Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Group: attack-types Clear

ID	Title	Severity	Tags	Detected
CVE-2025-71392	Command Injection in privilege-escalation (CVE-2025-71392) command injection in privilege-escalation (CVE-2025-71392). Successful exploitation can lead to full system takeover.	High	Privilege Escalation Cwe 77 Surrealdb	1 month ago
CVE-2024-58369	Vulnerability in dos (CVE-2024-58369) vulnerability in dos (CVE-2024-58369). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 248 Surrealdb	1 month ago
CVE-2025-71395	Vulnerability in dos (CVE-2025-71395) vulnerability in dos (CVE-2025-71395). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 789 Surrealdb	1 month ago
CVE-2024-58364	Vulnerability in dos (CVE-2024-58364) vulnerability in dos (CVE-2024-58364). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 248 Surrealdb	1 month ago
CVE-2024-58368	SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST... SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST...	High	Cwe 248 Surrealdb HTTP Denial of Service	1 month ago
CVE-2024-58362	SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the... SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the...	High	Cwe 75 Remote Code Execution Surrealdb Rpc Api	1 month ago
CVE-2024-58366	SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception:... SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception:...	High	Cwe 134 Surrealdb Remote Code Execution Delskayn +1	1 month ago
CVE-2024-58357	Vulnerability in dos (CVE-2024-58357) vulnerability in dos (CVE-2024-58357). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 248 Surrealdb	1 month ago
CVE-2024-58358	Vulnerability in dos (CVE-2024-58358) vulnerability in dos (CVE-2024-58358). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 248 Surrealdb	1 month ago
CVE-2024-58359	Vulnerability in dos (CVE-2024-58359) vulnerability in dos (CVE-2024-58359). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 248 Surrealdb	1 month ago
CVE-2023-54366	SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT,... SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT,...	High	Cwe 276 Surrealdb Privilege Escalation	1 month ago
CVE-2026-9147	uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file... uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file...	High	Python Cwe 94 Remote Code Execution	1 month ago
CVE-2026-15631	Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in... Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapse...	High	Path Traversal Cwe 22 Fastify Nodejs +2	1 month ago
CVE-2026-16088	Path Traversal in path-traversal (CVE-2026-16088) path traversal in path-traversal (CVE-2026-16088). Risk of unauthorized operations or information disclosure.	Medium	Java Path Traversal Cwe 22	1 month ago
CVE-2026-47869	Code Injection in broadcom (CVE-2026-47869) code injection in broadcom (CVE-2026-47869). Confidential information can be exposed externally. Mitigation: upgrade to `32.1.2` or later.	High	Remote Code Execution Cwe 94 Broadcom Vmware Avi Load Balancer	1 month ago
CVE-2026-47871	Path Traversal in path-traversal (CVE-2026-47871) path traversal in path-traversal (CVE-2026-47871). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `32.1.2` or later.	High	Path Traversal Cwe 22 Broadcom Vmware Avi Load Balancer	1 month ago
CVE-2026-47868	Privilege Escalation in privilege-escalation (CVE-2026-47868) vulnerability in privilege-escalation (CVE-2026-47868). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `32.1.2` or later.	High	Privilege Escalation Cwe 269 Broadcom Vmware Avi Load Balancer	1 month ago
CVE-2026-47870	Privilege Escalation in privilege-escalation (CVE-2026-47870) vulnerability in privilege-escalation (CVE-2026-47870). Confidential information can be exposed externally. Mitigation: upgrade to `32.1.2` or later.	High	Privilege Escalation Cwe 269 Broadcom Vmware Avi Load Balancer	1 month ago
CVE-2026-16083	Authentication Bypass in CVE-2026-16083 (CVE-2026-16083) authentication bypass in CVE-2026-16083 (CVE-2026-16083). Risk of unauthorized operations or information disclosure.	Medium	Authentication Bypass Cwe 287 Cwe 294	1 month ago
CVE-2026-47865	Authentication Bypass in broadcom (CVE-2026-47865) authentication bypass in broadcom (CVE-2026-47865). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `31.2.2-2p3` or later.	Critical	Authentication Bypass Cwe 287 Broadcom Vmware Avi Load Balancer	1 month ago
CVE-2026-47867	Code Injection in broadcom (CVE-2026-47867) code injection in broadcom (CVE-2026-47867). Confidential information can be exposed externally. Mitigation: upgrade to `32.1.2` or later.	High	Remote Code Execution Cwe 94 Broadcom Vmware Avi Load Balancer	1 month ago
CVE-2026-16076	Authentication Bypass in CVE-2026-16076 (CVE-2026-16076) authentication bypass in CVE-2026-16076 (CVE-2026-16076). Risk of unauthorized operations or information disclosure.	Medium	Authentication Bypass Cwe 287 Cwe 290	1 month ago
CVE-2026-57980	Vulnerability in microsoft (CVE-2026-57980) vulnerability in microsoft (CVE-2026-57980). Risk of unauthorized operations or information disclosure.	Medium	Authentication Bypass Cwe 288 Microsoft Edge Chromium	1 month ago
CVE-2026-56741	Vulnerability in org.jline:jline-remote-telnet (CVE-2026-56741) vulnerability in org.jline:jline-remote-telnet (CVE-2026-56741). Risk of unauthorized operations or information disclosure. Exploitable via ``Telnet``. Mitigation: upgrade to `4.2.1` or later.	High	Java Denial of Service Cwe 400 Jline	1 month ago
CVE-2026-52348	cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.	Critical	Java SQL Injection Cwe 89	1 month ago
CVE-2026-54570	Vulnerability in AngleSharp (CVE-2026-54570) vulnerability in AngleSharp (CVE-2026-54570). Data can be tampered with by attackers. Exploitable via ``MathAnnotationXmlElement``. Mitigation: upgrade to `1.5.0` or later.	Medium	C# Cross-Site Scripting Cwe 80	1 month ago
CVE-2026-8505	Vulnerability in langflow (CVE-2026-8505) vulnerability in langflow (CVE-2026-8505). Successful exploitation can lead to full system takeover.	Critical	Remote Code Execution Cwe 306 Langflow Apple +5	1 month ago
CVE-2026-8859	Path Traversal in path-traversal (CVE-2026-8859) path traversal in path-traversal (CVE-2026-8859). Successful exploitation can lead to full system takeover.	Critical	Path Traversal Cwe 22 Langflow Apple +5	1 month ago
CVE-2026-7755	IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to... IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to...	High	Remote Code Execution Cwe 94 Langflow Apple +6	1 month ago
CVE-2026-8056	IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters... IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters...	High	Cwe 94 Remote Code Execution Langflow Apple +5	1 month ago
CVE-2026-8476	Unsafe Deserialization in langflow (CVE-2026-8476) vulnerability in langflow (CVE-2026-8476). Successful exploitation can lead to full system takeover.	Critical	Python Remote Code Execution Cwe 502 Langflow +6	1 month ago
CVE-2026-8481	Code Injection in c (CVE-2026-8481) code injection in c (CVE-2026-8481). Successful exploitation can lead to full system takeover. Exploitable via `POST /api/v1/validate/code`.	Critical	Python C Remote Code Execution Cwe 94 +7	1 month ago
CVE-2026-7771	Vulnerability in dos (CVE-2026-7771) vulnerability in dos (CVE-2026-7771). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 835 Ibm Db2	1 month ago
CVE-2026-7667	IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow... IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow...	High	Cwe 22 Remote Code Execution Langflow Apple +5	1 month ago
CVE-2026-7754	IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery ... IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery ...	High	Server-Side Request Forgery Cwe 918 Langflow Apple +5	1 month ago
CVE-2026-63030 KEV	WordPress Core — WordPress Core Interpretation Conflict Vulnerability WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.	Critical	WordPress Remote Code Execution SQL Injection Cwe 436 +10	1 month ago
CVE-2026-60137 KEV	[KEV] SQL Injection in Wordpress sqli (CVE-2026-60137) SQL injection in Wordpress sqli (CVE-2026-60137). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.	Medium	WordPress SQL Injection Cwe 89	1 month ago
CVE-2026-51833	SSRF (Server-Side Request Forgery) in ssrf (CVE-2026-51833) SSRF in ssrf (CVE-2026-51833). Confidential information can be exposed externally.	High	Server-Side Request Forgery Cwe 918	1 month ago
CVE-2026-14979	Vulnerability in dos (CVE-2026-14979) vulnerability in dos (CVE-2026-14979). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 776 Ibm Engineering Lifecycle Management	1 month ago
CVE-2026-13448	Vulnerability in langflow (CVE-2026-13448) vulnerability in langflow (CVE-2026-13448). Successful exploitation can lead to full system takeover.	High	Remote Code Execution Langflow Apple macOS +5	1 month ago
CVE-2026-15415	Vulnerability in Amazon aws (CVE-2026-15415) vulnerability in Amazon aws (CVE-2026-15415). Data can be tampered with by attackers.	Medium	AWS Amazon Cloud Path Traversal +1	1 month ago
CVE-2026-9171	Vulnerability in dos (CVE-2026-9171) vulnerability in dos (CVE-2026-9171). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 400 Ibm Powervm Novalink	1 month ago
CVE-2026-16073	Cross-Site Scripting (XSS) in CVE-2026-16073 (CVE-2026-16073) cross-site scripting in CVE-2026-16073 (CVE-2026-16073). Risk of unauthorized operations or information disclosure.	Low	Cross-Site Scripting Cwe 79 Cwe 94	1 month ago
CVE-2026-9198 KEV	[KEV] Code Injection in Ibm langflow (CVE-2026-9198) code injection in Ibm langflow (CVE-2026-9198). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Remote Code Execution Cwe 94 Langflow	1 month ago
CVE-2026-9202	Vulnerability in langflow (CVE-2026-9202) vulnerability in langflow (CVE-2026-9202). Successful exploitation can lead to full system takeover.	Critical	Remote Code Execution Cwe 306 Langflow	1 month ago
CVE-2026-9586	SQL Injection in sqli (CVE-2026-9586) SQL injection in sqli (CVE-2026-9586). Risk of unauthorized operations or information disclosure.		Remote Code Execution SQL Injection Cwe 89	1 month ago
CVE-2026-9762	Code Injection in ibm (CVE-2026-9762) code injection in ibm (CVE-2026-9762). Successful exploitation can lead to full system takeover.	High	Remote Code Execution Cwe 94 Ibm Db2	1 month ago
CVE-2026-9588	Cross-Site Scripting (XSS) in CVE-2026-9588 (CVE-2026-9588) cross-site scripting in CVE-2026-9588 (CVE-2026-9588). Risk of unauthorized operations or information disclosure.		JavaScript Cross-Site Scripting Cwe 79	1 month ago
CVE-2026-9585	Cross-Site Scripting (XSS) in CVE-2026-9585 (CVE-2026-9585) cross-site scripting in CVE-2026-9585 (CVE-2026-9585). Risk of unauthorized operations or information disclosure.		JavaScript Cross-Site Scripting Cwe 79	1 month ago
CVE-2026-8297	SQL Injection in sqli (CVE-2026-8297) SQL injection in sqli (CVE-2026-8297). Successful exploitation can lead to full system takeover.	Critical	SQL Injection Cwe 89	1 month ago

Vulnerabilities

🍪 About cookies