Browse CVEs by Ecosystem and Severity
2,313 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-38999
jrburke requirejs vulnerable to prototype pollution
HIGH
CVE-2024-38996
Prototype pollution in ag-grid-community via the _.mergeDeep function
HIGH
CVE-2024-38528
Unlimited number of NTS-KE connections can crash ntpd-rs server
HIGH
CVE-2024-38516
Aimeos HTML client may potentially reveal sensitive information in error log
HIGH
CVE-2023-22650
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
HIGH
CVE-2024-36760
Rhai stack overflow vulenrability
HIGH
CVE-2024-34104
Magento Open Source Improper Authorization vulnerability
HIGH
CVE-2024-35252
Azure Storage Movement Client Library Denial of Service Vulnerability
HIGH
CVE-2024-35241
Composer has a command injection via malicious git branch name
HIGH
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
HIGH
CVE-2024-37153
Contract balance not updating correctly after interchain transaction
HIGH
CVE-2024-37031
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends
HIGH
CVE-2024-34008
Moodle CSRF risk in analytics management of models
HIGH
CVE-2014-6072
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
HIGH
CVE-2024-35231
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
HIGH
CVE-2024-35186
gix traversal outside working tree enables arbitrary code execution
HIGH
CVE-2024-28109
veraPDF has potential XSLT injection vulnerability when using policy files
HIGH
CVE-2024-35312
Tor Arti's STUB circuits incorrectly have a length of 2
HIGH
CVE-2024-32655
Npgsql vulnerable to SQL Injection via Protocol Message Size Overflow
HIGH
CVE-2024-34346
Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag
HIGH
CVE-2024-32984
Yamux Memory Exhaustion Vulnerability via Active::pending_frames property
HIGH
CVE-2024-32970
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values
HIGH
CVE-2024-32866
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function
HIGH
CVE-2024-32650
Denial of Service Vulnerability in Rustls Library
HIGH
CVE-2024-21409
.NET Elevation of Privilege Vulnerability
HIGH
CVE-2024-32463
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
HIGH
CVE-2024-20758
Magento Open Source allows Improper Input Validation
HIGH
CVE-2024-27284
cassandra-rs's non-idiomatic use of iterators leads to use after free
HIGH
CVE-2024-29891
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
HIGH
CVE-2024-29187
WiX based installers are vulnerable to binary hijack when run as SYSTEM
HIGH
CVE-2024-29188
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
HIGH
CVE-2024-28855
Improper HTML sanitization in ZITADEL
HIGH
CVE-2024-28854
tls-listener affected by the slow loris vulnerability with default configuration
HIGH
CVE-2024-28181
TurboBoost Commands vulnerable to arbitrary method invocation
HIGH
CVE-2024-28252
CoreWCF NetFraming based services can leave connections open when they should be closed
HIGH
GHSA-2x7m-gf85-3745
Remote Denial of Service Vulnerability in Microsoft QUIC
HIGH
CVE-2024-27894
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
HIGH
CVE-2024-27135
Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution
HIGH
CVE-2024-21392
Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability
HIGH
CVE-2024-28121
StimulusReflex arbitrary method call
HIGH
CVE-2024-28199
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
HIGH
CVE-2024-28123
Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
HIGH
CVE-2024-28101
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
HIGH
CVE-2024-27934
*const c_void / ExternalPointer unsoundness leading to use-after-free
HIGH
CVE-2024-27933
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
HIGH
CVE-2024-27936
Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping
HIGH
CVE-2024-27935
Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
HIGH
CVE-2024-27929
Use After Free in SixLabors.ImageSharp
HIGH
CVE-2024-27304
pgproto3 SQL Injection via Protocol Message Size Overflow
HIGH
CVE-2024-27308
Mio's tokens for named pipes may be delivered after deregistration