Security Vulnerabilities Database

CRITICAL 9.3

npm

CVE-2026-44990

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

May 14, 2026

CRITICAL 10.0

npm

CVE-2026-47140

NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

May 29, 2026

CRITICAL 10.0

npm

CVE-2026-47131

vm2 has a Sandbox Escape issue

May 29, 2026

CRITICAL 9.8

npm

CVE-2026-47210

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

May 29, 2026

CRITICAL 10.0

npm

CVE-2026-47208

vm2 is Vulnerable to Sandbox Breakout Through Promise Species

May 29, 2026

CRITICAL 10.0

npm

CVE-2026-47137

vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

May 29, 2026

CRITICAL 9.1

Maven

CVE-2025-66614

Apache Tomcat - Client certificate verification bypass

Feb 17, 2026

CRITICAL 10.0

PyPI

CVE-2026-46695

BoxLite: Permission Bypass Allows Modification of Read-Only Files

May 21, 2026

CRITICAL 9.6

PyPI

CVE-2026-46703

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

May 21, 2026

CRITICAL 9.0

npm

CVE-2026-48150

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Jun 12, 2026

CRITICAL 9.1

Maven

CVE-2026-40982

Spring Cloud Config vulnerable to Path Traversal

May 7, 2026

CRITICAL 9.8

npm

CVE-2024-30564

@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

Apr 18, 2024

CRITICAL 9.1

PyPI

CVE-2026-48039

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Jun 11, 2026

CRITICAL 9.8

PyPI

CVE-2024-3408

Authentication bypass in dtale

Jun 6, 2024

CRITICAL 9.8

Go

CVE-2026-46614

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

May 21, 2026

CRITICAL 9.8

PyPI

CVE-2020-18698

Lin-CMS-Flask vulnerable to Improper Authentication

May 24, 2022

CRITICAL 9.4

PyPI

CVE-2024-32977

May 14, 2024

CRITICAL 9.8

PyPI

CVE-2022-39327

Oct 25, 2022

CRITICAL 9.0

PyPI

CVE-2024-28179

Jupyter Server Proxy's Websocket Proxying does not require authentication

Mar 20, 2024

CRITICAL 9.3

PyPI

CVE-2024-23346

pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

Feb 21, 2024

CRITICAL 9.8

PyPI

CVE-2025-31116

Mar 31, 2025

CRITICAL 9.8

PyPI

CVE-2025-32375

BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Apr 9, 2025

CRITICAL 9.6

PyPI

CVE-2024-35225

Jupyter Server Proxy has a reflected XSS issue in host parameter

Jun 11, 2024

CRITICAL 10.0

PyPI

CVE-2025-32444

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

Apr 29, 2025

CRITICAL 9.8

PyPI

CVE-2023-29824

Withdrawn: Use after free in SciPy

Jul 6, 2023

CRITICAL 9.8

PyPI

CVE-2024-22205

Jan 23, 2024

CRITICAL 9.8

PyPI

CVE-2024-22203

Jan 23, 2024

CRITICAL 9.9

PyPI

CVE-2024-2083

Apr 16, 2024

CRITICAL 9.8

PyPI

CVE-2025-6278

Jun 19, 2025

CRITICAL 9.8

PyPI

CVE-2024-9053

Mar 20, 2025

CRITICAL 9.8

PyPI

CVE-2024-53899

Nov 24, 2024

CRITICAL 9.8

PyPI

CVE-2022-3457

Oct 13, 2022

CRITICAL 9.8

PyPI

CVE-2022-3439

Oct 14, 2022

CRITICAL 9.8

PyPI

CVE-2022-3456

Oct 13, 2022

CRITICAL 9.8

PyPI

CVE-2024-34249

May 6, 2024

CRITICAL 9.8

PyPI

CVE-2025-1497

Mar 10, 2025

CRITICAL 9.8

PyPI

CVE-2025-1716

Mar 3, 2025

CRITICAL 9.8

PyPI

CVE-2023-52314

Jan 3, 2024

CRITICAL 9.8

PyPI

CVE-2023-52311

Jan 3, 2024

CRITICAL 9.8

PyPI

CVE-2023-52310

Jan 3, 2024

CRITICAL 9.8

PyPI

CVE-2023-52309

Jan 3, 2024

CRITICAL 9.8

PyPI

CVE-2023-52304

Jan 3, 2024

CRITICAL 9.8

PyPI

CVE-2022-46742

Dec 7, 2022

CRITICAL 9.1

PyPI

CVE-2024-27319

Feb 23, 2024

CRITICAL 9.8

PyPI

CVE-2026-24178

Apr 28, 2026

CRITICAL 9.8

PyPI

CVE-2023-39631

Sep 1, 2023

CRITICAL 9.1

PyPI

CVE-2024-7776

Mar 20, 2025

CRITICAL 9.8

PyPI

CVE-2023-52307

Jan 3, 2024

CRITICAL 10.0

PyPI

CVE-2025-14009

Feb 18, 2026

CRITICAL 9.0

PyPI

CVE-2024-6581

Oct 29, 2024

CRITICAL 10.0

PyPI

CVE-2023-3765

Jul 19, 2023

CRITICAL 9.8

PyPI

CVE-2024-37014

Jun 10, 2024

CRITICAL 10.0

PyPI

CVE-2025-2828

Jun 23, 2025

CRITICAL 9.8

PyPI

CVE-2023-36281

Aug 22, 2023

CRITICAL 9.8

PyPI

CVE-2023-39659

Aug 15, 2023

CRITICAL 9.8

PyPI

CVE-2023-38896

Aug 15, 2023

CRITICAL 9.8

PyPI

CVE-2023-38860

Aug 15, 2023

Know every threat before it ships

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

vm2 has a Sandbox Escape issue

vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

vm2 is Vulnerable to Sandbox Breakout Through Promise Species

vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE

Apache Tomcat - Client certificate verification bypass

BoxLite: Permission Bypass Allows Modification of Read-Only Files

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Spring Cloud Config vulnerable to Path Traversal

@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Authentication bypass in dtale

Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger

Lin-CMS-Flask vulnerable to Improper Authentication

CVE-2024-32977

CVE-2022-39327

Jupyter Server Proxy's Websocket Proxying does not require authentication

pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

CVE-2025-31116

BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

Jupyter Server Proxy has a reflected XSS issue in host parameter

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

Withdrawn: Use after free in SciPy

CVE-2024-22205

CVE-2024-22203

CVE-2024-2083

CVE-2025-6278

CVE-2024-9053

CVE-2024-53899

CVE-2022-3457

CVE-2022-3439

CVE-2022-3456

CVE-2024-34249

CVE-2025-1497

CVE-2025-1716

CVE-2023-52314

CVE-2023-52311

CVE-2023-52310

CVE-2023-52309

CVE-2023-52304

CVE-2022-46742

CVE-2024-27319

CVE-2026-24178

CVE-2023-39631

CVE-2024-7776

CVE-2023-52307

CVE-2025-14009

CVE-2024-6581

CVE-2023-3765

CVE-2024-37014

CVE-2025-2828

CVE-2023-36281

CVE-2023-39659

CVE-2023-38896

CVE-2023-38860

Start Securing