- CRITICAL9.8CVE-2026-43512EPSS 0.14%Apache Tomcat - Digest authenticator will authenticate any unknown user
- CRITICAL9.8CVE-2026-41293EPSS 0.25%Apache Tomcat - HTTP/2 request headers not validated
- CRITICAL9.1CVE-2026-45091EPSS 0.01%sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
- CRITICAL9.6CVE-2026-45321⚠ KEVEPSS 17.1%Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
- CRITICAL10.0CVE-2026-43898EPSS 0.06%SandboxJS has a sandbox escape via Function.caller leakage of internal call op
- CRITICAL9.1CVE-2026-27478EPSS 0.03%Unity Catalog has a JWT Issuer Validation Bypass tht Allows Complete User Impersonation
- CRITICAL9.8CVE-2026-25244EPSS 0.15%WebdriverIO BrowserStack Service has a Command Injection issue
- CRITICAL9.6CVE-2026-44211EPSS 0.02%Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
- CRITICAL9.6CVE-2026-43944EPSS 0.15%Electerm users can run dangrous code through link or command line
- CRITICAL9.8CVE-2026-43940EPSS 0.04%Electerm runWidget has a path traversal that leads to arbitrary code execution
- CRITICAL9.8CVE-2026-44009EPSS 0.02%vm2 has Sandbox Breakout Through Null Proto Exception
- CRITICAL9.8CVE-2026-44008EPSS 0.08%vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- CRITICAL9.8CVE-2025-63704EPSS 0.02%query-parser-string is vulnerable to Prototype Pollution
- CRITICAL9.8CVE-2025-63703EPSS 0.02%parse-ini is vulnerable to Prototype Pollution in index.js()
- CRITICAL9.8CVE-2025-63706EPSS 0.11%next-npm-version is vulnerable to Command injection
- CRITICAL9.1CVE-2026-40982EPSS 0.14%Spring Cloud Config vulnerable to Path Traversal
- CRITICAL9.1CVE-2026-44007EPSS 0.05%vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- CRITICAL9.9CVE-2026-43999EPSS 0.18%vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
- CRITICAL10.0CVE-2026-44005EPSS 0.11%vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
- CRITICAL10.0CVE-2026-43997EPSS 0.02%vm2 Access to Host Object Enables Sandbox Escape
- CRITICAL10.0CVE-2026-44006EPSS 0.06%vm2 has a Sandbox Escape Vulnerability
- CRITICAL9.1CVE-2026-44351EPSS 0.01%fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver
- CRITICAL9.1CVE-2026-42555EPSS 0.30%Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users
- CRITICAL9.1CVE-2026-40010EPSS 0.11%Apache Wicket has a Session Fixation issue
- CRITICAL9.0CVE-2026-44221EPSS 0.01%ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases