CVE-2026-73226 | High | 8.8 | 2026-08-11 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client… |
CVE-2026-53753 | Critical | 9.8 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST… |
CVE-2026-48775 | Medium | 6.8 | 2026-06-16 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and p… |
CVE-2026-47210 | Critical | 9.8 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host proces… |
CVE-2026-47208 | Critical | 10.0 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code w… |
CVE-2026-47137 | Critical | 10.0 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 26… |
CVE-2026-47131 | Critical | 10.0 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.cal… |
CVE-2026-48700 | | | 2026-05-22 | An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.Sho… |
CVE-2026-44336 | Critical | 9.6 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-han… |
CVE-2026-7381 | Critical | 9.1 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting.
Plack::Middleware::XSendfile allows the variation se… |
CVE-2026-5251 | Medium | 6.3 | 2026-04-01 | A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoi… |
CVE-2026-5248 | Medium | 6.3 | 2026-04-01 | A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the compo… |
CVE-2026-34156 | Critical | 9.9 | 2026-03-31 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow S… |
CVE-2026-33286 | Critical | 9.1 | 2026-03-24 | Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execu… |
CVE-2025-69219 | High | 8.8 | 2026-03-09 | A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same… |
CVE-2026-25049 | Critical | 9.9 | 2026-02-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows c… |
CVE-2026-1770 | | | 2026-02-02 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2026-23830 | Critical | 10.0 | 2026-01-28 | SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `Sandbo… |
CVE-2026-22709 | Critical | 9.8 | 2026-01-26 | vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be b… |
CVE-2025-66398 | Critical | 9.6 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal sta… |
CVE-2025-68613 | Critical | 9.9 | 2025-12-19 | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Ex… |
CVE-2025-14695 | Medium | 6.3 | 2025-12-15 | A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/… |
CVE-2025-13659 | High | 8.8 | 2025-12-09 | Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to wr… |
CVE-2025-13426 | | | 2025-12-05 | A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remo… |
CVE-2025-14085 | Medium | 6.3 | 2025-12-05 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the… |
CVE-2025-14051 | Medium | 6.3 | 2025-12-04 | A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addr… |
CVE-2024-5401 | Medium | 4.3 | 2025-12-04 | Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-6… |
CVE-2025-54065 | High | 7.9 | 2025-12-03 | GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling… |
CVE-2025-26405 | Medium | 5.9 | 2025-11-11 | Improper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileg… |
CVE-2025-61780 | Medium | 5.8 | 2025-10-10 | Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sen… |
CVE-2025-9905 | High | 7.3 | 2025-09-19 | The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True.
One can create a specially crafted .h5/.hdf5… |
CVE-2025-25270 | Critical | 9.8 | 2025-07-08 | An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations. |
CVE-2025-6705 | Medium | 5.3 | 2025-06-27 | A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’… |
CVE-2025-6384 | Critical | 9.1 | 2025-06-19 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via… |
CVE-2025-6107 | Low | 3.1 | 2025-06-16 | A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.p… |
CVE-2025-46675 | Low | 3.5 | 2025-04-27 | In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking. |
CVE-2025-46673 | Medium | 4.9 | 2025-04-27 | NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security p… |
CVE-2025-31674 | High | 7.5 | 2025-03-31 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects D… |
CVE-2024-8953 | Critical | 9.8 | 2025-03-20 | In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to… |
CVE-2022-31764 | High | 8.5 | 2025-02-06 | The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apac… |
CVE-2024-7297 | High | 8.8 | 2024-07-30 | Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privilege… |
CVE-2024-5452 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user in… |
CVE-2024-2537 | Medium | 4.4 | 2024-03-15 | Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion. |
CVE-2024-27135 | High | 8.5 | 2024-03-12 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, out… |
CVE-2023-50386 | High | 8.8 | 2024-02-09 | Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphe… |
CVE-2023-6184 | Medium | 5.0 | 2024-01-18 | Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting |
