Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
CRITICAL
CVE-2025-14931
Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
CRITICAL
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
CRITICAL
CVE-2025-68613KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
CRITICAL
CVE-2025-63389
Ollama Platform has missing authentication enabling attackers to perform model management operations
CRITICAL
CVE-2025-67165
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
CRITICAL
CVE-2025-67164
Pagekit CMS is vulnerable to OS Command Injection via Storage component
CRITICAL
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
CRITICAL
CVE-2025-66844
Grav may be vulnerable to SSRF attack via Twig Templates
CRITICAL
CVE-2025-13888
OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources
CRITICAL
CVE-2025-65854
MineAdmin has an insecure default password
CRITICAL
CVE-2025-67719
Ibexa User Bundle is missing password change validation
CRITICAL
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
CRITICAL
CVE-2025-14307
Robocode has an insecure temporary file creation vulnerability in the AutoExtract component
CRITICAL
CVE-2025-14306
Robocode vulnerable to Directory Traversal in recursivelyDelete Method
CRITICAL
CVE-2025-67510
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
CRITICAL
CVE-2025-67494
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
CRITICAL
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
CRITICAL
CVE-2025-66568
Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation
CRITICAL
CVE-2025-66567
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
CRITICAL
CVE-2025-65964
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
CRITICAL
CVE-2025-66516
Apache Tika has XXE vulnerability
CRITICAL
CVE-2025-55182KEV
React Server Components are Vulnerable to RCE
CRITICAL
CVE-2025-44005
Step CA Has Authorization Bypass in ACME and SCEP Provisioners
CRITICAL
CVE-2025-65896
asyncmy is vulnerable to SQL injection via crafted dict keys
CRITICAL
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
CRITICAL
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
CRITICAL
CVE-2025-12421
Mattermost fails to to verify the token used during code exchange
CRITICAL
CVE-2025-12419
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
CRITICAL
CVE-2025-34351
Ray's New Token Authentication is Disabled By Default
CRITICAL
CVE-2025-62593
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack
CRITICAL
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret
CRITICAL
GHSA-2fjw-whxm-9v4q
libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)
CRITICAL
CVE-2025-66016
cggmp21 has a missing check in the ZK proof used in CGGMP21
CRITICAL
CVE-2025-41115
Grafana Incorrect Privilege Assignment vulnerability
CRITICAL
CVE-2025-65108
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
CRITICAL
CVE-2025-64767
@hpke/core reuses AEAD nonces
CRITICAL
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
CRITICAL
CVE-2025-12383
Eclipse Jersey has a Race Condition
CRITICAL
CVE-2025-55449
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
CRITICAL
CVE-2025-64513
Milvus Proxy has a Critical Authentication Bypass Vulnerability
CRITICAL
CVE-2025-64522
Soft Serve is vulnerable to SSRF through its Webhooks
CRITICAL
CVE-2025-64459EPSS 0.2%
Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
CRITICAL
CVE-2025-11953KEV
@react-native-community/cli has arbitrary OS command injection
CRITICAL
CVE-2025-57108
CRITICAL
CVE-2025-64095
DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite
CRITICAL
CVE-2025-54469
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
CRITICAL
CVE-2025-10678
NetBird VPN does not remove the default password of an admin account
CRITICAL
CVE-2025-56316
MCMS vulnerable SQL injection via the content_title parameter
CRITICAL
CVE-2025-49655
Keras framework vulnerable to deserialization of untrusted data