Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-35569
Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
HIGH
CVE-2026-41211
Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME
HIGH
CVE-2026-41230
Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()
HIGH
CVE-2026-6654
thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
HIGH
CVE-2024-53412
NietThijmen ShoppingCart: Command injection in the connect function
HIGH
CVE-2026-41146
Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem
HIGH
CVE-2026-26171
Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability
HIGH
CVE-2026-33116
Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
HIGH
CVE-2026-41064
WWBN AVideo has an incomplete fix for CVE-2026-33502: Command Injection
HIGH
CVE-2026-40944
Oxia's TLS CA certificate chain validation fails with multi-certificate PEM bundles
HIGH
CVE-2026-40925
WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
HIGH
CVE-2026-40909
WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)
HIGH
CVE-2026-4789
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
HIGH
CVE-2026-40885
goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access
HIGH
CVE-2026-40876
SFTP root escape via prefix-based path validation in goshs
HIGH
CVE-2026-40869
Decidim amendments can be accepted or rejected by anyone
HIGH
CVE-2026-40261
Composer has a command injection via malicious perforce reference
HIGH
CVE-2026-38527
Webkul Krayin CRM has Server-Side Request Forgery (SSRF)
HIGH
CVE-2026-38529
Webkul Krayin CRM has Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php
HIGH
CVE-2026-33901
ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder
HIGH
CVE-2026-32271
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
HIGH
CVE-2026-32272
Craft Commerce hasVariant/hasProduct Blind SQL Injection
HIGH
CVE-2026-33908
ImageMagick has a Stack Overflow in DestroyXMLTree()
HIGH
CVE-2026-5795
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
HIGH
CVE-2026-40323
SP1 V6 Recursion Circuit Row-Count Binding Gap
HIGH
CVE-2026-40262
Note Mark has Stored XSS via Unrestricted Asset Upload
HIGH
CVE-2026-35582
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
HIGH
CVE-2026-35337
Apache Storm: Deserialization of Untrusted Data vulnerability
HIGH
CVE-2019-25710
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
HIGH
CVE-2026-41139
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
HIGH
CVE-2026-40321
DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
HIGH
CVE-2026-40318
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
HIGH
CVE-2026-40107
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
HIGH
CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
HIGH
CVE-2026-35595
Vikunja vulnerable to Privilege Escalation via Project Reparenting
HIGH
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
HIGH
CVE-2026-39304
Apache ActiveMQ: Denial of Service via Out of Memory vulnerability
HIGH
CVE-2026-34486KEV
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
HIGH
CVE-2026-34483
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
HIGH
CVE-2026-34487
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
HIGH
CVE-2026-24880
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
HIGH
CVE-2026-29129
Apache Tomcat: Configured cipher preference order not preserved
HIGH
CVE-2026-29146
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
HIGH
CVE-2026-40069
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts
HIGH
CVE-2026-40070
bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)
HIGH
CVE-2026-39959
Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service
HIGH
CVE-2026-39429
kcp's cache server is accessible without authentication or authorization checks
HIGH
CVE-2026-35611
Addressable has a Regular Expression Denial of Service in Addressable templates
HIGH
CVE-2026-35533
Local settings bypass config trust checks
HIGH
CVE-2026-35406
netavark has incorrect error handling for malformed tcp packets