Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-59830
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
HIGH
CVE-2025-59839
Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes
HIGH
CVE-2025-9079
Mattermost Path Traversal vulnerability
HIGH
CVE-2025-10492
JasperReports has a Java deserialisation vulnerability
HIGH
CVE-2025-71336
Flowise has unsandboxed remote code execution via Custom MCP
HIGH
CVE-2025-58754EPSS 0.1%
Axios is vulnerable to DoS attack through lack of data size check
HIGH
CVE-2024-43115
Apache DolphinScheduler vulnerable to Alert Script Attack
HIGH
GHSA-pfp7-vxgr-83pw
toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor
HIGH
CVE-2025-59037
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
HIGH
CVE-2025-58365
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
HIGH
CVE-2025-57833EPSS 0.0%
Django is subject to SQL injection through its column aliases
HIGH
GHSA-3632-54q8-m96x
arenavec has multiple memory corruption vulnerabilities in safe APIs
HIGH
CVE-2025-58158
Harness Allows Arbitrary File Write in Gitness LFS server
HIGH
CVE-2024-58259
Rancher affected by unauthenticated Denial of Service
HIGH
CVE-2025-57820
devalue prototype pollution vulnerability
HIGH
CVE-2025-52353
Badaso CMS file upload vulnerability
HIGH
CVE-2025-57803
ImageMagick (WriteBMPImage): 32-bit integer overflow when writing BMP scanline stride → heap buffer overflow
HIGH
CVE-2025-55298
ImageMagick has a Format String Bug in InterpretImageFilename leads to arbitrary code execution
HIGH
CVE-2025-55154
imagemagick: integer overflows in MNG magnification
HIGH
CVE-2025-55004
imagemagick: heap-buffer overflow read in MNG magnification with alpha
HIGH
CVE-2025-53101
ImageMagick has a Stack Buffer Overflow in image.c
HIGH
CVE-2025-26467
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
HIGH
CVE-2025-43960
Adminer PHP Object Injection issue leads to Denial of Service
HIGH
CVE-2025-57801
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks
HIGH
CVE-2025-51606
hippo4j Includes Hard Coded Secret Key in JWT Creation
HIGH
CVE-2025-54867
Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.
HIGH
CVE-2025-49555
Magento Cross-Site Request Forgery (CSRF) vulnerability
HIGH
CVE-2025-49556
Magento has incorrect authorization issue that leads to arbitrary file system read
HIGH
CVE-2025-49557
Magento Cross-site Scripting vulnerability
HIGH
CVE-2025-49554
Magento vulnerable to denial of service
HIGH
CVE-2025-55164
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
HIGH
CVE-2025-71325
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
HIGH
CVE-2025-53606
Apache Seata: Deserialization of untrusted Data in Apache Seata Server
HIGH
CVE-2025-7054
quiche connection ID retirement can trigger an infinite loop
HIGH
CVE-2025-53534
RatPanel can perform remote command execution without authorization
HIGH
CVE-2025-54803
js-toml Prototype Pollution Vulnerability
HIGH
CVE-2025-54581
vproxy Divide by Zero DoS Vulnerability
HIGH
CVE-2025-8264
z-push/z-push-dev SQL Injection Vulnerability
HIGH
CVE-2025-54379
eKuiper API endpoints handling SQL queries with user-controlled table names.
HIGH
CVE-2025-53015
ImageMagick has XMP profile write that triggers hang due to unbounded loop
HIGH
CVE-2025-53942
Authentik has insufficient check for account active status when authenticating with OAuth/SAML Sources
HIGH
CVE-2025-23267
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook
HIGH
GHSA-7mcq-f592-pf7v
Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs
HIGH
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
HIGH
CVE-2025-6965
SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
HIGH
CVE-2025-53689
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
HIGH
CVE-2025-53506
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
HIGH
CVE-2025-52520
Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits
HIGH
CVE-2025-53632
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive
HIGH
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity