Browse CVEs by Ecosystem and Severity

Ghost has a SQL injection in Content API

NLTK has a Zip Slip Vulnerability

OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)

Nextcloud Talk allowlist bypass via actor.name display name spoofing

OpenClaw has a potential access-group authorization bypass if channel type lookup fails

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated

Known affected by Account Takeover via Password Reset Token Leakage

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

set-in Affected by Prototype Pollution

Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

CASL Ability is Vulnerable to Prototype Pollution

Apache Druid Vulnerable to Authentication Bypass

FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

Keylime Missing Authentication for Critical Function and Improper Authentication

Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK

OpenSTAManager has an OS Command Injection in P7M File Processing

Gogs's update .git/config file allows remote command execution

@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses

@nyariv/sandboxjs has a Sandbox Escape vulnerability

@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

@nyariv/sandboxjs has a Sandbox Escape issue

Nonce Reuse in HPKE Context

FUXA Unauthenticated Remote Arbitrary Device Tag Write

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

FUXA Unauthenticated Exposure of Plaintext Database Credentials

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

n8n has a Python sandbox escape

n8n Merge Node has Arbitrary File Write leading to RCE

Alist has Insecure TLS Config

n8n has OS Command Injection in Git Node

n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

n8n Has Expression Escape Vulnerability Leading to RCE

n8n Vulnerable to Command Injection in Community Package Installation

Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

Prototype Pollution via FormData Processing in Qwik City

JinJava Bypass through ForTag leads to Arbitrary Java Execution

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

locutus is vulnerable to Prototype Pollution

CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

Langroid has WAF Bypass Leading to RCE in TableChatAgent

SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE