Browse CVEs by Ecosystem and Severity
5,778 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2019-9081
Laravel Framework Deserialization Vulnerability
CRITICAL
CVE-2018-7600KEV
Drupal Core Remote Code Execution Vulnerability
MEDIUM
CVE-2019-0657
Improper Input Validation in .Net Framework API's
CRITICAL
CVE-2018-12026
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
HIGH
CVE-2018-12029
Phusion Passenger Race Condition Allows Privilege Escalation
CRITICAL
CVE-2018-16809
Dolibarr SQL injection via the integer parameters qty and value_unit
CRITICAL
CVE-2017-10842
baserCMS SQL Injection vulnerability
CRITICAL
CVE-2014-3600
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
HIGH
CVE-2018-11406
Symfony CSRF Token Fixation
CRITICAL
CVE-2019-5715
Silverstripe Framework SQLi Vulnerability
CRITICAL
CVE-2019-10641
Contao Does Not Invalidate Existing Sessions When Password Changes
HIGH
CVE-2016-3072
Katello SQL Injection vulnerabilities
HIGH
CVE-2017-11914
ChakraCore vulnerable to privilege escalation due to exposure from scriptFunction
HIGH
CVE-2017-11909
ChakraCore vulnerable to remote code execution
HIGH
CVE-2017-11911
ChakraCore RCE Vulnerability
HIGH
CVE-2017-11893
ChakraCore vulnerable to remote code execution
HIGH
CVE-2017-0900
RubyGems Improper Input Validation vulnerability
MEDIUM
CVE-2018-16887
katello Cross-site Scripting vulnerability
CRITICAL
CVE-2018-1000076
RubyGems Improper Verification of Cryptographic Signature vulnerability
HIGH
CVE-2018-1000074
RubyGems Deserialization of Untrusted Data vulnerability
MEDIUM
CVE-2018-1000078
RubyGems Cross-site Scripting vulnerability
CRITICAL
CVE-2016-9299
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CRITICAL
CVE-2017-12633
Apache Camel camel-hessian component vulnerable to Java object deserialization
HIGH
CVE-2014-4326
Elasticsearch Logstash allows remote attackers to execute arbitrary commands
HIGH
CVE-2016-1000221
Logstash Logs Sensitive Information
CRITICAL
CVE-2018-1000120
curl FTP path confusion leads to NIL byte out of bounds write
CRITICAL
CVE-2015-5243
phpWhois arbitrary code execution via a crafted whois record
CRITICAL
CVE-2016-7954
Bundler allows attacker to inject arbitrary code via secondary Gem source
CRITICAL
CVE-2018-19281
Centreon allows SNMP trap SQL Injection
CRITICAL
CVE-2013-3221
Active Record component in Ruby on Rails has a data-type injection vulnerability
CRITICAL
CVE-2016-3087
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
CRITICAL
CVE-2016-4438
Arbitrary code execution in Apache Struts 2
HIGH
CVE-2018-8145
ChakraCore information disclosure vulnerability
CRITICAL
CVE-2018-6521
SimpleSAMLphp Use of insecure connection charset (sqlauth module)
HIGH
CVE-2018-18385
Asciidoctor Infinite Loop vulnerability
CRITICAL
CVE-2018-16395
Ruby Openssl Allows Incorrect Value Comparison
HIGH
CVE-2018-12028
Incorrect Access Control in Phusion Passenger
HIGH
CVE-2018-12027
Insecure Permissions in Phusion Passenger
HIGH
CVE-2018-1000075
RubyGems Infinite Loop vulnerability
HIGH
CVE-2018-0818
ChakraCore RCE Vulnerability
CRITICAL
CVE-2017-9232
Juju uses a UNIX domain socket without setting appropriate permissions
HIGH
CVE-2017-8700
Cross-origin Resource Sharing bypass in ASP.NET Core
CRITICAL
CVE-2017-6925
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
CRITICAL
CVE-2017-5651
Expected Behavior Violation in Apache Tomcat
CRITICAL
CVE-2017-18264
phpMyAdmin Improper Privilege Management
HIGH
CVE-2017-11883
Denial of service in ASP.NET Core
CRITICAL
CVE-2017-11767
ChakraCore vulnerable to privilege escalation
CRITICAL
CVE-2017-11366
Codiad Vulnerable to Shell Command Injection
MEDIUM
CVE-2017-10689
Tarball permission preservation in puppet
CRITICAL
CVE-2017-1000245
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext