Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-37901
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
CRITICAL
CVE-2024-41110
Authz zero length regression
CRITICAL
CVE-2024-38529
Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
CRITICAL
CVE-2024-37906
Admidio has Blind SQL Injection in ecard_send.php
CRITICAL
CVE-2024-41637
RaspAP allows an attacker to escalate privileges
CRITICAL
CVE-2024-37084
Remote code execution in Spring Cloud Data Flow
CRITICAL
CVE-2024-36533
Volcano has insecure permissions
CRITICAL
CVE-2024-28698
CLSA Directory Traversal vulnerability
CRITICAL
CVE-2024-35198
TorchServe vulnerable to bypass of allowed_urls configuration
CRITICAL
CVE-2024-39907
1Panel has an SQL injection issue related to the orderBy clause
CRITICAL
CVE-2024-40624
TorrentPier Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-35264
Microsoft Security Advisory CVE-2024-35264 | .NET Remote Code Execution Vulnerability
CRITICAL
CVE-2024-39697
panic on parsing crafted phonenumber inputs
CRITICAL
CVE-2024-39223
Missing key verification in gost
CRITICAL
CVE-2024-38513
Session Middleware Token Injection Vulnerability
CRITICAL
CVE-2024-36401KEV
Remote Code Execution (RCE) vulnerability in geoserver
CRITICAL
CVE-2024-39309
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
CRITICAL
CVE-2019-25211
Gin mishandles a wildcard at the end of an origin string
CRITICAL
CVE-2024-37843
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
CRITICAL
CVE-2024-38369
XWiki programming rights may be inherited by inclusion
CRITICAL
CVE-2024-37899
XWiki Platform allows remote code execution from user account
CRITICAL
CVE-2023-32191
rke's credentials are stored in the RKE1 Cluster state ConfigMap
CRITICAL
CVE-2024-37902
DeepJavaLibrary API absolute path traversal
CRITICAL
CVE-2024-36573
obx Prototype Pollution
CRITICAL
CVE-2024-34103
Magento Open Source Improper Authentication vulnerability
CRITICAL
CVE-2024-34102KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
CRITICAL
CVE-2024-5262
Files or Directories Accessible to External Parties in ProjectDiscovery
CRITICAL
CVE-2024-37273
Jan path traversal vulnerability
CRITICAL
CVE-2024-36858
Jan path traversal vulnerability
CRITICAL
CVE-2024-36400
Unable to generate the correct character set
CRITICAL
CVE-2024-36042
Silverpeas authentication bypass
CRITICAL
CVE-2024-3584
qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint
CRITICAL
CVE-2024-25738
VuFind Server-Side Request Forgery (SSRF) vulnerability
CRITICAL
CVE-2024-25737
VuFind Server-Side Request Forgery (SSRF) vulnerability
CRITICAL
CVE-2024-31989
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
CRITICAL
CVE-2024-24294
Blackprint @blackprint/engine Prototype Pollution issue
CRITICAL
CVE-2020-35125
Mautic is vulnerable to XSS vulnerability
CRITICAL
CVE-2024-32888
Amazon JDBC Driver for Redshift SQL Injection via line comment generation
CRITICAL
CVE-2022-39328
Grafana Race condition allowing privilege escalation
CRITICAL
CVE-2021-41244
Grafana Fine-grained access control vulnerability
CRITICAL
CVE-2024-34716
PrestaShop cross-site scripting via customer contact form in FO, through file upload
CRITICAL
CVE-2024-4825
Cockpit CMS contains an arbitrary file upload vulenrability
CRITICAL
CVE-2024-34706
@valtimo/components exposes access token to form.io
CRITICAL
CVE-2024-34070
Blind XSS Leading to Froxlor Application Compromise
CRITICAL
CVE-2024-4701
Genie Path Traversal vulnerability via File Uploads
CRITICAL
CVE-2024-32980
Spin applications with specific configuration vulnerable to potential network sandbox escape
CRITICAL
CVE-2024-26579
Apache Inlong Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2024-30850
tiagorlampert CHAOS vulnerable to arbitrary code execution
CRITICAL
CVE-2024-34461
Zenario uses Twig filters insecurely in the Twig Snippet plugin
CRITICAL
CVE-2024-32971
Apollo Router vulnerable to Critical Regression In Query Plan Cache