Browse CVEs by Ecosystem and Severity

Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

plone.app.event vulnerable to denial of service via iCalendar import

plone.app.portlets vulnerable to denial of service via RSS feed portlet

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

Snipe-IT has CSS Injection via `header_color` Setting

Snipe-IT vulnerable to stored XSS via inline-served attachment

Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

KubeVela Terraform remote loader DoS via unbounded file read

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

silverstripe/userforms vulnerable to remote code execution via userforms email subject

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring Framework Improper Path Limitation in XsltView

senaite.core Vulnerable to Eval Injection and Missing Authorization

Wasmtime has a leak in WASIp1 `fd_renumber` implementation

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability

Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable