Vulnerability database
107 records so far. Any CVE or GHSA ID is added the first time someone looks it up, and new GitHub-reviewed advisories and CISA known-exploited CVEs are added in batches. Records refresh from their sources after 24 hours. To fetch an ID that isn't here yet, search for it exactly.
Showing 1 to 25 of 107 records
| ID | Title | Ecosystem | Severity | CVSS | Fix | KEV | Intelligence | Published |
|---|---|---|---|---|---|---|---|---|
| GHSA-m687-p538-r5hp | Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted | Go | High | 7.2v4.0 | No | No | None yet | |
| CVE-2026-107725GHSA-w294-6q5q-53p8 | Hazelcast has an authorization bypass in IMap Predicates API | Maven | High | 8.7v4.0 | Yes | No | None yet | |
| CVE-2026-41510GHSA-6r3q-mjv7-xr8m | Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding | Go | High | 7.2v3.1 | Yes | No | None yet | |
| CVE-2026-105855GHSA-fx49-4h83-wjv9 | Payload didn't enforce field-level password update restrictions | npm | High | 7.6v4.0 | Yes | No | None yet | |
| CVE-2026-105852GHSA-7c34-32v3-j575 | Payload relationship-query authorization bypass | npm | Medium | 6.9v4.0 | Yes | No | None yet | |
| CVE-2026-105850GHSA-8r29-2mp2-pmrw | Payload Ecommerce has an order confirmation validation issue | npm | High | 8.8v4.0 | Yes | No | None yet | |
| CVE-2026-102824GHSA-w3jg-pjxf-73p4 | Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange | crates.io (Rust) | Medium | 4.3v3.1 | Yes | No | None yet | |
| CVE-2026-102823GHSA-47hw-gvq5-r2gm | russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened | crates.io (Rust) | High | 7.5v3.1 | Yes | No | None yet | |
| CVE-2026-101918GHSA-42vr-xj54-vc7v | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) | PyPI | Medium | 5.3v3.1 | Yes | No | None yet | |
| CVE-2026-56682GHSA-32gc-64m7-hj7v | 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header | npm | Medium | 5.3v3.1 | Yes | No | None yet | |
| GHSA-jhjp-4c2q-xmx4 | k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers | Go | Medium | 4.3v3.1 | Yes | No | None yet | |
| CVE-2026-61612GHSA-798p-78g2-v556 | @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 | npm | Medium | 5.7v3.1 | Yes | No | None yet | |
| CVE-2026-61687GHSA-phg3-3g28-wq9v | Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState | Go | High | 7.1v3.1 | Yes | No | None yet | |
| CVE-2026-61628GHSA-pxcx-fv34-x9p5 | nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition | Go | High | 8.1v3.1 | Yes | No | None yet | |
| CVE-2026-61629GHSA-jr34-h97m-9hpx | nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware | Go | High | 7.5v3.1 | Yes | No | None yet | |
| CVE-2026-61630GHSA-hf33-q6cf-c66f | nginx ignition has TOTP Reuse During Validity Window | Go | Medium | 4.2v3.1 | Yes | No | None yet | |
| GHSA-3rj7-hf4w-jh5c | Malicious code in radio-player-theme (npm) | npm | Critical | None | No | No | None yet | |
| GHSA-jgh3-fggc-mcpm | Obot: Server-Side Request Forgery via remote MCP server URL | Go | High | 7.6v3.1 | Yes | No | None yet | |
| GHSA-pr6h-vr44-xq8j | Obot: MCP Registry API readable without authentication | Go | Medium | 5.3v3.1 | Yes | No | None yet | |
| GHSA-xwmw-prc4-v3cr | Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion | Go | High | 8.8v3.1 | Yes | No | None yet | |
| CVE-2026-59163GHSA-xcw4-53cc-hv32 | Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass | PyPI | Critical | 9.1v3.1 | Yes | No | None yet | |
| CVE-2026-71537GHSA-5gmm-hjfj-8ff7 | Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) | Packagist (PHP) | Medium | 6.5v3.1 | Yes | No | None yet | |
| CVE-2026-85058GHSA-9jjc-fw8x-fmwx | io.moquette:moquette-broker has a Missing Authorization issue | Maven | High | 7.5v3.1 | Yes | No | None yet | |
| CVE-2026-63445GHSA-vr5f-w35q-98jp | Perses's unvalidated project parameter enables filesystem path traversal | Go | High | 7.1v4.0 | Yes | No | None yet | |
| CVE-2026-63199GHSA-4227-9989-jrhx | Perses's missing authorization in datasource proxy allows cross-scope secret disclosure | Go | High | 8.3v4.0 | Yes | No | None yet |
- GHSA-m687-p538-r5hp
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
High7.2No fix yetGo - CVE-2026-107725GHSA-w294-6q5q-53p8
Hazelcast has an authorization bypass in IMap Predicates API
High8.7Fix availableMaven - CVE-2026-41510GHSA-6r3q-mjv7-xr8m
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
High7.2Fix availableGo - CVE-2026-105855GHSA-fx49-4h83-wjv9
Payload didn't enforce field-level password update restrictions
High7.6Fix availablenpm - CVE-2026-105852GHSA-7c34-32v3-j575
Payload relationship-query authorization bypass
Medium6.9Fix availablenpm - CVE-2026-105850GHSA-8r29-2mp2-pmrw
Payload Ecommerce has an order confirmation validation issue
High8.8Fix availablenpm - CVE-2026-102824GHSA-w3jg-pjxf-73p4
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange
Medium4.3Fix availablecrates.io (Rust) - CVE-2026-102823GHSA-47hw-gvq5-r2gm
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
High7.5Fix availablecrates.io (Rust) - CVE-2026-101918GHSA-42vr-xj54-vc7v
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
Medium5.3Fix availablePyPI - CVE-2026-56682GHSA-32gc-64m7-hj7v
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Medium5.3Fix availablenpm - GHSA-jhjp-4c2q-xmx4
k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers
Medium4.3Fix availableGo - CVE-2026-61612GHSA-798p-78g2-v556
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Medium5.7Fix availablenpm - CVE-2026-61687GHSA-phg3-3g28-wq9v
Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
High7.1Fix availableGo - CVE-2026-61628GHSA-pxcx-fv34-x9p5
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
High8.1Fix availableGo - CVE-2026-61629GHSA-jr34-h97m-9hpx
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
High7.5Fix availableGo - CVE-2026-61630GHSA-hf33-q6cf-c66f
nginx ignition has TOTP Reuse During Validity Window
Medium4.2Fix availableGo - GHSA-3rj7-hf4w-jh5c
Malicious code in radio-player-theme (npm)
CriticalNo fix yetnpm - GHSA-jgh3-fggc-mcpm
Obot: Server-Side Request Forgery via remote MCP server URL
High7.6Fix availableGo - GHSA-pr6h-vr44-xq8j
Obot: MCP Registry API readable without authentication
Medium5.3Fix availableGo - GHSA-xwmw-prc4-v3cr
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
High8.8Fix availableGo - CVE-2026-59163GHSA-xcw4-53cc-hv32
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
Critical9.1Fix availablePyPI - CVE-2026-71537GHSA-5gmm-hjfj-8ff7
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Medium6.5Fix availablePackagist (PHP) - CVE-2026-85058GHSA-9jjc-fw8x-fmwx
io.moquette:moquette-broker has a Missing Authorization issue
High7.5Fix availableMaven - CVE-2026-63445GHSA-vr5f-w35q-98jp
Perses's unvalidated project parameter enables filesystem path traversal
High7.1Fix availableGo - CVE-2026-63199GHSA-4227-9989-jrhx
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
High8.3Fix availableGo