Browse CVEs by Ecosystem and Severity
797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2026-107399
Mechanize sends credential headers to another origin after a meta refresh
MEDIUM
CVE-2026-107715
Mechanize sends credential headers to another host after an HTTP redirect
MEDIUM
CVE-2026-106111
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate
MEDIUM
CVE-2026-105848
Payload: Insufficient Access Control in Stripe REST Proxy
MEDIUM
CVE-2026-88023
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
MEDIUM
CVE-2026-100723
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
MEDIUM
GHSA-mwm8-39rw-8826
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
MEDIUM
CVE-2026-102820
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
MEDIUM
CVE-2026-102821
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
MEDIUM
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
MEDIUM
CVE-2026-101900
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
MEDIUM
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
MEDIUM
CVE-2026-102342
Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
MEDIUM
CVE-2026-65829
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
MEDIUM
CVE-2026-61670
microsandbox: Secret values exposed in world-readable process arguments
MEDIUM
CVE-2026-81868
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
MEDIUM
CVE-2026-75523
Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets
MEDIUM
CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targets
MEDIUM
CVE-2026-88011
Traefik: ForwardAuth identity spoofing via dot-form header alias
MEDIUM
CVE-2026-44282
decidim-elections: Election question titles allow stored script execution
MEDIUM
CVE-2025-24890
gix-sec safe.directory protections absent for elevated administrators
MEDIUM
CVE-2026-69304
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability
MEDIUM
CVE-2026-62900
Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability
MEDIUM
CVE-2026-72925
SWC HTML minifier may allow script element breakout when minifying embedded JSON
MEDIUM
CVE-2025-71390
SurrealDB allows bypass of deny-net flags via DNS resolution
MEDIUM
CVE-2026-63481
Hurl: Cookies in Cookies section leak when redirecting to a different host
MEDIUM
CVE-2026-63435
Mail: Email address spoofing via malformed RFC 2047 encoded-words
MEDIUM
CVE-2026-75592
Kirby: Access to image files outside of the site root via path traversal in the media handling
MEDIUM
CVE-2026-62993
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
MEDIUM
CVE-2026-55481
Snipe-IT has CSS Injection via `header_color` Setting
MEDIUM
CVE-2026-55466
Snipe-IT vulnerable to stored XSS via inline-served attachment
MEDIUM
CVE-2026-82250
gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
MEDIUM
CVE-2026-55663
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
MEDIUM
CVE-2026-61807
Snipe-IT: Stored DOM XSS via table selected-count IDs
MEDIUM
CVE-2026-84190
LibreNMS Vulnerable to Remote Code Execution via AboutController
MEDIUM
CVE-2026-63740
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
MEDIUM
CVE-2026-62902
Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability
MEDIUM
CVE-2026-62909
Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
MEDIUM
CVE-2026-62899
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
MEDIUM
CVE-2026-71437
Mermaid Architecture diagrams are vulnerable to prototype pollution
MEDIUM
CVE-2026-54765
Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port
MEDIUM
CVE-2026-65602
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass
MEDIUM
CVE-2026-65601
Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion
MEDIUM
CVE-2026-68930
Russh: Channel-scoped server callbacks can be reached without an open channel
MEDIUM
CVE-2016-1000305
guard-livereload has a directory traversal vulnerability
MEDIUM
CVE-2026-53466
ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow
MEDIUM
CVE-2026-67430
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
MEDIUM
CVE-2026-63119
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
MEDIUM
CVE-2026-63118
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
MEDIUM
CVE-2026-54659
Pagy I18n locale option is not validated before being used in a file path