Browse CVEs by Ecosystem and Severity

nimiq-blockchain is missing a wall-clock upper bound on block timestamps

PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

PraisonAI has critical RCE via `type: job` workflow YAML

PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`

PraisonAI Vulnerable Untrusted Remote Template Code Execution

LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf

LXD: Importing a crafted backup leads to project restriction bypass

LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin

Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access

parisneo/lollms vulnerable to stored XSS in the social feature

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

PraisonAI Vulnerable to OS Command Injection

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Emissary has GitHub Actions Shell Injection via Workflow Inputs

Memory-safety vulnerability in github.com/jackc/pgx/v5.

pgx contains memory-safety vulnerability

OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

LoLLMs is vulnerable to Improper Access Control through weak secret key

changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering

CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

SandboxJS: Sandbox integrity escape

Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Axios npm Supply Chain Incident Impacting @usebruno/cli

Agno is vulnerable to Eval Injection

Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster

PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code