Browse CVEs by Ecosystem and Severity

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

Hazelcast has an authorization bypass in IMap Predicates API

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

Ghost: Remote Code Execution via Bookmark Card Images

Payload: SQL injection in SQLite/Postgres

Payload: Bypassed sanitization of user uploaded SVGs

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

ImageSharp: ICC LUT16 output channel count can write beyond Vector4

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

Backstage: Improper validation of TechDocs MkDocs configuration

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

Backstage: Scaffolder action input authorization bypass

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

Payload Ecommerce has an order confirmation validation issue

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

CliInvoke: Argument Injection in Extensibility Runner Factory

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

phpMyFAQ's two-factor authentication login bypasses the password factor

phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

ZITADEL: Actions V1 sandbox escape: host file read via require()

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

Snipe-IT: 2FA bypass via the API token flow

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

Klever-Go: /log controls global node logging

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Formie: Unauthenticated users can overwrite incomplete submissions via submit action