Browse CVEs by Ecosystem and Severity

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Sakai Conversations has a Stored XSS Issue

YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Filesystem sandbox escape when paths or symlinks contain trailing slashes

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

http4k: `DigestAuthProvider.verify` did not bind to request URI

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

nimiq-blockchain: Validity store off by one error

Winter: Authenticated backend users can bypass Users controller permission checks

Winter: Stored XSS through Editor Settings custom styles

Winter: Stored XSS through Brand Settings custom styles

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Nx: Zip-Slip in the self-hosted remote cache

Statamic: Account takeover via OAuth email matching without email-verification check

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store