Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-41316
ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
HIGH
CVE-2026-41246
Contour has Lua code injection via Cookie Path Rewrite Policy
HIGH
CVE-2026-41044
Apache ActiveMQ Vulnerable to Code Injection
HIGH
CVE-2026-40466
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
HIGH
CVE-2026-41900
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
HIGH
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
HIGH
CVE-2026-33318
Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
HIGH
CVE-2026-42084
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
HIGH
CVE-2026-41676
rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
HIGH
CVE-2026-41678
rust-openssl has incorrect bounds assertion in aes key wrap
HIGH
CVE-2026-41681
rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
HIGH
CVE-2026-41898
rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
HIGH
CVE-2026-41644
monetr: Server-side request forgery in Lunch Flow link creation and refresh
HIGH
CVE-2026-40937
RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks
HIGH
CVE-2026-34065
nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals
HIGH
CVE-2026-35352
uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition
HIGH
CVE-2026-35368
uutils coreutils has an Untrusted Search Path
HIGH
CVE-2026-41422
Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API
HIGH
CVE-2026-40938
Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
HIGH
CVE-2026-40488
OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
HIGH
CVE-2026-40161
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
HIGH
CVE-2026-39861
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
HIGH
CVE-2026-39386
Neko has a Self-service Privilege Escalation for Authenticated Users
HIGH
CVE-2026-31018
Dolibarr Allows Code Injection through its Website Module
HIGH
CVE-2026-31019
Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions
HIGH
CVE-2026-41490
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
HIGH
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
HIGH
CVE-2026-40880
Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
HIGH
CVE-2026-41247
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
HIGH
CVE-2026-41433
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
HIGH
CVE-2026-41491
Dapr: Service Invocation path traversal ACL bypass
HIGH
CVE-2026-43530
OpenClaw: busybox and toybox applet execution weakened exec approval binding
HIGH
CVE-2026-42434
OpenClaw: Sandboxed agents could escape exec routing via host=node override
HIGH
CVE-2026-43569
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
HIGH
CVE-2026-43571
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
HIGH
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
HIGH
CVE-2026-41277
Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
HIGH
CVE-2026-3505
Bouncy Castle Uncontrolled Resource Consumption vulnerability
HIGH
CVE-2026-5598
Bouncy Castle Has Covert Timing Channel Vulnerability
HIGH
GHSA-f5v8-v6q3-q4h6
Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)
HIGH
CVE-2026-41208
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
HIGH
CVE-2026-41427
OAuth 2.1 Provider: Unprivileged users can register OAuth clients
HIGH
CVE-2026-41423
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
HIGH
CVE-2026-41276
Flowise: resetPassword Authentication Bypass Vulnerability
HIGH
CVE-2026-41274
Flowise: Cypher Injection in GraphCypherQAChain
HIGH
CVE-2026-40308
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar
HIGH
CVE-2026-41883
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
HIGH
CVE-2026-40611
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
HIGH
CVE-2026-41175
Statamic: Unsafe method invocation via query value resolution allows data destruction
HIGH
CVE-2026-41304
WWBN AVideo: RCE cause by clonesite plugin