CVEs added in
June 2026

Hardcoded Admin Credential (CWE-798) in UltraVNC Repeater

Weak Diffie-Hellman (CWE-326) in UltraVNC MS-Logon II

Unvalidated Label Propagation (CWE-20) in containerd

Privilege Escalation (CWE-269) in phpMyFAQ Groups

Code Execution (CWE-78, CWE-502) in Grav CMS Core

Command Injection (CWE-78) in Storage Concentrator SC

Command Injection (CWE-78) in Storage Concentrator SCVM

Authorization Bypass (CWE-285) in Capgo Device Creation

Information Exposure (CWE-200) in Capgo RPC API Keys

Authentication Bypass (CWE-306) in Capgo Account Deletion

Hardcoded Session Secret (CWE-798) in Flowise Auth

Arbitrary JS Code Execution (CWE-94) in Crawl4AI API

Authorization Bypass (CWE-285) in Capgo Channel Logic

Path Traversal (CWE-22) in Capgo Builder Upload Proxy

Broken Object Auth (CWE-639) in Capgo limited keys

Auth Bypass via Null Check (CWE-287) in Capgo RBAC API

SQL Injection (CWE-89) via Cookies in Storage SC

Hardcoded Credentials (CWE-798) in Storage Concentrator

Unsafe Pickle Deserialization (CWE-502) in picklescan

Undetected Unsafe Pickle Deserialization (CWE-502) Risk

Pickle RCE via doctest.debug_script (CWE-502) bypass

Unsafe Deserialization (CWE-502) via picklescan Bypass

Unsafe Pickle Deserialization (CWE-502) in picklescan

Undetected Unsafe Deserialization (CWE-502) in picklescan

Code Injection (CWE-94) via txtai /reindex API Resolver

Path Traversal (CWE-22) in Medical Worklist Storage

Path Traversal (CWE-22) in DCMTK C-GET Storage Mode

Unauthenticated RCE (CWE-94) via Orkes Conductor

Broken Access Control (CWE-862) in JeecgBoot OpenAPI

SQL Injection (CWE-89) in Dolibarr REST API Filters

Missing Authentication (CWE-306) in JimuReport Export API

Path Traversal (CWE-22) in SeaweedFS S3 Delete Handler

Path Traversal (CWE-22) in Vibe-Trading Mandate Loader

Authorization Bypass (CWE-862) in DeepTutor MCP Tool Access

Path Traversal (CWE-22) in ChatDev File Upload API

Authorization Flaw (CWE-862) in OpenZiti Enrollment

Command Injection (CWE-78) in Coolify CA Certificate Tool

AuthZ Bypass via Route Prefix (CWE-285) in Fastify

Remote Code Execution via Model Loading in LLaMA-Factory

SQL Injection (CWE-89) via Unquoted Identifiers in DBIx::QuickORM

Path Traversal (CWE-22) in LinuxCNC rtapi_app Loader

Path Traversal (CWE-22) in Zephyr HTTP Static FS

Denial of Service via CPF Parsing in OpENer Stack

Improper Access Control (CWE-639) in Coolify Teams

Weak HMAC Auth (CWE-287) in Coolify GitHub Webhooks

OS Command Injection (CWE-78) in Coolify Nixpacks Build

Command Injection (CWE-78) in Coolify Network Manager

Broken Access Control (CWE-639) in Coolify Livewire UI

Code Injection (CWE-94) in Alexantr Filemanager 1.0

Command Injection (CWE-78) in LuCI OpenVPN generateKey

Command Injection (CWE-78) in luci-app-tailscale Login RPC

SQL Injection (CWE-89) in SigNoz Alert History API

Broken Access Control (CWE-863) in Ruoyi ErpSaleOrder API

SSRF (CWE-918) in Pinpoint Webhook Registration API

Auth Bypass (CWE-306) in Gorse Dump/Restore APIs

IDOR (CWE-639) in Modoboa account password reset

SSRF via Weak HMAC Validation (CWE-918) in Nitter

Directory Traversal (CWE-22) in Gigamon GVOS H-VUE

Path Traversal (CWE-22) in mcp-toolbox HTTP URL Builder

Cleartext Token Exposure (CWE-319) in iOS App SSID Logic

Path Traversal & Sandbox Escape in Claude Code Git

SQL Injection (CWE-89) in FrontAccounting GL Reports

SQL Injection (CWE-89) in FrontAccounting Audit Trail

SQL Injection (CWE-89) in FrontAccounting Bank Reports

Path Traversal (CWE-22) enables RCE in FrontAccounting

SQL Injection (CWE-89) in Class Timetabling System

SQL Injection (CWE-89) in Class Timetabling System

SQL Injection (CWE-89) in Real State Services App

Relative Path Traversal (CWE-23) in libzypp Metadata

SQL Injection (CWE-89) in Hotel Admin User Creation

Unrestricted File Upload (CWE-434) in Hotel Admin Panel

SQL Injection (CWE-89) in Hotel Admin Amenities Module

SQL Injection (CWE-89) in Baptism Edit Function

SQL Injection (CWE-89) in Baptism Management System

Missing REST API Authentication (CWE-287) in Feehi CMS

OS Command Injection (CWE-78) in D-Link DCS-935L Camera

Path Traversal (CWE-22) in ruoyi-vue-pro Upload Endpoint

SQL Injection (CWE-89) in Exam Timetabling preview4.php

SQL Injection (CWE-89) in Class Timetabling System

SQL Injection (CWE-89) in Class Timetabling System

Code Injection (CWE-94) in ANTLR4 Grammar Action Block

SQL Injection (CWE-89) in Restaurant Password Reset

SQL Injection (CWE-89) in Class Timetabling System

SQL Injection (CWE-89) in Class Exam Timetabling App

SQL Injection (CWE-89) in Class Timetabling System 1.0

SQL Injection (CWE-89) in Class Timetabling System

Privilege Enforcement Flaw (CWE-863) in RustDesk Sessions

Privilege Misconfiguration (CWE-269) in MyBB ACP Users

Privilege Misconfiguration (CWE-269) in Gitea act_runner

Unrestricted File Upload (CWE-434) in H.View Cameras

Command Injection (CWE-78) in H.View IP Cameras

Unrestricted File Upload (CWE-434) in DMP-5000 Service

Hardcoded Default Admin Credentials (CWE-798) in DMP-5000

Path Traversal (CWE-22) in Daktronics Controller Firmware

Auth Bypass and RCE (CWE-288/94) in Kestra REST API

Path Traversal (CWE-22) in Kestra File Retrieval API

Auth Bypass & RCE (CWE-287) in Kestra Configs Paths

Path Traversal (CWE-22) via kestra:// URIs in Kestra API

SSRF via DNS Rebinding (CWE-918) in Budibase Fetch

Symlink Path Traversal (CWE-22) in Budibase PWA Zip

JSON Injection (CWE-89) in Budibase Public Queries

Missing Authorization (CWE-862) in Budibase S3 Upload

Missing Auth on S3 URL Generator (CWE-306) in Budibase

Auth Bypass & CSRF (CWE-284) in Budibase Chat Links

OS Command Injection (CWE-78) via Notepad++ Run Menu

OS Command Injection (CWE-78) via Notepad++ config.xml

Input Validation Flaw (CWE-20) in relibc parse_month

Missing FTP IAM Authorization (CWE-862) in RustFS

AuthZ Bypass (CWE-863) in RustFS Replication API

SQL Injection (CWE-89) in OpenProject Timestamps API

CSRF Admin Privilege Escalation (CWE-352) in OpenProject

IDOR (CWE-639) in OpenProject Storage Folder Sync

Cache Store Poisoning (CWE-20) in OpenProject RCE Risk

Path Traversal (CWE-22) in RustFS Snowball Extract

Sensitive Data Exposure (CWE-200) in OpenProject Journals

Marshal Deserialization (CWE-502) in OpenProject Docker

Zip Symlink Path Traversal (CWE-22) in extract-zip

Template Command Execution (CWE-78) in mise Tasks

Request Desync (CWE-444) in Envoy HTTP/3 to HTTP/1

Command Injection (CWE-94) via mise .tool-versions parsing

Missing Authorization (CWE-862) in Pagekit User API

Env Variable Leakage (CWE-200) in Podman Images

SSRF (CWE-918) via IP Normalization Flaws in AutoGPT

Path Traversal (CWE-22) via Echo URL Decode Mismatch

Command Injection (CWE-78) in Dokku Cron Plugin

Shell Injection (CWE-78) via Dokku Git Hook App Names

Shell Eval Injection (CWE-95) via Dokku vhosts plugin

Privilege Escalation (CWE-863) via LXD Snapshot Restore

Path Handling Flaw (CWE-73) in Docling HTML Backend

Broken Access Control (CWE-639) in Canonical LXD

Java Deserialization (CWE-502) in ZAP ViewState Add-on

Missing Authorization (CWE-862) in Teable v2 REST API

Cleartext Data Channel (CWE-319) in Airflow FTPSHook

Weak MD5 Request Signing (CWE-327) in Setracker2 App

SQL Injection (CWE-89) in Cacti SNMP Managers Module

SSL Cert Validation (CWE-295) IP Name Constraint Flaw

Excessive Auth Attempts (CWE-307) in WebSocket API

Missing WebSocket Authentication (CWE-306) in EV System

Auth Bypass via SNI/ALPN Session Reuse (CWE-287)

