Browse CVEs by Ecosystem and Severity

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

awslabs/tough is Missing Delegated Metadata Validation

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

net-imap vulnerable to STARTTLS stripping via invalid response timing

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure

Argo has Missing Authorization in its Sync ConfigMap Provider

Quarkus has Authentication/Authorization bypasses

Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader

phpBB has Password Reset Link Poisoning via Host Header injection

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation

Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection

Admidio Sends SAML Response to Unvalidated Assertion Consumer Service URL from AuthnRequest

Admidio Ignores SAML Signature Validation Result, Processes Forged AuthnRequests and LogoutRequests

n8n Vulnerable to XSS via MCP OAuth client

n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type

Spring AI has SQL Injection in CosmosDBVectorStore.doDelete()

Spring AI has a VectorStore FilterExpression Converter injection

Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

Camel-MINA Vulnerable to Deserialization of Untrusted Data

Cillium exposes sensitive information included in the cilium-bugtool debug archive

zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write

Heimdall has an authorization bypass via path normalization mismatch

Heimdall: Case-sensitive host matching may lead to policy bypass

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

simple-git is vulnerable to Remote Code Execution

Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler