The dataset
Searchable CVE index
3,029 CVEs match · showing first 100
| CVE ↓ | Title | Exploit Verificationi | AI-XIi | Cost | Gen time | Tokens | EPSS | Exploited in Wild |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-56270 | Missing Authentication for Critical Function vulnerability in Flowise | Could not verify | 5 · Hard | $4.09 | 86m | 517k | 0.4% | — |
| CVE-2026-56268 | Authorization Bypass vulnerability in Flowise | Could not verify | 5 · Hard | $5.03 | 59m | 568k | 0.3% | — |
| CVE-2026-55700 | pnpm: `stage download` writes outside its destination directory via manifest name/version traversal | AI-VERIFIED | 4 · High | $2.35 | 11m | 269k | 0.3% | — |
| CVE-2026-55697 | OS Command Injection vulnerability in pnpm | Could not verify | 5 · Hard | $3.42 | 12m | 410k | 0.1% | — |
| CVE-2026-55603 | HTTP Header Injection vulnerability in chimurai http-proxy-middleware | AI-VERIFIED | 5 · Hard | $5.57 | 20m | 695k | 0.2% | — |
| CVE-2026-55450 | Unauthenticated File Upload vulnerability in Langflow | Could not verify | — | — | — | — | 0.3% | — |
| CVE-2026-55255 | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | Could not verify | 5 · Hard | $8.54 | 49m | 1.1M | 0.2% | — |
| CVE-2026-55200 | Out-of-Bounds Write vulnerability in libssh2 | AI-VERIFIED | 5 · Hard | $1.44 | 47m | 143k | — | — |
| CVE-2026-55199 | Pre-Authentication Denial of Service vulnerability in libssh2 | AI-VERIFIED | 4 · High | $3.23 | 22m | 333k | — | — |
| CVE-2026-54420 | UNIX Symbolic Link (Symlink) Following vulnerability in LiteSpeed cPanel plugin | AI-VERIFIED | — | — | — | — | 1.3% | IN WILD |
| CVE-2026-54352 | Arbitrary File Read vulnerability in budibase | Could not verify | 5 · Hard | $6.80 | 68m | 2.2M | 0.5% | — |
| CVE-2026-54350 | Anonymous NoSQL operator injection vulnerability in Budibase | AI-VERIFIED | 4 · High | $2.24 | 30m | 517k | 0.5% | — |
| CVE-2026-54317 | Information Disclosure vulnerability in home-assistant core | Could not verify | 5 · Hard | $3.53 | 28m | 368k | 0.2% | — |
| CVE-2026-54293 | Path Traversal vulnerability in nltk | Could not verify | 5 · Hard | $1.84 | 10m | 197k | 0.4% | — |
| CVE-2026-54018 | Server-Side Request Forgery vulnerability in open-webui | AI-VERIFIED | 4 · High | $4.17 | 67m | 277k | 0.3% | — |
| CVE-2026-54013 | Cross-site Scripting vulnerability in open-webui | AI-VERIFIED | 3 · Moderate | $3.16 | 41m | 214k | 0.2% | — |
| CVE-2026-54011 | Cross-site Scripting vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $5.59 | 57m | 695k | 0.2% | — |
| CVE-2026-54008 | Server-Side Request Forgery vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $5.71 | 38m | 573k | 0.2% | — |
| CVE-2026-53622 | Authentication Bypass vulnerability in traefik | AI-VERIFIED | 4 · High | $5.40 | 68m | 395k | 0.2% | — |
| CVE-2026-53571 | Path Traversal vulnerability in vitejs vite | AI-VERIFIED | 4 · High | $3.84 | 11m | 495k | 0.4% | — |
| CVE-2026-52845 | Authentication Bypass vulnerability in caddyserver caddy | AI-VERIFIED | 4 · High | $3.55 | 18m | 418k | 0.2% | — |
| CVE-2026-52844 | Caddy: Windows `file_server` path authorization bypass via encoded backslash | Could not verify | 5 · Hard | $4.52 | 42m | 557k | 0.4% | — |
| CVE-2026-52813 | Path Traversal vulnerability in Gogs | AI-VERIFIED | 4 · High | $1.20 | 20m | 106k | 1.1% | — |
| CVE-2026-52811 | Path Traversal vulnerability in Gogs | Could not verify | 5 · Hard | $7.56 | 53m | 1.0M | 0.5% | — |
| CVE-2026-52806 | PHP Remote File Inclusion vulnerability in Gogs | Could not verify | 5 · Hard | $8.82 | 29m | 943k | 1.0% | — |
| CVE-2026-50287 | Missing Authentication for Critical Function vulnerability in AgenticMail | Could not verify | 5 · Hard | $4.68 | 30m | 1.3M | 0.4% | — |
| CVE-2026-50146 | Astro: Reflected XSS via unescaped slot name | Could not verify | 5 · Hard | $4.19 | 47m | 526k | 0.2% | — |
| CVE-2026-50137 | Improper Access Control vulnerability in budibase | Could not verify | 5 · Hard | $5.82 | 50m | 606k | 0.4% | — |
| CVE-2026-50136 | Missing Authentication for Critical Function vulnerability in Budibase | AI-VERIFIED | 5 · Hard | $2.50 | 24m | 253k | 0.3% | — |
| CVE-2026-50016 | Path Traversal vulnerability in pnpm | AI-VERIFIED | 5 · Hard | $1.51 | 16m | 148k | 0.3% | — |
| CVE-2026-50015 | Path Traversal vulnerability in pnpm | AI-VERIFIED | 4 · High | $6.48 | 12m | 906k | 0.3% | — |
| CVE-2026-49402 | OS Command Injection vulnerability in denoland deno | AI-VERIFIED | 4 · High | $2.60 | 48m | 308k | 0.3% | — |
| CVE-2026-49401 | Improper Resolution of Path Equivalence vulnerability in denoland deno | Could not verify | 5 · Hard | $3.86 | 32m | 443k | 0.1% | — |
| CVE-2026-49257 | Missing Authentication for Critical Function vulnerability in mcp-pinot | AI-VERIFIED | 5 · Hard | $4.14 | 18m | 340k | 0.5% | — |
| CVE-2026-48907 | Unauthenticated Remote Code Execution vulnerability in JCE editor extension for Joomla | AI-VERIFIED | — | — | — | — | 80.4% | IN WILD |
| CVE-2026-48710 | Host-Header Authentication Bypass vulnerability in Starlette | AI-VERIFIED | 1 · Easy | $3.70 | 14m | 325k | 1.4% | — |
| CVE-2026-48526 | Authentication Bypass vulnerability in jpadilla pyjwt | AI-VERIFIED | 4 · High | $1.59 | 8m | 170k | 0.4% | — |
| CVE-2026-48519 | Remote Code Execution vulnerability in langflow-ai langflow | AI-VERIFIED | 3 · Moderate | $2.64 | 16m | 291k | 0.7% | — |
| CVE-2026-48491 | Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass | AI-VERIFIED | 5 · Hard | $7.38 | 31m | 1.0M | 0.2% | — |
| CVE-2026-48151 | Missing Authorization vulnerability in Budibase | Could not verify | — | — | — | — | 0.2% | — |
| CVE-2026-48020 | Authentication Bypass vulnerability in traefik | AI-VERIFIED | 4 · High | $3.82 | 18m | 454k | 0.6% | — |
| CVE-2026-47668 | Remote Code Execution vulnerability in DbGate | AI-VERIFIED | 2 · Low | $3.39 | 12m | 385k | — | — |
| CVE-2026-47429 | Missing Authorization vulnerability in Vitest | AI-VERIFIED | 2 · Low | $3.63 | 17m | 389k | — | — |
| CVE-2026-47140 | NodeVM builtin denylist bypass vulnerability in patriksimek vm2 | AI-VERIFIED | 3 · Moderate | $2.53 | 11m | 233k | 0.5% | — |
| CVE-2026-47102 | Incorrect Authorization vulnerability in LiteLLM | Could not verify | 5 · Hard | $6.02 | 31m | 765k | 0.7% | — |
| CVE-2026-47101 | Incorrect Authorization vulnerability in LiteLLM | Could not verify | 5 · Hard | $6.33 | 51m | 839k | 0.7% | — |
| CVE-2026-47075 | HTTP Header Injection vulnerability in benoitc hackney | AI-VERIFIED | 5 · Hard | $2.53 | 22m | 293k | 0.4% | — |
| CVE-2026-47072 | HTTP Header Injection vulnerability in benoitc hackney | AI-VERIFIED | 5 · Hard | $4.56 | 22m | 427k | 0.5% | — |
| CVE-2026-46490 | Privilege Escalation vulnerability in tngan samlify | AI-VERIFIED | 4 · High | $3.00 | 14m | 333k | 0.4% | — |
| CVE-2026-46442 | Code Injection vulnerability in FlowiseAI Flowise | Could not verify | 5 · Hard | $6.92 | 61m | 981k | 0.8% | — |
| CVE-2026-46364 | Unauthenticated SQL Injection vulnerability in phpMyFAQ | AI-VERIFIED | 5 · Hard | $4.13 | 27m | 449k | 1.7% | — |
| CVE-2026-46339 | Remote Code Execution vulnerability in 9router | AI-VERIFIED | 3 · Moderate | $4.90 | 32m | 595k | — | — |
| CVE-2026-46331 | Out-Of-Bounds Write vulnerability in Linux kernel | AI-VERIFIED | 3 · Moderate | $2.55 | 27m | 314k | — | — |
| CVE-2026-45829 | Code Injection vulnerability in ChromaDB | HUMAN-VERIFIED | 5 · Hard | $5.75 | 17m | 645k | 12.4% | — |
| CVE-2026-45758 | Malicious Code (Supply Chain) vulnerability in guardrails-ai guardrails | AI-VERIFIED | 1 · Easy | $2.33 | 7m | 238k | 0.3% | — |
| CVE-2026-45672 | Authorization Bypass vulnerability in open-webui | AI-VERIFIED | 4 · High | $4.71 | 48m | 573k | 0.4% | — |
| CVE-2026-45671 | Authorization Bypass vulnerability in open-webui | Could not verify | — | — | — | — | 0.3% | — |
| CVE-2026-45667 | Missing Authorization vulnerability in Open WebUI | Could not verify | 5 · Hard | $2.23 | 65m | 245k | 0.3% | — |
| CVE-2026-45665 | Cross-site Scripting vulnerability in open-webui | Could not verify | 5 · Hard | $8.82 | 63m | 1.8M | 0.3% | — |
| CVE-2026-45618 | Remote Code Execution vulnerability in LiquidJS | AI-VERIFIED | 3 · Moderate | $3.54 | 23m | 373k | — | — |
| CVE-2026-45402 | Authorization Bypass vulnerability in open-webui | AI-VERIFIED | 3 · Moderate | $1.13 | 18m | 95k | 0.3% | — |
| CVE-2026-45401 | Server-Side Request Forgery vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $3.46 | 35m | 393k | 0.3% | — |
| CVE-2026-45400 | Server-Side Request Forgery vulnerability in open-webui | AI-VERIFIED | 4 · High | $5.11 | 35m | 587k | 0.3% | — |
| CVE-2026-45399 | Improper Access Control vulnerability in open-webui | Could not verify | 5 · Hard | $7.72 | 86m | 961k | 0.3% | — |
| CVE-2026-45398 | Authorization Bypass vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $2.08 | 16m | 206k | 0.3% | — |
| CVE-2026-45397 | Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure | AI-VERIFIED | 3 · Moderate | $0.46 | 2m | 42k | 0.7% | — |
| CVE-2026-45350 | Missing Authorization vulnerability in Open WebUI | Could not verify | 5 · Hard | $6.04 | 46m | 630k | 0.3% | — |
| CVE-2026-45349 | Authorization Bypass vulnerability in open-webui | Could not verify | 5 · Hard | $7.81 | 65m | 1.1M | 0.2% | — |
| CVE-2026-45338 | Server-Side Request Forgery vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $4.07 | 38m | 500k | 0.4% | — |
| CVE-2026-45332 | Broken Access Control vulnerability in Automad | Could not verify | 5 · Hard | $4.44 | 37m | 551k | 0.3% | — |
| CVE-2026-45331 | Server-Side Request Forgery vulnerability in open-webui | AI-VERIFIED | 3 · Moderate | $4.36 | 39m | 689k | 0.3% | — |
| CVE-2026-45321 | Embedded Malicious Code vulnerability inTanStack | AI-VERIFIED | 1 · Easy | $2.57 | 7m | 252k | 2.3% | IN WILD |
| CVE-2026-45315 | Cross-site Scripting vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $8.02 | 58m | 1.1M | 0.2% | — |
| CVE-2026-45303 | Cross-site Scripting vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $3.95 | 46m | 370k | 0.2% | — |
| CVE-2026-45300 | async-http-client vulnerability in AsyncHttpClient async-http-client | Could not verify | 5 · Hard | $2.20 | 24m | 237k | 0.3% | — |
