Browse CVEs by Ecosystem and Severity

Parse Server: SQL injection via dot-notation field name in PostgreSQL

Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting

Craft Commerce is Vulnerable to SQL Injection in Commerce Purchasables Table Sorting

StudioCMS has Privilege Escalation via Insecure API Token Generation

Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface

OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

Apache IoTDB has an Improper Input Validation vulnerability

Apache IoTDB has an Insecure Default Configuration Vulnerability

OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation

WeKnora Vulnerable to Remote Code Execution via SQL Injection Bypass in AI Database Query Tool

WeKnora Vulnerable to Broken Access Control in Tenant Management

Flowise has IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import

Flowise has Authorization Bypass via Spoofed x-request-from Header

Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment

MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery

@perfood/couch-auth has a host header injection vulnerability

Keycloak SAML Broken has Authentication Bypass by Primary Weakness

Pingora vulnerable to cache poisoning via insecure-by-default cache key

Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade

OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

Gogs: Stored XSS via data URI in issue comments

Gogs: Cross-repository LFS object overwrite via missing content hash verification

Gokapi has Stored XSS in SVG Hotlinks

Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

ZITADEL: Login V2 UI Policy Bypass Allows Unauthorized Self-Registration and Authentication

ZITADEL has 1-Click Account Takeover via XSS in /saml-post Endpoint

File Browser's TUS Delete Endpoint Bypasses Delete Permission Check

SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint

Immutable is vulnerable to Prototype Pollution

Nuclio Shell Runtime Command Injection Leading to Privilege Escalation

Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

Craft CMS has unauthenticated activation email trigger with potential user enumeration