Browse CVEs by Ecosystem and Severity
5,778 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2021-3943
Moodle vulnerable to RCE via unsafe deserialization
CRITICAL
CVE-2021-41275
Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness
CRITICAL
GHSA-5629-8855-gf4g
Authentication Bypass by CSRF Weakness
CRITICAL
CVE-2021-41274
Authentication Bypass by CSRF Weakness
HIGH
CVE-2021-25976
Cross-Site Request Forgery in PiranhaCMS
HIGH
CVE-2021-41817
Regular expression denial of service vulnerability (ReDoS) in date
MEDIUM
CVE-2021-41263
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application
CRITICAL
CVE-2021-43569
Improper Verification of Cryptographic Signature in starkbank-ecdsa
CRITICAL
CVE-2021-41208
Incomplete validation in boosted trees code
MEDIUM
CVE-2021-25973
Publify `guest` role users can self-register even when the admin does not allow it
HIGH
CVE-2021-41238
Missing Authorization with Default Settings in Dashboard UI
MEDIUM
CVE-2024-21910
Cross-site scripting vulnerability in TinyMCE plugins
CRITICAL
CVE-2021-40865
Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
CRITICAL
CVE-2021-38294
Command injection leading to Remote Code Execution in Apache Storm
MEDIUM
CVE-2021-41183
XSS in `*Text` options of the Datepicker widget in jquery-ui
MEDIUM
CVE-2021-41184
XSS in the `of` option of the `.position()` util in jquery-ui
MEDIUM
CVE-2021-41182
XSS in the `altField` option of the Datepicker widget in jquery-ui
MEDIUM
CVE-2024-21908
Cross-site scripting vulnerability in TinyMCE
HIGH
CVE-2021-41150
Improper sanitization of delegated role names
HIGH
CVE-2021-41149
Improper sanitization of target names
HIGH
CVE-2021-41153
Specification non-compliance in JUMPI
CRITICAL
CVE-2013-2512
OS Command Injection in ftpd
CRITICAL
CVE-2020-13909
Critical severity vulnerability in Ignition
HIGH
CVE-2020-13671KEV
Drupal core Unrestricted Upload of File with Dangerous Type
HIGH
CVE-2021-20319
coreos-installer improperly verifies GPG signature when decompressing gzipped artifact
CRITICAL
CVE-2021-33575
Remote code execution in ruby-jss
CRITICAL
CVE-2019-11831
Directory Traversal in typo3/phar-stream-wrapper
HIGH
CVE-2021-41098
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
CRITICAL
CVE-2021-32619
Deno's static imports inside dynamically imported modules do not adhere to permission checks
CRITICAL
CVE-2021-31819
Remote Code Execution in Halibut
HIGH
CVE-2021-41084
Response Splitting from unsanitized headers
CRITICAL
CVE-2021-35042EPSS 89.9%
SQL Injection in Django
HIGH
CVE-2021-23435
Clearance Gem Open Redirect Vulnerability
MEDIUM
CVE-2021-39197
Older releases of better_errors open to Cross-Site Request Forgery attack
HIGH
CVE-2021-23428
Path traversal in elFinder.NetCore
CRITICAL
CVE-2021-23427
Imporoper path validation in elFinder.NetCore
CRITICAL
CVE-2021-39185
Default CORS config allows any origin with credentials
HIGH
CVE-2021-31799
Arbitrary Code Execution in Rdoc
CRITICAL
CVE-2021-28034
Drop of uninitialized memory in stack_dst
CRITICAL
CVE-2021-28028
Double free in toodee
HIGH
CVE-2021-3749EPSS 1.5%
axios Inefficient Regular Expression Complexity vulnerability
HIGH
CVE-2021-37701EPSS 0.0%
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
HIGH
CVE-2021-37712EPSS 0.0%
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
HIGH
CVE-2021-37713EPSS 0.6%
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
HIGH
CVE-2021-36753
Uncontrolled Search Path Element in sharkdp/bat
HIGH
CVE-2020-36212
Update unsound DrainFilter and RString::retain
HIGH
CVE-2020-36212
Update unsound DrainFilter and RString::retain
HIGH
CVE-2019-25008
Integer Overflow/Infinite Loop in the http crate
HIGH
CVE-2020-13759
Improper Synchronization and Race Condition in vm-memory
CRITICAL
CVE-2021-32810
crossbeam-deque Data Race before v0.7.4 and v0.8.1