Browse CVEs by Ecosystem and Severity

Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization

Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter

SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch

Net::IMAP: Command Injection via ID command argument

Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.

LimeSurvey has a SQL Injection issue

degit has a Command Injection issue

Spring Framework Unsafe Deserialization via Jackson JMS Converters

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Micrometer HTTP server instrumentations DoS

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin

Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

PHPSpreadsheet has a patch bypass for CVE-2026-34084

Routinator has cache path traversal when processing the module component of rsync URIs

Routinator crashes when encountering maliciously crafted RRDP XML files

Routinator crashes when sending a maliciously crafted select-asn query parameter

Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.

Twig: Possible sandbox bypass when using a source policy

Shopper: Authorization bypass and RBAC privilege escalation in team settings

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments

TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes

TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs

NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Authenticated Remote Code Execution via loadReader functionName code injection in DbGate

DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)

Spree: CSV Formula Injection in Customer Export

Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

Doorkeeper Openid Connect: Dynamic Client Registration feature creates public clients with client_secret

OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed

browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler