Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-44523
Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery
CRITICAL
CVE-2026-104437
Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs
CRITICAL
CVE-2026-44497
Zebra has Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer
MEDIUM
CVE-2026-44500
Zebra Vulnerable to Allocation Amplification in Inbound Network Deserializers
CRITICAL
CVE-2026-44498
Zebra's Block Validator Undercounts Coinbase and P2SH Sigops
CRITICAL
CVE-2026-42284
CRITICAL
CVE-2025-63704
query-parser-string is vulnerable to Prototype Pollution
CRITICAL
CVE-2025-63703
parse-ini is vulnerable to Prototype Pollution in index.js()
CRITICAL
CVE-2025-63706
next-npm-version is vulnerable to Command injection
HIGH
CVE-2025-63705
node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js
MEDIUM
CVE-2025-67202
Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL
CRITICAL
CVE-2026-40982
Spring Cloud Config vulnerable to Path Traversal
CRITICAL
CVE-2026-44007
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
HIGH
CVE-2026-44001
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
CRITICAL
CVE-2026-43999
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
CRITICAL
CVE-2026-44005
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
CRITICAL
CVE-2026-43997
vm2 Access to Host Object Enables Sandbox Escape
CRITICAL
CVE-2026-44006
vm2 has a Sandbox Escape Vulnerability
CRITICAL
CVE-2026-44542
FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion
HIGH
CVE-2026-44511
katalyst-koi: Session cookies can be replayed after user logout
MEDIUM
CVE-2026-44312
CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content
CRITICAL
CVE-2026-42880
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
HIGH
CVE-2026-44503
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
CRITICAL
CVE-2026-41050
Fleet: Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering
HIGH
CVE-2026-25705
Rancher Extensions have arbitrary file access via path traversal
CRITICAL
CVE-2026-42596
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
CRITICAL
CVE-2026-42589
Gotenberg has Unauthenticated RCE via ExifTool Metadata Key Injection
CRITICAL
CVE-2026-44484
Compromise of PyTorch Lightning PyPi Package Versions
HIGH
CVE-2026-44471
gix-fs: Symlink prefix-reuse allows worktree escape during checkout
HIGH
CVE-2026-46689
scim_proto and kanidm_proto have an authenticated process abort via SCIM filter stack exhaustion
HIGH
CVE-2026-44375
Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
MEDIUM
CVE-2026-44363
misp-modules has nsafe remote resource fetching in expansion
CRITICAL
CVE-2026-44351
fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
HIGH
CVE-2026-44335
PraisonAI has an SSRF bypass
HIGH
CVE-2026-42559
rmcp Streamable HTTP server transport has a DNS rebinding vulnerability
HIGH
CVE-2026-42557
JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content
CRITICAL
CVE-2026-42555
Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
HIGH
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
HIGH
CVE-2026-42548
Flight has reflected XSS through an unvalidated JSONP callback in Flight::jsonp()
HIGH
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
HIGH
CVE-2026-44302
Snappier has an infinite loop during SnappyStream decompression with malformed framed input
CRITICAL
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
CRITICAL
CVE-2026-45010
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
HIGH
CVE-2025-71261
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
CRITICAL
CVE-2026-44262
Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules
CRITICAL
CVE-2026-43948
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
MEDIUM
CVE-2026-79771
Nokogiri XSLT transform has a memory leak
HIGH
CVE-2026-79770
Nokogiri CSS selector tokenizer has regular expression backtracking
CRITICAL
CVE-2026-42238
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
MEDIUM
CVE-2026-42184
Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands