Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-38894
tree-kit Prototype Pollution vulnerability
CRITICAL
CVE-2023-40013
external-svg-loader Cross-site Scripting vulnerability
CRITICAL
CVE-2021-26505
MrSwitch hello.js vulnerable to prototype pollution
CRITICAL
CVE-2023-39532
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution
CRITICAL
CVE-2023-26045
Path traversal and code execution via prototype vulnerability
CRITICAL
CVE-2023-3696
Mongoose Prototype Pollution vulnerability
CRITICAL
CVE-2023-36665
protobufjs Prototype Pollution vulnerability
CRITICAL
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
HIGH
CVE-2023-26134
git-commit-info vulnerable to Command Injection
CRITICAL
CVE-2023-2479
appium-desktop OS Command Injection vulnerability
CRITICAL
CVE-2023-22621
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
CRITICAL
CVE-2023-2138
@nuxtlabs/github-module made Use of Hard-coded Credentials
CRITICAL
CVE-2023-26122
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization
CRITICAL
CVE-2023-26121
safe-eval vulnerable to Prototype Pollution via the safeEval function
CRITICAL
CVE-2023-28444
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
CRITICAL
CVE-2023-22578
Sequelize - Default support for “raw attributes” when using parentheses
CRITICAL
CVE-2023-22579
Unsafe fall-through in getWhereConditions
CRITICAL
CVE-2023-25813
Sequelize vulnerable to SQL Injection via replacements
CRITICAL
CVE-2020-36632
flat vulnerable to Prototype Pollution
MEDIUM
CVE-2022-23494
Cross-site scripting vulnerability in TinyMCE alerts
CRITICAL
CVE-2022-39396
Remote code execution via MongoDB BSON parser through prototype pollution
CRITICAL
CVE-2022-39353
xmldom allows multiple root nodes in a DOM
CRITICAL
CVE-2022-2421
Insufficient validation when decoding a Socket.IO packet
CRITICAL
CVE-2022-36084
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch
MEDIUM
CVE-2022-31160
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
HIGH
CVE-2022-31129
Moment.js vulnerable to Inefficient Regular Expression Complexity
MEDIUM
CVE-2018-14040
Bootstrap vulnerable to Cross-Site Scripting (XSS)
HIGH
CVE-2022-24785
Path Traversal: 'dir/../../filename' in moment.locale
CRITICAL
CVE-2021-44906EPSS 0.9%
Prototype Pollution in minimist
CRITICAL
CVE-2021-23682
Prototype Pollution in litespeed.js and appwrite/server-ce
HIGH
CVE-2022-0235EPSS 0.6%
node-fetch forwards secure headers to untrusted sites
MEDIUM
CVE-2020-28500EPSS 0.2%
Regular Expression Denial of Service (ReDoS) in lodash
MEDIUM
CVE-2024-21910
Cross-site scripting vulnerability in TinyMCE plugins
MEDIUM
CVE-2021-41183
XSS in `*Text` options of the Datepicker widget in jquery-ui
MEDIUM
CVE-2021-41184
XSS in the `of` option of the `.position()` util in jquery-ui
MEDIUM
CVE-2021-41182
XSS in the `altField` option of the Datepicker widget in jquery-ui
MEDIUM
CVE-2024-21908
Cross-site scripting vulnerability in TinyMCE
HIGH
CVE-2021-3749EPSS 1.5%
axios Inefficient Regular Expression Complexity vulnerability
HIGH
CVE-2021-37701EPSS 0.0%
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
HIGH
CVE-2021-37712EPSS 0.0%
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
HIGH
CVE-2021-37713EPSS 0.6%
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
MEDIUM
CVE-2021-23343EPSS 0.3%
Regular Expression Denial of Service in path-parse
HIGH
CVE-2021-32804EPSS 85.0%
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
HIGH
CVE-2021-32803EPSS 0.1%
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
HIGH
CVE-2020-28469EPSS 0.3%
glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex
HIGH
CVE-2021-23337EPSS 0.7%
Command Injection in lodash
HIGH
CVE-2021-21252
Regular Expression Denial of Service in jquery-validation
LOW
CVE-2020-15168EPSS 0.1%
The `size` option isn't honored after following a redirect in node-fetch
HIGH
CVE-2020-8203
Prototype Pollution in lodash
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery