Browse CVEs by Ecosystem and Severity
340 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-67853
Moodle Affected by Improper Restriction of Excessive Authentication Attempts
HIGH
CVE-2025-67848
Moodle authentication bypass vulnerability
HIGH
CVE-2026-24788
RaspAP raspap-webgui contains an OS Command Injection vulnerability
HIGH
CVE-2026-22243
EGroupware has SQL Injection in Nextmatch Filter Processing
HIGH
CVE-2026-24765
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
HIGH
CVE-2025-67847
Moodle affected by a code injection vulnerability
HIGH
CVE-2021-47853
phpPgAdmin contains a remote command execution vulnerability
HIGH
CVE-2026-23622
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
HIGH
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
HIGH
CVE-2026-23492
Pimcore Has an Incomplete Patch for CVE-2023-30848
HIGH
CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
HIGH
CVE-2025-68456
Unauthenticated Craft CMS users can trigger a database backup
HIGH
CVE-2026-21449
Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
HIGH
CVE-2026-21448
Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
HIGH
CVE-2026-21446
Bagisto Missing Authentication on Installer API Endpoints
HIGH
CVE-2025-69210
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
HIGH
CVE-2025-51511
Cadmium CMS has a background arbitrary file upload vulnerability
HIGH
CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
HIGH
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
HIGH
CVE-2025-66468
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
HIGH
CVE-2025-13827
GrapesJsBuilder File Upload allows all file uploads
HIGH
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
HIGH
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
HIGH
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
HIGH
CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
HIGH
CVE-2025-66299
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
HIGH
CVE-2025-66296
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
HIGH
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
HIGH
CVE-2025-64500EPSS 0.0%
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
HIGH
CVE-2025-64519
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
HIGH
CVE-2025-47776
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
HIGH
CVE-2025-54264
Magento vulnerable to stored Cross-Site Scripting (XSS)
HIGH
CVE-2025-54263
Magento provides incorrect authorization through a security feature bypass
HIGH
CVE-2025-56588
Dolibarr vulnerable to RCE via the computed field parameter
HIGH
CVE-2025-59839
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes
HIGH
CVE-2025-52353
Badaso CMS file upload vulnerability
HIGH
CVE-2025-43960
Adminer PHP Object Injection issue leads to Denial of Service
HIGH
CVE-2025-49555
Magento Cross-Site Request Forgery (CSRF) vulnerability
HIGH
CVE-2025-49556
Magento has incorrect authorization issue that leads to arbitrary file system read
HIGH
CVE-2025-49557
Magento Cross-site Scripting vulnerability
HIGH
CVE-2025-49554
Magento vulnerable to denial of service
HIGH
CVE-2025-8264
z-push/z-push-dev SQL Injection Vulnerability
HIGH
CVE-2025-53369
Citizen Short Description stored XSS vulnerability through wikitext
HIGH
CVE-2025-53370
Citizen vulnerable to Stored XSS through short descriptions
HIGH
CVE-2025-53368
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
HIGH
CVE-2025-53093
TabberNeue vulnerable to Stored XSS through wikitext
HIGH
CVE-2025-48446
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability
HIGH
CVE-2025-48445
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability
HIGH
CVE-2025-43585
Magento Improper Authorization leading to security feature bypass
HIGH
CVE-2025-48201
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location