Browse CVEs by Ecosystem and Severity
393 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2018-16974
Elefant CMS Code Execution Vulnerability
CRITICAL
CVE-2018-9209
FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability
CRITICAL
CVE-2019-6798
phpMyAdmin SQL injection in Designer feature
CRITICAL
CVE-2019-9081
Laravel Framework Deserialization Vulnerability
CRITICAL
CVE-2018-7600KEV
Drupal Core Remote Code Execution Vulnerability
CRITICAL
CVE-2018-16809
Dolibarr SQL injection via the integer parameters qty and value_unit
CRITICAL
CVE-2017-10842
baserCMS SQL Injection vulnerability
CRITICAL
CVE-2019-5715
Silverstripe Framework SQLi Vulnerability
CRITICAL
CVE-2019-10641
Contao Does Not Invalidate Existing Sessions When Password Changes
CRITICAL
CVE-2015-5243
phpWhois arbitrary code execution via a crafted whois record
CRITICAL
CVE-2018-19281
Centreon allows SNMP trap SQL Injection
CRITICAL
CVE-2018-6521
SimpleSAMLphp Use of insecure connection charset (sqlauth module)
CRITICAL
CVE-2017-6925
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
CRITICAL
CVE-2017-18264
phpMyAdmin Improper Privilege Management
CRITICAL
CVE-2017-11366
Codiad Vulnerable to Shell Command Injection
CRITICAL
CVE-2019-3809
Moodle Blind SSRF Risk in /badges/mybackpack.php
CRITICAL
CVE-2017-1000009
Akeneo PIM vulnerable to shell injection in the mass edition
CRITICAL
CVE-2019-9194
elFinder command injection vulnerability in the PHP connector
CRITICAL
CVE-2019-11018
ThinkAdmin Administrator cookies still working after password change
CRITICAL
CVE-2019-1000001
TeamPass Storing Passwords in a Recoverable Format vulnerability
CRITICAL
CVE-2018-16975
Elefant CMS PHP Code Execution Vulnerability
CRITICAL
CVE-2018-14009
Codiad remote code execution vulnerability
CRITICAL
CVE-2019-10643
Contao Does Not Expire Tokens Correctly
CRITICAL
CVE-2021-23592
Deserialization of Untrusted Data in topthink/framework
CRITICAL
CVE-2022-28056
Incorrect Permission Assignment for Critical Resource in ShopXO
CRITICAL
CVE-2011-3583
Typo3 SQL injection due to faulty prepared statements
CRITICAL
CVE-2011-4628
Typo3 Authentication Bypass
CRITICAL
CVE-2021-46433
Sandbox bypass in fenom
CRITICAL
CVE-2017-9841KEV
Code Injection in PHPUnit
CRITICAL
CVE-2020-13756
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
CRITICAL
CVE-2021-23682
Prototype Pollution in litespeed.js and appwrite/server-ce
CRITICAL
CVE-2022-24086KEV
Magento improper input validation vulnerability
CRITICAL
CVE-2020-13675
Unrestricted Upload of File with Dangerous Type in Drupal core
CRITICAL
CVE-2019-6339
Arbitrary PHP code execution in Drupal
CRITICAL
CVE-2021-3943
Moodle vulnerable to RCE via unsafe deserialization
CRITICAL
CVE-2020-13909
Critical severity vulnerability in Ignition
CRITICAL
CVE-2019-11831
Directory Traversal in typo3/phar-stream-wrapper
CRITICAL
CVE-2021-3129KEV
Unauthenticated remote code execution in Ignition
CRITICAL
CVE-2020-15146
Remote Code Execution in SyliusResourceBundle
CRITICAL
CVE-2019-11325
Improper Input Validation in Symfony
CRITICAL
CVE-2019-10913
Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
CRITICAL
CVE-2019-18889
Symfony Unsafe Cache Serialization Could Enable RCE
CRITICAL
CVE-2019-10910
Symfony Service IDs Allow Injection