Browse CVEs by Ecosystem and Severity

Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity

Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload

goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Kedro has Arbitrary Code Execution via Malicious Logging Configuration

OpenSTAManager: SQL Injection via Aggiornamenti Module

OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md

OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Rack has Content-Length mismatch in Rack::Files error responses

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

Rack:: Static header_rules bypass via URL-encoded paths

Rack::Static prefix matching can expose unintended files under the static root

Axios npm Supply Chain Incident Impacting @usebruno/cli

Agno is vulnerable to Eval Injection

Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster

EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites

KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

PraisonAI Has Second-Order SQL Injection in `get_all_user_threads`

PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code

phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController

CI4MS: Account Deactivation Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

CI4MS: Account Deletion Module Grants Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS