Browse CVEs by Ecosystem and Severity

OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

Modular Max Serve has Unsafe Deserialization vulnerability

Eclipse Jersey has a Race Condition

AstrBot is vulnerable to RCE with hard-coded JWT signing keys

File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function

Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

Incus vulnerable to local privilege escalation through custom storage volumes

Milvus Proxy has a Critical Authentication Bypass Vulnerability

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation

OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed

Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack

Soft Serve is vulnerable to SSRF through its Webhooks

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

MQTT does not validate hostnames

Apollo Router Affected by an Access Control Bypass on Polymorphic Types

Apollo Router Improperly Enforces Renamed Access Control Directives

Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering

youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

youki container escape via "masked path" abuse due to mount race conditions

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

@react-native-community/cli has arbitrary OS command injection

MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling

n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

Zitadel May Bypass Second Authentication Factor

Zitadel allows brute-forcing authentication factors

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

Jenkins Azure CLI Plugin does not restrict the commands it executes

ImageMagick has Integer Overflow in BMP Decoder (ReadBMP)

ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)

Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

Apache Tomcat Vulnerable to Relative Path Traversal

pg8000 SQL injection vulnerability via a specially crafted Python list input

Piranha CMS vulnerable to stored cross-site scripting (XSS)

Kottster app reinitialization can be re-triggered allowing command injection in development mode

binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

NeuVector telemetry sender is vulnerable to MITM and DoS

NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

astral-tokio-tar Vulnerable to PAX Header Desynchronization

NetBird VPN does not remove the default password of an admin account

Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

MCMS vulnerable SQL injection via the content_title parameter

Keras framework vulnerable to deserialization of untrusted data