Browse CVEs by Ecosystem and Severity

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Apache Ranger has a Command Injection vulnerability

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise RCE via SQLite Record Manager Node

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise RCE via TypeORM DataSource

Sequelize: SQL Injection (Oracle DB)

Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

sentence-transformers local model loading bypasses trust_remote_code and executes custom Python

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

Wings exposes node configuration secrets through egg configuration-file templating

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Logging operator has Fluentd configuration injection that allows remote code execution

prebid-server's request forgery vulnerability allows for possible host environment data extraction

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

lettre has TLS hostname verification disabled when using Boring TLS backend

Shescape: Shell injection via unescaped parentheses on Windows with CMD

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: SQL Injection via `multipleStatements: true`

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)