Browse CVEs by Ecosystem and Severity

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring Framework Improper Path Limitation in XsltView

senaite.core Vulnerable to Eval Injection and Missing Authorization

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server

Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

jmespath.php has CompilerRuntime code injection via unescaped function names

surfio has an out-of-bounds read

resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation