Miggo Predictive Vulnerability Database

Comprehensive vulnerability intelligence for security teams to gain clarity into CVEs to prioritize and respond with precision.

Concerned about an active attack path? Talk to our security experts and see Miggo in action

Top 10 CVEs

CVE-2021-44228

Remote code injection in Log4j

2 Vulnerable Functions

CVE-2022-22965

Remote Code Execution in Spring Framework

2 Vulnerable Functions

CVE-2022-1471

SnakeYaml Constructor Deserialization Remote Code Execution

6 Vulnerable Functions

CVE-2023-50164

Apache Struts vulnerable to path traversal

4 Vulnerable Functions

CVE-2024-27348

Apache HugeGraph-Server: Command execution in gremlin

2 Vulnerable Functions

CVE-2024-53677

Apache Struts file upload logic is flawed

2 Vulnerable Functions

CVE-2025-1974

ingress-nginx admission controller RCE escalation

2 Vulnerable Functions

CVE-2025-24813

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

2 Vulnerable Functions

CVE-2025-29927

Authorization Bypass in Next.js Middleware

3 Vulnerable Functions

CVE-2025-3248

Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint

2 Vulnerable Functions

New vulnerabilities last 30 days

CVE-2025-66295: Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption

Grav Admin UI path traversal in user creation writes arbitrary YAML files via malicious usernames, causing account takeover and system config corruption.

CVE-2025-66306: Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Grav Admin Panel IDOR grants low-privilege users account enumeration by leaking sensitive emails in the HTML title of 403 Forbidden user account pages.

CVE-2025-66302: Grav vulnerable to Path Traversal allowing server files backup

Grav CMS path traversal in the backup tool grants authenticated admins arbitrary file read access via unsanitized path input, risking sensitive file exposure.

CVE-2025-66401: MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL

MCP Watch Command Injection in the cloneRepo method grants RCE via a malicious URL with shell metacharacters passed directly to the execSync function.