Browse CVEs by Ecosystem and Severity

@nyariv/sandboxjs has a Sandbox Escape issue

OpenCloud Reva has a Public Link Exploit

Sandbox escape via infinite recursion and error objects

Nonce Reuse in HPKE Context

FUXA Unauthenticated Remote Arbitrary Device Tag Write

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

FUXA Unauthenticated Exposure of Plaintext Database Credentials

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)

Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

survey-pdf Upgraded jsPDF Version Due to Security Vulnerability

Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage

n8n has a Python sandbox escape

n8n Merge Node has Arbitrary File Write leading to RCE

n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node

Alist vulnerable to Path Traversal in multiple file operation handlers

Alist has Insecure TLS Config

n8n has OS Command Injection in Git Node

n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS

n8n Has Expression Escape Vulnerability Leading to RCE

n8n Vulnerable to Command Injection in Community Package Installation

ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx

Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

Prototype Pollution via FormData Processing in Qwik City

HtmlSanitizer has a bypass via template tag

bytes has integer overflow in BytesMut::reserve

OpenSTAManager has an SQL Injection in the Stampe Module

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

FUXA allows Remote Code Execution (RCE) via the project import functionality.

FUXA contains an Unrestricted File Upload vulnerability

FUXA contains an insecure default configuration vulnerability

FacturaScripts has SQL Injection in Autocomplete Actions

JinJava Bypass through ForTag leads to Arbitrary Java Execution

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

Decidim's private data exports can lead to data leaks

Django has an SQL Injection issue

Django has an SQL Injection issue

Moodle Affected by Improper Restriction of Excessive Authentication Attempts

Moodle authentication bypass vulnerability

OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable

Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation

Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)

locutus is vulnerable to Prototype Pollution

CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor

Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication