Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

788 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest

XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token

OpenCRX allows a remote attacker to execute arbitrary code via a crafted request

CVE-2023-46604KEV

Apache ActiveMQ is vulnerable to Remote Code Execution

XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages

XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

XWiki Platform XSS vulnerability from account in the create page form via template provider

org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter

org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

SaToken privilege escalation vulnerability

Sureness uses hardcoded key

Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter

Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class

Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page

XWiki Change Request Application UI XSS and remote code execution through change request title

Authorization Bypass in Apache InLong

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper

CVE-2023-44487KEV

HTTP/2 Stream Cancellation Attack

Microsoft Common Data Model SDK Denial of Service Vulnerability

SQL injection in jeecgboot

Quarkus HTTP vulnerable to incorrect evaluation of permissions

CVE-2022-24816KEV

Improper Control of Generation of Code ('Code Injection') in jai-ext

OpenRefine Remote Code execution in project import with mysql jdbc url attack

hutool Buffer Overflow vulnerability

hutool Buffer Overflow vulnerability

Jeecg boot SQL Injection vulnerability

Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

XWiki Platform privilege escalation (PR) from account through AWM content fields

XWiki Platform privilege escalation (PR)/RCE from account through Invitation subject/message

Alluxio vulnerable to arbitrary code execution

Aerospike Java Client vulnerable to unsafe deserialization of server responses

Apache NiFi Code Injection vulnerability

Code injection in PowerJob

Code injection in stanford-parser

Code injection in oscore

Code injection in BoofCV

Code injection in wix-embedded-mysql

Code injection in webmagic-core

Code injection in Duke

SQL injection in jeecg-boot

Deserialization vulnerability in Helix workflow and REST

Remote code execution in Apache Jackrabbit

Hard-coded System User Credentials in Folio Data Export Spring module

SQL injection in audit endpoint

Path Traversal in Apache Shiro

Access Control Bypass in Spring Security

rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message

Scan your dependencies for these CVEs