Unsafe Deserialization (CWE-502) in picklescan Scanner

Path Traversal (CWE-73) in Flowise Document Loader

OS Command Injection (CWE-78) in Flowise Custom MCP

Path Traversal (CWE-73) in Flowise File Storage APIs

Arbitrary File Upload (CWE-73) in Flowise Local Storage

Missing Authentication (CWE-306) in Flowise Register API

Path Traversal (CWE-73) in Flowise File Download API

X.509 Name Constraint Bypass (CWE-295) in CN Field

Path Traversal (CWE-22) in qrscp DICOM C-STORE Handler

Information Exposure (CWE-200) in MSI NBFoundation

SSRF (CWE-918) via OHIF DICOM Data Source Auth Leak

Missing Role Hierarchy Check (CWE-862) in Bitwarden

TLS RPK Trust Bypass (CWE-295) in Raw Key Support

Sensitive Data Exposure (CWE-200) in MSI NBFoundation

Insecure Pipe Permissions (CWE-200) in MSI Service

SQL Injection (CWE-89) in Grocery Store Search

X.509 Trust-Chain Bypass (CWE-295) in wolfSSL Cert Verify

Server-Side Request Forgery (CWE-918) in NewsBlur API

Authenticated SSRF (CWE-918) in Huly Import Endpoint

Missing Share Link Auth (CWE-862) in Seahub API Zip

Missing Authorization (CWE-862) in Maxun Robot APIs

Path Traversal (CWE-22) in File Browser Cleanup Logic

Path Traversal (CWE-22) in SeaweedFS S3 and Iceberg Gateways

Improper Authorization (CWE-863) in File Browser

Path Traversal via Symlinks (CWE-22) in File Browser

Privilege Rule Bypass (CWE-863) in File Browser Shares

Auth Bypass via Proxy Headers (CWE-290) in FileBrowser

Command Injection (CWE-22) in Glances AMP secure_popen

Path Traversal (CWE-22) in Cursor AI Agent Sandbox

Unsafe Pickle Deserialization (CWE-502) in Glances Cache

Command Injection (CWE-78) in Glances KVM Monitor

Path Traversal (CWE-22) in pnpm Stage Download Logic

Command Execution (CWE-78) via pnpm configDependencies abuse

Path Traversal (CWE-23) in pnpm Dependency Aliasing

Path Traversal (CWE-22) in pnpm Patch Application

X.509 Trust-Chain Bypass (CWE-295) in wolfSSL API

SSRF (CWE-918) in ToolJet RestAPI Data Source

Path Traversal (CWE-22) in Trivy OCI Artifact Handling

Server-Side Request Forgery (CWE-918) in LibreChat API

Path Traversal (CWE-22) in HTMLy CMS Autosave Logic

Code Injection (CWE-94) via Vim Python Completion

Command Injection (CWE-78) in Vim netrw file delete

Arbitrary File Write (CWE-73) via 3X-UI DB Import Abuse

Path Traversal (CWE-22) in Winstone Servlet Engine

Command Injection (CWE-78) in Cacti rrdtool graphing

Stored SQL Injection (CWE-89) in Cacti Reports

Pre-auth SQL Injection (CWE-89) in Cacti graph_view.php

SQL Injection (CWE-89) in Cacti rfilter Graph Queries

Unauthenticated LFI (CWE-22) in Cacti Graph Theme IPC

Missing Authorization (CWE-862) in Rocket.Chat Cloud API

Broken Apple JWT Claim Validation (CWE-287) in Rocket.Chat

DOM XSS (CWE-79) in SiYuan Marketplace Cards

SSRF (CWE-918) in Appsmith HTTP Data Source Path

Stored XSS (CWE-79) in SiYuan Attribute-View Renderer

Stored XSS (CWE-79) in SiYuan Bazaar README Renderer

Stored XSS (CWE-79) in SiYuan CSS Snippet Renderer

Path Traversal (CWE-22) in SiYuan /assets Route

Stored XSS (CWE-79) in SiYuan Attribute View Renderer

SSRF to Supervisor RCE (CWE-918) in Appsmith Admin

SQL Injection (CWE-89) in Cacti rfilter Graph Endpoint

Unsafe Deserialization (CWE-502) in MosaicML Composer

Path Traversal (CWE-23) in Gogs Org Repo Storage

Authorization Bypass (CWE-269) in Gogs Repo APIs

Command Injection (CWE-77) in Gogs Git Rebase Merge Flow

SSRF (CWE-918) in Gogs Repository Migration Logic

Input Validation Flaw (CWE-20) in Gogs Mirror Settings

CSRF (CWE-352) in Gogs Org Team Member Management

Broken Access Control (CWE-639) in Gogs Attachments API

Stored XSS (CWE-79) in Gogs .ipynb Markdown Preview

Path Traversal (CWE-22) in Gogs Git Diff Handling

SSRF via Webhook Redirects (CWE-918) in Gogs Git

Missing Authentication (CWE-306) in Aclara Web Interface

Cross-workspace IDOR (CWE-639) in Twenty AI Monitor

SSRF via IPv4-mapped IPv6 (CWE-918) in Mastodon

JavaScript Injection (CWE-79) in Ghost ActivityPub Client

Unauthenticated Command Execution in Rclone rcd API

Path Traversal (CWE-22) in Jellyfin ClientLog Endpoint

OS Command Injection (CWE-78) in Warp WSL URL Fallback

Command Injection (CWE-78) in Warp SSH Metadata Path

Command Injection (CWE-78) in Warp Linux Editor Launcher

Improper File Creation (CWE-73) via OSC 1337 in Warp

Command Injection (CWE-78) in Warp Prompt Branch Selector

Input Validation Flaw (CWE-20) in Warp Link Handling

OS Command Injection (CWE-78) in Warp Agent Tools

XML Entity Expansion (CWE-776) in Docling USPTO Parser

Zip Slip Path Traversal (CWE-22) in Docling EasyOCR

JS Execution & SSRF (CWE-94) in Docling HTML Backend

Unsafe Deserialization (CWE-502) in Feast Registry

GPU Register Data Exposure (CWE-200) on Apple M1

OS Command Injection (CWE-78) in Gemini CLI Launcher

SQL Injection (CWE-89) in n8n Database Workflow Nodes

Missing Auth on SSO Config (CWE-306) in Flowise API

Authorization Flaw (CWE-284) in Capgo Ownership APIs

Authorization Bypass (CWE-269) in Supabase Capgo RPC

Information Exposure (CWE-200) in Capgo Webhooks API

Broken Auth (CWE-287) in Capgo API Key Generation

Authorization Bypass (CWE-863) in Capgo Subkey Scoping

Broken Object Level Authorization (CWE-285) in Capgo

SSO Auth Bypass (CWE-287) in Capgo Provision-User API

Code Injection (CWE-95) via Python pickle payloads

Unsafe Pickle Deserialization (CWE-502) in picklescan

Stored XSS (CWE-79) in FlatPress Comment Handling

Open Redirect (CWE-601) in Poweradmin OIDC and SAML

Polymorphic Deserialization Bypass (CWE-502) in Jackson

AuthZ Bypass (CWE-284) in Traefik Kubernetes Gateway

Privilege Validation Flaw (CWE-863) in rtk Shell Filter

Auth Bypass via Path Normalization (CWE-288) in Traefik

Unsafe Deserialization (CWE-502) in Pivotal CRM

Authorization Bypass (CWE-639) in Daytona Org Roles

Session Caching Flaw (CWE-613) in Daytona Sandbox

Improper OIDC Email Verification (CWE-287) in Daytona

SSRF via Proxy Configuration (CWE-918) in Crawl4AI

SSRF (CWE-918) in Crawl4AI Docker API URL Validation

Code Injection (CWE-94) in Crawl4AI Computed Fields

Unauthenticated GET Data Exposure (CWE-200) in HA Konnected

Covert WebFetch Data Exfiltration (CWE-200) in Claude Code

SSRF (CWE-918) in LobeHub /webapi/proxy Endpoint

SSRF via Redirects (CWE-918) in Open WebUI RAG Fetch

Stored SVG XSS (CWE-79) in Open WebUI Model Profiles

Authorization Bypass (CWE-285) in Open WebUI Models

Stored XSS (CWE-79) via Mermaid SVG in Open WebUI

Broken Access Control (CWE-284) in Open WebUI file API

Server-Side Request Forgery (CWE-918) in Open WebUI

Reflected XSS (CWE-79) in Immich Auth Login Flow

Header Confusion (CWE-287) in Caddy forward_auth

Path Traversal Auth Bypass (CWE-22) in Caddy Server

OS Command Injection (CWE-78) in Deno child_process API

Path Parsing Flaws (CWE-20) in Caddy FastCGI Splitter

Cleartext TLS Fallback (CWE-319) in Deno Node Layer

SQL Injection (CWE-89) in Virtuoso sqlo_untry Component

SQL Injection (CWE-89) in Virtuoso sqlo_try_in_loop

Broken Access Control (CWE-862) in Bootimus Admin API

Unauthenticated File Upload (CWE-400) in Langflow

Path Traversal (CWE-61) in Langflow RAG File Components

IDOR (CWE-639) in Langflow /api/v1/responses Flows

Access Control Flaw (CWE-863) in n8n Shared Workflows

Access Control Flaws (CWE-284/200) in n8n Credentials

Credential Exfiltration (CWE-200) via n8n Node Misuse

Command Injection (CWE-74) in yt-dlp aria2c Handling

Path Traversal (CWE-22) in n8n Git Workflow Node

Input Validation Flaw (CWE-20) in n8n Python Node

Code Injection (CWE-94) in Langflow Public Flows

Authorization Bypass (CWE-639) in n8n OAuth Reconnect

SQL Injection (CWE-89) via n8n Source Control Data Table

IDOR/BOLA Access Control (CWE-639) in Langflow APIs

SQL Injection (CWE-89) in Virtuoso time_t_to_dt

SQL Injection (CWE-89) causing DoS in Virtuoso engine

SQL Injection DoS (CWE-89) in Virtuoso sslr_qst_get

SQL Injection (CWE-89) in Virtuoso st_compare Component

SQL Injection DoS (CWE-89) in Virtuoso sqlo_tb_col_preds

SQL Injection (CWE-89) in Virtuoso Natural Join Logic

SQL Injection (CWE-89) in Virtuoso sqlo_strip_in_join

SQL Injection (CWE-89) in Virtuoso sqlo_key_part_best

SQL Injection (CWE-89) in Virtuoso sqlo_place_dt_set

NoSQL Injection (CWE-89) in n8n MongoDB Node Filters

SQL Injection (CWE-89) in n8n TimescaleDB Workflow Node

Missing Auth on MCP Browser HTTP (CWE-306) in n8n

IDOR (CWE-639) in OpenRemote Bulk Alarm Deletion

Command Injection in SVG Decoder (CWE-78) ImageMagick

Information Disclosure (CWE-200) in Capgo Updates API

SSRF (CWE-918) in Flowise Execute Flow base URL

OS Command Injection (CWE-78) in Flowise MCP Server

Path Traversal (CWE-22) in Crawl4AI Export Endpoints

Authorization Bypass (CWE-269) in Capgo API Key Scope

Authorization Bypass (CWE-639) in Capgo Role Bindings

Undetected Malicious Pickle (CWE-502) in picklescan

Deserialization Bypass (CWE-502) in picklescan Scanner

Unsafe Deserialization (CWE-502) in picklescan Scanner

Undetected Unsafe Pickle Use (CWE-502) in picklescan

Code Injection (CWE-94) via expr-eval toJSFunction API

Bluetooth SDP Parsing (CWE-20) Assertion Panic in Zephyr

GPU Tensor Info Leak (CWE-200) in vLLM GGUF Kernels

Auth Bypass (CWE-444) in vLLM OpenAI API Middleware

Code Injection (CWE-94) in vLLM Model Activation Loader

SSRF Credential Exfiltration (CWE-918) in n8n API

Information Disclosure (CWE-200) in Capgo API Endpoint

Privilege Inversion (CWE-862) in Cap-go Build Logs API

Authorization Bypass (CWE-863) in Flowise Chatflows API

Server-Side Request Forgery (CWE-918) in Crawl4AI

Stored XSS (CWE-79) in Filament RichEditor component

Unsafe Typeless Deserialization (CWE-502) in MessagePack

Stack Overflow via Timestamp Parsing in MessagePack C#

LZ4 Decompression Bounds Error (CWE-20) in MessagePack

Pickle Deserialization Bypass (CWE-502) in picklescan

Unsafe Deserialization (CWE-502) in picklescan Scanner

Unsafe Deserialization (CWE-502) in Picklescan Scanner

SSRF via Host Header Validation (CWE-918) in Astro

Path Traversal (CWE-22) in NLTK nltk.data.load() URLs

Path Traversal (CWE-22) in WebP Server Go on Windows

Reflected XSS (CWE-80) in Astro client directive slots

Host Header Routing Flaw (CWE-187) in Node Proxy

Prototype Pollution to RCE (CWE-94) in Piscina Pool

Code Injection (CWE-94) in protobufjs-cli static output

Path Traversal (CWE-22) in Vite Windows Dev Server

HTTP Header Injection (CWE-113) in aiohttp Multipart

SSRF via URL Validation Bypass (CWE-918) in Angular SSR

Missing AuthZ in WebSocket Session Restore for Chainlit

Markdown Injection (CWE-79) in Angular VS Code Ext

Arbitrary Module Loading (CWE-94) in Angular VS Code Ext

Auth Cache Flaw (CWE-303) in qSnapper D-Bus Service

Auth Cache Flaw (CWE-303) in qSnapper polkit Methods

Path Traversal (CWE-23) in qSnapper Config Handling

Code Injection via Log Path (CWE-94) in MISP JsonLogTool

Session Fixation (CWE-384) in Azure AD OAuth Plugin

Broken Access Control (CWE-639) in MISP Core Data Paths

Broken Bulk Access Control (CWE-862) in MISP Core

Stored XSS (CWE-79) in SiYuan Bazaar Marketplace UI

Missing Authorization (CWE-862) in phpMyFAQ User Admin

Stored XSS (CWE-79) in SiYuan Bazaar Marketplace

Code Injection (CWE-94) in Craft CMS Field Layout

Hardcoded JWT Signing Key (CWE-798) in Crawl4AI

Improper Access Control (CWE-284) in Capgo Org Members API

Information Disclosure (CWE-200) in Capgo RPC API

Privilege Escalation (CWE-269) in Capgo Billing RPC

Unsafe Deserialization (CWE-502) in picklescan Scanner

Unsafe Pickle Deserialization (CWE-502) in picklescan

Undetected Unsafe Deserialization (CWE-502) in picklescan

Missing Authentication (CWE-287) in litellm SSO Debug Flow

SQL Injection (CWE-89) in House-Rental Login Flow

Improper Authentication (CWE-287) in litellm MCP Proxy

Authorization Bypass (CWE-287) in AVideo Meet Upload API

Missing Auth on Payment APIs (CWE-862) in AVideo 26.0

Input Validation Flaw (CWE-20) in vLLM Sparse Embeddings

Code Injection (CWE-94) via Flowise overrideConfig Option

Arbitrary File Upload (CWE-434) in iCagenda Joomla

Authorization Scope Escalation (CWE-269) in Capgo API

IDOR Account Linking Flaw (CWE-639) in Capgo SSO

Info Exposure (CWE-200) in Capgo Supabase Billing RPC

Access Control Flaw (CWE-284) in Capgo Billing RPC API

AuthZ Bypass (CWE-287) via Encoded Paths in Quarkus

Input Validation Flaw (CWE-20) in ProxySQL MCP Tool

PROXY Protocol Parsing (CWE-348) in ProxySQL ACLs

Path Traversal (CWE-22) in Gonic Playlist Handling

Path Traversal IDOR (CWE-22) in Gonic Playlists

Broken Playlist Authorization (CWE-285) in Gonic API

Missing Authorization (CWE-862) in MCP Memory Service

PHAR Deserialization (CWE-502) in PhpWeasyPrint

OS Command Injection (CWE-78) in PhpWeasyPrint PDF Tool

Missing Authentication (CWE-306) in NI grpc-device

Path Traversal (CWE-22) in FileRise Shared Upload API

Stored XSS (CWE-79) in pgAdmin 4 UI rendering flows

Auth Bypass & Unsafe Pickle (CWE-306/502) in pgAdmin 4

SQL Injection (CWE-89) in pgAdmin 4 AI Assistant

SQL Injection (CWE-89) in pgAdmin 4 dialog templates

Path Traversal (CWE-22) in PraisonAI MultiAgentMonitor

Broken Approval Control (CWE-863) in PraisonAI Agents

Path Traversal and SSRF (CWE-22) in Open WebUI Proxy

SAML Signature Validation Flaw (CWE-347) in Relyra

Missing Authentication (CWE-306) in mcp-pinot MCP Server

Authorization Flaw (CWE-284) in conda-smithy Webservices

Path Traversal (CWE-22) in Nanobot WhatsApp Bridge

Hardcoded Default Superuser (CWE-798) in Cassandra

DOM-based XSS (CWE-87) in AutoGPT signup redirect

Missing Authentication (CWE-306) in GAO EPDS/CBCA EDS API

Path Manipulation (CWE-73) in GeoServer Security UI

JNDI Injection (CWE-74) in GeoServer DB2 Extension

SQL Injection (CWE-89) in PIAF-HMS Hotel Management System

Authorization Bypass (CWE-862) in MCP Toolbox APIs

Authentication Bypass (CWE-287) in Google MCP Toolbox

Authentication Bypass (CWE-287) in Google MCP Toolbox

Stored XSS (CWE-79) in Cotonti PFS folder titles

CSRF (CWE-352) in Cotonti Personal File Storage

CSRF (CWE-352) in Cotonti admin rights escalation

CSRF (CWE-352) in Cotonti admin configuration panel

SQL Injection (CWE-89) in bus_info.php Ticket System

Path Injection (CWE-22) in TypeBot File Upload API

SSRF via TOCTOU DNS Rebinding (CWE-918) in TypeBot

IDOR (CWE-639) in TypeBot cross-workspace theme APIs

Sensitive Data Exposure (CWE-200) in Steeltoe Env Actuator

Input Validation (CWE-20) in Steeltoe Eureka Client

Auth Bypass via Host Header (CWE-288) in Steeltoe

Command Injection (CWE-78) in e107 ImageMagick path

HTTP/2 Request Smuggling (CWE-444) in PSL H2 Server

HTTP Request Smuggling (CWE-444) in Tinyproxy

HTTP Request Smuggling (CWE-444) in Tinyproxy Proxy

Missing Authentication (CWE-306) in Network-AI MCP Server

Auth Bypass (CWE-306) in Hermes WebUI Passkey Setup

Auth Bypass (CWE-306) in Hermes Agent WebSockets

SSRF via UNC Paths (CWE-918) in Starlette StaticFiles

TLS Validation Bypass (CWE-295) in undici ProxyAgent

Unauthenticated Pickle RCE (CWE-502) in NVIDIA GEN3C

Unsafe Pickle Deserialization (CWE-502) in picklescan

Path Traversal Data Exfiltration (CWE-22) in picklescan

Expression Injection (CWE-94) in JimuReport API Endpoint

Unsafe Pickle Deserialization (CWE-502) in picklescan

Command Injection (CWE-78) in OpenHuman Shell Allowlist

Missing Authorization (CWE-269) in Azuriom CMS AzLink API

Eval Injection (CWE-95) in Python StateMachine SCXML

Authorization Bypass (CWE-284) in Citrix Cloud Workflows

Path Traversal (CWE-22) in Airflow SFTP Provider

Broken Access Control (CWE-287) in Rocket.Chat uploads

Cross-Site Scripting (CWE-79) in Remark42 Image Proxy

Broken JWT Authorization (CWE-863) in Postiz Skool SSO

Access Control Flaw (CWE-284) in Rocket.Chat Livechat

Zip Slip Path Traversal (CWE-22) in Streambert App

Path Traversal (CWE-73) in ServerCo getssl ACME Handler

Authorization Bypass (CWE-862) in OpenClaw Shell Parser

Insecure Direct Object Reference (CWE-639) in OpenClaw

Allowlist Bypass (CWE-184) in OpenClaw Shell Paths

Exec Allowlist Bypass (CWE-693) in OpenClaw Filters

Sensitive Header Exposure (CWE-522) in OpenClaw MCP

OS Command Injection (CWE-78) in wicked DHCP Client

TLS Certificate Validation Flaw (CWE-295) in Harvester

Auth Bypass via Email Validation (CWE-287) in Forem

SSRF (CWE-918) via IPv4-Mapped IPv6 in Sync-in URL

OS Command Injection (CWE-78) in BrowserStack CLI

Code Injection (CWE-94) in DbGate load-reader Endpoint

Access Control Bypass (CWE-284) in Wasmtime WASI Filesystem

Broken Access Control (CWE-284) in Filestash API

SQL Injection (CWE-89) in grocy stockreports module

Authenticated SSRF (CWE-918) in Koillection Scraper

Server-Side Request Forgery (CWE-918) in Shlink URLs

Access Control Failure (CWE-284) in Firefly III Webhooks

Access Control Failure (CWE-284) in Teedy Share Reads

Privilege Escalation (CWE-284) in statping-ng Core

Reflected XSS (CWE-79) in Wastebin highlight module

Broken Access Control (CWE-284) in Bonsai v6.0

Code Injection (CWE-94) in YouTransfer Sendmail

Directory Traversal (CWE-22) in Zhoros SuperBin 1.0.0

Access Control Failure (CWE-284) in Deck9 Webhooks

OS Command Injection (CWE-78) in Reminiscence

Arbitrary File Upload (CWE-434) in Flatnotes 5.5.4

Code Injection (CWE-94) in Selfoss Loopback Handler

OS Command Injection (CWE-94) in Reminiscence

Information Disclosure (CWE-200) in Whoogle Config API

Directory Traversal (CWE-22) in Bludit plugin API

SQL Injection (CWE-89) in Metacat Harvester Endpoint

SQL Injection (CWE-89) in Datadog Vector Query Logic

Information Disclosure (CWE-200) in Observe CSV Export

Path Traversal and RCE (CWE-73) in SNMP4J-Agent

SQL Injection (CWE-89) in RuoYi Code Generation Module

Missing Auth Checks (CWE-862) in Bludit API Upload

Command Injection (CWE-78) in Tenda 5G03 IMS APN Handler

Command Injection (CWE-78) in Tenda 5G03 Dial Feature

OS Command Injection (CWE-78) in Tenda 5G03 Router

OS Command Injection (CWE-78) in Tenda 5G03 Router

OS Command Injection (CWE-78) in Tenda 5G03 Router

OS Command Injection (CWE-78) in Tenda 5G03 Router

Time-Based SQL Injection (CWE-89) in OpenSIPS Panel

Privilege Escalation (CWE-269) in MEmu MemuService.exe

Code Injection (CWE-94) in remotion-dev remotion v4.0.409

Authorization Bypass (CWE-863) in Mastodon Collections

Authorization Bypass (CWE-285) in ShopXO Cron API Tasks

Path Traversal (CWE-22) in Microweber API Endpoint

Command Injection (CWE-77) in Ruijie EG105G-P Router

Command Injection (CWE-77) in GL.iNet GL-MT3000 Router

Command Injection (CWE-77) in GL.iNet Tor Proxy Handler

Command Injection (CWE-78) in Perl Config::IniFiles

OS Command Injection (CWE-78) in Perl GD File Handling

Improper Authentication (CWE-287) in BUK TS-G System

Missing Authentication (CWE-306) in Capgo Account Deletion

Authorization Bypass (CWE-863) in OpenClaw QQBot Commands

Authorization Bypass (CWE-863) in OpenClaw Commands

TOCTOU Command Injection (CWE-367) in OpenClaw Shell

Missing Authorization (CWE-862) in OpenClaw WebSockets

Stored XSS (CWE-79) in ApostropheCMS SEO Scripts

Path Traversal (CWE-22) in Nezha Monitoring Dashboard

CSRF (CWE-352) in Nezha Monitoring Cron Execution

Missing Authorization (CWE-862) in Nezha Monitoring

Authorization Bypass (CWE-863) in Nezha Monitoring

SSRF and Privilege Issue (CWE-918) in Nezha Dashboard

Cron Command Abuse (CWE-78) in Nezha Monitoring

Command Injection via OSC Color Control in Kitty Terminal

Host Header Abuse (CWE-640) in ApostropheCMS Reset

Authenticated SSRF (CWE-918) in ApostropheCMS widgets

Stored XSS (CWE-79) in ApostropheCMS image widget

Stored XSS (CWE-79) via xmp Sanitizer Bypass in Node.js

Information Exposure (CWE-200) in Discourse MessageBus

SSRF (CWE-918) via Podcast Enclosure URLs in Koel

Code Injection (CWE-94) in Kitty GPU Terminal Emulator

Command Injection (CWE-77) in Kitty GPU Terminal

Missing Authorization (CWE-862) in Naxclow Relay API

Authorization Bypass (CWE-639) in Naxclow Device Binding

OS Command Injection (CWE-78) in MariaDB Galera SST

Command Injection (CWE-78) in MariaDB SST Donor Node

SQL Injection (CWE-89) via Big5 Escaping in MariaDB

OS Command Injection (CWE-78) in MariaDB CONNECT REST

Command Injection (CWE-78) in MariaDB SST Donor Handling

Missing Re-Authentication (CWE-306) in Cap-go Email Change

Hard-coded Crypto Keys (CWE-321) in Aqara Home App

Broken Crypto (CWE-327) in Aqara IAM/SSO Gateway

Missing Authentication (CWE-306) in Aqara MQTT Service

Missing Authorization (CWE-862) in Aqara Cloud API

Hard-coded OAuth Credentials (CWE-798) in Aqara IAM

Missing Authorization (CWE-862) in Yarbo Cloud Fleet Control

Code Injection (CWE-94) in jmespath.php CompilerRuntime

Route-rule Middleware Bypass (CWE-178) in Nuxt Router

Hard-Coded MQTT Credentials (CWE-798) in Yarbo Apps

SQL Injection (CWE-89) in ClipBucket Subtitle Editor

Blind SQL Injection (CWE-89) in ClipBucket v5 API

OS Command Injection (CWE-78) in ClipBucket v5

IPv6 Subnet Rule Bypass (CWE-284) in Netty Handler

Missing Authorization (CWE-862) in OpenClaw Node Events

Server-Side Request Forgery (CWE-918) in OpenClaw

Authorization Bypass (CWE-863) in OpenClaw Telegram Bot

Missing Authentication (CWE-306) in Brickcom Cameras

SSRF (CWE-918) in Summarize Podcast Transcript Fetching

Missing Authentication (CWE-306) in Hermes WebUI Setup

Stored XSS (CWE-79) via SVG Logo Upload in SolidInvoice

Code Injection (CWE-94) via Vim Python omni-completion

Code Injection (CWE-94) in Vim Python Omni-Completion

Command Injection (CWE-78) in KanaDojo Release Workflow

SSRF (CWE-918) in Garlic-Hub UploadFromUrl Endpoint

Code injection (CWE-94) via netrw history in Vim

Broken Access Control (CWE-863) in MCP K8s Server

Command Injection (CWE-78) via wsrep_notify_cmd in MariaDB

Server-Side Request Forgery (CWE-918) in Fediverse Embeds

Path Traversal (CWE-22) in Node.js tmp file creator

Path Traversal (CWE-22) in Node.js tmp Temp Creator

Prototype Pollution Gadget (CWE-1321) in Axios Client

SSRF via IPv4-Mapped IPv6 (CWE-918) in Axios

Proxy Credential Exposure (CWE-200) in Axios HTTP Client

Path Traversal (CWE-22) in Perry Artifact Handling

SQL Injection (CWE-89) in thaipalliative_lte ezform.php

Path Traversal (CWE-22) in Keras Archive Extraction

Path Traversal (CWE-22) in Dulwich Git Submodule Update

Input Validation Flaw (CWE-20) in ImageMagick DCM Decoder

Path Traversal (CWE-22) in Boxlite OCI Image Handling

Capability Misconfiguration (CWE-284) in Boxlite Sandbox

Stored XSS (CWE-79) in Xibo CMS Data Connector Chain

Path Traversal (CWE-22) in Dulwich Git on Windows

SSRF via Incomplete IPv4 URL Validation in Fedify

Input Validation (CWE-20) in Russh SSH Message Handling

Resource Exhaustion (CWE-400) in libp2p Gossipsub Nodes

Input Validation Flaw (CWE-20) in OpenVM Pairing Check

Input Validation Flaw (CWE-20) in libp2p Kademlia DHT

Insecure Direct Object Reference (CWE-639) in Sharp

Command Injection (CWE-77) in Atril PDF Link Handling

Privilege Misconfiguration (CWE-269) in Fission Pods

Path Traversal (CWE-22) in Fission Fetcher Zip Handling

Privilege Misconfiguration (CWE-250) in Fission RBAC

Pod Security Bypass (CWE-284) in Fission Environment CRD

Podspec Privilege Escalation (CWE-269) in Fission Executor

PodSpec Privilege Escalation (CWE-284) in Fission

Authorization Bypass (CWE-284) in Fission Functions

Authorization flaw (CWE-284) in Fission function specs

Authorization Bypass (CWE-284) in Fission KWT Triggers

Improper Namespace Validation (CWE-441) in Fission

Authorization Bypass (CWE-284) in Fission Router

Missing Authentication (CWE-306) in Fission storagesvc API

Path Parsing Flaws (CWE-20) in FrankenPHP CGI Router

OS Command Injection (CWE-78) in AWS CDK NodejsFunction

Cross-Workspace Access Control (CWE-639) in Plane

Path Traversal (CWE-22) in Roxy-WI Config File Handling

Auth Bypass (CWE-287) in Roxy-WI API GPT Endpoint

Input Validation Flaws (CWE-20) in Roxy-WI EscapedString

Path Traversal (CWE-59) in assisted-migration-agent

TLS Certificate Validation Flaw (CWE-295) in Migration Agent

SQL Injection (CWE-89) via RVTools XLSX in migration-planner

Stored Cross-Site Scripting (CWE-79) in Migration Planner

Broken JWT Authorization (CWE-639) in migration-planner

IDOR Access Control Flaw (CWE-639) in migration-planner

Missing Authorization (CWE-306) in migration-planner API

OS Command Injection (CWE-78) in Roxy-WI Config Save Path

Config Injection RCE (CWE-94) in Roxy-WI HAProxy Manager

Path Traversal RCE (CWE-22) in Roxy-WI WAF Rule Upload

Broken Access Control (CWE-639) in Roxy-WI Install APIs

Broken Access Control (CWE-639) in Roxy-WI Monitor Checks

Missing Authorization Checks (CWE-862) in Roxy-WI Agent

SQL Injection (CWE-89) in Ghidra BSim Filter Queries

Path Traversal (CWE-22) in Ghidra Theme Import Feature

Path Traversal (CWE-22) in Ghidra Extension Installer

Unsafe RMI Deserialization (CWE-502) in Ghidra Projects

SQL Injection (CWE-89) in Ghidra Postgres Password Logic

TEE Memory Exposure (CWE-200) in Espressif ESP-IDF

Input Validation Flaws (CWE-20) in ESP-IDF TEE Services

Stored XSS (CWE-79) in OpenEMR prescription multiprint

Remote Code Execution (CWE-94) via LMDeploy HF Loading

Path Traversal (CWE-22) in SimpleSAMLphp CAS Ticket Store

Code Injection (CWE-94) in LMDeploy Model Loading Logic

Path Traversal (CWE-22) in Pipecat Dev File Server

Access Control Failure (CWE-284) in SEMCMS_copy.php

Authentication Bypass (CWE-287) in Bookcars JWT Handling

Path Traversal (CWE-22) in Bookcars create-user API

Privilege Misconfiguration (CWE-284) in Bookcars v8.3

User Info Disclosure (CWE-200) in AgentChat API

SQL Injection (CWE-89) in LimeSurvey RemoteControl API

Command Injection (CWE-78) via Git config in Hermes WebUI

Path Traversal (CWE-22) in Hermes WebUI Workspace Logic

Heap Corruption via Negative Length (CWE-122) in FreeSWITCH

STUN Attribute OOB Memory Access (CWE-787) in FreeSWITCH

Stored XSS (CWE-80) in md-fileserver Markdown Engine

XML Entity Expansion (CWE-776) in FreeSWITCH Parser

OS Command Injection (CWE-78) in DedeCMS File Manager

Missing Authorization (CWE-862) in Mem0 Config API

OS Command Injection (CWE-78) in Ivanti Sentry

Session Fixation (CWE-384) in Catalyst Authentication

Command Injection (CWE-78) in degit Git Repository Handling

Improper Authentication (CWE-287) in Taier Source Test

Authorization Bypass (CWE-639) in WACRM Automation Engine

Path Traversal Auth Bypass (CWE-22) in Headplane UI

OS Command Injection (CWE-78) in Nginx Proxy Manager

SQL Injection (CWE-89) in Student Attendance System

Eval Injection (CWE-94) in YesWiki Bazar CalcField

XML Injection (CWE-91) in samlify SAML Assertion Templates

Code Injection (CWE-94) in AgentCore CLI Collaboration Flow

OS Command Injection (CWE-78) in Tenda F451 Router

Access Control Flaw (CWE-863) in Snipe-IT User Edit Flow

Path Traversal (CWE-22) in AdGuard Home GL.iNet Auth

SQL Injection (CWE-89) in Student Admin Login Panel

SQL Injection (CWE-89) in Student Login Endpoint

Broken Access Control (CWE-285) in Bludit Sessions

Missing Authorization (CWE-862) in Flowise Vector API

Code Injection (CWE-94) in Flowise Custom JS Function

Mass Assignment (CWE-915) in Flowise Assistant API

Plaintext Credential Validation (CWE-522) in Flowise UI

Mass Assignment (CWE-915) in Flowise Chatflow Update

Mass Assignment (CWE-915) in FlowiseAI Variables API

Improper Access Control (CWE-863) in Keycloak FGAP

SQL Injection (CWE-89) in Hospital Patient Records App

SQL Injection (CWE-89) in Online Music Site Search

SQL Injection (CWE-89) in Online Music Site Admin API

SQL Injection (CWE-89) in Flight Booking checkUser.php

SQL Injection (CWE-89) in Class Exam Timetabling App

SQL Injection (CWE-89) in Class Exam Timetabling App

SQL Injection (CWE-89) in Class Timetabling System

SQL Injection (CWE-89) in Class Exam Timetabling System

SQL Injection (CWE-89) in Class Exam Timetabling System

Unrestricted File Upload (CWE-434) in Student System

SQL Injection (CWE-89) in Exam Timetabling Password Field

SQL Injection (CWE-89) in Class Exam Timetable Login

Improper Authorization (CWE-285) in BeikeShop Stripe Plugin Callback

Improper Input Validation (CWE-20) in Boost Serialization ≤ 1.91

Injection in JimuReport Test-Connection Endpoint (CWE-74) in JeeWMS

SQL Injection (CWE-89) via gblOrgID in Chanjet CRM HTTP GET Handler

OS Command Injection (CWE-77) in GL.iNet GL-MT3000 SET_USER_PWD Handler

OS Command Injection via Unsanitized Argument (CWE-77) in GL.iNet GL-MT3000 FTP Protocol Handler

Command Injection via Path Normalization Handler (CWE-77) in GL.iNet GL-MT3000 RPC Interface

SQL Injection (CWE-89) in Jinher OA nextselectplan.aspx httpOID Parameter

Arbitrary File Upload (CWE-434) in MDJM Event Management WordPress Plugin

Local File Inclusion (CWE-22) in WP User Manager Profile Template Scope

Path Traversal (CWE-22) in MoviePilot Cloud Storage Download Handlers

JavaScript Code Injection (CWE-95) in Markdown Preview Enhanced WaveDrom Renderer

SQL Injection (CWE-89) in Open XDMoD Metrics Platform

OS Command Injection (CWE-78) in Open XDMoD Web Server

Cross-Origin Cookie Leakage (CWE-200) in AsyncHttpClient Redirect Handling

Case-Sensitive Content-Type Bypass (CWE-178) Enabling HTML Upload in HAX CMS

Broken Client Authentication Logic (CWE-287) in UDS Identity Config Keycloak Authenticator

Eval Injection in WaveDrom Diagram Parsing (CWE-95) in Markdown Preview Enhanced

Server-Side Code Injection (CWE-94) in Markdown Preview Enhanced Bitfield Code Blocks

OS Command Injection (CWE-78) in Markdown Preview Enhanced Diagram and LaTeX Handling

OS Command Injection (CWE-78) in Termix File Manager SSH Path Resolution

Insufficient MFA Enforcement (CWE-308) in Termix TOTP Management Endpoints

OS Command Injection (CWE-78) in Termix SSH Tunnel Connect Endpoint

Broken Access Control via Session ID (CWE-284) in Termix File Manager

Improper TLS Certificate Validation (CWE-295) in Termix Desktop Electron Client

OS Command Injection (CWE-78) in Termix SSH File Manager Path Resolution

Broken Session Authorization (CWE-639) in Termix File Manager Endpoints

Missing Authentication (CWE-306) on WebRTC Ingest Endpoint in TinyIce Streaming Server

Improper Input Validation (CWE-20) Enabling Netty Channel Shutdown in Cloudburst Network

Input Validation Flaw (CWE-20) in Controller Externalizable

Path Traversal (CWE-22) in Controller Backup Datastore

Unrestricted File Upload (CWE-434) in Vehicle Management System New Driver Registration

SQL Injection (CWE-89) via room Parameter in Hotel and Tourism Reservation System /details.php

SQL Injection (CWE-89) in CollegeManagementSystem fetch.php Endpoint

Broken Authentication (CWE-287) in Redline WR3200 Router

Stored Cross-Site Scripting (CWE-79) in Chartbrew Tooltip Rendering

Code Injection via Insecure GitHub Actions Workflow (CWE-94) in CoreShop Static Analysis Pipeline

Injection in BIND Zone Generation (CWE-74) via TXT Records in Froxlor DomainZones.add API

Insecure .NET Deserialization (CWE-502) in BarTender DataServiceSingleton Remoting Endpoint

OS Command Injection (CWE-78) via Mirror-Controlled Version Strings in nvm (Node Version Manager)