| CVE-2026-45298 | Server-Side Request Forgery vulnerability in amir20 dozzle | AI-VERIFIED | 5 · Hard | $3.49 | 33m | 424k | 1.5% | — |
| CVE-2026-45245 | Server-Side Request Forgery vulnerability in summarize | AI-VERIFIED | 5 · Hard | $2.43 | 10m | 244k | 0.3% | — |
| CVE-2026-45242 | Path Traversal vulnerability in Summarize | Could not verify | 5 · Hard | $4.72 | 18m | 586k | 0.4% | — |
| CVE-2026-45136 | OS Command Injection vulnerability in cnighswonger claude-code-cache-fix | AI-VERIFIED | 4 · High | $1.22 | 7m | 137k | 0.2% | — |
| CVE-2026-45033 | Incorrect Behavior Order vulnerability in GitHub Copilot CLI | AI-VERIFIED | 2 · Low | $3.75 | 12m | 373k | 0.4% | — |
| CVE-2026-44882 | Authorization Bypass vulnerability in portainer | Could not verify | 5 · Hard | $3.07 | 29m | 560k | 0.3% | — |
| CVE-2026-44850 | Authorization Bypass vulnerability in portainer | Could not verify | 5 · Hard | $5.65 | 49m | 763k | 0.2% | — |
| CVE-2026-44849 | Improper Access Control vulnerability in portainer | Could not verify | 5 · Hard | $3.84 | 58m | 1.4M | 0.3% | — |
| CVE-2026-44848 | Remote Code Execution vulnerability in portainer | Could not verify | 5 · Hard | $4.35 | 66m | 563k | 0.3% | — |
| CVE-2026-44843 | Unsafe Deserialization vulnerability in LangChain | AI-VERIFIED | 5 · Hard | $6.55 | 25m | 842k | 0.4% | — |
| CVE-2026-44827 | Remote Code Execution vulnerability in Diffusers | Could not verify | — | — | — | — | 0.6% | — |
| CVE-2026-44790 | Arbitrary File Read vulnerability in n8n-io n8n | AI-VERIFIED | 2 · Low | $3.99 | 11m | 445k | 0.6% | — |
| CVE-2026-44789 | HTTP Request Node Pagination Prototype Pollution vulnerability in n8n Workflow Automation | AI-VERIFIED | 1 · Easy | $3.51 | 8m | 388k | 0.6% | — |
| CVE-2026-44738 | Information Disclosure vulnerability in getgrav grav | Could not verify | 5 · Hard | $5.44 | 40m | 598k | 0.3% | — |
| CVE-2026-44721 | Stored Cross-site Scripting vulnerability in Open WebUI | AI-VERIFIED | 5 · Hard | $4.61 | 49m | 516k | 0.3% | — |
| CVE-2026-44716 | Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator | AI-VERIFIED | 5 · Hard | $1.85 | 16m | 188k | 0.4% | — |
| CVE-2026-44705 | Path Traversal vulnerability in raszi node-tmp | AI-VERIFIED | 4 · High | $0.67 | 5m | 59k | 0.4% | — |
| CVE-2026-44680 | SQL Injection vulnerability in mikro-orm | AI-VERIFIED | 4 · High | $5.46 | 26m | 548k | 1.3% | — |
| CVE-2026-44643 | Remote Code Execution vulnerability in Angular Expressions | AI-VERIFIED | 1 · Easy | $2.57 | 8m | 271k | 0.5% | — |
| CVE-2026-44578 | Server-Side Request Forgery vulnerability in Next.js | HUMAN-VERIFIED | 4 · High | $6.81 | 25m | 763k | 38.7% | — |
| CVE-2026-44570 | Authorization Bypass vulnerability in open-webui | AI-VERIFIED | 5 · Hard | $5.53 | 69m | 702k | 0.3% | — |
| CVE-2026-44569 | Improper Access Control vulnerability in open-webui | Could not verify | 5 · Hard | $4.41 | 57m | 503k | 0.3% | — |
| CVE-2026-44566 | Path Traversal vulnerability in open-webui | Could not verify | 5 · Hard | $4.43 | 14m | 580k | 0.3% | — |
| CVE-2026-44565 | Path Traversal vulnerability in open-webui | AI-VERIFIED | 4 · High | $2.80 | 13m | 307k | 0.5% | — |
| CVE-2026-44561 | Incorrect Authorization vulnerability in Open WebUI | AI-VERIFIED | 3 · Moderate | $4.64 | 27m | 500k | 0.2% | — |