Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2017-11366
Codiad Vulnerable to Shell Command Injection
CRITICAL
CVE-2019-3809
Moodle Blind SSRF Risk in /badges/mybackpack.php
CRITICAL
CVE-2017-1000009
Akeneo PIM vulnerable to shell injection in the mass edition
CRITICAL
CVE-2019-9194
elFinder command injection vulnerability in the PHP connector
CRITICAL
CVE-2019-11018
ThinkAdmin Administrator cookies still working after password change
CRITICAL
CVE-2019-1000001
TeamPass Storing Passwords in a Recoverable Format vulnerability
CRITICAL
CVE-2018-16975
Elefant CMS PHP Code Execution Vulnerability
HIGH
CVE-2010-1615
Moodle vulnerable to SQL injection
CRITICAL
CVE-2018-14009
Codiad remote code execution vulnerability
CRITICAL
CVE-2019-10643
Contao Does Not Expire Tokens Correctly
MEDIUM
CVE-2018-14040
Bootstrap vulnerable to Cross-Site Scripting (XSS)
HIGH
CVE-2015-5237
protobuf susceptible to buffer overflow
CRITICAL
CVE-2021-23592
Deserialization of Untrusted Data in topthink/framework
CRITICAL
CVE-2022-28056
Incorrect Permission Assignment for Critical Resource in ShopXO
HIGH
CVE-2010-1153
TYPO3 PHP remote file inclusion vulnerability
HIGH
CVE-2010-0329
TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors
HIGH
CVE-2009-4803
Accessibility Glossary (a21glossary) SQL injection vulnerability
CRITICAL
CVE-2011-3583
Typo3 SQL injection due to faulty prepared statements
CRITICAL
CVE-2011-4628
Typo3 Authentication Bypass
CRITICAL
CVE-2021-46433
Sandbox bypass in fenom
CRITICAL
CVE-2017-9841KEV
Code Injection in PHPUnit
CRITICAL
CVE-2020-13756
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
CRITICAL
CVE-2021-23682
Prototype Pollution in litespeed.js and appwrite/server-ce
CRITICAL
CVE-2022-24086KEV
Magento improper input validation vulnerability
CRITICAL
CVE-2020-13675
Unrestricted Upload of File with Dangerous Type in Drupal core
CRITICAL
CVE-2019-6339
Arbitrary PHP code execution in Drupal
CRITICAL
CVE-2021-3943
Moodle vulnerable to RCE via unsafe deserialization
MEDIUM
CVE-2024-21910
Cross-site scripting vulnerability in TinyMCE plugins
MEDIUM
CVE-2024-21908
Cross-site scripting vulnerability in TinyMCE
CRITICAL
CVE-2020-13909
Critical severity vulnerability in Ignition
HIGH
CVE-2020-13671KEV
Drupal core Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2019-11831
Directory Traversal in typo3/phar-stream-wrapper
CRITICAL
CVE-2021-3129KEV
Unauthenticated remote code execution in Ignition
HIGH
CVE-2021-21355
Unrestricted File Upload in Form Framework
CRITICAL
CVE-2020-15146
Remote Code Execution in SyliusResourceBundle
MEDIUM
CVE-2020-11023KEV
Potential XSS vulnerability in jQuery
MEDIUM
CVE-2020-11022
Potential XSS vulnerability in jQuery
CRITICAL
CVE-2019-11325
Improper Input Validation in Symfony
CRITICAL
CVE-2019-10913
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
CRITICAL
CVE-2019-18889
Symfony Unsafe Cache Serialization Could Enable RCE
CRITICAL
CVE-2019-10910
Symfony Service IDs Allow Injection
MEDIUM
CVE-2019-11358
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
MEDIUM
CVE-2019-8331
Bootstrap Vulnerable to Cross-Site Scripting
MEDIUM
CVE-2018-20677
bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-20676
XSS vulnerability that affects bootstrap
MEDIUM
CVE-2016-10735
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-14042
Bootstrap Cross-site Scripting vulnerability
MEDIUM
CVE-2018-14041
Bootstrap Cross-site Scripting vulnerability