Browse CVEs by Ecosystem and Severity

vm2 NodeVM can replace the host process TLS trust store

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

@xhmikosr/decompress: Path traversal via symlink chain

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

http4s-scala-xml has an XML External Entity (XXE) processing issue

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

SunEditor: Critical XSS vulnerability - sanitizer bypass

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

Marten's LINQ provider has SQL injection via unescaped string literals

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

djust has an authorization bypass on the WebSocket/SSE mount path

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

yayson: Prototype pollution in Store/LegacyStore deserialization

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Traefik HTTP/3 Backend NTLM Connection Reuse

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone: RC per-server auth-proxy bypass

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

PyTorch Lightning path traversal vulnerability

Apache FreeMarker template loading mechanism vulnerable to path traversal

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip