Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-9701
Kedro deserialization vulnerability
CRITICAL
CVE-2022-46741
PaddlePaddle Out-of-bounds Read vulnerability
CRITICAL
CVE-2022-39366
acryl-datahub missing JWT signature check
CRITICAL
CVE-2022-38649
OS Command Injection in Apache Airflow
CRITICAL
CVE-2022-40189
OS Command Injection in Apache Airflow
CRITICAL
CVE-2022-46421
Apache Airflow Hive Provider vulnerable to Command Injection
CRITICAL
CVE-2021-21386
Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks
CRITICAL
CVE-2021-4171
calibre-web is vulnerable to Business Logic Errors
CRITICAL
CVE-2022-31573
ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
CRITICAL
CVE-2021-3563
Openstack Keystone Incorrect Authorization vulnerability
CRITICAL
CVE-2022-31506
SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely
CRITICAL
CVE-2022-45908
PaddlePaddle vulnerable to code injection via winstr
CRITICAL
CVE-2022-34558
WMAgent arbitrary code execution via a crafted dbs-client package
CRITICAL
CVE-2022-35411
rpc.py vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-37298
Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control
CRITICAL
CVE-2022-31558
Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely
CRITICAL
CVE-2022-2650
wger vulnerable to brute force attempts
CRITICAL
CVE-2022-0766
Server-Side Request Forgery in calibreweb
CRITICAL
CVE-2022-30765
SQL injection in calibreweb
CRITICAL
CVE-2022-0767
Server-Side Request Forgery in calibreweb
CRITICAL
CVE-2018-10931
Cobbler has Exposed Dangerous Method or Function
CRITICAL
CVE-2017-1000469
Cobbler vulnerable to arbitrary code execution
CRITICAL
CVE-2018-1000226
Cobbler Improper Validation of Security Tokens
CRITICAL
CVE-2016-4972
OpenStack Murano Code Execution
CRITICAL
CVE-2015-8914
OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism
CRITICAL
CVE-2017-7214
OpenStack Nova logs sensitive context from notification exceptions
CRITICAL
CVE-2019-17134
OpenStack Octavia Amphora-Agent not requiring Client-Certificate
CRITICAL
CVE-2016-7404
Openstack Magnum Unsafe Credential Handling
CRITICAL
CVE-2019-15753
OpenStack os-vif Ageing time of 0 disables linuxbridge MAC learning
CRITICAL
CVE-2020-7941
Plone Unauthenticated Write Vulnerability
CRITICAL
CVE-2016-1505
Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component
CRITICAL
CVE-2013-4409
ReviewBoard and Djblets library are vulnerable to code execution
CRITICAL
CVE-2012-4406
OpenStack Object Storage (swift) Code Injection vulnerability
CRITICAL
CVE-2016-10321
web2py is vulnerable to password brute-force attack
CRITICAL
CVE-2016-3953
web2py remote code execution via hardcoded encryption key in session.connect function
CRITICAL
CVE-2026-53519
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key
CRITICAL
CVE-2026-62283
Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check
CRITICAL
CVE-2026-49257
mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind
CRITICAL
CVE-2026-49252
deepstream is vulnerable to prototype pollution
CRITICAL
CVE-2026-48797
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
CRITICAL
CVE-2026-48769
Incus has an arbitrary file write on its client due to trusted image hash
CRITICAL
CVE-2026-48755
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
CRITICAL
CVE-2026-48753
Incus has an arbitrary file write via path traversal in S3 multipart upload
CRITICAL
CVE-2026-48752
Incus has arbitrary file read+write on host via templates/ symlink in malicious image
CRITICAL
CVE-2026-48751
Incus has a restricted project bypass leading to arbitrary command execution
CRITICAL
CVE-2026-48750
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
CRITICAL
CVE-2026-48749
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
CRITICAL
CVE-2026-44024
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
CRITICAL
CVE-2026-46595
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
CRITICAL
CVE-2026-42508
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status