Browse CVEs by Ecosystem and Severity
758 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-22647
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
CRITICAL
CVE-2023-33965
Brook's tproxy server is vulnerable to a drive-by command injection.
CRITICAL
CVE-2023-33189
Pomerium vulnerable to Incorrect Authorization with specially crafted requests
HIGH
CVE-2023-2515
Mattermost Incorrect Authorization vulnerability
CRITICAL
CVE-2023-22651
Rancher Webhook is misconfigured during upgrade process
CRITICAL
CVE-2021-28235
Etcd-io Improper Authentication vulnerability
CRITICAL
CVE-2023-1800
sjqzhang go-fastdfs vulnerable to path traversal
CRITICAL
CVE-2023-1537
Answer vulnerable to Authentication Bypass by Capture-replay
CRITICAL
CVE-2023-28609
Ansible Semaphore mishandles authentication
CRITICAL
CVE-2022-2024
Gogs OS Command Injection vulnerability
CRITICAL
CVE-2021-32163
Privilege escalation in MOSN
CRITICAL
CVE-2023-23947
Users with any cluster secret update access may update out-of-bounds cluster secrets
CRITICAL
CVE-2023-25168
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system
CRITICAL
CVE-2023-0744
Answer contains Improper Access Control vulnerability
CRITICAL
CVE-2021-3538
go.uuid has Predictable UUID Identifiers
CRITICAL
CVE-2023-22463
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys
CRITICAL
CVE-2022-48195
mellium.im/sasl authentication failure due to insufficient nonce randomness
CRITICAL
CVE-2017-20146
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy
CRITICAL
CVE-2022-4686
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
CRITICAL
CVE-2022-4643
docconv OS Command Injection vulnerability
CRITICAL
CVE-2022-45933
KubeView vulnerable to full cluster takeover due to improper authentication
CRITICAL
CVE-2022-41924
Tailscale Windows daemon is vulnerable to RCE via CSRF
CRITICAL
CVE-2022-39395
Vela Insecure Defaults
CRITICAL
CVE-2022-44797
btcd mishandles witness size checking
CRITICAL
CVE-2022-3023
TiDB vulnerable to Use of Externally-Controlled Format String
CRITICAL
CVE-2022-39345
Gin-vue-admin subject to Remote Code Execution via file upload vulnerability
CRITICAL
CVE-2022-38580
Skipper vulnerable to SSRF via X-Skipper-Proxy
CRITICAL
CVE-2018-21246
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
CRITICAL
CVE-2021-36782
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
CRITICAL
CVE-2022-2321
Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2022-31035
Argo CD's external URLs for Deployments can include JavaScript
CRITICAL
CVE-2022-31053
Signature forgery in Biscuit
CRITICAL
CVE-2022-1986
OS Command Injection in file editor in Gogs
CRITICAL
CVE-2022-30324
Privilege escalation in Hashicorp Nomad
CRITICAL
CVE-2022-26945
HashiCorp go-getter command injection
CRITICAL
CVE-2020-25816
Token leases could outlive their TTL in HashiCorp Vault
CRITICAL
CVE-2022-29165
Argo CD will blindly trust JWT claims if anonymous access is enabled
CRITICAL
CVE-2021-43350
Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection
CRITICAL
CVE-2020-15391
DevSpace vulnerable to remote code execution
CRITICAL
CVE-2017-18915
Mattermost Server server restarts may provide attackers with API access
CRITICAL
CVE-2017-18908
Mattermost Server password reset email requests can be sent to attacker-provided email addresses
CRITICAL
CVE-2017-18900
Mattermost Server is vulnerable CSV Injection
CRITICAL
CVE-2017-18888
Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests
CRITICAL
CVE-2017-18885
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials
CRITICAL
CVE-2019-11202
Rancher Recreates Default User With Known Password Despite Deletion
CRITICAL
CVE-2019-14271
Moby Docker cp broken with debian containers
CRITICAL
CVE-2019-11576
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
CRITICAL
CVE-2019-9901
EnvoyProxy Envoy Missing HTTP URL path normalization
CRITICAL
CVE-2022-24817
Improper kubeconfig validation allows arbitrary code execution
CRITICAL
CVE-2018-9057
HashiCorp Terraform Amazon Web Services (AWS) uses an insecure PRNG