Browse CVEs by Ecosystem and Severity

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

Wasmtime has out-of-bounds write or crash when transcoding component model strings

Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

Wasmtime has host panic when Winch compiler executes `table.fill`

Wasmtime has host data leakage with 64-bit tables and Winch

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime has a possible panic when lifting `flags` component value

Wasmtime: Panic when transcoding misaligned utf-16 strings

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

PraisonAI Vulnerable to OS Command Injection

Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service

PraisonAI has sandbox escape via exception frame traversal in `execute_code` (subprocess mode)

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

kcp's cache server is accessible without authentication or authorization checks

SiYuan: Remote Code Execution in the Electron desktop client via stored XSS in synced table captions

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Emissary has GitHub Actions Shell Injection via Workflow Inputs

Addressable has a Regular Expression Denial of Service in Addressable templates

Local settings bypass config trust checks

netavark has incorrect error handling for malformed tcp packets

Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator

Memory-safety vulnerability in github.com/jackc/pgx/v5.

pgx contains memory-safety vulnerability

Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

OpenIdentityPlatform OpenAM: Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

LoLLMs is vulnerable to Improper Access Control through weak secret key

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering

rdiscount has an Out-of-bounds Read

CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion

libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers

Directus: Missing Cross-Origin Opener Policy

Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step

Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write

LiteLLM: Authentication bypass via OIDC userinfo cache key collision

LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint

goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

Budibase: Command Injection in Bash Automation Step

SandboxJS: Sandbox integrity escape