Browse CVEs by Ecosystem and Severity

Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

Apache Wicket has a Session Fixation issue

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

OpAMP client reads unbounded HTTP response bodies

rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs

Grav is Vulnerable to Stored XSS via Tag Injection

Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access

Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature

Grav API Privilege Escalation to Super Admin

DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header

MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint

YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

RustFS: ListServiceAccount authorizes against wrong admin action, enabling cross-user enumeration and root service account takeover

django-s3file is vulnerable to relative path traversal

Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

gix-transport: HTTP credentials leaked to redirected host in curl backend

S3-Proxy has Security Issues in its Resource Path Matching Implementation

awslabs/tough is Missing Delegated Metadata Validation

OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes

Eclipse BaSyx Java Server SDK vulnerable to Path Traversal

Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

Langflow Knowledge Bases API is Vulnerable to Path Traversal

FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

Codechecker has an authentication bypass for certain API calls

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

VM2 Has a WASM Sandbox Escape

VM2 Has a Sandbox Escape Issue via SuppressedError

VM2 Has Sandbox Breakout Through Inspect Function

VM2 Has Sandbox Breakout Through Promise Species

net-imap vulnerable to command Injection via "raw" arguments to multiple commands

net-imap vulnerable to command Injection via unvalidated Symbol inputs

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

net-imap has quadratic complexity when reading response literals

net-imap vulnerable to STARTTLS stripping via invalid response timing

ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

Pelican Web UI Affected by a Privilege Escalation Attack

phpVMS has an /importer authorization bypass causing full database wipe

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field