Browse CVEs by Ecosystem and Severity

CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

@payloadcms/next has Stored XSS in Admin Panel

OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

SiYuan Desktop: Stored XSS in imported .sy.zip content leads to arbitrary command execution

OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

OpenClaw: Zalo channel downloads media before sender authorization

OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

parse-server has cloud function validator bypass via prototype chain traversal

SiYuan is Vulnerable to Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection

SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

SciTokens is vulnerable to SQL Injection in KeyCache

phpMyFAQ is Vulnerable to Stored XSS via Unsanitized Email Field in Admin FAQ Editor

baserCMS Update Functionality Vulnerable to OS Command Injection

baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)

Mlflow: Command Injection when serving models with enable_mlserver=True

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)

libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling

MLflow Command Injection vulnerability

MLFlow path traversal vulnerability

MikroORM has Prototype Pollution in Utils.merge

MikroORM is vulnerable to SQL Injection via specially crafted object

mpp has multiple payment bypass and griefing vulnerabilities

OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers

OpenClaw: Silent privilege escalation via gateway shared-auth reconnect

OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

AWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction

Zebra node crash — V5 transaction hash panic (P2P reachable)

Ruby LSP has arbitrary code execution through branch setting

act: Unrestricted set-env and add-path command processing enables environment injection

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

Saloon has insecure deserialization in AccessTokenAuthenticator