Browse CVEs by Ecosystem and Severity
61 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CRITICAL
CVE-2026-75513
Marten's LINQ provider has SQL injection via unescaped string literals
CRITICAL
CVE-2026-62815
Microsoft QUIC: Remote Code Execution Vulnerability
CRITICAL
CVE-2026-59865
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
CRITICAL
CVE-2026-59864
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
CRITICAL
CVE-2026-54782
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CRITICAL
CVE-2026-45288
Marten has an injection vulnerability in its full-text search regConfig parameter
CRITICAL
CVE-2026-40372
Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege
CRITICAL
CVE-2026-40324
ChilliCream GraphQL Platform: Utf8GraphQLParser Stack Overflow via Deeply Nested GraphQL Documents
CRITICAL
CVE-2026-32179
MsQuic has a Remote Elevation of Privilege Vulnerability
CRITICAL
CVE-2026-74790
Scriban: Sandbox escape due to TypedObjectAccessorcache bypassing MemberFilter after TemplateContext reuse
CRITICAL
CVE-2026-25592
Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK
CRITICAL
CVE-2026-24838
DotNetNuke.Core Vulnerable to Stored XSS via Module Title
CRITICAL
CVE-2025-68924
UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
CRITICAL
CVE-2025-64095
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
CRITICAL
CVE-2025-54539
Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-55315
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
CRITICAL
CVE-2025-61778
Akka.Remote TLS did not properly implement certificate-based authentication
CRITICAL
CVE-2025-59545
DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module
CRITICAL
CVE-2025-43858
YoutubeDLSharp allows command injection on windows system due to non sanitized arguments
CRITICAL
CVE-2025-29953
Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-24895
AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass
CRITICAL
CVE-2025-24894
The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass
CRITICAL
CVE-2024-43498
.NET Remote Code Execution Vulnerability
CRITICAL
CVE-2024-51501
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
CRITICAL
CVE-2024-28698
CLSA Directory Traversal vulnerability
CRITICAL
CVE-2024-35264
Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability
CRITICAL
CVE-2024-0057
NuGet Client Security Feature Bypass Vulnerability
CRITICAL
CVE-2023-32571
Dynamic Linq vulnerable to remote code execution
CRITICAL
CVE-2022-23535
LiteDB may deserialize bad JSON on object type using _type
CRITICAL
CVE-2021-4248
DNS NuGet package uses insufficiently random values
CRITICAL
CVE-2022-39256
Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
CRITICAL
CVE-2022-35540
Use of Hard-coded Credentials in AgileConfig.Client
CRITICAL
CVE-2021-24112
.NET Core Remote Code Execution Vulnerability
CRITICAL
CVE-2020-20136
QuantConnect Lean vulnerable to insecure deserialization
CRITICAL
CVE-2019-20627
AutoUpdater.NET allows XXE
CRITICAL
CVE-2019-12277
Blogifier does not properly restrict APIs
CRITICAL
CVE-2014-4172
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
CRITICAL
CVE-2017-0252
ChakraCore RCE Vulnerability
CRITICAL
CVE-2017-9246
New Relic .NET Agent contains SQL Injection
CRITICAL
CVE-2017-0223
ChakraCore RCE Vulnerability
CRITICAL
CVE-2017-9785
Deserialization of Untrusted Data in NancyFX Nancy
CRITICAL
CVE-2017-8658
ChakraCore RCE Vulnerability
CRITICAL
CVE-2021-33318
Improper Input Validation in IpMatcher
CRITICAL
CVE-2018-1000120
curl FTP path confusion leads to NIL byte out of bounds write
CRITICAL
CVE-2017-11767
ChakraCore vulnerable to privilege escalation
CRITICAL
CVE-2018-8500
ChakraCore RCE Vulnerability
CRITICAL
CVE-2022-0749
Deserialization of Untrusted Data in SinGooCMS.Utility
CRITICAL
CVE-2021-46703
Code injection in RazorEngine
CRITICAL
CVE-2021-23758KEV
Remote Code Execution in AjaxNetProfessional