Browse CVEs by Ecosystem and Severity

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation

OpenClaw: Pairing-scoped device session could restore revoked node token authority

Cotonti: Cross-Site Request Forgery in the administration rights handler

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector

katello: missing repository authorization in content_uploads exposes cross-product content existence

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

Laravel Framework: CRLF injection in default email rule

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Gogs: Overwriting critical files results in a denial of service

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

LiteLLM: Authentication Bypass via Host Header Injection

n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

n8n: Credential Exfiltration via Permission Bypass

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

LobeHub: Unauthenticated SSRF in `/webapi/proxy`

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)

Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Deno: Miller-Rabin Primality Test Allows Zero Rounds

Deno: Command Injection via spawnSync & spawn on Windows

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

n8n: Python sandbox escape

Langflow: Unauthenticated RCE in Shareable Playgrounds

Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

statping-ng allows attackers to escalate privileges to Administrator and access sensitive components

YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

Project Firefly III has incorrect access control in the webhook management component

shlink has a Server-Side Request Forgery issue

SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

Remotion: remote code execution (RCE) vulnerability

Remotion: arbitrary file write vulnerability

Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR