Browse CVEs by Ecosystem and Severity
340 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-38909
Studio 42 elFinder vulnerable to Incorrect Access Control
HIGH
CVE-2024-38516
Aimeos HTML client may potentially reveal sensitive information in error log
HIGH
CVE-2024-34104
Magento Open Source Improper Authorization vulnerability
HIGH
CVE-2024-35241
Composer has a command injection via malicious git branch name
HIGH
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
HIGH
CVE-2024-34008
Moodle CSRF risk in analytics management of models
HIGH
CVE-2014-6072
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
HIGH
CVE-2024-20758
Magento Open Source allows Improper Input Validation
HIGH
CVE-2024-20719
Magento Open Source allows Cross-Site Scripting (XSS)
HIGH
CVE-2024-20720
Magento Open Source allows OS Command Injection
HIGH
CVE-2023-50461
Configuration Injection in extension "Direct Mail" (direct_mail)
HIGH
CVE-2023-38208
Magento Open Source allows Improper Neutralization of Special Elements Used
HIGH
CVE-2023-29297
Magento Open Source allows Improper Neutralization of Special Elements Used
HIGH
CVE-2023-24814
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
HIGH
CVE-2022-35698
Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
HIGH
CVE-2020-13663
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
HIGH
CVE-2020-13664
Drupal Core Arbitrary PHP code execution vulnerability
HIGH
CVE-2019-19849
TYPO3 Insecure Deserialization in Query Generator & Query View
HIGH
CVE-2019-7876
Magento 2 Community Edition RCE Vulnerability
HIGH
CVE-2019-7865
Magento 2 Community Edition CSRF Vulnerability
HIGH
CVE-2010-1630
phpBB vulnerability related to use of "forum id" in circumstances related to a "global announcement."
HIGH
CVE-2010-3604
powermail extension for TYPO3 vulnerable to SQL Injection
HIGH
CVE-2011-4932
ImpressPages CMS eval injection vulnerability
HIGH
CVE-2010-3313
EGroupware Code Injection vulnerability
HIGH
CVE-2014-2921
Pimcore Vulnerable to PHP Object Injection Attacks
HIGH
CVE-2014-6289
yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions
HIGH
CVE-2014-6295
WEC Map (wec_map) extension for TYPO3 allows SQL Injection
HIGH
CVE-2014-3947
TYPO3 powermail extension has unrestricted file upload vulnerability
HIGH
CVE-2010-4961
Webkit PDFs for TYPO3 has SQL Injection vulnerability
HIGH
CVE-2010-4962
Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands
HIGH
CVE-2013-4748
News system (news) extension for TYPO3 vulnerable to SQL Injection
HIGH
CVE-2013-5322
CoolURI extension for TYPO3 vulnerable to SQL Injection
HIGH
CVE-2018-11406
Symfony CSRF Token Fixation
HIGH
CVE-2010-1615
Moodle vulnerable to SQL injection
HIGH
CVE-2015-5237
protobuf susceptible to buffer overflow
HIGH
CVE-2010-1153
TYPO3 PHP remote file inclusion vulnerability
HIGH
CVE-2010-0329
TYPO3 powermail Extension Vulnerable to SQL Injection via Unspecified Vectors
HIGH
CVE-2009-4803
Accessibility Glossary (a21glossary) SQL injection vulnerability
HIGH
CVE-2020-13671KEV
Drupal core Unrestricted Upload of File with Dangerous Type
HIGH
CVE-2021-21355
Unrestricted File Upload in Form Framework