Browse CVEs by Ecosystem and Severity
596 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-64439
LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer
CRITICAL
CVE-2025-64459EPSS 0.2%
Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
HIGH
CVE-2025-64458EPSS 0.0%
Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
CRITICAL
CVE-2025-57108
HIGH
CVE-2025-61385
pg8000 SQL injection vulnerability via a specially crafted Python list input
CRITICAL
CVE-2025-49655
Keras framework vulnerable to deserialization of untrusted data
CRITICAL
CVE-2025-62515
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
MEDIUM
CVE-2025-11849
Mammoth is vulnerable to Directory Traversal
CRITICAL
CVE-2025-10283
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
CRITICAL
CVE-2025-10284
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
CRITICAL
CVE-2025-59681
CRITICAL
CVE-2025-61622
Apache Pyfory python is vulnerable to deserialization of untrusted data
CRITICAL
CVE-2025-6544
H2O affected by a deserialization vulnerability
CRITICAL
CVE-2025-6237
InvokeAI has External Control of File Name or Path
CRITICAL
CVE-2025-10156
CRITICAL
CVE-2025-59377
mcp-kubernetes-server has an OS Command Injection vulnerability
HIGH
CVE-2025-57833EPSS 0.0%
Django is subject to SQL injection through its column aliases
CRITICAL
CVE-2025-58438
internetarchive Vulnerable to Directory Traversal in File.download()
CRITICAL
CVE-2025-55037
TkEasyGUI Vulnerable to OS Command Injection
CRITICAL
CVE-2025-58367
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
HIGH
CVE-2025-71325
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
CRITICAL
CVE-2025-30405
ExecuTorch integer overflow vulnerability
CRITICAL
CVE-2025-54949
ExecuTorch heap buffer overflow vulnerability
CRITICAL
CVE-2025-54950
ExecuTorch out-of-bounds access vulnerability
CRITICAL
CVE-2025-30404
ExecuTorch integer overflow vulnerability
CRITICAL
CVE-2025-54951
ExecuTorch vulnerable to Heap-based Buffer Overflow
CRITICAL
CVE-2025-54802
pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
LOW
CVE-2025-50460
MS SWIFT Remote Code Execution via unsafe PyYAML deserialization
CRITICAL
CVE-2025-54381
BentoML SSRF Vulnerability in File Upload Processing
CRITICAL
CVE-2025-5120
smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
CRITICAL
CVE-2025-53890
pyLoad vulnerable to XSS through insecure CAPTCHA
CRITICAL
CVE-2025-50213
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator
CRITICAL
CVE-2025-2828
CRITICAL
CVE-2025-3248
Langflow Unauth RCE
CRITICAL
CVE-2024-38824
Salt vulnerable to directory traversal attack in file receiving method
MEDIUM
CVE-2024-47081EPSS 0.1%
Requests vulnerable to .netrc credentials leak via malicious URLs
CRITICAL
CVE-2025-49652
BackendAI Missing Authentication for Critical Function
MEDIUM
CVE-2025-48432EPSS 0.1%
Django Improper Output Neutralization for Logs vulnerability
CRITICAL
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
CRITICAL
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
HIGH
CVE-2025-46725
Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
CRITICAL
CVE-2025-46724
Langroid has a Code Injection vulnerability in TableChatAgent
HIGH
CVE-2025-47782
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
CRITICAL
CVE-2024-24780
Apache IoTDB Vulnerable to Remote Code Execution
CRITICAL
CVE-2025-32444
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
CRITICAL
CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
HIGH
CVE-2024-53924
Pycel allows code injection via a crafted formula
HIGH
CVE-2024-53305
Whoogle allows attackers to execute arbitrary code via supplying a crafted search query
CRITICAL
CVE-2025-32375
BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
CRITICAL
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization