Browse CVEs by Ecosystem and Severity
36 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2026-65829
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
MEDIUM
CVE-2025-46571
Open WebUI allows limited stored XSS vila uploaded html file
MEDIUM
CVE-2026-47425
rattler has an entry-point path traversal in noarch:python install (arbitrary file write)
MEDIUM
CVE-2026-44363
misp-modules has nsafe remote resource fetching in expansion
MEDIUM
CVE-2026-42086
OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender
MEDIUM
CVE-2026-27735
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
MEDIUM
CVE-2020-36962
Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field
MEDIUM
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
MEDIUM
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
MEDIUM
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
MEDIUM
CVE-2025-11849
Mammoth is vulnerable to Directory Traversal
MEDIUM
CVE-2024-47081EPSS 0.1%
Requests vulnerable to .netrc credentials leak via malicious URLs
MEDIUM
CVE-2025-48432EPSS 0.1%
Django Improper Output Neutralization for Logs vulnerability
MEDIUM
CVE-2024-27529
wasm3 uncontrolled memory allocation vulnerability
MEDIUM
CVE-2024-48061
Langflow vulnerable to remote code execution
MEDIUM
CVE-2024-49771
MPXJ has a Potential Path Traversal Vulnerability
MEDIUM
CVE-2024-45231EPSS 0.2%
Django allows enumeration of user e-mail addresses
MEDIUM
CVE-2024-47529
OpenC3 stores passwords in clear text (`GHSL-2024-129`)
MEDIUM
CVE-2024-43795
OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)
MEDIUM
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
MEDIUM
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
MEDIUM
CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
MEDIUM
CVE-2024-35195EPSS 0.0%
Requests `Session` object does not verify requests after making first request with verify=False
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
MEDIUM
CVE-2023-36566
Microsoft Common Data Model SDK Denial of Service Vulnerability
MEDIUM
CVE-2020-8927
Integer overflow in the bundled Brotli C library
MEDIUM
CVE-2022-22818EPSS 0.6%
Cross-site Scripting in Django
MEDIUM
CVE-2021-45452EPSS 0.3%
Directory-traversal in Django
MEDIUM
CVE-2021-44420EPSS 0.1%
Potential bypass of an upstream access control based on URL paths in Django
MEDIUM
CVE-2024-21910
Cross-site scripting vulnerability in TinyMCE plugins
MEDIUM
CVE-2021-33203EPSS 0.3%
Path Traversal in Django
MEDIUM
CVE-2021-32052EPSS 2.6%
Header injection possible in Django
MEDIUM
CVE-2021-28658EPSS 1.5%
Directory Traversal in Django
MEDIUM
CVE-2020-24584EPSS 3.3%
Django Incorrect Default Permissions
MEDIUM
CVE-2021-3281EPSS 36.2%
Django Directory Traversal via archive.extract
MEDIUM
CVE-2019-11358
XSS in jQuery as used in Drupal, Backdrop CMS, and other products