Browse CVEs by Ecosystem and Severity
393 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-37906
Admidio has Blind SQL Injection in ecard_send.php
CRITICAL
CVE-2024-41637
RaspAP allows an attacker to escalate privileges
CRITICAL
CVE-2024-40624
TorrentPier Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-37843
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
CRITICAL
CVE-2024-34103
Magento Open Source Improper Authentication vulnerability
CRITICAL
CVE-2024-34102KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
CRITICAL
CVE-2024-25738
VuFind Server-Side Request Forgery (SSRF) vulnerability
CRITICAL
CVE-2024-25737
VuFind Server-Side Request Forgery (SSRF) vulnerability
CRITICAL
CVE-2020-35125
Mautic is vulnerable to XSS vulnerability
CRITICAL
CVE-2024-34716
PrestaShop cross-site scripting via customer contact form in FO, through file upload
CRITICAL
CVE-2024-4825
Cockpit CMS contains an arbitrary file upload vulenrability
CRITICAL
CVE-2024-34070
Blind XSS Leading to Froxlor Application Compromise
CRITICAL
CVE-2024-34461
Zenario uses Twig filters insecurely in the Twig Snippet plugin
CRITICAL
CVE-2014-8089
Zend Framework SQL injection vulnerability
CRITICAL
CVE-2018-7602KEV
Drupal Core Remote Code Execution Vulnerability
CRITICAL
CVE-2024-31819
WWBN AVideo Remote Code Execution
CRITICAL
CVE-2024-1651
Deserialization of Untrusted Data in Torrentpier
CRITICAL
CVE-2024-25108
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
CRITICAL
CVE-2024-22406
Blind SQL injection in shopware
CRITICAL
CVE-2019-6342
Drupal Improper Access Control
CRITICAL
CVE-2023-49599
WWBN AVideo Insufficient Entropy vulnerbaility
CRITICAL
CVE-2023-46308
plotly.js prototype pollution vulnerability
CRITICAL
CVE-2023-6026
PHPMemcachedAdmin Path Traversal vulnerability
CRITICAL
CVE-2023-6069
Froxlor Improper Input Validation vulnerability
CRITICAL
CVE-2015-5467
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter
CRITICAL
CVE-2023-38888
Cross Site Scripting vulnerability in Dolibarr ERP CRM
CRITICAL
CVE-2023-41892
Craft CMS Remote Code Execution vulnerability
CRITICAL
CVE-2023-41330
Snappy PHAR deserialization vulnerability
CRITICAL
CVE-2021-36021
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
CRITICAL
CVE-2021-36023
Magento XML Injection vulnerability in the Widgets Update Layout
CRITICAL
CVE-2021-36036
Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
CRITICAL
CVE-2023-39526
PrestaShop SQL manager vulnerability
CRITICAL
CVE-2023-4195
Cockpit PHP Remote File Inclusion vulnerability
CRITICAL
CVE-2023-29689
PyroCMS remote code execution vulnerability
CRITICAL
CVE-2022-39986
RaspAP Command Injection vulnerability
CRITICAL
CVE-2023-36825
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
CRITICAL
CVE-2023-36097
fuadmin vulnerable to insecure file upload
CRITICAL
CVE-2023-29931
laravel-s vulnerable to Local File Inclusion
CRITICAL
CVE-2020-21489
Liufee CMS File Upload vulnerability
CRITICAL
CVE-2020-21174
liufee CMS File Upload vulnerability
CRITICAL
CVE-2023-3173
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2023-32692
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
CRITICAL
CVE-2023-27238
LavaLite vulnerable to web cache poisoning
CRITICAL
CVE-2023-2531
AzuraCast missing brute force prevention
CRITICAL
CVE-2023-28473
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section
CRITICAL
CVE-2020-36070
Remote code execution in Voyager
CRITICAL
CVE-2023-30839
SQL filter bypass leading to arbitrary write requests using "SQL Manager"
CRITICAL
CVE-2023-29141
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
CRITICAL
CVE-2023-28333
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input
CRITICAL
CVE-2023-25655
baserCMS allows any file to be uploaded