Browse CVEs by Ecosystem and Severity

pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Paymenter has URL parameter injection that bypasses paid plan limits at checkout

Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header

chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution

OpenAM has Unsafe Java Deserialization via SNS

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Jenkins Script Security Plugin sandbox bypass vulnerability

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection

Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repository

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft

Gogs Vulnerable to CSRF Leading to Organization Owner Takeover

Gogs has Stored XSS in `.ipynb` Preview

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

Grafana: Pre-authentication denial of service in the public dashboard query handler

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.

Apache NiFi: Missing authorization when replacing Process Groups with restricted components

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

Oj: Integer Overflow in Oj.load 2GB String Handling

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages