Browse CVEs by Ecosystem and Severity
596 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-23752
Code execution in pandasai
CRITICAL
CVE-2024-3829
qdrant input validation failure
CRITICAL
CVE-2024-0937
Deserialization of untrusted data in synthcity
CRITICAL
CVE-2024-25141
Improper Certificate Validation in apache airflow mongo hook
CRITICAL
CVE-2024-3955
CraftBeerPi 4 allows arbitrary code execution
CRITICAL
CVE-2024-5023
ConsoleMe has an Arbitrary File Read Vulnerability via Limited Git command
CRITICAL
CVE-2024-25128
Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
CRITICAL
CVE-2024-32874
Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service
CRITICAL
CVE-2024-27444
LangChain Experimental vulnerable to arbitrary code execution
CRITICAL
CVE-2024-34359
llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
CRITICAL
CVE-2024-35374
Mocodo vulnerable to SQL injection in `/web/generate.php`
CRITICAL
CVE-2024-24811
SQLAlchemyDA unauthenticated arbitrary SQL query execution
CRITICAL
CVE-2024-2195
Aim Web API vulnerable to Remote Code Execution
CRITICAL
CVE-2024-35056
NASA AIT-Core vulnerable to SQL Injection
CRITICAL
CVE-2024-35059
NASA AIT-Core vulnerable to remote code execution
CRITICAL
CVE-2024-2912
Insecure deserialization in BentoML
CRITICAL
CVE-2024-3660
Keras code injection vulnerability
CRITICAL
CVE-2024-2952
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
CRITICAL
CVE-2024-3271
llama-index-core Command Injection vulnerability
CRITICAL
CVE-2024-3098
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
CRITICAL
CVE-2024-0818
PaddlePaddle Path Traversal vulnerability
CRITICAL
CVE-2024-0917
PaddlePaddle vulnerable to remote code execution
CRITICAL
CVE-2024-2044
pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
CRITICAL
CVE-2024-32880
pyLoad allows upload to arbitrary folder lead to RCE
CRITICAL
CVE-2024-36039
PyMySQL SQL Injection vulnerability
CRITICAL
CVE-2025-1793
llama_index vulnerable to SQL Injection
CRITICAL
CVE-2025-13780
pgadmin4 has a Meta-Command Filter Command Execution
CRITICAL
CVE-2025-52556
rfc3161-client has insufficient verification for timestamp response signatures
CRITICAL
CVE-2025-22146
Sentry's improper authentication on SAML SSO process allows user impersonation
CRITICAL
CVE-2025-68398
Weblate is vulnerable to RCE through Git config file overwrite
CRITICAL
CVE-2025-47241
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
CRITICAL
CVE-2025-12762
pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode
CRITICAL
CVE-2024-8551
AgentScope path traversal vulnerability in save-workflow
CRITICAL
CVE-2024-6829
Aim External Control of File Name or Path vulnerability
CRITICAL
CVE-2024-10835
DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users
CRITICAL
CVE-2025-43859
h11 accepts some malformed Chunked-Encoding bodies
CRITICAL
CVE-2024-10190
Horovod Vulnerable to Command Injection
CRITICAL
CVE-2024-11042
InvokeAI Arbitrary File Deletion vulnerability
CRITICAL
CVE-2025-32428
TigerVNC accessible via the network and not just via a UNIX socket as intended
CRITICAL
CVE-2025-2946
pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering
CRITICAL
CVE-2024-8769
Aim path traversal in LockManager.release_locks
CRITICAL
CVE-2024-9070
BentoML deserialization vulnerability
CRITICAL
CVE-2024-10902
DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
CRITICAL
CVE-2024-10901
DB-GPT Arbitrary File Write vulnerability
CRITICAL
CVE-2024-10831
DB-GPT Absolute Path Traversal vulnerability
CRITICAL
CVE-2024-10833
DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload
CRITICAL
CVE-2024-9701
Kedro deserialization vulnerability
CRITICAL
CVE-2022-46741
PaddlePaddle Out-of-bounds Read vulnerability
CRITICAL
CVE-2022-39366
acryl-datahub missing JWT signature check
CRITICAL
CVE-2022-38649
OS Command Injection in Apache Airflow