Browse CVEs by Ecosystem and Severity
758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-41121
Woodpecker's custom workspace allow to overwrite plugin entrypoint executable
CRITICAL
CVE-2024-39907
1Panel has an SQL injection issue related to the orderBy clause
CRITICAL
CVE-2024-39223
Missing key verification in gost
CRITICAL
CVE-2024-38513
Session Middleware Token Injection Vulnerability
CRITICAL
CVE-2019-25211
Gin mishandles a wildcard at the end of an origin string
CRITICAL
CVE-2023-32191
rke's credentials are stored in the RKE1 Cluster state ConfigMap
HIGH
CVE-2023-22650
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
MEDIUM
CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
HIGH
CVE-2024-37153
Contract balance not updating correctly after interchain transaction
CRITICAL
CVE-2024-5262
Files or Directories Accessible to External Parties in ProjectDiscovery
CRITICAL
CVE-2024-31989
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
CRITICAL
CVE-2022-39328
Grafana Race condition allowing privilege escalation
CRITICAL
CVE-2021-41244
Grafana Fine-grained access control vulnerability
CRITICAL
CVE-2024-30850
tiagorlampert CHAOS vulnerable to arbitrary code execution
CRITICAL
CVE-2020-28991
Improper Access Control in Gitea
CRITICAL
CVE-2020-14316
Privilege Escalation in kubevirt
CRITICAL
CVE-2024-3817
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
CRITICAL
CVE-2024-32644
Evmos transaction execution not accounting for all state transition after interaction with precompiles
CRITICAL
CVE-2024-2029
LocalAI Command Injection in audioToWav
HIGH
CVE-2024-29891
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
HIGH
CVE-2024-28855
Improper HTML sanitization in ZITADEL
CRITICAL
CVE-2024-21652
Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss
CRITICAL
CVE-2024-28175
Cross-site scripting on application summary component
CRITICAL
CVE-2024-27102
Pterodactyl Wings vulnerable to improper isolation of server file access
HIGH
CVE-2024-27304
pgproto3 SQL Injection via Protocol Message Size Overflow
CRITICAL
CVE-2024-27302
Authorization Bypass Through User-Controlled Key in go-zero
CRITICAL
CVE-2024-25124
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
CRITICAL
CVE-2024-23652
BuildKit vulnerable to possible host system access from mount stub cleaner
CRITICAL
CVE-2024-23653
Buildkit's interactive containers API does not validate entitlements check
CRITICAL
CVE-2024-23827
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature
CRITICAL
CVE-2024-22199
Django Template Engine Vulnerable to XSS
CRITICAL
CVE-2023-49569
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
CRITICAL
CVE-2023-48312
Capsule Proxy Authentication bypass using an empty token
HIGH
CVE-2023-5528
Kubernetes Improper Input Validation vulnerability
HIGH
CVE-2023-3893
Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation
HIGH
CVE-2023-3676
Kubernetes privilege escalation vulnerability
HIGH
CVE-2023-3955
Kubernetes privilege escalation vulnerability
CRITICAL
CVE-2023-45128
CSRF Token Reuse Vulnerability
MEDIUM
CVE-2023-44487KEV
HTTP/2 Stream Cancellation Attack
CRITICAL
CVE-2023-32188
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
CRITICAL
CVE-2023-43644
sing-box vulnerable to improper authentication in the SOCKS inbound
CRITICAL
CVE-2022-28357
NATS nats-server allows directory traversal via unintended path to a management action
HIGH
CVE-2023-4863
libwebp: OOB write in BuildHuffmanTable
CRITICAL
CVE-2023-40029
Argo CD cluster secret might leak in cluster details page
CRITICAL
CVE-2023-4696
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos
CRITICAL
CVE-2023-37266
CasaOS contains weak JWT secrets
CRITICAL
CVE-2023-37265
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
CRITICAL
CVE-2023-33190
Improper configuration of RBAC permissions obtaining cluster control permissions
CRITICAL
CVE-2023-3128
Grafana vulnerable to Authentication Bypass by Spoofing