Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-40880
Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
HIGH
CVE-2026-41247
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
CRITICAL
CVE-2026-44109
OpenClaw: Feishu webhook and card-action validation now fail closed
CRITICAL
CVE-2026-41507
Remote Code Execution (RCE) via String Literal Injection into math-codegen
CRITICAL
CVE-2026-41497
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
HIGH
CVE-2026-41433
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
MEDIUM
CVE-2026-41493
yard: Possible arbitrary path traversal and file access via yard server
HIGH
CVE-2026-41491
Dapr: Service Invocation path traversal ACL bypass
HIGH
CVE-2026-43530
OpenClaw: busybox and toybox applet execution weakened exec approval binding
HIGH
CVE-2026-42434
OpenClaw: Sandboxed agents could escape exec routing via host=node override
HIGH
CVE-2026-43569
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
HIGH
CVE-2026-43571
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
MEDIUM
CVE-2026-43531
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables
MEDIUM
CVE-2026-43534
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input
HIGH
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
MEDIUM
CVE-2026-43566
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events
HIGH
CVE-2026-41277
Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
CRITICAL
CVE-2026-40525
OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes
CRITICAL
CVE-2026-27197
Sentry: Improper authentication on SAML SSO process allows user identity linking
CRITICAL
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
CRITICAL
CVE-2025-14813
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
HIGH
CVE-2026-3505
Bouncy Castle Uncontrolled Resource Consumption vulnerability
HIGH
CVE-2026-5598
Bouncy Castle Has Covert Timing Channel Vulnerability
CRITICAL
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
HIGH
GHSA-f5v8-v6q3-q4h6
Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)
HIGH
CVE-2026-41208
Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution
HIGH
CVE-2026-41427
OAuth 2.1 Provider: Unprivileged users can register OAuth clients
CRITICAL
CVE-2026-41428
Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints
HIGH
CVE-2026-41423
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
CRITICAL
CVE-2026-41242
Arbitrary code execution in protobufjs
CRITICAL
CVE-2026-6270
@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes
HIGH
CVE-2026-41276
Flowise: resetPassword Authentication Bypass Vulnerability
HIGH
CVE-2026-41274
Flowise: Cypher Injection in GraphCypherQAChain
CRITICAL
CVE-2026-41137
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
HIGH
CVE-2026-40308
Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar
HIGH
CVE-2026-41883
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
HIGH
CVE-2026-40611
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
CRITICAL
CVE-2026-41248
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
HIGH
CVE-2026-41175
Statamic: Unsafe method invocation via query value resolution allows data destruction
HIGH
CVE-2026-41304
WWBN AVideo: RCE cause by clonesite plugin
CRITICAL
CVE-2026-41500
electerm: electerm_install_script_CommandInjection Vulnerability Report
CRITICAL
CVE-2026-40933
Flowise: Authenticated RCE Via MCP Adapters
CRITICAL
CVE-2026-40324
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
CRITICAL
CVE-2026-40173
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
HIGH
CVE-2026-35569
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
MEDIUM
CVE-2026-27820
Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption
CRITICAL
CVE-2026-31843
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files
CRITICAL
CVE-2026-54334
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
CRITICAL
CVE-2026-54333
UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable
CRITICAL
CVE-2026-32179
MsQuic has a Remote Elevation of Privilege Vulnerability