Browse CVEs by Ecosystem and Severity

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass

MCP Toolbox for Databases has an Origin Validation Error

File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

TYPO3 CMS has Broken Access Control in its Form Framework

TYPO3 CMS: Destructive Actions on File Mount Folders

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

TYPO3 CMS has Broken Access Control in its Form Framework

TYPO3 CMS has Insecure Deserialization via Core API

Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

ChromaDB has a code injection vulnerability

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Chisel has an ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory

Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

Apache CXF has Improper Restriction of XML External Entity Reference

MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance

Russh: Unchecked keyboard-interactive prompt count in client auth path

DevGuard has improper authorization on public assets

CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule

Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS

netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default

Spring for GraphQL: Cross-Site WebSocket Hijacking

Spring for GraphQL: Unsafe Deserialization

Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Openshift Migration Advisor agent-API fails to validate JWT source_id claim, allowing cross-tenant data manipulation

Openshift Migration Advisor lacks proper authorization and filtering for its DELETE /api/v1/sources API

Assisted Migration Agent: Path traversal in gzipped tarball handling enables arbitrary file write and remote code execution

Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication

Openshift Migration Advisor: Broken access control in migration-planner image-url endpoint exposes other users' OVA images and agent JWTs

Openshift Migration Advisor: Improper input sanitization allows specially crafted RVTools .xlsx files to include malicious SQL commands

Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name