Vulnerability Intelligence

Search and explore vulnerability advisories, CVEs, CWEs, and affected packages across software supply chain ecosystems.

Examples: CVE-2020-11973 • CWE-79 • GHSA-8g9c-28fc-cxqx

Top Critical Vulnerabilities by Ecosystem

Highest severity threats sorted by modification date for each software ecosystem.

ID / Advisory	NVD ID	PURL	Severity	Summary
GHSA-qx66-fv34-fjm8	CVE-2026-102989	npm/@tanstack/react-start npm/@tanstack/solid-start npm/@tanstack/start-server-core npm/@tanstack/vue-start	CRITICAL	TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
GHSA-p8wg-vrv2-v86f	CVE-2026-106445	npm/handlebars	CRITICAL	Handlebars: JavaScript Injection via Own Property Check Bypass
GHSA-x34j-47hf-4xg7	CVE-2026-108261	npm/@tinacms/app npm/tinacms	CRITICAL	TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
GHSA-ww5h-9m49-7xx4	CVE-2026-107722	npm/fast-jwt	CRITICAL	fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
GHSA-8r5x-fm3f-whwj	CVE-2026-106446	npm/handlebars	CRITICAL	Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
GHSA-8m2g-8cgm-3vcp	CVE-2026-82533	npm/@deepseek-ai/dsh-client-connection	CRITICAL	DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API
GHSA-r488-j9vj-wx3q	CVE-2026-105857	npm/@payloadcms/plugin-form-builder	CRITICAL	Payload Form Builder has an RCE issue
GHSA-f7hx-52q9-hcrf	CVE-2026-105859	npm/payload	CRITICAL	Payload: Unauthorized update to collection documents
GHSA-66wr-7vmr-p5jq	CVE-2026-105863	npm/payload	CRITICAL	Payload authentication token field handling issue
GHSA-pq68-rvw4-xp4r	CVE-2026-93605	npm/vm2	CRITICAL	vm2 contains a sandbox escape vulnerability

ID / Advisory	NVD ID	PURL	Severity	Summary
GHSA-6v25-8wq6-xq4j	CVE-2026-107726	maven/com.hazelcast/hazelcast	CRITICAL	Hazelcast allows arbitrary member memory access by low-privileged client
GHSA-jmqq-x5g9-9p2w	CVE-2026-107282	maven/org.asynchttpclient/async-http-client	CRITICAL	AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
GHSA-9qf2-26p9-2q2q	CVE-2026-47892	maven/org.springframework/spring-webflux	CRITICAL	Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
GHSA-j9f9-w8pj-32f8	CVE-2026-47890	maven/org.springframework/spring-webflux maven/org.springframework/spring-webmvc	CRITICAL	Spring Framework Server Sent Event stream corruption while rendering fragments
GHSA-93g8-qqv3-mrx8	CVE-2026-50632	maven/org.apache.cxf/cxf-rt-transports-jms	CRITICAL	Apache CXF has JNDI Injection Vulnerability in JMSConfigFactory
GHSA-pc63-qcmh-9cmg	CVE-2026-47884	maven/org.springframework/spring-webmvc	CRITICAL	Spring Framework Improper Path Limitation in XsltView
GHSA-rvm3-566m-v7fv	CVE-2026-103922	maven/com.capacitorjs/core npm/@capacitor/android npm/@capacitor/ios	CRITICAL	Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
GHSA-8364-hfqj-pwm6	CVE-2026-47323	maven/org.apache.camel/camel-cxf-rest	CRITICAL	Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound Filtering
GHSA-2vqf-x7g4-7c2g	CVE-2026-33454	maven/org.apache.camel/camel-mail	CRITICAL	Apache Camel's Camel-Mail component is vulnerable to Camel message header injection
GHSA-jg2m-9x48-3gvj	CVE-2026-40453	maven/org.apache.camel/camel-coap maven/org.apache.camel/camel-google-pubsub maven/org.apache.camel/camel-jms maven/org.apache.camel/camel-sjms	CRITICAL	Apache Camel has an incomplete fix for CVE-2025-27636

ID / Advisory	NVD ID	PURL	Severity	Summary
GHSA-w5f2-9q9c-ff4h	CVE-2026-105192	pypi/lmcache	CRITICAL	LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
GHSA-vv44-hjm2-qw2f	-	pypi/lmcache	CRITICAL	Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport
GHSA-h4mw-j7qp-8mwm	CVE-2026-96620	pypi/claude-agent-sdk	CRITICAL	Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
GHSA-hxpf-9xvq-wph8	CVE-2026-57496	pypi/netlicensing-mcp	CRITICAL	netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
GHSA-w794-rj3p-xv45	CVE-2026-105697	pypi/langflow pypi/langflow-base pypi/lfx	CRITICAL	Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
GHSA-9mp3-24cc-77mg	CVE-2026-61445	pypi/praisonai	CRITICAL	PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
GHSA-wj29-gm8v-33x8	-	pypi/praisonai	CRITICAL	Duplicate Advisory: PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
GHSA-q65p-7p84-495c	-	pypi/praisonai	CRITICAL	Duplicate Advisory: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
GHSA-2xv2-w8cq-5gxw	CVE-2026-61447	pypi/praisonaiagents	CRITICAL	PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
GHSA-mhgx-w3w5-2rvc	-	pypi/praisonai	CRITICAL	Duplicate Advisory: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

ID / Advisory	NVD ID	PURL	Severity	Summary
GHSA-628f-v4f6-p37r	CVE-2026-107845	-	CRITICAL	Contao: Cross-site scripting in the comments bundle
GHSA-g7vj-c29h-3h5m	CVE-2026-92161	-	CRITICAL	FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
GHSA-vjqc-q4mp-2rvf	CVE-2026-79752	-	CRITICAL	CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
GHSA-m97h-2qj3-5773	-	-	CRITICAL	Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin
GHSA-f8wv-xp27-6gq7	CVE-2026-75827	-	CRITICAL	Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
GHSA-fwwx-3362-3947	-	-	CRITICAL	Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
GHSA-vfmf-q6x9-cw96	CVE-2026-75828	-	CRITICAL	Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
GHSA-9pr6-8r9w-wvmj	-	-	CRITICAL	Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
GHSA-qh7h-6c7g-x8m6	-	-	CRITICAL	Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
GHSA-g4c3-4g96-6g4m	CVE-2026-45140	-	CRITICAL	Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

ID / Advisory	NVD ID	PURL	Severity	Summary
GHSA-2cvf-wqm6-wr9g	CVE-2026-94603	golang/github.com/containers/podman golang/go.podman.io/podman/v6	CRITICAL	Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
GHSA-637c-6jxx-4rwm	CVE-2026-77524	golang/github.com/kedacore/keda golang/github.com/kedacore/keda/v2	CRITICAL	KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
GHSA-fmxq-cgp8-87wp	CVE-2026-77459	golang/github.com/argoproj/argo-cd/v2 golang/github.com/argoproj/argo-cd/v3	CRITICAL	Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
GHSA-qj98-gp63-54xj	CVE-2026-102748	golang/github.com/dgraph-io/dgraph/v25	CRITICAL	Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
GHSA-v75v-6fpf-gvw8	CVE-2026-104252	golang/vitess.io/vitess	CRITICAL	Vitess vttablet /twopcz reflected XSS
GHSA-p393-cf76-4jmr	CVE-2026-107806	golang/github.com/0xJacky/Nginx-UI	CRITICAL	Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
GHSA-rj9j-8772-4h6c	CVE-2026-68582	golang/code.vikunja.io/api	CRITICAL	Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
GHSA-p4r4-8cxw-pjx7	-	golang/code.vikunja.io/api	CRITICAL	Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
GHSA-6xp5-7rcx-xfgx	CVE-2026-62252	golang/github.com/sipcapture/homer-app	CRITICAL	Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
GHSA-rqcc-94gv-wjm9	CVE-2026-62253	golang/github.com/sipcapture/homer-app	CRITICAL	Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Top Weaknesses (CWE)

Weakness classifications mapped to the highest number of critical threats.

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

13523 Critical

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

11489 Critical

CWE-787

Out-of-bounds Write

10318 Critical

CWE-416

Use After Free

7039 Critical

CWE-20

Improper Input Validation

6931 Critical

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

5578 Critical

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

5536 Critical

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

4993 Critical

CWE-94

Improper Control of Generation of Code ('Code Injection')

4702 Critical

CWE-125

Out-of-bounds Read

4336 Critical

Latest Published Advisories

Recently published or updated security advisories in the database.

Top 10 Latest

Advisory ID	NVD ID	PURL	Severity	Summary	Published
GHSA-pw5q-rjx4-7f7p	CVE-2026-96627	golang/github.com/getarcaneapp/arcane/backend/v2	HIGH	Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)	2026-10-16
GHSA-mp22-58ff-6fhr	CVE-2026-96628	golang/github.com/getarcaneapp/arcane/backend/v2	MODERATE	Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`	2026-10-16
GHSA-w5f2-9q9c-ff4h	CVE-2026-105192	pypi/lmcache	CRITICAL	LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport	2026-10-16
GHSA-74vm-87hj-r66f	CVE-2026-100349	golang/github.com/getkin/kin-openapi	HIGH	kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content	2026-10-16
GHSA-4ch3-9j33-3pmj	CVE-2026-58494	-	MODERATE	Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination	2026-10-16
GHSA-6fj4-rcr3-r7rr	-	-	HIGH	lopdf has a stack overflow via deeply nested PDF objects	2026-10-16
GHSA-rxjv-24xq-76wc	CVE-2026-102834	maven/org.bytedeco/javacv	HIGH	JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS	2026-10-16
GHSA-h4mw-j7qp-8mwm	CVE-2026-96620	pypi/claude-agent-sdk	CRITICAL	Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution	2026-10-16
GHSA-74w3-63xv-x9mv	CVE-2026-62994	golang/github.com/coredns/coredns	LOW	CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin	2026-10-16
GHSA-vqff-r82h-9crc	CVE-2026-76894	npm/@aborruso/ckan-mcp-server	LOW	ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)	2026-10-16