Browse CVEs by Ecosystem and Severity
393 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-26016
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
CRITICAL
CVE-2026-26273
Known affected by Account Takeover via Password Reset Token Leakage
CRITICAL
CVE-2025-69212
OpenSTAManager has an OS Command Injection in P7M File Processing
CRITICAL
CVE-2026-25510
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
CRITICAL
CVE-2026-23524
Laravel Redis Horizontal Scaling Insecure Deserialization
CRITICAL
CVE-2025-67165
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
CRITICAL
CVE-2025-67164
Pagekit CMS is vulnerable to OS Command Injection via Storage component
CRITICAL
CVE-2025-66844
Grav may be vulnerable to SSRF attack via Twig Templates
CRITICAL
CVE-2025-65854
MineAdmin has an insecure default password
CRITICAL
CVE-2025-67719
Ibexa User Bundle is missing password change validation
CRITICAL
CVE-2025-67510
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
CRITICAL
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
CRITICAL
CVE-2025-62417
bagisto has CSV Formula Injection in Create New Product
CRITICAL
CVE-2025-61922
PrestaShop Checkout allows customer account takeover via email
CRITICAL
CVE-2025-10353
Melis Platform CMS Unauthenticated File Upload Leading to RCE
CRITICAL
CVE-2025-10351
Melis Platform CMS SQL Injection
CRITICAL
CVE-2025-10352
Melis Platform CMS Unauthenticated Admin Account Creation
CRITICAL
CVE-2025-54236KEV
Magento Community Edition Improper Input Validation vulnerability
CRITICAL
CVE-2025-52122
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
CRITICAL
CVE-2025-50706
ThinkPHP Path Traversal Vulnerability
CRITICAL
CVE-2025-54119
The ADOdb sqlite3 driver allows SQL injection
CRITICAL
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
CRITICAL
CVE-2025-54082
nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability
CRITICAL
CVE-2025-46001
simogeo/filemanager arbitrary file upload vulnerability
CRITICAL
CVE-2025-54068KEV
Livewire is vulnerable to remote command execution during component property update hydration
CRITICAL
CVE-2025-53833
LaRecipe is vulnerable to Server-Side Template Injection attacks
CRITICAL
CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
CRITICAL
CVE-2025-47110
Magneto contains stored XSS vulnerability
CRITICAL
CVE-2025-48951
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-49113KEV
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
CRITICAL
CVE-2025-48200
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution
CRITICAL
CVE-2025-47275
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
CRITICAL
CVE-2025-46337
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
CRITICAL
CVE-2025-0520
ShowDoc unrestricted file upload vulnerability
CRITICAL
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
CRITICAL
CVE-2025-32432KEV
Craft CMS Allows Remote Code Execution
CRITICAL
CVE-2025-32931
DevDojo Voyager Argument Injection vulnerability
CRITICAL
CVE-2024-58136KEV
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
CRITICAL
CVE-2025-22871
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
CRITICAL
CVE-2025-27517
Volt Allows RCE Via User-Crafted Requests
CRITICAL
CVE-2024-47051
Mautic allows Remote Code Execution and File Deletion in Asset Uploads
CRITICAL
CVE-2024-57602
Easy!Appointments Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
CRITICAL
CVE-2025-25286
Crayfish allows Remote Code Execution via Homarus Authorization header
CRITICAL
CVE-2024-56145KEV
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
CRITICAL
CVE-2024-51092
LibreNMS has an Authenticated OS Command Injection
CRITICAL
CVE-2021-3902
Improper Restriction of XML External Entity Reference in dompdf/dompdf
CRITICAL
CVE-2021-3838
Deserialization of Untrusted Data in dompdf/dompdf
CRITICAL
CVE-2024-44902
ThinkPHP deserialization vulnerability
CRITICAL
CVE-2024-38529
Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment