Browse CVEs by Ecosystem and Severity

Spring Security authorization bypass for method security annotations on private methods

vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store

Langroid has a Code Injection vulnerability in TableChatAgent

samlify SAML Signature Wrapping attack

Gardener allows metadata injection for a project secret which can lead to privilege escalation

Gardener allows bypassing project secret validation which can lead to privilege escalation

Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials

Jenkins OpenID Connect Provider Plugin Incorrectly Validates Crafted Build ID Tokens

Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting

BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference

Apache IoTDB Vulnerable to Remote Code Execution

Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability

OPKSSH Vulnerable to Authentication Bypass

OpenPubkey Vulnerable to Authentication Bypass

Rack has an Unbounded-Parameter DoS in Rack::QueryParser

JRuby-OpenSSL has hostname verification disabled by default

Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

goshs route not protected, allows command execution

Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

BRCC Incorrect Access Control vulnerability

OpenVM allows the byte decomposition of pc in AUIPC chip to overflow

WSO2 API Manager XML External Entity (XXE) vulnerability

OPA server Data API HTTP path injection of Rego

SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

Any user with view access to the XWiki space can change the authenticator

OpenFGA Authorization Bypass

Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

ShowDoc unrestricted file upload vulnerability

Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

Apache Tomcat Denial of Service via invalid HTTP priority header

net-imap rubygem vulnerable to possible DoS by memory exhaustion

Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository

Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository

Rancher users who can create Projects can gain access to arbitrary projects

Craft CMS Allows Remote Code Execution

YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2

Wazuh server vulnerable to remote code execution