Vulnerability database
107 records so far. Any CVE or GHSA ID is added the first time someone looks it up, and new GitHub-reviewed advisories and CISA known-exploited CVEs are added in batches. Records refresh from their sources after 24 hours. To fetch an ID that isn't here yet, search for it exactly.
Showing 26 to 50 of 107 records
| ID | Title | Ecosystem | Severity | CVSS | Fix | KEV | Intelligence | Published |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-63458GHSA-cjgj-2fwf-4c2w | Perses's project query parameter authorization bypass exposes cross-project resources | Go | High | 7.1v4.0 | Yes | No | None yet | |
| CVE-2026-91127GHSA-3753-m2x2-q623 | File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer | npm | High | 8.2v3.1 | Yes | No | None yet | |
| CVE-2026-63374GHSA-82r6-8w77-94w6 | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing | PyPI | Critical | 9.3v4.0 | Yes | No | None yet | |
| GHSA-39wr-7q6h-cf68 | LMDeploy has an SSRF bypass | PyPI | High | 7.5v3.1 | Yes | No | None yet | |
| CVE-2026-84992GHSA-3rm2-h79c-8qw6 | md-editor-v3: XSS via fenced-code language rendering bypass | npm | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-64847GHSA-5p39-cfhj-2xmp | AnyIO process-pool workers can block indefinitely on undrained stderr | PyPI | Medium | 6.8v4.0 | Yes | No | None yet | |
| CVE-2026-33625GHSA-3hmm-rh5q-gwwr | LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading | PyPI | High | 8.8v3.1 | Yes | No | None yet | |
| CVE-2025-66455GHSA-2vh9-42vm-xmv2 | LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py | PyPI | Critical | 9.8v3.1 | Yes | No | None yet | |
| CVE-2026-63349GHSA-3w57-8xmc-8v26 | AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups | PyPI | High | 7.0v4.0 | Yes | No | None yet | |
| GHSA-jr78-w6w5-m8f8 | Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks | Packagist (PHP) | High | 7.3v3.1 | Yes | No | None yet | |
| GHSA-9rcc-pmj8-ffhr | Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-77616GHSA-cx86-7xwp-w9wf | Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-61833GHSA-qg67-7m6v-qg25 | zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion | Go | High | 8.1v3.1 | Yes | No | None yet | |
| CVE-2026-77610GHSA-q5fm-9mx6-44f4 | Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-63406GHSA-w72w-9qmj-c9qm | AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets | Go | Medium | 5.9v3.1 | Yes | No | None yet | |
| CVE-2026-77609GHSA-hw3m-8j5x-94ff | Semantic MediaWiki has an open redirect in Special:URIResolver | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-77607GHSA-7xv3-gf2g-498h | Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-63405GHSA-5p54-whvp-x327 | AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body | Go | Medium | 5.9v3.1 | Yes | No | None yet | |
| CVE-2026-77608GHSA-59xw-qv23-j3rc | Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-77606GHSA-3jp5-3h47-28qf | Semantic MediaWiki has reflected XSS in Special:Ask plain table headers | Packagist (PHP) | Medium | 6.1v3.1 | Yes | No | None yet | |
| CVE-2026-77301GHSA-7q85-xj36-vmfc | adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) | npm | High | 7.5v3.1 | Yes | No | None yet | |
| CVE-2026-77339GHSA-5gm3-9crp-6g3v | Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools | Go | Medium | 5.1v4.0 | Yes | No | None yet | |
| CVE-2026-58197GHSA-qg2g-g9w3-m5h8 | ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement | Go | High | 8.8v3.1 | Yes | No | None yet | |
| CVE-2026-61795GHSA-f94q-w3w8-cj67 | Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation | Go | Medium | 6.8v3.1 | Yes | No | None yet | |
| CVE-2026-61672GHSA-gjw4-3v3v-rqxg | Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement | Go | High | 7.1v3.1 | Yes | No | None yet |
- CVE-2026-63458GHSA-cjgj-2fwf-4c2w
Perses's project query parameter authorization bypass exposes cross-project resources
High7.1Fix availableGo - CVE-2026-91127GHSA-3753-m2x2-q623
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
High8.2Fix availablenpm - CVE-2026-63374GHSA-82r6-8w77-94w6
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Critical9.3Fix availablePyPI - GHSA-39wr-7q6h-cf68
LMDeploy has an SSRF bypass
High7.5Fix availablePyPI - CVE-2026-84992GHSA-3rm2-h79c-8qw6
md-editor-v3: XSS via fenced-code language rendering bypass
Medium6.1Fix availablenpm - CVE-2026-64847GHSA-5p39-cfhj-2xmp
AnyIO process-pool workers can block indefinitely on undrained stderr
Medium6.8Fix availablePyPI - CVE-2026-33625GHSA-3hmm-rh5q-gwwr
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
High8.8Fix availablePyPI - CVE-2025-66455GHSA-2vh9-42vm-xmv2
LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py
Critical9.8Fix availablePyPI - CVE-2026-63349GHSA-3w57-8xmc-8v26
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
High7.0Fix availablePyPI - GHSA-jr78-w6w5-m8f8
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
High7.3Fix availablePackagist (PHP) - GHSA-9rcc-pmj8-ffhr
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
Medium6.1Fix availablePackagist (PHP) - CVE-2026-77616GHSA-cx86-7xwp-w9wf
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token
Medium6.1Fix availablePackagist (PHP) - CVE-2026-61833GHSA-qg67-7m6v-qg25
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
High8.1Fix availableGo - CVE-2026-77610GHSA-q5fm-9mx6-44f4
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
Medium6.1Fix availablePackagist (PHP) - CVE-2026-63406GHSA-w72w-9qmj-c9qm
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
Medium5.9Fix availableGo - CVE-2026-77609GHSA-hw3m-8j5x-94ff
Semantic MediaWiki has an open redirect in Special:URIResolver
Medium6.1Fix availablePackagist (PHP) - CVE-2026-77607GHSA-7xv3-gf2g-498h
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Medium6.1Fix availablePackagist (PHP) - CVE-2026-63405GHSA-5p54-whvp-x327
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
Medium5.9Fix availableGo - CVE-2026-77608GHSA-59xw-qv23-j3rc
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Medium6.1Fix availablePackagist (PHP) - CVE-2026-77606GHSA-3jp5-3h47-28qf
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Medium6.1Fix availablePackagist (PHP) - CVE-2026-77301GHSA-7q85-xj36-vmfc
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
High7.5Fix availablenpm - CVE-2026-77339GHSA-5gm3-9crp-6g3v
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
Medium5.1Fix availableGo - CVE-2026-58197GHSA-qg2g-g9w3-m5h8
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
High8.8Fix availableGo - CVE-2026-61795GHSA-f94q-w3w8-cj67
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
Medium6.8Fix availableGo - CVE-2026-61672GHSA-gjw4-3v3v-rqxg
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
High7.1Fix availableGo