Browse CVEs by Ecosystem and Severity
393 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
CRITICAL
CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
CRITICAL
CVE-2026-75827
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
CRITICAL
CVE-2026-75828
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
CRITICAL
CVE-2026-79752
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
CRITICAL
CVE-2026-45140
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
CRITICAL
CVE-2026-84372
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
CRITICAL
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CRITICAL
CVE-2026-55634
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name
CRITICAL
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)
CRITICAL
CVE-2026-59989
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)
CRITICAL
CVE-2026-62988
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints
CRITICAL
CVE-2026-54133
jmespath.php has CompilerRuntime code injection via unescaped function names
CRITICAL
CVE-2026-63223
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
CRITICAL
CVE-2026-63221
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
CRITICAL
CVE-2026-72780
Craft CMS: Passkey login accepts replayed WebAuthn assertions
CRITICAL
CVE-2026-54588
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
CRITICAL
CVE-2026-55579
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
CRITICAL
CVE-2026-52881
MantisBT: Reflected XSS in admin/install.php via unescaped printf
CRITICAL
CVE-2026-52847
MantisBT: Reflected XSS in admin/install.php
CRITICAL
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
CRITICAL
CVE-2026-45262
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
CRITICAL
CVE-2026-47677
FacturaScripts: Account takeover of any 2FA-enabled user
CRITICAL
CVE-2026-54159
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CRITICAL
CVE-2026-52778
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
CRITICAL
CVE-2026-52777
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
CRITICAL
CVE-2026-52766
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
CRITICAL
CVE-2026-27823
EGroupware has a Remote Code Execution Vulnerability
CRITICAL
CVE-2026-52889
Formie Hidden field defaults vulnerable to Server-Side Template Injection
CRITICAL
CVE-2026-9559
Mautic vulnerable to Path Traversal via Campaign Import
CRITICAL
CVE-2026-9558
Mautic has Server-Side Template Injection (SSTI) in Theme Templates
CRITICAL
CVE-2025-58048
Paymenter vulnerable to Remote Code Execution via public file uploads
CRITICAL
CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
CRITICAL
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
CRITICAL
CVE-2026-55742
Cotonti: Cross-Site Request Forgery in the administration rights handler
CRITICAL
CVE-2026-50886
Project Firefly III has incorrect access control in the webhook management component
CRITICAL
CVE-2026-50887
shlink has a Server-Side Request Forgery issue
CRITICAL
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
CRITICAL
CVE-2026-48030
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
CRITICAL
CVE-2026-45034
PHPSpreadsheet has a patch bypass for CVE-2026-34084
CRITICAL
CVE-2026-47744
Shopper: Authorization bypass and RBAC privilege escalation in team settings
CRITICAL
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
CRITICAL
CVE-2018-25357
Dolibarr ERP CRM contains a remote code evaluation vulnerability
CRITICAL
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
CRITICAL
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
CRITICAL
CVE-2026-9082KEV
Drupal Core has a SQL Injection issue
CRITICAL
CVE-2026-46725
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector)
CRITICAL
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
CRITICAL
CVE-2026-37709
Snipe-IT has insecure permissions in file uploads
CRITICAL
CVE-2026-44212
PrestaShop has a stored XSS executable in customer service view