Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2025-22145EPSS 0.1%
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
HIGH
CVE-2024-56329
Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback
CRITICAL
CVE-2024-56145KEV
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
HIGH
CVE-2024-21546
UniSharp Laravel Filemanager Code Injection vulnerability
HIGH
CVE-2024-55661
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
LOW
CVE-2024-55636
Drupal core contains a potential PHP Object Injection vulnerability
HIGH
CVE-2024-55638
Drupal core contains a potential PHP Object Injection vulnerability
HIGH
CVE-2024-55637
Drupal core contains a potential PHP Object Injection vulnerability
HIGH
CVE-2024-54149
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
HIGH
CVE-2024-52596
SimpleSAMLphp xml-common XXE vulnerability
CRITICAL
CVE-2024-51092
LibreNMS has an Authenticated OS Command Injection
CRITICAL
CVE-2021-3902
Improper Restriction of XML External Entity Reference in dompdf/dompdf
CRITICAL
CVE-2021-3838
Deserialization of Untrusted Data in dompdf/dompdf
HIGH
CVE-2024-51736
Symfony vulnerable to command execution hijack on Windows with Process class
LOW
CVE-2024-50345EPSS 0.3%
Symfony vulnerable to open redirect via browser-sanitized URLs
HIGH
CVE-2024-51478
YesWiki Uses a Broken or Risky Cryptographic Algorithm
HIGH
CVE-2024-48112
ThinkPHP deserialization vulnerability
HIGH
CVE-2024-48230
SQL injection in funadmin
HIGH
CVE-2024-48229
SQL injection in funadmin
HIGH
CVE-2024-48222
SQL injection in funadmin
HIGH
CVE-2024-48226
SQL injection in funadmin
HIGH
CVE-2024-48218
SQL injection in funadmin
HIGH
CVE-2024-48225
SQL injection in funadmin
HIGH
CVE-2024-48223
SQL injection in funadmin
HIGH
CVE-2024-48514
Remote code execution in php-heic-to-jpg
MEDIUM
CVE-2024-45117
Magento Open Source Improper Input Validation vulnerability
MEDIUM
CVE-2024-45116
Magento Open Source Cross-Site Scripting (XSS) vulnerability
CRITICAL
CVE-2024-44902
ThinkPHP deserialization vulnerability
MEDIUM
CVE-2024-45411
Twig has a possible sandbox bypass
HIGH
CVE-2024-45048
XXE in PHPSpreadsheet encoding is returned
HIGH
CVE-2024-41964
Kirby has insufficient permission checks in the language settings
HIGH
CVE-2024-39402
Magento OS Command ('OS Command Injection') vulnerability
HIGH
CVE-2024-39400
Magento DOM-based Cross-Site Scripting (XSS) vulnerability
HIGH
CVE-2024-39399
Magento Path Traversal vulnerability
HIGH
CVE-2024-39401
Magento OS Command ('OS Command Injection') vulnerability
HIGH
CVE-2024-39403
Magento Stored Cross-Site Scripting (XSS) vulnerability
HIGH
CVE-2024-39398
Magento does not properly restrict excessive authentication attempts
HIGH
CVE-2024-42356
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
HIGH
CVE-2024-42355
Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
HIGH
CVE-2024-38909
Studio 42 elFinder vulnerable to Incorrect Access Control
CRITICAL
CVE-2024-38529
Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
CRITICAL
CVE-2024-37906
Admidio has Blind SQL Injection in ecard_send.php
CRITICAL
CVE-2024-41637
RaspAP allows an attacker to escalate privileges
CRITICAL
CVE-2024-40624
TorrentPier Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-37843
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
HIGH
CVE-2024-38516
Aimeos HTML client may potentially reveal sensitive information in error log
MEDIUM
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
MEDIUM
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
CRITICAL
CVE-2024-34103
Magento Open Source Improper Authentication vulnerability
CRITICAL
CVE-2024-34102KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability