Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-33728
dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution
CRITICAL
CVE-2026-33696
n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE
CRITICAL
CVE-2026-33716
AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
CRITICAL
CVE-2026-33701
OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
CRITICAL
CVE-2026-33660
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
CRITICAL
CVE-2026-33670
SiYuan has directory traversal within its publishing service
CRITICAL
CVE-2026-33669
SiYuan has Arbitrary Document Reading within the Publishing Service
CRITICAL
CVE-2026-26832
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
CRITICAL
CVE-2026-26831
textract is vulnerable to OS Command Injection
CRITICAL
CVE-2026-26833
thumbler allows OS Command Injection
CRITICAL
CVE-2026-26830
pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
CRITICAL
CVE-2026-74790
Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse
CRITICAL
CVE-2026-33634KEV
Trivy ecosystem supply chain was briefly compromised
CRITICAL
CVE-2026-30849
MantisBT is vulnerable to authentication bypass through the SOAP API on MySQL
CRITICAL
CVE-2026-4404
Harbor allows the use of the default password for web UI login
CRITICAL
CVE-2026-4599
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
CRITICAL
CVE-2026-33502
AVideo has Unauthenticated SSRF via plugin/Live/test.php
CRITICAL
CVE-2026-33494
Ory Oathkeeper has a path traversal authorization bypass
CRITICAL
CVE-2026-33419
MinIO LDAP login brute-force via user enumeration and missing rate limit
CRITICAL
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
CRITICAL
CVE-2026-33286
Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
CRITICAL
CVE-2026-22732
Spring Security HTTP Headers Are not Written Under Some Conditions
CRITICAL
CVE-2026-27953
CRITICAL
CVE-2026-33352
AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
CRITICAL
CVE-2026-33351
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
CRITICAL
CVE-2026-33322
MinIO has JWT Algorithm Confusion in OIDC Authentication
CRITICAL
CVE-2026-33309
Langflow has an Arbitrary File Write (RCE) via v2 API
CRITICAL
CVE-2026-30924
qui CORS Misconfiguration: Arbitrary Origins Trusted
CRITICAL
CVE-2026-30836
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
CRITICAL
CVE-2026-33211
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
CRITICAL
CVE-2026-33186
gRPC-Go has an authorization bypass via missing leading slash in :path
CRITICAL
CVE-2026-33180
HAPI FHIR HTTP authentication leak in redirects
CRITICAL
CVE-2026-33057
Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py
CRITICAL
CVE-2026-33054
Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion
CRITICAL
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
CRITICAL
CVE-2026-27459
CRITICAL
CVE-2026-33017
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
CRITICAL
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
CRITICAL
CVE-2026-32940
SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)
CRITICAL
CVE-2026-32938
SiYuan Vulnerable to Arbitrary File Read in Desktop Publish Service
CRITICAL
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
CRITICAL
CVE-2026-32767
SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
CRITICAL
CVE-2026-32760
File Browser Signup Grants Admin When Default Permissions Include Admin
CRITICAL
CVE-2026-25534
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
CRITICAL
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
CRITICAL
CVE-2026-32621
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
CRITICAL
CVE-2026-32301
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
CRITICAL
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
CRITICAL
CVE-2026-32304
Locutus vulnerable to RCE via unsanitized input in create_function()
CRITICAL
CVE-2026-32922
OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE