Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-42496
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2023-42498
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2024-25601
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25152
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25602
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25147
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
CRITICAL
CVE-2024-25610
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
CRITICAL
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
CRITICAL
CVE-2024-1651
Deserialization of Untrusted Data in Torrentpier
CRITICAL
CVE-2024-0057
NuGet Client Security Feature Bypass Vulnerability
CRITICAL
CVE-2024-25108
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
CRITICAL
CVE-2024-25145
Liferay Portal stored cross-site scripting (XSS) vulnerability
CRITICAL
CVE-2024-1143
Central Dogma Authentication Bypass Vulnerability via Session Leakage
CRITICAL
CVE-2024-22533
Beetl Server-Side Template Injection vulnerability
CRITICAL
CVE-2024-23652
BuildKit vulnerable to possible host system access from mount stub cleaner
CRITICAL
CVE-2024-23653
Buildkit's interactive containers API does not validate entitlements check
CRITICAL
CVE-2023-51837
Ylianst MeshCentral Missing SSL Certificate Validation
CRITICAL
CVE-2024-23827
Nginx-UI vulnerable to arbitrary file write through the Import Certificate feature
CRITICAL
CVE-2024-23897KEV
Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
CRITICAL
CVE-2024-23636
Remote Command Execution in SOFARPC
CRITICAL
CVE-2017-20189
Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization
CRITICAL
CVE-2024-22406
Blind SQL injection in shopware
CRITICAL
CVE-2024-22199
Django Template Engine Vulnerable to XSS
CRITICAL
CVE-2019-6342
Drupal Improper Access Control
CRITICAL
CVE-2023-49599
WWBN AVideo Insufficient Entropy vulnerbaility
CRITICAL
CVE-2023-49569
Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients
CRITICAL
CVE-2024-21669
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
CRITICAL
CVE-2024-21650
XWiki Remote Code Execution Vulnerability via User Registration
CRITICAL
CVE-2023-51784
Apache InLong Manager Remote Code Execution vulnerability
CRITICAL
CVE-2023-46308
plotly.js prototype pollution vulnerability
CRITICAL
CVE-2023-41542
Jeecg Boot SQL injection vulnerability
CRITICAL
CVE-2023-41543
Jeecg Boot SQL Injection
CRITICAL
CVE-2023-51084
hyavijava stack overflow vulnerability
CRITICAL
CVE-2023-51656
Apache IoTDB: Unsafe deserialize map in Sync Tool
CRITICAL
CVE-2019-25158
Pedroetb TTS-API OS Command Injection
CRITICAL
CVE-2023-50723
Remote code execution/programming rights with configuration section from any user account
CRITICAL
CVE-2023-50722
XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
CRITICAL
CVE-2023-50721
Remote code execution from account through SearchAdmin
CRITICAL
CVE-2023-29234
Bypass serialize checks in Apache Dubbo
CRITICAL
CVE-2023-46279
Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
CRITICAL
CVE-2023-50422
Improper JWT Signature Validation in SAP Security Services Library
CRITICAL
CVE-2023-46498
Code execution in evershop
CRITICAL
CVE-2023-50164
Apache Struts vulnerable to path traversal
CRITICAL
CVE-2023-49093
HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
CRITICAL
CVE-2023-48910
Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
CRITICAL
CVE-2023-48967
Solon is vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-48887
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
CRITICAL
CVE-2023-49371
RuoYi vulnerable to SQL injection vulnerability
CRITICAL
CVE-2023-6026
PHPMemcachedAdmin Path Traversal vulnerability
CRITICAL
CVE-2023-49733
Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability