Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-54781
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
HIGH
CVE-2026-54774
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
HIGH
CVE-2026-54772
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake
HIGH
CVE-2026-54898
Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation
HIGH
CVE-2026-54897
Oj: Use-After-Free in Oj::Doc Iterators via Reentrant Close
HIGH
CVE-2026-54896
Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent
HIGH
CVE-2026-54592
Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
HIGH
CVE-2026-54527
jupyterlab-git extension: Stored XSS leading to RCE
HIGH
CVE-2026-54297
Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
HIGH
CVE-2026-53492
containerd CRI checkpoint restore CDI annotation smuggling
HIGH
CVE-2026-53488
containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
HIGH
CVE-2026-54502
Oj: Stack Buffer Overflow in Oj.dump via Large Indent
HIGH
CVE-2026-54899
Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle
HIGH
CVE-2026-58404
Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
HIGH
CVE-2026-57579
AlchemyCMS: Unauthenticated nested page API leaks restricted & unpublished content
HIGH
CVE-2026-58195
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
HIGH
CVE-2026-55773
CedarJava has policy injection vulnerability
HIGH
CVE-2026-55772
CedarJava has type confusion vulnerability
HIGH
CVE-2026-44688
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
HIGH
CVE-2026-57133
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
HIGH
CVE-2026-57137
npm PraisonAI AgentLoop onToolCall approval runs after tool execution
HIGH
CVE-2026-57136
npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
HIGH
CVE-2026-57209
Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode
HIGH
CVE-2026-57210
Heimdall: IP Spoofing via Unvalidated Forwarding Headers
HIGH
CVE-2026-53843
OpenClaw: Pairing-scoped device session could restore revoked node token authority
HIGH
CVE-2026-55405
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
HIGH
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
HIGH
CVE-2026-28737
Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer
HIGH
CVE-2026-48019
Laravel Framework: CRLF injection in default email rule
HIGH
CVE-2026-26231
Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo
HIGH
CVE-2026-52797
Gogs: Overwriting critical files results in a denial of service
HIGH
CVE-2026-54309
n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
HIGH
CVE-2026-54305
n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
HIGH
CVE-2026-54307
n8n: Credential Exfiltration via Permission Bypass
HIGH
CVE-2026-52845
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
HIGH
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
HIGH
CVE-2026-49401
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
HIGH
CVE-2026-49440
Deno: Miller-Rabin Primality Test Allows Zero Rounds
HIGH
CVE-2026-49402
Deno: Command Injection via spawnSync & spawn on Windows
HIGH
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
HIGH
CVE-2026-49444
n8n: Python sandbox escape
HIGH
CVE-2026-50884
statping-ng allows attackers to escalate privileges to Administrator and access sensitive components
HIGH
CVE-2026-47835
Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores
HIGH
CVE-2026-45591
Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability
HIGH
CVE-2026-50556
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
HIGH
CVE-2026-50168
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
HIGH
CVE-2026-54090
File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection
HIGH
CVE-2026-54096
File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
HIGH
CVE-2026-54097
File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
HIGH
CVE-2026-11607
TYPO3 CMS has Broken Access Control in its Form Framework