Browse CVEs by Ecosystem and Severity

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

MPXJ: XXE Vulnerability in MerlinReader

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

Grav CMS vulnerable to remote code execution via .zip file upload

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper: privilege escalation via improper Livewire admin component authorization

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Traefik entrypoint header-name sanitization bypassed via request trailers

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run