Vulnerability database
107 records so far. Any CVE or GHSA ID is added the first time someone looks it up, and new GitHub-reviewed advisories and CISA known-exploited CVEs are added in batches. Records refresh from their sources after 24 hours. To fetch an ID that isn't here yet, search for it exactly.
Showing 51 to 75 of 107 records
| ID | Title | Ecosystem | Severity | CVSS | Fix | KEV | Intelligence | Published |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-61794GHSA-gxjc-74v5-3vx3 | Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic | Go | Medium | 4.9v3.1 | Yes | No | None yet | |
| CVE-2026-81505GHSA-p5vg-v7mj-f6q4 | Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials | Go | High | 7.1v4.0 | Yes | No | None yet | |
| CVE-2026-61682GHSA-c8w2-fgvx-vhv4 | kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace | Go | Critical | 9.9v3.1 | Yes | No | None yet | |
| CVE-2025-61682GHSA-hg8h-557g-q8pp | Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes | Packagist (PHP) | High | 8.6v3.1 | Yes | No | None yet | |
| CVE-2025-53837GHSA-26vp-8gxg-v4pg | org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue | Maven | Critical | 9.9v3.1 | Yes | No | None yet | |
| CVE-2026-77281GHSA-j8px-rmrx-76h9 | Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass | Go | Medium | 6.5v3.1 | Yes | No | None yet | |
| CVE-2026-77615GHSA-m6c8-jcw2-5r25 | Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text | Maven+1 | High | 8.7v3.1 | Yes | No | None yet | |
| CVE-2026-63472GHSA-6j36-r6pr-59x4 | Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification | npm | Critical | 9.1v3.1 | Yes | No | None yet | |
| CVE-2026-87819GHSA-g5vv-9gxw-82hx | GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing | PyPI | High | 8.7v4.0 | Yes | No | None yet | |
| CVE-2026-72819GHSA-r94f-hx44-8jqf | Grav CMS vulnerable to remote code execution via .zip file upload | Packagist (PHP) | High | 8.7v4.0 | Yes | No | None yet | |
| CVE-2026-13506GHSA-qp49-qgx5-5m26 | Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard | Maven | High | 8.7v4.0 | Yes | No | None yet | |
| CVE-2026-8763GHSA-9pwp-9qqc-pr26 | Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI | Maven | Critical | 9.3v4.0 | Yes | No | None yet | |
| CVE-2026-5588GHSA-wg6q-6289-32hp | Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules | Maven | Medium | 6.3v4.0 | Yes | No | None yet | |
| CVE-2026-0636GHSA-c3fc-8qff-9hwx | Bouncy Castle has an LDAP injection | Maven | Medium | 5.5v4.0 | Yes | No | None yet | |
| CVE-2025-14813GHSA-574f-3g2m-x479 | Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks | Maven | Critical | 9.3v4.0 | Yes | No | None yet | |
| CVE-2025-55182GHSA-fv66-9v8q-g76r | React Server Components are Vulnerable to RCE | npm | Critical | 10.0v3.1 | Yes | Yes | None yet | |
| CVE-2025-8916GHSA-4cx2-fc23-5wg6 | Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation | Maven | Medium | 6.3v4.0 | Yes | No | None yet | |
| CVE-2025-8885GHSA-67mf-3cr5-8w23 | Bouncy Castle for Java on All (API modules) allows Excessive Allocation | Maven | Medium | 6.3v4.0 | Yes | No | None yet | |
| CVE-2025-53864GHSA-xwmg-2g98-w7v9 | Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON | Maven | Medium | 5.8v3.1 | Yes | No | None yet | |
| CVE-2025-1974GHSA-mgvx-rpfc-9mpv | ingress-nginx admission controller RCE escalation | Go | Critical | 9.8v3.1 | Yes | No | None yet | |
| CVE-2025-29927GHSA-f82v-jwr5-mffw | Authorization Bypass in Next.js Middleware | npm | Critical | 9.1v3.1 | Yes | No | None yet | |
