Miggo Predictive Vulnerability Database

Comprehensive vulnerability intelligence for security teams to gain clarity into CVEs to prioritize and respond with precision.

Concerned about an active attack path? Talk to our security experts and see Miggo in action

Top 10 CVEs

New vulnerabilities last 30 days

CVE-2026-54335: Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed proto

@feathersjs/commons _.merge prototype pollution from a JSON-parsed __proto__ key recursively merges malicious properties onto Object.prototype for the process.

CVE-2026-49485: HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

org.hl7.fhir.core FHIRPathEngine ReDoS via malicious regex in matches() or replaceMatches() causes catastrophic backtracking, resulting in CPU exhaustion DoS.

CVE-2026-48049: @hapi/inert: Static-file confinement bypass via sibling-prefix path

@hapi/inert path traversal grants unauthenticated attackers arbitrary file reads from sibling directories via a crafted URL exploiting a confinement bypass.

CVE-2026-48022: @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

@hapi/wreck's improper origin check on redirects leaks Authorization and Cookie headers across ports and schemes, risking credential theft and impersonation.

Resources

Full Broker Takeover, No Login Required: Miggo Discovers Critical RabbitMQ Vulnerabilities Putting Application Data at Risk

Miggo uncovered two critical RabbitMQ flaws enabling unauthenticated broker takeover and tenant data exposure. Learn who is affected.

CVE-2026-20253: How to Stop the Unauthenticated Splunk Enterprise RCE Before the Patch Lands

CVE-2026-20253 turns Splunk Enterprise, the platform built to catch intruders, into an unauthenticated way in. Here's how the exploit chain works, and how Miggo blinds it before Splunk's patch ships.

The Security Patch that Created a Vulnerability: Miggo Security Releases Detector for CVE-2026-23111 to Catch an Attack Before a Fix

A Linux vulnerability introduced by a security fix remained exposed for 2.5 years. Miggo built the first working exploit and detection.

Miggo Predictive Vulnerability Database

Top 10 CVEs

CVE-2025-3248

CVE-2025-29927

CVE-2025-24813

CVE-2025-1974

CVE-2024-53677

CVE-2024-27348

CVE-2022-22965

CVE-2021-44228

CVE-2025-55182

CVE-2023-50164

New vulnerabilities last 30 days

CVE-2026-54335: Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

CVE-2026-49485: HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

CVE-2026-48049: @hapi/inert: Static-file confinement bypass via sibling-prefix path

CVE-2026-48022: @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Resources

Full Broker Takeover, No Login Required: Miggo Discovers Critical RabbitMQ Vulnerabilities Putting Application Data at Risk

CVE-2026-20253: How to Stop the Unauthenticated Splunk Enterprise RCE Before the Patch Lands

The Security Patch that Created a Vulnerability: Miggo Security Releases Detector for CVE-2026-23111 to Catch an Attack Before a Fix

Resources

Full Broker Takeover, No Login Required: Miggo Discovers Critical RabbitMQ Vulnerabilities Putting Application Data at Risk

CVE-2026-20253: How to Stop the Unauthenticated Splunk Enterprise RCE Before the Patch Lands

The Security Patch that Created a Vulnerability: Miggo Security Releases Detector for CVE-2026-23111 to Catch an Attack Before a Fix

CVE-2026-54335: Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed proto