Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-65598
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
HIGH
CVE-2026-65015
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
HIGH
CVE-2026-27775
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
HIGH
CVE-2026-58424
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
HIGH
CVE-2026-56654
Gitea: Privilege Escalation via Access Token Scope Escalation in API
HIGH
CVE-2026-73650
SVGO removeScripts plugin leaves some executable scripts intact
HIGH
CVE-2026-57894
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
HIGH
CVE-2026-61666
websocket-driver-ruby: Denial of service via malformed Host header
HIGH
CVE-2026-56170
Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50526
Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability
HIGH
CVE-2026-47300
Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability
HIGH
CVE-2026-47303
Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability
HIGH
CVE-2026-50527
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50650
Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
HIGH
CVE-2026-50651
Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50525
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50528
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
HIGH
CVE-2026-50648
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-50524
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-47304
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
HIGH
CVE-2026-47302
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-57108
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-61836
Directus: Authorization-dependent response served from unsegmented cache key
HIGH
CVE-2026-55667
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
HIGH
CVE-2026-53597
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
HIGH
CVE-2026-53598
Prompty: Arbitrary file read via file reference expansion
HIGH
CVE-2026-27771
Gitea has insufficient permission checks for Composer package source links
HIGH
CVE-2026-67341
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
HIGH
CVE-2026-55578
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
HIGH
CVE-2026-54540
Pheditor has an authenticated terminal command whitelist bypass
HIGH
CVE-2026-54504
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
HIGH
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
HIGH
CVE-2026-50276
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
HIGH
CVE-2026-50273
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
HIGH
CVE-2026-54498
ViewComponent: around_render HTML-Safety Bypass
HIGH
CVE-2026-54628
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
HIGH
CVE-2026-50131
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
HIGH
CVE-2026-44300
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
HIGH
CVE-2026-49970
Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()
HIGH
CVE-2026-54065
NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function
HIGH
CVE-2026-54064
NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module
HIGH
CVE-2026-49259
NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
HIGH
CVE-2026-48118
NukeViet: Unauthenticated Reflected XSS in Comment Module
HIGH
CVE-2026-45414
Decidim: JWT-backed authentication can be replayed across organizations
HIGH
CVE-2026-45378
Decidim: Verification documents can be downloaded through reusable links
HIGH
CVE-2026-54174
melange: Incomplete package integrity verification allows data section substitution
HIGH
CVE-2026-52775
YesWiki has Authenticated SQL Injection via ReactionManager
HIGH
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
HIGH
CVE-2026-52769
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
HIGH
CVE-2026-52767
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`