Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
CRITICAL
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
CRITICAL
CVE-2026-107806
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CRITICAL
CVE-2026-68582
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CRITICAL
CVE-2026-107726
Hazelcast allows arbitrary member memory access by low-privileged client
CRITICAL
CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
CRITICAL
CVE-2026-61445
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
CRITICAL
CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
CRITICAL
CVE-2026-106445
Handlebars: JavaScript Injection via Own Property Check Bypass
CRITICAL
CVE-2026-61447
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
CRITICAL
CVE-2026-107282
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
CRITICAL
CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
CRITICAL
CVE-2026-105857
Payload Form Builder has an RCE issue
CRITICAL
CVE-2026-105859
Payload: Unauthorized update to collection documents
CRITICAL
CVE-2026-105863
Payload authentication token field handling issue
CRITICAL
CVE-2026-93605
vm2 contains a sandbox escape vulnerability
CRITICAL
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
CRITICAL
CVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
CRITICAL
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
CRITICAL
CVE-2026-62252
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
CRITICAL
CVE-2026-62253
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
CRITICAL
CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
CRITICAL
CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
CRITICAL
CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CRITICAL
CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
CRITICAL
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
CRITICAL
CVE-2026-90711
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
CRITICAL
CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
CRITICAL
CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
CRITICAL
CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
CRITICAL
CVE-2026-104849
Tinypool: Prototype Pollution Gadget to RCE in run() options
CRITICAL
CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
CRITICAL
CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
CRITICAL
CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
CRITICAL
CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
CRITICAL
CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
CRITICAL
CVE-2026-92956
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
CRITICAL
CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
CRITICAL
CVE-2026-73802
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
CRITICAL
CVE-2026-10032
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
CRITICAL
RUSTSEC-2026-0327
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
CRITICAL
CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
CRITICAL
CVE-2026-92940
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
CRITICAL
CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
CRITICAL
CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
CRITICAL
CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
CRITICAL
CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
CRITICAL
CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
CRITICAL
CVE-2026-92939
vm2 crypto builtin loads attacker native code through setEngine
CRITICAL
CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector