Browse CVEs by Ecosystem and Severity

Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

mkfifo: permissions of an existing file are changed after FIFO creation fails

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)

Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)

Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

Apache Camel JMS deserialization filter bypass

Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache

electerm has Command Injection in File System Operations (rmrf, mv, cp)

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

OpenClaw: Matrix allowFrom could bind to mutable display names

OpenClaw: Combined POSIX shell options could confuse exec revalidation

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

OpenClaw: Shell wrapper argv could change between approval and execution

Rancher has over-inclusive team membership expansion in GitHub App authentication provider

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

SurrealDB has Denial of Service in JSON parser due to nested objects

SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation

SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection