Browse CVEs by Ecosystem and Severity

OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

MQTT does not validate hostnames

Apollo Router Affected by an Access Control Bypass on Polymorphic Types

Apollo Router Improperly Enforces Renamed Access Control Directives

Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering

youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

youki container escape via "masked path" abuse due to mount race conditions

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

Zitadel May Bypass Second Authentication Factor

Zitadel allows brute-forcing authentication factors

Jenkins Azure CLI Plugin does not restrict the commands it executes

Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations

Apache Tomcat Vulnerable to Relative Path Traversal

pg8000 SQL injection vulnerability via a specially crafted Python list input

Kottster app reinitialization can be re-triggered allowing command injection in development mode

binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

NeuVector telemetry sender is vulnerable to MITM and DoS

astral-tokio-tar Vulnerable to PAX Header Desynchronization

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

Mattermost has a Missing Authorization vulnerability

Mattermost has a Missing Authorization vulnerability

Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability

alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

Magento vulnerable to stored Cross-Site Scripting (XSS)

Magento provides incorrect authorization through a security feature bypass

Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages

JDBC Driver for SQL Server has improper input validation issue

Omni vulnerable to information leak via API

MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

cel-rust May Panic During Parsing of Invalid CEL Expressions

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

Amazon.IonDotnet is vulnerable to Denial of Service attacks

n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI

Apache Kylin Files or Directories Accessible to External Parties

Dolibarr vulnerable to RCE via the computed field parameter

github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks

Rancher CLI SAML authentication is vulnerable to phishing attacks

Hutool allows remote code execution (RCE) via the QLExpressEngine class