Browse CVEs by Ecosystem and Severity

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Gogs allows deletion of internal files which leads to remote command execution

pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos

Mattermost allows authenticated users to write files to arbitrary locations

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Langflow Unauth RCE

Teleport allows remote authentication bypass

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint

Salt vulnerable to directory traversal attack in file receiving method

XWiki allows SQL injection in query endpoint of REST API with Oracle

@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests

Magneto contains stored XSS vulnerability

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

BackendAI Missing Authentication for Critical Function

listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

billboard.js allows prototype pollution via the function generate

LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Fabio allows HTTP clients to manipulate custom headers it adds

Argo CD allows cross-site scripting on repositories page

The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution

Spring Security authorization bypass for method security annotations on private methods

vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Langroid has a Code Injection vulnerability in TableChatAgent

samlify SAML Signature Wrapping attack

Gardener allows metadata injection for a project secret which can lead to privilege escalation

Gardener allows bypassing project secret validation which can lead to privilege escalation

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Apache IoTDB Vulnerable to Remote Code Execution

OPKSSH Vulnerable to Authentication Bypass

OpenPubkey Vulnerable to Authentication Bypass

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

goshs route not protected, allows command execution

BRCC Incorrect Access Control vulnerability

WSO2 API Manager XML External Entity (XXE) vulnerability

SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

ShowDoc unrestricted file upload vulnerability

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

Craft CMS Allows Remote Code Execution