Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-43858
YoutubeDLSharp allows command injection on windows system due to non sanitized arguments
CRITICAL
CVE-2025-32969
org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API
CRITICAL
CVE-2025-32965
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
CRITICAL
CVE-2025-24016KEV
Wazuh server vulnerable to remote code execution
CRITICAL
CVE-2025-29287
MCMS allows arbitrary file uploads in the ueditor component
CRITICAL
CVE-2025-29953
Apache ActiveMQ NMS OpenWire Client Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
CRITICAL
CVE-2025-30215
NATS Server may fail to authorize certain Jetstream admin APIs
CRITICAL
CVE-2025-30206
Dpanel's hard-coded JWT secret leads to remote code execution
CRITICAL
CVE-2025-32931
DevDojo Voyager Argument Injection vulnerability
CRITICAL
CVE-2025-32445
Argo Events users can gain privileged access to the host system and cluster with EventSource and Sensor CR
CRITICAL
CVE-2025-71392
SurrealDB server-takeover via SurrealQL injection on backup import
CRITICAL
CVE-2024-58136KEV
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
CRITICAL
CVE-2025-32375
BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
CRITICAL
CVE-2025-22871
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
CRITICAL
CVE-2025-27520
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
CRITICAL
CVE-2025-2945
pgAdmin 4 Vulnerable to Remote Code Execution
CRITICAL
CVE-2025-31477
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`
CRITICAL
CVE-2025-23391
Rancher: Restricted Administrator can change Administrator's passwords
CRITICAL
CVE-2025-30065
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
CRITICAL
CVE-2024-56325
Apache Pinot Vulnerable to Authentication Bypass
CRITICAL
CVE-2025-30223
Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input
CRITICAL
CVE-2025-1974
ingress-nginx admission controller RCE escalation
CRITICAL
CVE-2025-29315
OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request
CRITICAL
CVE-2024-12029
InvokeAI Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-29927
Authorization Bypass in Next.js Middleware
CRITICAL
CVE-2025-29922
kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace
CRITICAL
CVE-2024-9053
vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints
CRITICAL
CVE-2024-9052
vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
CRITICAL
CVE-2024-8502
AgentScope Deserialization Vulnerability
CRITICAL
CVE-2024-12909
llama-index-packs-finchat SQL Injection vulnerability
CRITICAL
CVE-2024-11958
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
CRITICAL
CVE-2024-11041
vLLM Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-10553
H2O Deserialization of Untrusted Data Vulnerability
CRITICAL
CVE-2025-2000
Qiskit allows arbitrary code execution decoding QPY format versions < 13
CRITICAL
CVE-2025-71338
Flowise allows arbitrary file write to RCE
CRITICAL
CVE-2025-29775
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
CRITICAL
CVE-2025-29774
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
CRITICAL
CVE-2025-2304
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
CRITICAL
CVE-2025-71333
Flowise Pre-auth Arbitrary File Upload
CRITICAL
CVE-2025-25292
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
CRITICAL
CVE-2025-25291
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
CRITICAL
CVE-2025-27407
graphql allows remote code execution when loading a crafted GraphQL schema
CRITICAL
CVE-2025-24813KEV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CRITICAL
CVE-2025-27603
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Remote Code Execution via unescaped translations
CRITICAL
CVE-2025-27509
Fleet has SAML authentication vulnerability due to improper SAML response validation
CRITICAL
CVE-2025-27517
Volt Allows RCE Via User-Crafted Requests
CRITICAL
CVE-2023-38693
Lucee RCE/XXE Vulnerability
CRITICAL
CVE-2025-27507
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
CRITICAL
CVE-2025-27590
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account