| CVE-2025-30066GHSA-mrrh-fwg8-r2c3 | tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. | GitHub Actions | High | 8.6v3.1 | Yes | Yes | None yet | |
| CVE-2024-49580GHSA-8qv4-773j-c979 | JetBrains Ktor information disclosure | Maven | Medium | 5.3v3.1 | Yes | No | None yet | |
| GHSA-cxww-7g56-2vh6 | @actions/download-artifact has an Arbitrary File Write via artifact extraction | GitHub Actions | High | 8.6v4.0 | Yes | No | None yet | |
| CVE-2024-4577 | Argument Injection in PHP-CGI | Git repositories | Critical | 9.8v3.1 | Yes | Yes | None yet |
- CVE-2026-61794GHSA-gxjc-74v5-3vx3
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
Medium4.9Fix availableGo - CVE-2026-81505GHSA-p5vg-v7mj-f6q4
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
High7.1Fix availableGo - CVE-2026-61682GHSA-c8w2-fgvx-vhv4
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
Critical9.9Fix availableGo - CVE-2025-61682GHSA-hg8h-557g-q8pp
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
High8.6Fix availablePackagist (PHP) - CVE-2025-53837GHSA-26vp-8gxg-v4pg
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
Critical9.9Fix availableMaven - CVE-2026-77281GHSA-j8px-rmrx-76h9
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
Medium6.5Fix availableGo - CVE-2026-77615GHSA-m6c8-jcw2-5r25
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
High8.7Fix availableMaven+1 - CVE-2026-63472GHSA-6j36-r6pr-59x4
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification
Critical9.1Fix availablenpm - CVE-2026-87819GHSA-g5vv-9gxw-82hx
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
High8.7Fix availablePyPI - CVE-2026-72819GHSA-r94f-hx44-8jqf
Grav CMS vulnerable to remote code execution via .zip file upload
High8.7Fix availablePackagist (PHP) - CVE-2026-13506GHSA-qp49-qgx5-5m26
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
High8.7Fix availableMaven - CVE-2026-8763GHSA-9pwp-9qqc-pr26
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
Critical9.3Fix availableMaven - CVE-2026-5588GHSA-wg6q-6289-32hp
Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules
Medium6.3Fix availableMaven - CVE-2026-0636GHSA-c3fc-8qff-9hwx
Bouncy Castle has an LDAP injection
Medium5.5Fix availableMaven - CVE-2025-14813GHSA-574f-3g2m-x479
Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks
Critical9.3Fix availableMaven - CVE-2025-55182GHSA-fv66-9v8q-g76r
React Server Components are Vulnerable to RCE
Critical10.0Known exploitedFix availablenpm - CVE-2025-8916GHSA-4cx2-fc23-5wg6
Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation
Medium6.3Fix availableMaven - CVE-2025-8885GHSA-67mf-3cr5-8w23
Bouncy Castle for Java on All (API modules) allows Excessive Allocation
Medium6.3Fix availableMaven - CVE-2025-53864GHSA-xwmg-2g98-w7v9
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Medium5.8Fix availableMaven - CVE-2025-1974GHSA-mgvx-rpfc-9mpv
ingress-nginx admission controller RCE escalation
Critical9.8Fix availableGo - CVE-2025-29927GHSA-f82v-jwr5-mffw
Authorization Bypass in Next.js Middleware
Critical9.1Fix availablenpm - CVE-2025-30066GHSA-mrrh-fwg8-r2c3
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
High8.6Known exploitedFix availableGitHub Actions - CVE-2024-49580GHSA-8qv4-773j-c979
JetBrains Ktor information disclosure
Medium5.3Fix availableMaven - GHSA-cxww-7g56-2vh6
@actions/download-artifact has an Arbitrary File Write via artifact extraction
High8.6Fix availableGitHub Actions - CVE-2024-4577
Argument Injection in PHP-CGI
Critical9.8Known exploitedFix availableGit repositories