171
Excon does not redact additional sensitive/risky headers when following redirects
MEDIUM
CVE-2026-54163
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CRITICAL
CVE-2026-50551
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content
CRITICAL
CVE-2026-54159
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CRITICAL
CVE-2026-54158
SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()
CRITICAL
CVE-2026-54088
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
CRITICAL
CVE-2026-54089
File Browser: Authentication Bypass via Proxy Auth Header Forgery
CRITICAL
CVE-2026-54072
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
CRITICAL
CVE-2026-54067
SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet()
CRITICAL
CVE-2026-52778
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service