Browse CVEs by Ecosystem and Severity

SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

nimiq-blockchain: Validity store off by one error

Winter: Authenticated backend users can bypass Users controller permission checks

Winter: Stored XSS through Editor Settings custom styles

Winter: Stored XSS through Brand Settings custom styles

Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Apache Ranger has a Command Injection vulnerability

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Nx: Zip-Slip in the self-hosted remote cache

Mermaid Architecture diagrams are vulnerable to prototype pollution

Statamic: Account takeover via OAuth email matching without email-verification check

Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool