Browse CVEs by Ecosystem and Severity
456 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-21534
JSONPath Plus Remote Code Execution (RCE) Vulnerability
CRITICAL
CVE-2024-38989
Prototype pollution in izatop bunt
CRITICAL
CVE-2024-39309
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
CRITICAL
CVE-2024-36573
obx Prototype Pollution
CRITICAL
CVE-2024-37273
Jan path traversal vulnerability
CRITICAL
CVE-2024-36858
Jan path traversal vulnerability
CRITICAL
CVE-2024-24294
Blackprint @blackprint/engine Prototype Pollution issue
CRITICAL
CVE-2024-34706
@valtimo/components exposes access token to form.io
CRITICAL
CVE-2024-32962
xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing
CRITICAL
CVE-2024-21511
MySQL2 for Node Arbitrary Code Injection
CRITICAL
CVE-2024-30564
@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability
CRITICAL
CVE-2024-28056
AWS Amplify CLI has incorrect trust policy management
CRITICAL
CVE-2024-21508
mysql2 Remote Code Execution (RCE) via the readCodeFor function
CRITICAL
CVE-2024-27448
MailDev Remote Code Execution
CRITICAL
CVE-2024-29650
@thi.ng/paths Prototype Pollution vulnerability
CRITICAL
CVE-2024-27922
HTTP Handling Vulnerability in the Bare server
CRITICAL
CVE-2024-27307
JSONata expression can pollute the "Object" prototype
CRITICAL
CVE-2024-27298
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
CRITICAL
CVE-2023-51837
Ylianst MeshCentral Missing SSL Certificate Validation
CRITICAL
CVE-2023-46308
plotly.js prototype pollution vulnerability
CRITICAL
CVE-2019-25158
Pedroetb TTS-API OS Command Injection
CRITICAL
CVE-2023-46498
Code execution in evershop
CRITICAL
CVE-2023-49210
openssl npm package vulnerable to command execution
CRITICAL
CVE-2023-45133
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
CRITICAL
CVE-2023-5572
Server-Side Request Forgery (SSRF) in vriteio/vrite
CRITICAL
CVE-2023-42810
systeminformation SSID Command Injection Vulnerability
CRITICAL
CVE-2023-33831
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
CRITICAL
CVE-2023-40582
Command Injection Vulnerability in find-exec
CRITICAL
CVE-2023-38894
tree-kit Prototype Pollution vulnerability
CRITICAL
CVE-2023-40013
external-svg-loader Cross-site Scripting vulnerability
CRITICAL
CVE-2021-26505
MrSwitch hello.js vulnerable to prototype pollution
CRITICAL
CVE-2023-39532
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution
CRITICAL
CVE-2023-26045
Path traversal and code execution via prototype vulnerability
CRITICAL
CVE-2023-3696
Mongoose Prototype Pollution vulnerability
CRITICAL
CVE-2023-36665
protobufjs Prototype Pollution vulnerability
CRITICAL
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
CRITICAL
CVE-2023-2479
appium-desktop OS Command Injection vulnerability
CRITICAL
CVE-2023-22621
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
CRITICAL
CVE-2023-2138
@nuxtlabs/github-module made Use of Hard-coded Credentials
CRITICAL
CVE-2023-26122
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization
CRITICAL
CVE-2023-26121
safe-eval vulnerable to Prototype Pollution via the safeEval function
CRITICAL
CVE-2023-28444
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
CRITICAL
CVE-2023-22578
Sequelize - Default support for “raw attributes” when using parentheses
CRITICAL
CVE-2023-22579
Unsafe fall-through in getWhereConditions
CRITICAL
CVE-2023-25813
Sequelize vulnerable to SQL Injection via replacements
CRITICAL
CVE-2020-36632
flat vulnerable to Prototype Pollution
CRITICAL
CVE-2022-39396
Remote code execution via MongoDB BSON parser through prototype pollution
CRITICAL
CVE-2022-39353
xmldom allows multiple root nodes in a DOM
CRITICAL
CVE-2022-2421
Insufficient validation when decoding a Socket.IO packet
CRITICAL
CVE-2022-36084
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch