Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-53368
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
HIGH
CVE-2025-53093
TabberNeue vulnerable to Stored XSS through wikitext
CRITICAL
CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
HIGH
CVE-2025-48446
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability
HIGH
CVE-2025-48445
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability
CRITICAL
CVE-2025-47110
Magneto contains stored XSS vulnerability
HIGH
CVE-2025-43585
Magento Improper Authorization leading to security feature bypass
CRITICAL
CVE-2025-48951
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-49113KEV
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
CRITICAL
CVE-2025-48200
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution
HIGH
CVE-2025-48201
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
HIGH
CVE-2025-48205
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
CRITICAL
CVE-2025-47275
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
CRITICAL
CVE-2025-46337
SQL injection in ADOdb PostgreSQL driver pg_insert_id() method
CRITICAL
CVE-2025-0520
ShowDoc unrestricted file upload vulnerability
HIGH
CVE-2025-46347
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
CRITICAL
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
HIGH
CVE-2025-3641
Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository
HIGH
CVE-2025-3642
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository
CRITICAL
CVE-2025-32432KEV
Craft CMS Allows Remote Code Execution
CRITICAL
CVE-2025-32931
DevDojo Voyager Argument Injection vulnerability
CRITICAL
CVE-2024-58136KEV
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
CRITICAL
CVE-2025-22871
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
HIGH
CVE-2025-31691
Drupal OAuth2 Server Missing Authorization vulnerability
MEDIUM
CVE-2025-31690
Drupal Cache Utility Cross-Site Request Forgery (CSRF) vulnerability
MEDIUM
CVE-2025-31685
Drupal Open Social Missing Authorization vulnerability
HIGH
CVE-2025-31681
Drupal Authenticator Login Missing Authorization vulnerability
MEDIUM
CVE-2025-31677
Drupal AI Cross-Site Request Forgery (CSRF) vulnerability
MEDIUM
CVE-2025-27617
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
HIGH
CVE-2025-27773
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
CRITICAL
CVE-2025-27517
Volt Allows RCE Via User-Crafted Requests
CRITICAL
CVE-2024-47051
Mautic allows Remote Code Execution and File Deletion in Asset Uploads
HIGH
CVE-2025-26525
Moodle has an arbitrary file read risk through pdfTeX
HIGH
CVE-2025-26530
Moodle allows reflected XSS via question bank filter
HIGH
CVE-2025-26533
Moodle has a SQL injection risk in course search module list filter
HIGH
CVE-2025-26529
Moodle has a stored XSS risk in admin live log
CRITICAL
CVE-2024-57602
Easy!Appointments Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
HIGH
CVE-2025-24438
Magento stored Cross-Site Scripting (XSS) vulnerability
HIGH
CVE-2025-24411
Magento Improper Access Control vulnerability
HIGH
CVE-2025-24406
Adobe Commerce Path Traversal
HIGH
CVE-2025-24414
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24417
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24415
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24410
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24412
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24416
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24409
Adobe Commerce Improper Authorization vulnerability
HIGH
CVE-2025-24413
Magento Stored Cross-Site Scripting (XSS) Vulnerability
CRITICAL
CVE-2025-25286
Crayfish allows Remote Code Execution via Homarus Authorization header