VulnSea

CWE-184

CVEs classified under CWE-184, newest first.

149 CVEsRSS

CVE-2026-67325High· 8.8PoC
3mo ago

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uplo…

▾ MidnightRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 2.2%via NVD
CVE-2026-52888Medium· 6.8
3mo ago

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

▾ Sunlitnocobase · @nocobase/plugin-collection-sqlEPSS 0.47%via GHSA
CVE-2026-66010Medium· 6.1PoC
3mo ago

dompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)

A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cr…

▾ TwilightRed Hat · Red Hat Enterprise Linux 8EPSS 0.21%via CSAF
GHSA-6p8h-3wgx-97gfHigh· 7.5
3mo ago

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

▾ TwilightGitPython · GitPythonvia GHSA
GHSA-5qhf-9phg-95m2Low
3mo ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

▾ Sunlitloofah · loofahvia GHSA
GHSA-c2j3-45gr-mqc4Low
3mo ago

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

▾ Sunlitdompurify · dompurifyvia GHSA
GHSA-2p49-hgcm-8545High· 8.2
3mo ago

SVGO removeScripts plugin leaves some executable scripts intact

SVGO removeScripts plugin leaves some executable scripts intact

▾ Twilightsvgo · svgovia GHSA
GHSA-2f96-g7mh-g2hxHigh· 8.8
3mo ago

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

▾ TwilightGitPython · GitPythonvia GHSA
GHSA-8whx-365g-h9vvLow
3mo ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

▾ Sunlitloofah · loofahvia GHSA
CVE-2026-16129Medium· 5.3
3mo ago

A vulnerability has been found in princezuda SafestClaw up to 4.2.4

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipula…

▾ SunlitEPSS 0.32%via NVD
CVE-2026-62203High· 8.8
3mo ago

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execu…

▾ TwilightEPSS 0.53%via NVD
CVE-2026-61453Medium· 6.1PoC
3mo ago

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1)

Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1). The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.proces…

▾ Twilightgetgrav · gravEPSS 0.20%via NVD
CVE-2026-54070High· 7.1
3mo ago

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

▾ Twilightsiyuan-note · github.com/siyuan-note/siyuan/kernelEPSS 0.30%via GHSA
CVE-2026-59261High· 7.1
4mo ago

OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials …

▾ TwilightOpenClaw · OpenClawEPSS 0.27%via CVEORG
CVE-2026-14534High· 8.8
4mo ago

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py)

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denyli…

▾ TwilightEPSS 0.59%via NVD
GHSA-j472-gf56-x589High
4mo ago

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

▾ Twilightopenclaw · openclawvia GHSA
CVE-2026-56777Medium· 5.0
4mo ago

n8n - AST Validator Bypass in Python Code Node

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can by…

▾ Sunlitn8n · n8nEPSS 0.33%via CVEORG
CVE-2025-71355Medium
4mo ago

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy…

▾ Sunlitpicklescan · picklescanEPSS 0.63%via NVD
CVE-2026-49869Critical· 10.0CISA KEVPoC
4mo ago

Kestra is an open-source, event-driven orchestration platform

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Bec…

▾ Hadalkestra · kestraEPSS 2.1%via NVD
GHSA-g7vj-qw6x-g3p8Critical· 9.8
4mo ago

Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist

Duplicate Advisory: PickleScan has multiple stdlib modules with direct RCE not in blocklist

▾ Midnightpicklescan · picklescanvia GHSA
CVE-2026-54512High· 8.1PoC
4mo ago

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious ty…

▾ MidnightRed Hat · Red Hat JBoss EAP 8.1 for RHEL 8EPSS 1.1%via CSAF
CVE-2026-54513High· 8.1
4mo ago

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the syst…

▾ TwilightRed Hat · Red Hat JBoss EAP 8.1 for RHEL 8EPSS 1.2%via CSAF
GHSA-fh2f-24rh-r2vqHigh
4mo ago

Duplicate Advisory: Picklescan missing detection when calling built-in python library function timeit.timeit()

Duplicate Advisory: Picklescan missing detection when calling built-in python library function timeit.timeit()

▾ Twilightpicklescan · picklescanvia GHSA
CVE-2025-71351Medium
4mo ago

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution

picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbit…

▾ Sunlitpicklescan · picklescanEPSS 0.55%via NVD
GHSA-8678-w3jw-xfc2Low· 2.6
4mo ago

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

▾ Sunlitnokogiri · nokogirivia GHSA
CVE-2026-53864High· 8.1
4mo ago

OpenClaw: Host environment sanitizer missed two Node.js control variables

OpenClaw: Host environment sanitizer missed two Node.js control variables

▾ Twilightopenclaw · openclawEPSS 0.25%via GHSA
CVE-2026-53866High· 8.1
4mo ago

OpenClaw: Shell inline-command parsing could miss an allowlist check

OpenClaw: Shell inline-command parsing could miss an allowlist check

▾ Twilightopenclaw · openclawEPSS 0.27%via GHSA
GHSA-vmmj-pfw7-fjwpCritical· 9.9
4mo ago

npm PraisonAI codeMode sandbox escape via Function constructor

npm PraisonAI codeMode sandbox escape via Function constructor

▾ Midnightpraisonai · praisonaivia GHSA
CVE-2026-53861Medium· 6.6
4mo ago

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

▾ Sunlitopenclaw · openclawEPSS 0.25%via GHSA
CVE-2026-53848Low· 4.3
4mo ago

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

▾ Sunlitopenclaw · openclawEPSS 0.18%via GHSA
CWE-184 vulnerabilities (CVEs) — page 4 · VulnSea