OS Command Injection and Information Exposure (CWE-78, CWE-200) in Neterbit NW-431F Router at_command.asp Interface

Stored Cross-Site Scripting (CWE-79) in Neterbit NW-431F Router SMS Module

OS Command Injection (CWE-78) in Neterbit NW-431F Router Network Diagnosis Module

Improper Authentication via Predictable Cookie (CWE-384) in Neterbit NW-431F Router

Unauthenticated SSRF via Image Hash Lookup (CWE-918) in Tautulli Image Proxy Endpoint

Cross-Site Request Forgery (CWE-352) in Tautulli Admin Configuration Endpoint

Stored Cross-Site Scripting (CWE-79) in Tautulli Log Viewer Endpoint

OS Command Injection via Undocumented Debug CGI Endpoint (CWE-78) in T3 Technology CPE Routers

Hardcoded Superadmin Root Password (CWE-259) in T3 CPE

Access Control Flaw (CWE-284) in T3 CPE Web Interface

Input Validation Flaw (CWE-20) in Correlations Ordering

Improper Authorization Enabling Remote Code Execution (CWE-863) in OpenStack Mistral API

Improper Authentication (CWE-287) in ealpha072 Student-Management-System Administrative Backend

Server-Side Request Forgery (CWE-918) in crmeb_java base64 QR Code Endpoint

Information Exposure via Uninitialized Memory (CWE-200) in Mercusys AC12G UPnP Handler

Predictable Cryptography and Static Nonce (CWE-327) in Mercusys AC12G Router Authentication

Improper Rate Limiting (CWE-307) on TDDP Password Change Endpoint in Mercusys AC12G Router

Hardcoded Cryptographic Key (CWE-798) in Mercusys AC12G Configuration Backups

Missing Authentication for Critical UPnP Actions (CWE-306) in Mercusys AC12G Router

OS Command Injection (CWE-78) in docker-wkhtmltopdf-aas app.py HTTP Handler

Missing Input Validation (CWE-20) in FRRouting BGP UPDATE Processing

SQL Injection (CWE-89) in Pizzafy E-Commerce System Administrative Login

Remote File Inclusion via Controllable Include (CWE-73) in Online Food Ordering System index.php

Improper Authorization (CWE-863) in LibreChat Cross-Agent File Deletion

Sandbox Escape via Improper Authorization (CWE-863) in alf.io Extension Script Engine

Environment Variable Exposure via URL Interpolation (CWE-200) in LibreChat MCP Server Integration

Broken Access Control via IDOR (CWE-862) in LibreChat API Key Management

Authentication Bypass via Source Stage Skipping (CWE-287) in authentik Identity Provider

Improper Authentication (CWE-287) in authentik Source Connections

Code Injection via Unsafe Dynamic Evaluation (CWE-94) in BrowserStack Runner /_log Handler

XML Signature Wrapping / Improper Input Validation (CWE-20) in authentik SAML Source ACS

Cross-Site Scripting (CWE-79) in authentik AutosubmitStage SFE Flow

SQL Injection (CWE-89) in Student Admission System /index.php Parameters eid/did

Improper Authentication (CWE-287) in sayan365 Student Management System

Server-Side Request Forgery (CWE-918) in Medplum FHIR Subscription Worker

Chained Unsafe Deserialization (CWE-502) via Framework Mode in React Router 7

HTTP Response Header Injection (CWE-113) in CrowCpp Crow Web Framework

Client-Side Cross-Site Scripting (CWE-79) in React Router RSC Redirect Handling

Missing Authentication (CWE-287) in GoClaw Webhook Verification Handler

Improper Access Control on Sandbox Configuration (CWE-284) in OpenClaude BashTool

Dynamic Code Loading via Untrusted ML Models (CWE-94) in OpenMed PII Privacy Filter

Uncaught Parser Panic on Malformed MongoDB Messages (CWE-248) in OpenTelemetry eBPF Instrumentation

Improper Input Validation (CWE-20) in OpenTelemetry eBPF Postgres Protocol Parser

Server-Side reStructuredText Rendering Information Exposure (CWE-200) in NiceGUI ui.restructured_text()

Authentication Bypass (CWE-287) in MISP LDAP OTP Flow

Authentication Bypass via Path-Based Exemptions (CWE-863) in Prefect 3.6.19 Control Plane Endpoints

LLM SQL Injection in Langroid SQLChatAgent

SQL Injection in Kiteworks Secure Data Forms

Cross-Site Scripting (XSS) in Kiteworks Secure Data Forms

SQL Injection in Hotel and Tourism Reservation System

SQL Injection in No-Cms manage_privilege Export Endpoint

Path Traversal in Banana Slides AI Image Backend

Cross-Site Scripting (XSS) in Kiteworks Secure Data Forms

Improper Authentication in Hotel and Tourism Reservation

Unsafe Deserialization in AITER ZMQ MessageQueue.recv

SQL Injection in Nextcloud Tables App

SQL Injection in Nextcloud Tables App

Broken Access Control in Nextcloud Server

Path Traversal in F5-TTS Gradio Finetune Handlers

Improper Access Control on xApp Identification (CWE-284) in FlexRIC E2 Interface

Improper Authorization via TenantResource RawItems (CWE-863) in Capsule Kubernetes Multi-Tenancy Controller

Missing Authentication in Enderfga claw-orchestrator

SSRF in mcpilot MCP API Call Endpoint

Command Injection (CWE-77) in Node.js launch-editor

Improper Input Validation in Linux Kernel CIFS cifs.spnego

Improper Authentication in Nextcloud User OIDC ID4me

CI/CD Code Injection in CloudPirates Helm Charts

CI/CD Code Execution in CloudPirates Helm Charts

Cross-Origin WebSocket Hijacking in Cline Kanban Servers

Unsafe Deserialization in ESA AnomalyMatch Checkpoint

OS Command Injection in php-censor Webhook GitBuild Handler

SQL Injection in SourceCodester Computer Repair Shop

SQL Injection in Real State Services Login Component

SQL Injection in CodeAstro Online Job Portal

SQL Injection in CodeAstro Online Job Portal Admin Job

Path Traversal in Vertex PT Management Video Streaming Tool

SQL Injection in Online House Rental System

SQL Injection in Online House Rental System

SQL Injection in Online House Rental System login endpoint

SQL Injection in Online Blood Bank Management System

SQL Injection in Online Blood Bank Management System

Unsafe Deserialization (CWE-502) in Apache Airflow Scheduler DeadlineReference Decoder

Unsafe XCom Deserialization & Forbidden Key Bypass (CWE-502) in Apache Airflow Triggerer

Authorization Bypass via Inconsistent Resource Scoping (CWE-639) in Apache Airflow Bulk Task Instances API

Open Redirect (CWE-601) in Apache Airflow Login Redirect Route

Missing Authentication in Smart Parking System Admin

Improper Authorization in Water Billing Management System

SQL Injection in User Creation Handler of PHP Student

SQL Injection in PHP Student Management System delete.php

SQL Injection in PHP Student Management System Login Handler