Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
GHSA-jg6f-48ff-5xrw
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement
CRITICAL
CVE-2024-47051
Mautic allows Remote Code Execution and File Deletion in Asset Uploads
CRITICAL
CVE-2023-25574
LTI JupyterHub Authenticator does not properly validate JWT Signature
CRITICAL
CVE-2025-25279
Mattermost allows reading arbitrary files related to importing boards
CRITICAL
CVE-2025-20051
Mattermost allows reading arbitrary files
CRITICAL
GHSA-f8qm-hmm3-fv7f
Namada-apps allows Excessive Computation in Mempool Validation
CRITICAL
GHSA-82vg-5v4f-f9wq
Namada-apps can Crash with Excessive Computation in Mempool Validation
CRITICAL
CVE-2025-24893KEV
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
CRITICAL
CVE-2025-0868
DocsGPT Allows Remote Code Execution
CRITICAL
CVE-2025-24895
AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass
CRITICAL
CVE-2025-24894
The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass
CRITICAL
CVE-2024-56180
Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
CRITICAL
CVE-2024-52577
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
CRITICAL
CVE-2024-57602
Easy!Appointments Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2024-57604
MaysWind ezBookkeeping has Improper Privilege Management
CRITICAL
CVE-2025-25200
Inefficient Regular Expression Complexity in koa
CRITICAL
CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
CRITICAL
CVE-2024-12366
PandasAI interactive prompt function Remote Code Execution (RCE)
CRITICAL
CVE-2025-24786
WhoDB has a path traversal opening Sqlite3 database
CRITICAL
CVE-2025-24981
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
CRITICAL
CVE-2024-36404
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
CRITICAL
CVE-2025-24964
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
CRITICAL
CVE-2025-24370
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CRITICAL
CVE-2025-23215
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
CRITICAL
CVE-2025-0851
Deep Java Library path traversal issue
CRITICAL
CVE-2025-24800
ismp-grandpa crate accepted incorrect signatures
CRITICAL
CVE-2024-45479
Apache Ranger UI vulnerable to Server Side Request Forgery
CRITICAL
CVE-2025-25286
Crayfish allows Remote Code Execution via Homarus Authorization header
CRITICAL
CVE-2025-23061
Mongoose search injection vulnerability
CRITICAL
CVE-2025-23025
XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing
CRITICAL
CVE-2024-49375
Rasa Allows Remote Code Execution via Remote Model Loading
CRITICAL
CVE-2024-54676
Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2025-21613
go-git has an Argument Injection via the URL field
CRITICAL
CVE-2024-56198
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
CRITICAL
CVE-2024-52046
Apache MINA Deserialization RCE Vulnerability
CRITICAL
CVE-2024-43441
Apache HugeGraph-Server: Fixed JWT Token (Secret)
CRITICAL
CVE-2024-39930
Gogs has an argument Injection in the built-in SSH server
CRITICAL
CVE-2024-39932
Gogs allows argument injection during the previewing of changes
CRITICAL
CVE-2024-39931
Gogs allows deletion of internal files
CRITICAL
CVE-2024-28892
GoCast OS Command Injection vulnerability
CRITICAL
CVE-2024-56145KEV
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
CRITICAL
CVE-2024-55662
XWiki allows remote code execution through the extension sheet
CRITICAL
CVE-2024-55875
http4k has a potential XXE (XML External Entity Injection) vulnerability
CRITICAL
CVE-2024-55877
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
CRITICAL
CVE-2024-55879
XWiki allows RCE from script right in configurable sections
CRITICAL
CVE-2024-45337
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
CRITICAL
CVE-2024-53677
Apache Struts file upload logic is flawed
CRITICAL
CVE-2024-54152
Angular Expressions - Remote Code Execution when using locals
CRITICAL
CVE-2024-47533
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CRITICAL
CVE-2024-52316
Apache Tomcat - Authentication Bypass