CVE-2023-31032 | High | 7.5 | 2024-01-12 | NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability… |
CVE-2023-43177 | Critical | 9.8 | 2023-11-18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. |
CVE-2023-5763 | Medium | 6.8 | 2023-11-03 | In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the… |
CVE-2022-4318 | High | 7.8 | 2023-09-25 | A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. |
CVE-2023-39983 | Medium | 5.3 | 2023-09-02 | A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to… |
CVE-2023-4041 | Critical | 9.8 | 2023-08-23 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon… |
CVE-2023-37271 | High | 8.4 | 2023-07-11 | RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. Restr… |
CVE-2023-35930 | Low | 3.7 | 2023-06-26 | SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a neg… |
CVE-2023-33175 | Critical | 9.1 | 2023-05-30 | ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables… |
CVE-2023-29199 | Critical | 9.8 | 2023-04-14 | There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleEx… |
CVE-2023-29017 | Critical | 10.0 | 2023-04-06 | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects pass… |
CVE-2022-43441 | High | 8.1 | 2023-03-16 | A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can l… |
CVE-2023-25560 | High | 8.2 | 2023-02-11 | DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or… |
CVE-2022-44000 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system comma… |
CVE-2022-3225 | High | 8.8 | 2022-09-16 | Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. |
CVE-2022-40635 | Medium | 6.4 | 2022-09-13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2022-40634 | Medium | 6.4 | 2022-09-13 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2022-36067 | Critical | 10.0 | 2022-09-06 | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandb… |
CVE-2022-39051 | Medium | 6.8 | 2022-09-05 | Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package |
CVE-2022-27889 | Medium | 5.3 | 2022-06-14 | The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A maliciou… |
CVE-2021-23267 | High | 7.6 | 2022-05-16 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2022-25355 | Medium | 5.3 | 2022-02-24 | EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the… |
CVE-2022-25265 | High | 7.8 | 2022-02-16 | In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Li… |
CVE-2021-42809 | Medium | 6.5 | 2021-12-20 | Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code. |
CVE-2021-23262 | Medium | 4.2 | 2021-12-02 | Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE. |
CVE-2021-23259 | Medium | 4.2 | 2021-12-02 | Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script… |
CVE-2021-23258 | Medium | 4.2 | 2021-12-02 | Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security re… |
CVE-2021-32813 | Medium | 4.8 | 2021-08-03 | Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connect… |
CVE-2021-22387 | Critical | 9.8 | 2021-08-02 | There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow… |
CVE-2021-32563 | Critical | 9.8 | 2021-05-11 | An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a differe… |
CVE-2021-21413 | High | 8.0 | 2021-03-30 | isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it… |
CVE-2020-15568 | Critical | 9.8 | 2021-01-30 | TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in i… |
CVE-2021-26276 | Medium | 5.3 | 2021-01-27 | scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendo… |
CVE-2020-3419 | Medium | 6.5 | 2020-11-18 | A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appeari… |
CVE-2020-25803 | Medium | 4.2 | 2020-10-06 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2020-25802 | Medium | 4.2 | 2020-10-06 | Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi… |
CVE-2020-15372 | Medium | 5.5 | 2020-09-25 | A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, c… |
CVE-2020-4100 | Medium | 4.4 | 2020-07-15 | "HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be… |
CVE-2019-15006 | Medium | 6.5 | 2019-12-19 | There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was u… |
CVE-2019-1617 | High | 7.4 | 2019-03-11 | A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenti… |
CVE-2019-1595 | High | 7.4 | 2019-03-06 | A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2018-19836 | Medium | 6.1 | 2018-12-03 | In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering var… |
CVE-2017-3202 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their… |
CVE-2017-3200 | High | 8.1 | 2018-06-11 | The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less… |
CVE-2014-9852 | Critical | 9.8 | 2017-03-17 | distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vect… |
CVE-2012-2055 | High | 7.5 | 2012-04-05 | GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set… |
CVE-2006-7079 | Critical | 9.8 | 2007-03-02 | Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduc… |