Browse CVEs by Ecosystem and Severity

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Marten's LINQ provider has SQL injection via unescaped string literals

Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

RMCP: Custom HTTP headers leak to cross-origin redirect targets

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

djust has an authorization bypass on the WebSocket/SSE mount path

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

yayson: Prototype pollution in Store/LegacyStore deserialization

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover

Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Shopper: privilege escalation via improper Livewire admin component authorization

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Traefik entrypoint header-name sanitization bypassed via request trailers