Browse CVEs by Ecosystem and Severity
39 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-60004KEV
Gitea: Remote Code Execution via diffpatch Git Hook Installation
CRITICAL
CVE-2026-55255KEV
CRITICAL
CVE-2026-9082KEV
Drupal Core has a SQL Injection issue
CRITICAL
CVE-2026-45321KEV
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CRITICAL
CVE-2026-33634KEV
Trivy ecosystem supply chain was briefly compromised
CRITICAL
CVE-2025-68613KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
CRITICAL
CVE-2025-55182KEV
React Server Components are Vulnerable to RCE
CRITICAL
CVE-2025-11953KEV
@react-native-community/cli has arbitrary OS command injection
CRITICAL
CVE-2025-54236KEV
Magento Community Edition Improper Input Validation vulnerability
CRITICAL
CVE-2025-54068KEV
Livewire is vulnerable to remote command execution during component property update hydration
CRITICAL
CVE-2025-49113KEV
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
CRITICAL
CVE-2025-32432KEV
Craft CMS Allows Remote Code Execution
CRITICAL
CVE-2025-24016KEV
Wazuh server vulnerable to remote code execution
CRITICAL
CVE-2024-58136KEV
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
CRITICAL
CVE-2025-24813KEV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CRITICAL
CVE-2025-24893KEV
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
CRITICAL
CVE-2024-56145KEV
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
CRITICAL
CVE-2024-36401KEV
Remote Code Execution (RCE) vulnerability in geoserver
CRITICAL
CVE-2024-34102KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
CRITICAL
CVE-2018-7602KEV
Drupal Core Remote Code Execution Vulnerability
CRITICAL
CVE-2024-27348KEV
Apache HugeGraph-Server: Command execution in gremlin
CRITICAL
CVE-2024-23897KEV
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CRITICAL
CVE-2023-46604KEV
Apache ActiveMQ is vulnerable to Remote Code Execution
CRITICAL
CVE-2022-24816KEV
Improper Control of Generation of Code ('Code Injection') in jai-ext
CRITICAL
CVE-2023-33246KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
CRITICAL
CVE-2020-16846KEV
SaltStack Salt Command Injection in netapi ssh client
CRITICAL
CVE-2018-7600KEV
Drupal Core Remote Code Execution Vulnerability
CRITICAL
CVE-2016-8735KEV
Apache Tomcat Improper Access Control vulnerability
CRITICAL
CVE-2017-1000353KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2018-1000861KEV
Deserialization of Untrusted Data in Jenkins
CRITICAL
CVE-2012-0391KEV
Apache Struts Remote Java Code Execution
CRITICAL
CVE-2022-22965KEV
Remote Code Execution in Spring Framework
CRITICAL
CVE-2017-9841KEV
Code Injection in PHPUnit
CRITICAL
CVE-2022-22947KEV
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
CRITICAL
CVE-2022-24086KEV
Magento improper input validation vulnerability
CRITICAL
CVE-2021-45046KEVEPSS 94.3%
Incomplete fix for Apache Log4j vulnerability
CRITICAL
CVE-2021-44228KEVEPSS 94.4%
Remote code injection in Log4j
CRITICAL
CVE-2021-23758KEV
Remote Code Execution in AjaxNetProfessional
CRITICAL
CVE-2021-3129KEV
Unauthenticated remote code execution in Ignition