Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-67165
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
CRITICAL
CVE-2025-67164
Pagekit CMS is vulnerable to OS Command Injection via Storage component
MEDIUM
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
CRITICAL
CVE-2025-66844
Grav may be vulnerable to SSRF attack via Twig Templates
CRITICAL
CVE-2025-65854
MineAdmin has an insecure default password
CRITICAL
CVE-2025-67719
Ibexa User Bundle is missing password change validation
CRITICAL
CVE-2025-67510
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
HIGH
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
HIGH
CVE-2025-66468
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
HIGH
CVE-2025-13827
GrapesJsBuilder File Upload allows all file uploads
CRITICAL
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
HIGH
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
HIGH
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
HIGH
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
HIGH
CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
HIGH
CVE-2025-66299
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
HIGH
CVE-2025-66296
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
HIGH
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
HIGH
CVE-2025-64500EPSS 0.0%
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
HIGH
CVE-2025-64519
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
HIGH
CVE-2025-47776
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
CRITICAL
CVE-2025-62417
bagisto has CSV Formula Injection in Create New Product
CRITICAL
CVE-2025-61922
PrestaShop Checkout allows customer account takeover via email
HIGH
CVE-2025-54264
Magento vulnerable to stored Cross-Site Scripting (XSS)
HIGH
CVE-2025-54263
Magento provides incorrect authorization through a security feature bypass
CRITICAL
CVE-2025-10353
Melis Platform CMS Unauthenticated File Upload Leading to RCE
CRITICAL
CVE-2025-10351
Melis Platform CMS SQL Injection
CRITICAL
CVE-2025-10352
Melis Platform CMS Unauthenticated Admin Account Creation
HIGH
CVE-2025-56588
Dolibarr vulnerable to RCE via the computed field parameter
HIGH
CVE-2025-59839
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes
CRITICAL
CVE-2025-54236KEV
Magento Community Edition Improper Input Validation vulnerability
CRITICAL
CVE-2025-52122
The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability
HIGH
CVE-2025-52353
Badaso CMS file upload vulnerability
HIGH
CVE-2025-43960
Adminer PHP Object Injection issue leads to Denial of Service
LOW
CVE-2025-55745
UnoPim has CSV Injection on Quick Export feature
HIGH
CVE-2025-49555
Magento Cross-Site Request Forgery (CSRF) vulnerability
HIGH
CVE-2025-49556
Magento has incorrect authorization issue that leads to arbitrary file system read
HIGH
CVE-2025-49557
Magento Cross-site Scripting vulnerability
HIGH
CVE-2025-49554
Magento vulnerable to denial of service
CRITICAL
CVE-2025-50706
ThinkPHP Path Traversal Vulnerability
CRITICAL
CVE-2025-54119
The ADOdb sqlite3 driver allows SQL injection
LOW
CVE-2025-45769EPSS 0.0%
php-jwt contains weak encryption
HIGH
CVE-2025-8264
z-push/z-push-dev SQL Injection Vulnerability
CRITICAL
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
CRITICAL
CVE-2025-54082
nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability
CRITICAL
CVE-2025-46001
simogeo/filemanager arbitrary file upload vulnerability
CRITICAL
CVE-2025-54068KEV
Livewire is vulnerable to remote command execution during component property update hydration
CRITICAL
CVE-2025-53833
LaRecipe is vulnerable to Server-Side Template Injection attacks
HIGH
CVE-2025-53369
Citizen Short Description stored XSS vulnerability through wikitext
HIGH
CVE-2025-53370
Citizen vulnerable to Stored XSS through short descriptions