Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-46681
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
HIGH
CVE-2026-46680
containerd user ID handling bypass allows runAsNonRoot evasion
HIGH
CVE-2026-46640
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
HIGH
CVE-2026-46639
Twig: Sandbox property and method bypass via object-destructuring assignment
MEDIUM
CVE-2026-46638
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
CRITICAL
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
HIGH
CVE-2026-46673
Russh: Unchecked CryptoVec allocation and growth handling is reachable
CRITICAL
CVE-2026-82856
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
MEDIUM
CVE-2026-46609
Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog
HIGH
CVE-2026-46519
MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement
HIGH
CVE-2026-46654
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
CRITICAL
CVE-2026-46614
Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger
HIGH
CVE-2026-46612
Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives
MEDIUM
CVE-2026-46616
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
HIGH
CVE-2026-46545
nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item
MEDIUM
CVE-2026-46539
nimiq-primitives: BlockInclusionProof interlink issue when hops are empty
CRITICAL
CVE-2026-48207
Apache Fory PyFory Deserialization of Untrusted Data
HIGH
CVE-2026-48989
Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
HIGH
CVE-2026-45760
Apache Camel K: Kubernetes namespace authorized users can create a Build resource
HIGH
CVE-2026-4858
Mattermost has a Path Traversal issue
CRITICAL
CVE-2026-9082KEV
Drupal Core has a SQL Injection issue
HIGH
CVE-2026-35675
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration
HIGH
CVE-2026-35671
phpMyFAQ: IDOR Account Takeover
HIGH
CVE-2026-35676
phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation
HIGH
CVE-2026-46415
Caddy Defender trusted proxy client IP bypass
CRITICAL
CVE-2026-46412
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
CRITICAL
CVE-2026-46354
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
HIGH
CVE-2026-45805
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
MEDIUM
CVE-2026-45785
OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle
LOW
CVE-2026-45772
Turbo: Unexpected local code execution during Yarn Berry detection
CRITICAL
CVE-2026-46339
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
CRITICAL
CVE-2026-45695
Kopia: RCE via SSH ProxyCommand Injection
HIGH
CVE-2026-6009
Jaspersoft Reports: Java Deserialization Vulnerability Lleads to Remote Code Execution (RCE)
CRITICAL
CVE-2026-31072
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
HIGH
CVE-2026-31069
BillaBear is Vulnerable to SQL Injection in the EventRepository
MEDIUM
CVE-2026-56348
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
CRITICAL
CVE-2026-45758
Malicious code in guardrails-ai 0.10.1 (supply chain compromise)
HIGH
CVE-2026-45576
zrok copy writes attacker-controlled WebDAV paths outside the destination root
CRITICAL
CVE-2026-2587
GlassFish's gadget handler is vulnerable to RCE
CRITICAL
CVE-2026-2586
GlassFish's Administration Console is Vulnerable to RCE
CRITICAL
CVE-2026-47323
Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
CRITICAL
CVE-2026-45568
rok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
HIGH
CVE-2026-46511
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
CRITICAL
CVE-2026-46395
HAXcms: Private Key Disclosure via Broken HMAC Implementation
HIGH
CVE-2026-46391
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
CRITICAL
CVE-2026-45721
Algernon: handler.lua discovery walks parent directories above the server root
HIGH
CVE-2026-74784
Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString
LOW
CVE-2026-7860
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability
CRITICAL
CVE-2026-46725
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
CRITICAL
CVE-2026-2611
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution