Miggo Predictive Vulnerability Database

Comprehensive vulnerability intelligence for security teams to gain clarity into CVEs to prioritize and respond with precision.

Concerned about an active attack path? Talk to our security experts and see Miggo in action

Top 10 CVEs

CVE-2025-29927

Authorization Bypass in Next.js Middleware

3 Vulnerable Functions

CVE-2021-44228

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

2 Vulnerable Functions

CVE-2025-1974

ingress-nginx admission controller RCE escalation

2 Vulnerable Functions

CVE-2025-55182

React Server Components are Vulnerable to RCE

7 Vulnerable Functions

CVE-2025-3248

Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint

2 Vulnerable Functions

CVE-2025-24813

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

2 Vulnerable Functions

CVE-2023-50164

Apache Struts vulnerable to path traversal

4 Vulnerable Functions

CVE-2024-27348

Apache HugeGraph-Server: Command execution in gremlin

2 Vulnerable Functions

CVE-2022-22965

Remote Code Execution in Spring Framework

2 Vulnerable Functions

CVE-2024-53677

Apache Struts file upload logic is flawed

2 Vulnerable Functions

New vulnerabilities last 30 days

CVE-2026-40486: Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate

Kimai User Preferences API auth bypass grants users unauthorized modification of hourly_rate and internal_rate via a PATCH request, causing financial tampering.

CVE-2026-40353: wger: Stored XSS via Unescaped License Attribution Fields

wger stored XSS in Ingredient license attribution fields executes arbitrary scripts for visitors, enabling session hijacking via unescaped HTML generation.

CVE-2026-40265: Note Mark has Broken Access Control on Asset Download

Note Mark auth bypass on the asset download API discloses private note assets via direct requests using known note and asset UUIDs to an unprotected route.

CVE-2026-40263: Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Note Mark login endpoint timing side-channel leaks account existence, enabling unauthenticated username enumeration by measuring bcrypt verification latency.