Browse CVEs by Ecosystem and Severity
797 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2024-21491
svix vulnerable to Authentication Bypass
MEDIUM
CVE-2022-34716
.NET Information Disclosure Vulnerability
MEDIUM
CVE-2021-29511
Memory over-allocation in evm crate
MEDIUM
CVE-2024-23644
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in trillium-http and trillium-client
MEDIUM
CVE-2024-22411
Cross-site scripting (XSS) in Action messages on Avo
MEDIUM
CVE-2024-21670
CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential
MEDIUM
CVE-2024-22192
Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders
MEDIUM
CVE-2024-21319
Microsoft ASP.NET Core project templates vulnerable to denial of service
MEDIUM
CVE-2024-21647
Puma HTTP Request/Response Smuggling vulnerability
MEDIUM
CVE-2024-21636
view_component Cross-site Scripting vulnerability
MEDIUM
CVE-2023-51652
OWASP.AntiSamy mXSS when preserving comments
MEDIUM
CVE-2023-51763
ActiveAdmin CSV Injection leading to sensitive information disclosure
MEDIUM
CVE-2023-51662
Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)
MEDIUM
CVE-2023-50724
Resque vulnerable to Reflected Cross Site Scripting through pathnames
MEDIUM
CVE-2023-50725
Resque vulnerable to reflected XSS in resque-web failed and queues lists
MEDIUM
CVE-2023-50727
Resque vulnerable to reflected XSS in Queue Endpoint
MEDIUM
CVE-2022-44303
Resque Scheduler Reflected XSS In Delayed Jobs View
MEDIUM
CVE-2023-26154
pubnub Insufficient Entropy vulnerability
MEDIUM
CVE-2023-49090
CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS
MEDIUM
CVE-2023-48219
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
MEDIUM
CVE-2023-36558
Microsoft Security Advisory CVE-2023-36558: .NET Security Feature Bypass Vulnerability
MEDIUM
CVE-2023-45857EPSS 0.1%
Axios Cross-Site Request Forgery Vulnerability
MEDIUM
CVE-2023-5349
memory leak flaw was found in ruby-magick
MEDIUM
CVE-2023-45819
TinyMCE XSS vulnerability in notificationManager.open API
MEDIUM
CVE-2023-45818
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
MEDIUM
CVE-2023-45814
Bunkum tokens cached in the AuthenticationService are susceptible to a use-after-free
MEDIUM
CVE-2024-43806
rustix's `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion
MEDIUM
CVE-2023-38250
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38249
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38221
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38218
Magento Open Source allows Incorrect Authorization
MEDIUM
CVE-2023-44487KEV
HTTP/2 Stream Cancellation Attack
MEDIUM
CVE-2023-36566
Microsoft Common Data Model SDK Denial of Service Vulnerability
MEDIUM
CVE-2023-44390
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
MEDIUM
CVE-2023-26141
sidekiq Denial of Service vulnerability
MEDIUM
CVE-2023-36799
Microsoft Security Advisory CVE-2023-36799: .NET Denial of Service Vulnerability
MEDIUM
CVE-2023-38037
Active Support Possibly Discloses Locally Encrypted Files
MEDIUM
CVE-2023-38697
protocol-http1 HTTP Request/Response Smuggling vulnerability
MEDIUM
CVE-2023-32693
Decidim Cross-site Scripting vulnerability in the external link redirections
MEDIUM
CVE-2023-36617
URI gem has ReDoS vulnerability
MEDIUM
CVE-2023-23913
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
MEDIUM
CVE-2023-27531
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability
MEDIUM
CVE-2023-2862
SSCMS vulnerable to Cross Site Scripting
MEDIUM
CVE-2023-25309
Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem
MEDIUM
CVE-2023-31048
Exposure of Sensitive Information in OPC UA .NET Standard Reference Server
MEDIUM
CVE-2023-30610
AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
MEDIUM
CVE-2023-28846
unpoly-rails Denial of Service vulnerability
MEDIUM
CVE-2023-28120
Possible XSS Security Vulnerability in SafeBuffer#bytesplice
MEDIUM
CVE-2023-25015
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
MEDIUM
CVE-2023-0569
Publify contains Weak Password Requirements