Miggo Predictive Vulnerability Database

Comprehensive vulnerability intelligence for security teams to gain clarity into CVEs to prioritize and respond with precision.

Concerned about an active attack path? Talk to our security experts and see Miggo in action

Top 10 CVEs

CVE-2021-44228

Remote code injection in Log4j

2 Vulnerable Functions

CVE-2022-22965

Remote Code Execution in Spring Framework

2 Vulnerable Functions

CVE-2022-1471

SnakeYaml Constructor Deserialization Remote Code Execution

6 Vulnerable Functions

CVE-2023-50164

Apache Struts vulnerable to path traversal

4 Vulnerable Functions

CVE-2024-27348

Apache HugeGraph-Server: Command execution in gremlin

2 Vulnerable Functions

CVE-2024-53677

Apache Struts file upload logic is flawed

2 Vulnerable Functions

CVE-2025-1974

ingress-nginx admission controller RCE escalation

2 Vulnerable Functions

CVE-2025-29927

Authorization Bypass in Next.js Middleware

3 Vulnerable Functions

CVE-2025-24813

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

2 Vulnerable Functions

CVE-2025-3248

Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint

2 Vulnerable Functions

New vulnerabilities last 30 days

GHSA-vfpf-xmwh-8m65: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

ProsemirrorToHtml XSS via unescaped HTML attributes in document rendering injects malicious JavaScript for arbitrary code execution in victim browsers.

GHSA-f83h-ghpp-7wcc: Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

pdfminer.six CMap loader insecure deserialization of malicious pickle files executes arbitrary code, granting local privilege escalation to root access.

GHSA-wf5f-4jwr-ppcp: Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

pdfminer.six RCE via crafted PDF CMap path traversal triggers unsafe pickle deserialization in CMapDB, granting remote attackers arbitrary code execution.

CVE-2025-64496: Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Open WebUI Direct Connections code injection via malicious model server SSE events executes arbitrary JS for token theft, account takeover, and backend RCE.

Resources