Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2024-45389
DOM clobbering could escalate to Cross-site Scripting (XSS)
HIGH
CVE-2024-43414
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
HIGH
CVE-2024-40453
squirrelly Code Injection vulnerability
HIGH
CVE-2024-39338EPSS 2.9%
Server-Side Request Forgery in axios
CRITICAL
CVE-2024-38989
Prototype pollution in izatop bunt
HIGH
CVE-2024-39943
rejetto HFS vulnerable to OS Command Execution by remote authenticated users
CRITICAL
CVE-2024-39309
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
HIGH
CVE-2024-38999
jrburke requirejs vulnerable to prototype pollution
HIGH
CVE-2024-38996
Prototype pollution in ag-grid-community via the _.mergeDeep function
MEDIUM
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
MEDIUM
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
CRITICAL
CVE-2024-36573
obx Prototype Pollution
MEDIUM
CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
CRITICAL
CVE-2024-37273
Jan path traversal vulnerability
CRITICAL
CVE-2024-36858
Jan path traversal vulnerability
CRITICAL
CVE-2024-24294
Blackprint @blackprint/engine Prototype Pollution issue
CRITICAL
CVE-2024-34706
@valtimo/components exposes access token to form.io
MEDIUM
CVE-2024-34341
Trix Editor Arbitrary Code Execution Vulnerability
CRITICAL
CVE-2024-32962
xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing
HIGH
CVE-2024-32866
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function
CRITICAL
CVE-2024-21511
MySQL2 for Node Arbitrary Code Injection
CRITICAL
CVE-2024-30564
@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability
CRITICAL
CVE-2024-28056
AWS Amplify CLI has incorrect trust policy management
CRITICAL
CVE-2024-21508
mysql2 Remote Code Execution (RCE) via the readCodeFor function
CRITICAL
CVE-2024-27448
MailDev Remote Code Execution
MEDIUM
CVE-2024-29041EPSS 0.1%
Express.js Open Redirect in malformed URLs
CRITICAL
CVE-2024-29650
@thi.ng/paths Prototype Pollution vulnerability
MEDIUM
CVE-2024-28863EPSS 0.4%
Denial of service while parsing a tar file due to lack of folders count validation
HIGH
CVE-2024-28181
TurboBoost Commands vulnerable to arbitrary method invocation
HIGH
CVE-2024-28121
StimulusReflex arbitrary method call
CRITICAL
CVE-2024-27922
HTTP Handling Vulnerability in the Bare server
CRITICAL
CVE-2024-27307
JSONata expression can pollute the "Object" prototype
CRITICAL
CVE-2024-27298
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
CRITICAL
CVE-2023-51837
Ylianst MeshCentral Missing SSL Certificate Validation
CRITICAL
CVE-2023-46308
plotly.js prototype pollution vulnerability
CRITICAL
CVE-2019-25158
Pedroetb TTS-API OS Command Injection
CRITICAL
CVE-2023-46498
Code execution in evershop
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
CRITICAL
CVE-2023-49210
openssl npm package vulnerable to command execution
MEDIUM
CVE-2023-48219
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
MEDIUM
CVE-2023-45857EPSS 0.1%
Axios Cross-Site Request Forgery Vulnerability
HIGH
CVE-2023-46115
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
MEDIUM
CVE-2023-45819
TinyMCE XSS vulnerability in notificationManager.open API
MEDIUM
CVE-2023-45818
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
CRITICAL
CVE-2023-45133
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
CRITICAL
CVE-2023-5572
Server-Side Request Forgery (SSRF) in vriteio/vrite
CRITICAL
CVE-2023-42810
systeminformation SSID Command Injection Vulnerability
CRITICAL
CVE-2023-33831
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
HIGH
CVE-2023-4863
libwebp: OOB write in BuildHuffmanTable
CRITICAL
CVE-2023-40582
Command Injection Vulnerability in find-exec