Browse CVEs by Ecosystem and Severity
59 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-60004KEV
Gitea: Remote Code Execution via diffpatch Git Hook Installation
CRITICAL
CVE-2026-55255KEV
CRITICAL
CVE-2026-9082KEV
Drupal Core has a SQL Injection issue
CRITICAL
CVE-2026-45321KEV
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
HIGH
CVE-2026-34486KEV
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
HIGH
CVE-2026-34197KEV
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
CRITICAL
CVE-2026-33634KEV
Trivy ecosystem supply chain was briefly compromised
CRITICAL
CVE-2025-68613KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
HIGH
CVE-2025-8110KEV
Gogs vulnerable to a bypass of CVE-2024-55947
CRITICAL
CVE-2025-55182KEV
React Server Components are Vulnerable to RCE
HIGH
CVE-2025-58360KEV
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
CRITICAL
CVE-2025-11953KEV
@react-native-community/cli has arbitrary OS command injection
CRITICAL
CVE-2025-54236KEV
Magento Community Edition Improper Input Validation vulnerability
CRITICAL
CVE-2025-54068KEV
Livewire is vulnerable to remote command execution during component property update hydration
CRITICAL
CVE-2025-49113KEV
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
CRITICAL
CVE-2025-32432KEV
Craft CMS Allows Remote Code Execution
CRITICAL
CVE-2025-24016KEV
Wazuh server vulnerable to remote code execution
CRITICAL
CVE-2024-58136KEV
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
CRITICAL
CVE-2025-24813KEV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CRITICAL
CVE-2025-24893KEV
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
CRITICAL
CVE-2024-56145KEV
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
CRITICAL
CVE-2024-36401KEV
Remote Code Execution (RCE) vulnerability in geoserver
CRITICAL
CVE-2024-34102KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
CRITICAL
CVE-2018-7602KEV
Drupal Core Remote Code Execution Vulnerability
CRITICAL
CVE-2024-27348KEV
Apache HugeGraph-Server: Command execution in gremlin
CRITICAL
CVE-2024-23897KEV
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CRITICAL
CVE-2023-46604KEV
Apache ActiveMQ is vulnerable to Remote Code Execution
MEDIUM
CVE-2023-44487KEV
HTTP/2 Stream Cancellation Attack
CRITICAL
CVE-2022-24816KEV
Improper Control of Generation of Code ('Code Injection') in jai-ext
HIGH
CVE-2023-38180KEV
.NET Denial of Service Vulnerability
CRITICAL
CVE-2023-33246KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
CRITICAL
CVE-2020-16846KEV
SaltStack Salt Command Injection in netapi ssh client
HIGH
CVE-2020-1147KEV
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
HIGH
CVE-2016-7201KEV
ChakraCore RCE Vulnerability
HIGH
CVE-2016-7200KEV
ChakraCore RCE Vulnerability
CRITICAL
CVE-2018-7600KEV
Drupal Core Remote Code Execution Vulnerability
HIGH
CVE-2018-8298KEV
ChakraCore RCE Vulnerability
CRITICAL
CVE-2016-8735KEV
Apache Tomcat Improper Access Control vulnerability
CRITICAL
CVE-2017-1000353KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2018-1000861KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2012-0391KEV
Apache Struts Remote Java Code Execution
CRITICAL
CVE-2022-22965KEV
Remote Code Execution in Spring Framework
CRITICAL
CVE-2017-9841KEV
Code Injection in PHPUnit
CRITICAL
CVE-2022-22947KEV
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
HIGH
CVE-2022-0609KEV
Use after free in Animation
CRITICAL
CVE-2022-24086KEV
Magento improper input validation vulnerability
CRITICAL
CVE-2021-45046KEVEPSS 94.3%
Incomplete fix for Apache Log4j vulnerability
CRITICAL
CVE-2021-44228KEVEPSS 94.4%
Remote code injection in Log4j
CRITICAL
CVE-2021-23758KEV
Remote Code Execution in AjaxNetProfessional
HIGH
CVE-2020-13671KEV
Drupal core Unrestricted Upload of File with Dangerous Type