Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-33166
Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers)
HIGH
CVE-2026-33001
Jenkins has a link following vulnerability allows arbitrary file creation
HIGH
CVE-2026-22730
SQL Injection in Spring AI MariaDBFilterExpressionConverter
HIGH
CVE-2026-22729
JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
HIGH
CVE-2026-33039
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
HIGH
CVE-2026-4208
Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)
HIGH
CVE-2026-32756
File Upload(RCE) Vulnerability in admidio
HIGH
CVE-2026-32829
lz4_flex's decompression can leak information from uninitialized memory or reused output buffer
HIGH
CVE-2026-32769
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace
HIGH
CVE-2026-32805
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
HIGH
CVE-2026-32771
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
HIGH
CVE-2026-32737
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
HIGH
CVE-2026-32768
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
HIGH
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
HIGH
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
HIGH
CVE-2026-24458
Mattermost fails to properly handle very long passwords
HIGH
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerability
HIGH
CVE-2026-32720
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control
HIGH
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
HIGH
CVE-2026-32933
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
HIGH
CVE-2026-32640
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox
HIGH
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
HIGH
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
HIGH
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
HIGH
GHSA-8fh9-c4jq-94h4
idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability
HIGH
CVE-2026-32600
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
HIGH
CVE-2026-32314
Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145
HIGH
CVE-2026-32260
Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process
HIGH
CVE-2026-31814
Yamux vulnerable to remote Panic via malformed WindowUpdate credit
HIGH
CVE-2026-32915
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
HIGH
CVE-2026-32129
Poseidon V1 variable-length input collision via implicit zero-padding
HIGH
CVE-2026-32246
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
HIGH
CVE-2026-32232
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
HIGH
CVE-2026-32231
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
HIGH
CVE-2026-32110
SiYuan has a Full-Read SSRF via /api/network/forwardProxy
HIGH
CVE-2026-30929
ImageMagick has stack buffer overflow in MagnifyImage
HIGH
CVE-2026-28693
ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write
HIGH
CVE-2026-28691
ImageMagick has uninitialized pointer dereference in JBIG decoder
HIGH
CVE-2026-28494
ImageMagick vulnerable to stack corruption through long morphology kernel names or arrays
HIGH
CVE-2026-25968
ImageMagick: MSL attribute stack buffer overflow leads to out of bounds write.
HIGH
CVE-2026-26127
.NET Denial of Service Vulnerability
HIGH
CVE-2026-26130
.NET Denial of Service Vulnerability
HIGH
CVE-2026-26131
.NET Elevation of Privilege Vulnerability
HIGH
CVE-2026-31892
Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
HIGH
CVE-2026-31889
Shopware vulnerable to a potential take over of app credentials
HIGH
CVE-2026-31887
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
HIGH
CVE-2026-31857
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
HIGH
CVE-2026-31834
Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
HIGH
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
HIGH
CVE-2026-31858
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection