Browse CVEs by Ecosystem and Severity
480 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-24370
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CRITICAL
CVE-2024-49375
Rasa Allows Remote Code Execution via Remote Model Loading
CRITICAL
CVE-2024-47533
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CRITICAL
CVE-2024-10081
codechecker vulnerable to authentication bypass when using specifically crafted URLs
CRITICAL
CVE-2024-32651
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CRITICAL
CVE-2024-46946
LangChain Experimental Eval Injection vulnerability
CRITICAL
CVE-2024-6091
AutoGPT bypass of the shell commands denylist settings
CRITICAL
CVE-2024-39205
pyload-ng vulnerable to RCE with js2py sandbox escape
CRITICAL
CVE-2024-45758
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
CRITICAL
CVE-2024-45201
LlamaIndex includes an exec call for `import {cls_name}`
CRITICAL
CVE-2024-35198
TorchServe vulnerable to bypass of allowed_urls configuration
CRITICAL
CVE-2024-21669
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
CRITICAL
CVE-2023-31047EPSS 0.1%
Django bypasses validation when using one form field to upload multiple files
CRITICAL
CVE-2022-37454
Buffer overflow in sponge queue functions
CRITICAL
CVE-2023-24831
Apache IoTDB Grafana Connector vulnerable to Improper Authentication
CRITICAL
CVE-2023-22946
Apache Spark vulnerable to Improper Privilege Management
CRITICAL
CVE-2022-34265EPSS 92.8%
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
CRITICAL
CVE-2021-3197
SaltStack Salt is vulnerable to shell injection via ProxyCommand argument
CRITICAL
CVE-2021-3148
SaltStack Salt command injection in the Salt-API when using the Salt-SSH client
CRITICAL
CVE-2021-3144
SaltStack Salt eauth tokens can be used once after expiration
CRITICAL
CVE-2021-25283
SaltStack Salt Server Side Template Injection
CRITICAL
CVE-2021-25281
SaltStack Salt Improper Authentication vulnerability
CRITICAL
CVE-2020-25592
SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi
CRITICAL
CVE-2020-16846KEV
SaltStack Salt Command Injection in netapi ssh client
CRITICAL
CVE-2022-28346EPSS 2.0%
SQL Injection in Django
CRITICAL
CVE-2022-28347EPSS 1.0%
SQL Injection in Django
CRITICAL
CVE-2021-41208
Incomplete validation in boosted trees code
CRITICAL
CVE-2021-35042EPSS 89.9%
SQL Injection in Django
CRITICAL
CVE-2018-20998
Potential memory corruption in arrayfire
CRITICAL
CVE-2018-7750
Paramiko not properly checking authentication before processing other requests