Browse CVEs by Ecosystem and Severity
480 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-55449
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
CRITICAL
CVE-2025-64459EPSS 0.2%
Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
CRITICAL
CVE-2025-57108
CRITICAL
CVE-2025-49655
Keras framework vulnerable to deserialization of untrusted data
CRITICAL
CVE-2025-62515
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
CRITICAL
CVE-2025-10283
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
CRITICAL
CVE-2025-10284
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
CRITICAL
CVE-2025-59681
CRITICAL
CVE-2025-61622
Apache Pyfory python is vulnerable to deserialization of untrusted data
CRITICAL
CVE-2025-6544
H2O affected by a deserialization vulnerability
CRITICAL
CVE-2025-6237
InvokeAI has External Control of File Name or Path
CRITICAL
CVE-2025-10156
CRITICAL
CVE-2025-59377
mcp-kubernetes-server has an OS Command Injection vulnerability
CRITICAL
CVE-2025-58438
internetarchive Vulnerable to Directory Traversal in File.download()
CRITICAL
CVE-2025-55037
TkEasyGUI Vulnerable to OS Command Injection
CRITICAL
CVE-2025-58367
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
CRITICAL
CVE-2025-30405
ExecuTorch integer overflow vulnerability
CRITICAL
CVE-2025-54949
ExecuTorch heap buffer overflow vulnerability
CRITICAL
CVE-2025-54950
ExecuTorch out-of-bounds access vulnerability
CRITICAL
CVE-2025-30404
ExecuTorch integer overflow vulnerability
CRITICAL
CVE-2025-54951
ExecuTorch vulnerable to Heap-based Buffer Overflow
CRITICAL
CVE-2025-54802
pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
CRITICAL
CVE-2025-54381
BentoML SSRF Vulnerability in File Upload Processing
CRITICAL
CVE-2025-5120
smolagents has Sandbox Escape Vulnerability in the local_python_executor.py Module
CRITICAL
CVE-2025-53890
pyLoad vulnerable to XSS through insecure CAPTCHA
CRITICAL
CVE-2025-50213
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator
CRITICAL
CVE-2025-2828
CRITICAL
CVE-2025-3248
Langflow Unauth RCE
CRITICAL
CVE-2024-38824
Salt vulnerable to directory traversal attack in file receiving method
CRITICAL
CVE-2025-49652
BackendAI Missing Authentication for Critical Function
CRITICAL
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
CRITICAL
CVE-2025-47277
vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
CRITICAL
CVE-2025-46724
Langroid has a Code Injection vulnerability in TableChatAgent
CRITICAL
CVE-2024-24780
Apache IoTDB Vulnerable to Remote Code Execution
CRITICAL
CVE-2025-32444
vLLM Vulnerable to Remote Code Execution via Mooncake Integration
CRITICAL
CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
CRITICAL
CVE-2025-32375
BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
CRITICAL
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
CRITICAL
CVE-2025-2945
pgAdmin 4 Vulnerable to Remote Code Execution
CRITICAL
CVE-2024-12029
InvokeAI Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-9053
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
CRITICAL
CVE-2024-9052
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CRITICAL
CVE-2024-8502
AgentScope Deserialization Vulnerability
CRITICAL
CVE-2024-12909
llama-index-packs-finchat SQL Injection vulnerability
CRITICAL
CVE-2024-11958
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
CRITICAL
CVE-2024-11041
vLLM Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-10553
H2O Deserialization of Untrusted Data Vulnerability
CRITICAL
CVE-2025-2000
Qiskit allows arbitrary code execution decoding QPY format versions < 13
CRITICAL
CVE-2023-25574
LTI JupyterHub Authenticator does not properly validate JWT Signature
CRITICAL
CVE-2024-12366
PandasAI interactive prompt function Remote Code Execution (RCE)