Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-0928
Juju allows arbitrary executable uploads via authenticated endpoint without authorization
HIGH
CVE-2025-53513
Juju zip slip vulnerability via authenticated endpoint
HIGH
CVE-2025-53547
Helm vulnerable to Code Injection through malicious chart.yaml content
HIGH
CVE-2025-53369
Citizen Short Description stored XSS vulnerability through wikitext
HIGH
CVE-2025-53370
Citizen vulnerable to Stored XSS through short descriptions
HIGH
CVE-2025-53368
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
HIGH
CVE-2025-53110
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
HIGH
CVE-2025-53109
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
HIGH
CVE-2025-53093
TabberNeue vulnerable to Stored XSS through wikitext
HIGH
CVE-2025-52477
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens
HIGH
CVE-2025-4366
Pingora has a Request Smuggling Vulnerability
HIGH
CVE-2025-52488
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
HIGH
CVE-2025-52487
DNN.PLATFORM possibly allows bypass of IP Filters
HIGH
CVE-2025-47771
PowSyBl Core allows deserialization of untrusted SparseMatrix data
HIGH
GHSA-6q65-j4jw-9cg8
DotVVM allows path traversal when deployed in Debug mode
HIGH
CVE-2025-6087
OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint
HIGH
CVE-2025-3594
Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler
HIGH
CVE-2025-49585
XWiki does not require right warnings for XClass definitions
HIGH
CVE-2025-49586
XWiki allows remote code execution through preview of XClass changes in AWM editor
HIGH
CVE-2025-49581
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
HIGH
CVE-2025-49582
XWiki's required right warnings for macros are incomplete
HIGH
CVE-2025-28382
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
HIGH
CVE-2025-48446
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability
HIGH
CVE-2025-48445
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability
HIGH
CVE-2025-30399
Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability
HIGH
CVE-2025-30220
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
HIGH
CVE-2025-43585
Magento Improper Authorization leading to security feature bypass
HIGH
CVE-2025-27818
Apache Kafka Deserialization of Untrusted Data vulnerability
HIGH
CVE-2025-27819
Apache Kafka Deserialization of Untrusted Data vulnerability
HIGH
CVE-2025-27531
Apache InLong Deserialization of Untrusted Data Vulnerability
HIGH
CVE-2025-5791
users may append `root` to group listings
HIGH
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
HIGH
CVE-2025-24015
Deno's AES GCM authentication tags are not verified
HIGH
CVE-2025-41235
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
HIGH
CVE-2025-48948
Navidrome Transcoding Permission Bypass Vulnerability Report
HIGH
CVE-2025-48949
Navidrome allows SQL Injection via role parameter
HIGH
CVE-2025-48936
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
HIGH
CVE-2025-48734
Apache Commons Improper Access Control vulnerability
HIGH
CVE-2025-48881
Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
HIGH
CVE-2025-27522
Apache InLong: JDBC Vulnerability during verification processing
HIGH
CVE-2025-48201
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
HIGH
CVE-2025-48205
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
HIGH
CVE-2025-47290
containerd allows host filesystem access on pull
HIGH
CVE-2025-46725
Langroid has a Code Injection vulnerability in LanceDocChatAgent through vector_store
HIGH
CVE-2025-47782
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
HIGH
CVE-2025-47889
Jenkins WSO2 Oauth Plugin Fails to Properly Authenticate User Credentials
HIGH
CVE-2025-47885
Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting
HIGH
CVE-2025-26646
Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability
HIGH
CVE-2025-46727
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
HIGH
CVE-2025-46723
OpenVM allows the byte decomposition of pc in AUIPC chip to overflow