Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Category: web-application Clear

ID	Title	Severity	Tags	Detected
CVE-2026-16158	Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destinat... Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a delimiter. Different destination and source pairs can therefore produce the same key while resolving to different upstream URLs....	High	Cwe 441 Fastify Nodejs Fastifyreply From	1 month ago
CVE-2026-15631	Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in... Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapse...	High	Path Traversal Cwe 22 Fastify Nodejs +2	1 month ago
CVE-2026-7872	IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files... IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files...	High	Cwe 22 Jwt File Access Auth Token +7	1 month ago
CVE-2026-8056	IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters... IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters...	High	Cwe 94 Remote Code Execution Langflow Apple +5	1 month ago
CVE-2026-7667	IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow... IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow...	High	Cwe 22 Remote Code Execution Langflow Apple +5	1 month ago
CVE-2026-7754	IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery ... IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery ...	High	Server-Side Request Forgery Cwe 918 Langflow Apple +5	1 month ago
CVE-2026-63030 KEV	WordPress Core — WordPress Core Interpretation Conflict Vulnerability WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.	Critical	WordPress Remote Code Execution SQL Injection Cwe 436 +10	1 month ago
CVE-2026-55234	Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize ag... Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authen...	High	JavaScript Cwe 284 Cwe 639 Meteor +1	1 month ago
CVE-2026-52890	Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled... Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js...	High	JavaScript Denial of Service Cwe 22 Cwe 400 +3	1 month ago
CVE-2026-14802	A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the... A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the...	High	JavaScript React Cwe 77 Cwe 78 +1	1 month ago
CVE-2026-57277	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 120 Remote Code Execution Buffer Overflow WebSocket +1	1 month ago
CVE-2026-57278	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 120 WebSocket Buffer Overflow	1 month ago
CVE-2026-57274	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 120 Buffer Overflow WebSocket Geovision +1	1 month ago
CVE-2026-57275	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 120 Geovision Remote Code Execution Buffer Overflow +1	1 month ago
CVE-2026-57276	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 120 Geovision WebSocket Buffer Overflow	1 month ago
CVE-2026-57270	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 129 WebSocket High Risk	1 month ago
CVE-2026-57271	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 129 Remote Code Execution WebSocket Geovision	1 month ago
CVE-2026-57272	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 129 WebSocket Remote Code Execution Index Out Of Bounds	1 month ago
CVE-2026-57273	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 120 WebSocket Buffer Overflow	1 month ago
CVE-2026-13125	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)... GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud)...	High	Cwe 306 WebSocket Authentication Bypass	1 month ago
CVE-2026-57955	SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers... SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers...	High	SQL Injection Cwe 89 Sql	2 months ago
CVE-2026-57947	Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook... Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook...	High	Server-Side Request Forgery Cwe 918	2 months ago
CVE-2026-57950	ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control... ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control...	High	Vue.js Cwe 863 Remote Code Execution Command Injection	2 months ago
CVE-2026-56780	Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api... Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api...	High	Cwe 639 Authentication Bypass Modoboa	2 months ago
CVE-2026-56285	Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and... Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and...	High	Cwe 918 Cwe 1188 Remote Code Execution HTTP +1	2 months ago
CVE-2026-13521	A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php.... A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php....	High	PHP SQL Injection Cwe 74 Cwe 89	2 months ago
CVE-2026-13498	A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an... A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an...	High	PHP SQL Injection Cwe 74 Cwe 89	2 months ago
CVE-2026-58054	MyBB 1.8.40 does not restrict which usergroup a limited Admin Control Panel user may assign when... MyBB 1.8.40 does not restrict which usergroup a limited Admin Control Panel user may assign when...	High	Cwe 269 Mybb PHP Privilege Escalation	2 months ago
