Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-34104
Magento Open Source Improper Authorization vulnerability
HIGH
CVE-2024-35241
Composer has a command injection via malicious git branch name
HIGH
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
HIGH
CVE-2024-34008
Moodle CSRF risk in analytics management of models
HIGH
CVE-2014-6072
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
CRITICAL
CVE-2024-25738
VuFind Server-Side Request Forgery (SSRF) vulnerability
CRITICAL
CVE-2024-25737
VuFind Server-Side Request Forgery (SSRF) vulnerability
CRITICAL
CVE-2020-35125
Mautic is vulnerable to XSS vulnerability
CRITICAL
CVE-2024-34716
PrestaShop cross-site scripting via customer contact form in FO, through file upload
CRITICAL
CVE-2024-4825
Cockpit CMS contains an arbitrary file upload vulenrability
CRITICAL
CVE-2024-34070
Blind XSS Leading to Froxlor Application Compromise
CRITICAL
CVE-2024-34461
Zenario uses Twig filters insecurely in the Twig Snippet plugin
CRITICAL
CVE-2014-8089
Zend Framework SQL injection vulnerability
CRITICAL
CVE-2018-7602KEV
Drupal Core Remote Code Execution Vulnerability
CRITICAL
CVE-2024-31819
WWBN AVideo Remote Code Execution
MEDIUM
CVE-2024-20759
Magento Open Source allows Cross-Site Scripting (XSS)
HIGH
CVE-2024-20758
Magento Open Source allows Improper Input Validation
CRITICAL
CVE-2024-1651
Deserialization of Untrusted Data in Torrentpier
HIGH
CVE-2024-20719
Magento Open Source allows Cross-Site Scripting (XSS)
HIGH
CVE-2024-20720
Magento Open Source allows OS Command Injection
CRITICAL
CVE-2024-25108
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
CRITICAL
CVE-2024-22406
Blind SQL injection in shopware
CRITICAL
CVE-2019-6342
Drupal Improper Access Control
CRITICAL
CVE-2023-49599
WWBN AVideo Insufficient Entropy vulnerbaility
CRITICAL
CVE-2023-46308
plotly.js prototype pollution vulnerability
HIGH
CVE-2023-50461
Configuration Injection in extension "Direct Mail" (direct_mail)
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
CRITICAL
CVE-2023-6026
PHPMemcachedAdmin Path Traversal vulnerability
MEDIUM
CVE-2023-48219
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
CRITICAL
CVE-2023-6069
Froxlor Improper Input Validation vulnerability
MEDIUM
CVE-2023-45819
TinyMCE XSS vulnerability in notificationManager.open API
MEDIUM
CVE-2023-45818
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
MEDIUM
CVE-2023-38250
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38249
Magento Open Source allows SQL Injection
LOW
CVE-2023-38219
Magento Open Source allows Cross-Site Scripting (XSS)
MEDIUM
CVE-2023-38221
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38218
Magento Open Source allows Incorrect Authorization
CRITICAL
CVE-2015-5467
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
CRITICAL
CVE-2023-38888
Cross Site Scripting vulnerability in Dolibarr ERP CRM
CRITICAL
CVE-2023-41892
Craft CMS Remote Code Execution vulnerability
CRITICAL
CVE-2023-41330
Snappy PHAR deserialization vulnerability
CRITICAL
CVE-2021-36021
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
CRITICAL
CVE-2021-36023
Magento XML Injection vulnerability in the Widgets Update Layout
CRITICAL
CVE-2021-36036
Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
CRITICAL
CVE-2023-39526
PrestaShop SQL manager vulnerability
HIGH
CVE-2023-38208
Magento Open Source allows Improper Neutralization of Special Elements Used
CRITICAL
CVE-2023-4195
Cockpit PHP Remote File Inclusion vulnerability
CRITICAL
CVE-2023-29689
PyroCMS remote code execution vulnerability
CRITICAL
CVE-2022-39986
RaspAP Command Injection vulnerability
CRITICAL
CVE-2023-36825
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution