Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-32768
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
CRITICAL
CVE-2026-32767
SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API
CRITICAL
CVE-2026-32760
File Browser Signup Grants Admin When Default Permissions Include Admin
HIGH
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
HIGH
CVE-2026-32267
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
HIGH
CVE-2026-24458
Mattermost fails to properly handle very long passwords
HIGH
CVE-2025-54920
Apache Spark: Spark History Server Code Execution Vulnerability
CRITICAL
CVE-2026-25534
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
HIGH
CVE-2026-32720
github.com/ctfer-io/monitoring Vulnerable to Improper Access Control
HIGH
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
HIGH
CVE-2026-32933
AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion
HIGH
CVE-2026-32640
SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox
HIGH
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
HIGH
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
CRITICAL
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
HIGH
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
CRITICAL
CVE-2026-32621
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
HIGH
GHSA-8fh9-c4jq-94h4
idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability
HIGH
CVE-2026-32600
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
HIGH
CVE-2026-32314
Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145
CRITICAL
CVE-2026-32301
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
HIGH
CVE-2026-32260
Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process
MEDIUM
CVE-2026-32322
rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction
CRITICAL
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
HIGH
CVE-2026-31814
Yamux vulnerable to remote Panic via malformed WindowUpdate credit
CRITICAL
CVE-2026-32304
Locutus vulnerable to RCE via unsanitized input in create_function()
HIGH
CVE-2026-32915
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
CRITICAL
CVE-2026-32922
OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE
CRITICAL
CVE-2026-32916
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
HIGH
CVE-2026-32129
Poseidon V1 variable-length input collision via implicit zero-padding
CRITICAL
CVE-2026-31886
Dagu: Path Traversal via `dagRunId` in Inline DAG Execution
CRITICAL
CVE-2026-26954
SandboxJS affected by a Sandbox Escape
CRITICAL
CVE-2026-28792
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
MEDIUM
CVE-2023-1289
ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
CRITICAL
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
MEDIUM
CVE-2026-73426
Trix has a Stored XSS vulnerability through serialized attributes
HIGH
CVE-2026-32246
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
HIGH
CVE-2026-32232
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
HIGH
CVE-2026-32231
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
CRITICAL
CVE-2026-32136
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass
HIGH
CVE-2026-32110
SiYuan has a Full-Read SSRF via /api/network/forwardProxy
MEDIUM
CVE-2026-30937
ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation
MEDIUM
CVE-2026-30936
ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage
MEDIUM
CVE-2026-30935
ImageMagick has Heap Buffer Over-Read in BilateralBlurImage
MEDIUM
CVE-2026-30931
ImageMagick has heap-based buffer overflow in UHDR encoder
HIGH
CVE-2026-30929
ImageMagick has stack buffer overflow in MagnifyImage
HIGH
CVE-2026-28693
ImageMagick: Integer overflow in DIB coder can result in out of bounds read or write
HIGH
CVE-2026-28691
ImageMagick has uninitialized pointer dereference in JBIG decoder
MEDIUM
CVE-2026-28690
ImageMagick has stack write buffer overflow in MNG encoder
MEDIUM
CVE-2026-28688
ImageMagick has heap use-after-free in the MSL encoder