CVE-2026-58056	RustDesk gates incoming control messages on per-capability flags rather than on the session's... RustDesk gates incoming control messages on per-capability flags rather than on the session's...	High	Cwe 863 Rustdesk Authentication Bypass Session Management	2 months ago
CVE-2026-3652	The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value`... The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value`...	High	WordPress Cross-Site Scripting Cwe 79 PHP	2 months ago
CVE-2026-54639	Style Dictionary - Prototype Pollution in convertTokenData utility function Style Dictionary - Prototype Pollution in convertTokenData utility function	High	JavaScript C Cwe 1321 Nodejs +1	2 months ago
CVE-2026-10521	An high privileged remote attacker can access a hidden configuration method, that should not be... An high privileged remote attacker can access a hidden configuration method, that should not be...	High	Cwe 425 Remote Code Execution	2 months ago
CVE-2026-9029	The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug.... The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug....	High	Cross-Site Scripting Grafana Cwe 79	2 months ago
CVE-2026-42129	The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An... The Loki datasource plugin's callResource handler contains a path traversal vulnerability. An...	High	Path Traversal Cwe 22 Grafana Loki Datasource	2 months ago
CVE-2026-53866	OpenClaw: Shell inline-command parsing could miss an allowlist check OpenClaw: Shell inline-command parsing could miss an allowlist check	High	Cwe 862 Remote Code Execution Openclaw	2 months ago
CVE-2026-53864	OpenClaw: Host environment sanitizer missed two Node.js control variables OpenClaw: Host environment sanitizer missed two Node.js control variables	High	JavaScript Cwe 184 Nodejs Openclaw	2 months ago
CVE-2026-53857	OpenClaw: Zalo allowFrom could bind to mutable display names OpenClaw: Zalo allowFrom could bind to mutable display names	High	Cwe 290 Policy Enforcement Remote Code Execution Web Application +2	2 months ago
CVE-2026-53849	OpenClaw: Discord allowFrom could bind to mutable display names OpenClaw: Discord allowFrom could bind to mutable display names	High	Privilege Escalation Cwe 290 Web Application Openclaw	2 months ago
CVE-2026-53855	OpenClaw: Shell positional parameters could weaken strict inline-eval checks OpenClaw: Shell positional parameters could weaken strict inline-eval checks	High	Cwe 184 Cwe 863 Remote Code Execution Openclaw	2 months ago
CVE-2026-53843	OpenClaw: Pairing-scoped device session could restore revoked node token authority OpenClaw: Pairing-scoped device session could restore revoked node token authority	High	Cwe 613 WebSocket Authentication Bypass Openclaw	2 months ago
CVE-2026-53705	Vulnerability in CVE-2026-53705 (CVE-2026-53705) vulnerability in CVE-2026-53705 (CVE-2026-53705). Risk of unauthorized operations or information disclosure.	High	Cwe 190 Gstreamer Denial of Service Remote Code Execution	2 months ago
CVE-2026-41708	Vulnerability in dos (CVE-2026-41708) vulnerability in dos (CVE-2026-41708). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 400 Spring Broadcom +1	2 months ago
CVE-2026-53782	@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch @steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch	High	Cwe 918 Server-Side Request Forgery JavaScript HTTP +1	2 months ago
CVE-2026-46489	SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG f... SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, the company logo upload feature accepts any file type without validation. An authenticated administrator can upload an SVG file containing embedded JavaScript. This script is base64-encoded and injected unescaped into every...	High	JavaScript Cross-Site Scripting Cwe 79 Cwe 434	2 months ago
CVE-2026-46622	SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any... SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconf...	High	SQL Injection Cwe 312 Credential Leak	2 months ago
CVE-2026-47170	Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HT... Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning,...	High	Cwe 918 Web Application HTTP Server-Side Request Forgery	2 months ago
CVE-2026-45541	ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation pat... ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request...	High	Cwe 476 WebSocket Denial of Service Iot +2	2 months ago
CVE-2026-47906	Dreamweaver Desktop versions 21.7 and earlier are affected by a Dependency on Vulnerable Third... Dreamweaver Desktop versions 21.7 and earlier are affected by a Dependency on Vulnerable Third...	High	PHP Remote Code Execution Cwe 94 Adobe +5	2 months ago
CVE-2026-11501	A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System... A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System...	High	PHP SQL Injection Cwe 74 Cwe 89	2 months ago
CVE-2026-11488	A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This... A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This...	High	PHP SQL Injection Cwe 74 Cwe 89	2 months ago

Vulnerabilities

🍪 About cookies