Browse CVEs by Ecosystem and Severity
758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-66626
RCE via ZipSlip and symbolic links in argoproj/argo-workflows
HIGH
CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login
HIGH
CVE-2026-29067
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login
CRITICAL
CVE-2025-67494
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
CRITICAL
CVE-2025-44005
Step CA Has Authorization Bypass in ACME and SCEP Provisioners
HIGH
CVE-2025-64443
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode
HIGH
CVE-2025-13353
gokey allows secret recovery from a seed file without the master password
CRITICAL
CVE-2025-12421
Mattermost fails to to verify the token used during code exchange
CRITICAL
CVE-2025-12419
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
CRITICAL
CVE-2025-41115
Grafana Incorrect Privilege Assignment vulnerability
MEDIUM
CVE-2025-64751
OpenFGA Improper Policy Enforcement
HIGH
CVE-2025-65109
Minder does not sandbox http.send in Rego programs
HIGH
CVE-2025-64523
File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function
HIGH
CVE-2025-64507
Incus vulnerable to local privilege escalation through custom storage volumes
CRITICAL
CVE-2025-64513
Milvus Proxy has a Critical Authentication Bypass Vulnerability
HIGH
CVE-2025-64186
Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves
HIGH
CVE-2025-64484
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation
HIGH
CVE-2025-2843
Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack
CRITICAL
CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
HIGH
CVE-2025-64431
IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering
HIGH
CVE-2025-64103
Zitadel May Bypass Second Authentication Factor
HIGH
CVE-2025-64102
Zitadel allows brute-forcing authentication factors
HIGH
CVE-2025-62725
Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations
HIGH
CVE-2025-54470
NeuVector telemetry sender is vulnerable to MITM and DoS
CRITICAL
CVE-2025-54469
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
CRITICAL
CVE-2025-10678
NetBird VPN does not remove the default password of an admin account
HIGH
CVE-2025-58073
Mattermost has a Missing Authorization vulnerability
HIGH
CVE-2025-58075
Mattermost has a Missing Authorization vulnerability
HIGH
CVE-2025-61688
Omni vulnerable to information leak via API
HIGH
CVE-2025-54286
Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
HIGH
CVE-2025-61595
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks
HIGH
CVE-2024-58267
Rancher CLI SAML authentication is vulnerable to phishing attacks
CRITICAL
CVE-2025-59823
Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning
HIGH
CVE-2025-9079
Mattermost Path Traversal vulnerability
MEDIUM
CVE-2025-59352
DragonFly vulnerable to arbitrary file read and write on a peer machine
CRITICAL
CVE-2025-59361
Chaos Controller Manager is vulnerable to OS command injection
CRITICAL
CVE-2025-59359
Chaos Controller Manager is vulnerable to OS command injection
CRITICAL
CVE-2025-59360
Chaos Controller Manager is vulnerable to OS command injection
CRITICAL
CVE-2025-54123
Hoverfly is vulnerable to Remote Code Execution through an insecure middleware implementation
CRITICAL
CVE-2025-58450
pREST has a Systemic SQL Injection Vulnerability
CRITICAL
CVE-2025-55190
Argo CD's Project API Token Exposes Repository Credentials
HIGH
CVE-2025-58158
Harness Allows Arbitrary File Write in Gitness LFS server
HIGH
CVE-2024-58259
Rancher affected by unauthenticated Denial of Service
CRITICAL
CVE-2025-8077
NeuVector admin account has insecure default password
HIGH
CVE-2025-57801
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks
MEDIUM
CVE-2025-55213
OpenFGA Authorization Bypass
CRITICAL
CVE-2025-55205
Capsule tenant owners with "patch namespace" permission can hijack system namespaces label
CRITICAL
CVE-2025-54997
Privileged OpenBao Operator May Execute Code on the Underlying Host
HIGH
CVE-2025-53534
RatPanel can perform remote command execution without authorization
CRITICAL
CVE-2025-6000
Hashicorp Vault has Code Execution Vulnerability via Plugin Configuration