Upcoming
Vulnerabilities that other sources know about before their CVE record appears in cvelistV5. Data from the GitHub Advisory Database (CC BY 4.0), OSV.dev sources and the Zero Day Initiative; see sources and licenses.
CVE IDs that a GitHub advisory, an OSV.dev record or a ZDI advisory already names, but that cvelistV5 doesn't contain yet: usually reserved and about to be published. Each badge links to the source's record.
234 CVE IDs · page 4 of 5
| CVE ID | First seen | Severity | Affects | Title | Sources |
|---|---|---|---|---|---|
| CVE-2026-44179 | 2026-06-22 | Critical 9.9 | com.xwiki.pro:xwiki-pro-macros | xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro | GitHub advisory |
| CVE-2026-54711 | 2026-06-18 | Low 2.4 | pghoard | PGHoard: Password written to debug log | GitHub advisory OSV.dev |
| CVE-2026-57144 | 2026-06-18 | High 8.8 | praisonai | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable | GitHub advisory OSV.dev |
| CVE-2026-57146 | 2026-06-18 | High 7.5 | praisonai | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default | GitHub advisory OSV.dev |
| CVE-2026-57142 | 2026-06-18 | High 7.8 | praisonai | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml | GitHub advisory OSV.dev |
| CVE-2026-57113 | 2026-06-18 | High 8.1 | praisonai | PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion | GitHub advisory OSV.dev |
| CVE-2026-57209 | 2026-06-18 | High 7.0 | github.com/dadrus/heimdall | Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode | GitHub advisory OSV.dev |
| CVE-2026-57210 | 2026-06-18 | High 7.0 | https://github.com/dadrus/heimdall | Heimdall: IP Spoofing via Unvalidated Forwarding Headers | GitHub advisory OSV.dev |
| CVE-2026-57121 | 2026-06-18 | High 8.1 | praisonai-platform | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API | GitHub advisory OSV.dev |
| CVE-2026-57116 | 2026-06-18 | Critical 9.8 | praisonai | PraisonAI: AgentOS remains unauthenticated after incomplete fix version and allows remote agent invocation | GitHub advisory OSV.dev |
| CVE-2026-57114 | 2026-06-18 | High 7.2 | praisonai | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | GitHub advisory OSV.dev |
| CVE-2026-57117 | 2026-06-18 | High 8.8 | praisonai | PraisonAI: Compute-bridged file tools allow shell command injection | GitHub advisory OSV.dev |
| CVE-2026-56838 | 2026-06-18 | High 7.8 | praisonai | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement | GitHub advisory OSV.dev |
| CVE-2026-56840 | 2026-06-18 | High 8.8 | praisonai | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools | GitHub advisory OSV.dev |
| CVE-2026-56837 | 2026-06-18 | High 8.6 | praisonai | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing | GitHub advisory OSV.dev |
| CVE-2026-56834 | 2026-06-18 | High 7.5 | praisonai | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage | GitHub advisory OSV.dev |
| CVE-2026-56835 | 2026-06-18 | High 8.3 | praisonai | PraisonAI Slack app_mention bypasses configured user/channel authorization | GitHub advisory OSV.dev |
| CVE-2026-56836 | 2026-06-18 | High 8.2 | praisonai | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard | GitHub advisory OSV.dev |
| CVE-2026-56833 | 2026-06-18 | High 7.5 | praisonai | PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal | GitHub advisory OSV.dev |
| CVE-2026-56832 | 2026-06-18 | High 8.8 | praisonai | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals | GitHub advisory OSV.dev |
| CVE-2026-28975 | 2026-06-12 | Medium 6.9 | github.com/apple/swift-nio-extras | NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length | GitHub advisory |
| CVE-2026-28980 | 2026-06-12 | High 8.7 | github.com/apple/swift-nio | SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS | GitHub advisory |
| CVE-2026-43671 | 2026-06-12 | High 8.3 | github.com/apple/swift-nio | SwiftNIO: Out-of-bounds write via ByteBuffer index and length UInt32 overflow | GitHub advisory |
| CVE-2026-28970 | 2026-06-12 | Medium 6.3 | github.com/apple/swift-nio | SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator | GitHub advisory |
| CVE-2026-38739 | 2026-05-29 | High 7.1 | ezsystems/ezpublish-legacy | ezsystems/ezpublish-legacy has a SQL injection in dfscleanup | GitHub advisory |
| CVE-2026-32179 | 2026-04-16 | Critical 9.8 | Microsoft.Native.Quic.MsQuic.OpenSSL | MsQuic has a Remote Elevation of Privilege Vulnerability | GitHub advisory |
| CVE-2026-30762 | 2026-04-04 | High 7.5 | lightrag-hku | LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass | GitHub advisory OSV.dev |
| CVE-2026-33864 | 2026-03-26 | Critical 9.4 | convict | Convict has Prototype Pollution via startsWith() function | GitHub advisory |
| CVE-2026-33863 | 2026-03-26 | Critical 9.4 | convict | Convict has prototype pollution via load(), loadFile(), and schema initialization | GitHub advisory |
| CVE-2025-65852 | 2026-02-06 | Medium 5.7 | gogs.io/gogs | Gogs has authorization bypass in repository deletion API | GitHub advisory OSV.dev |
| CVE-2025-61620 | 2025-10-07 | Medium 6.5 | vllm | vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server | GitHub advisory OSV.dev |
| CVE-2025-11059 | 2025-09-10 | High 8.7 | xml2rfc | xml2rfc is vulnerable to arbitrary file reads through prepped files | GitHub advisory OSV.dev |
| CVE-2025-11058 | 2025-08-26 | High 8.7 | xml2rfc | xml2rfc has an arbitrary file read vulnerability | GitHub advisory OSV.dev |
| CVE-2025-9141 | 2025-08-21 | High 8.8 | vllm | vLLM has remote code execution vulnerability in the tool call parser for Qwen3-Coder | GitHub advisory OSV.dev |
| CVE-2025-41419 | 2025-07-31 | Medium 5.1 | ms-swift | MS SWIFT WEB-UI RCE Vulnerability | GitHub advisory OSV.dev |
| CVE-2024-21486 | 2025-06-05 | Medium 5.3 | deno | Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | GitHub advisory |
| CVE-2025-28269 | 2025-04-07 | High 7.0 | js-object-utilities | js-object-utilities Vulnerable to Prototype Pollution | GitHub advisory |
| CVE-2025-2792 | 2025-03-26 | Low 2.9 | @mozilla/readability | @mozilla/readability Denial of Service through Regex | GitHub advisory |
| CVE-2025-30081 | 2025-03-19 | Medium 6.3 | clickstorm/cs-seo | Clickstorm SEO Allows Cross-Site Scripting (XSS) | GitHub advisory |
| CVE-2025-30083 | 2025-03-19 | Medium 5.5 | codingms/additional-tca | Additional TCA Allows Cross-Site Scripting (XSS) | GitHub advisory |
| CVE-2024-10039 | 2024-11-25 | High 7.1 | org.keycloak:keycloak-core | Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination | GitHub advisory |
| CVE-2015-3542 | 2024-11-07 | High 8.7 | phpoffice/phpexcel | PHPExcel XXE Vulnerability | GitHub advisory |
| CVE-2014-6072 | 2024-05-30 | High 8.1 | symfony/symfony | Symfony Cross-Site Request Forgery vulnerability in the Web Profiler | GitHub advisory |
| CVE-2014-5245 | 2024-05-30 | High 7.5 | symfony/http-kernel | Symfony allows direct access of ESI URLs behind a trusted proxy | GitHub advisory |
| CVE-2015-2309 | 2024-05-30 | Medium 5.3 | symfony/http-foundation | Symfony has unsafe methods in the Request class | GitHub advisory |
| CVE-2014-6061 | 2024-05-30 | Medium 5.3 | symfony/http-foundation | Symfony has a security issue when parsing the Authorization header | GitHub advisory |
| CVE-2014-5244 | 2024-05-30 | High 7.5 | symfony/http-foundation | Symfony vulnerable to denial of service via a malicious HTTP Host header | GitHub advisory |
| CVE-2014-4931 | 2024-05-30 | High 7.5 | symfony/framework-bundle | Code injection in the way Symfony implements translation caching in FrameworkBundle | GitHub advisory |
| CVE-2016-1000253 | 2024-05-17 | Unscored | onelogin/php-saml | onelogin/php-saml signature wrapping attacks | GitHub advisory |
| CVE-2021-32026 | 2024-05-14 | Unscored | github.com/nats-io/nats-server/v2 | NATS server TLS missing ciphersuite settings when CLI flags used | GitHub advisory OSV.dev |
Machine-readable: /api/upcoming · /api/upcoming/reported