Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-42268
Jeecg boot SQL Injection vulnerability
CRITICAL
CVE-2023-41330
Snappy PHAR deserialization vulnerability
CRITICAL
CVE-2021-36021
Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
CRITICAL
CVE-2021-36023
Magento XML Injection vulnerability in the Widgets Update Layout
CRITICAL
CVE-2021-36036
Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
CRITICAL
CVE-2023-40743
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
CRITICAL
CVE-2023-4696
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos
CRITICAL
CVE-2023-40582
Command Injection Vulnerability in find-exec
CRITICAL
CVE-2023-40177
XWiki Platform privilege escalation (PR) from account through AWM content fields
CRITICAL
CVE-2023-37914
XWiki Platform privilege escalation (PR)/RCE from account through Invitation subject/message
CRITICAL
CVE-2023-40175
Puma HTTP Request/Response Smuggling vulnerability
CRITICAL
CVE-2023-38894
tree-kit Prototype Pollution vulnerability
CRITICAL
CVE-2023-38889
Alluxio vulnerable to arbitrary code execution
CRITICAL
CVE-2023-40013
external-svg-loader Cross-site Scripting vulnerability
CRITICAL
CVE-2021-26505
MrSwitch hello.js vulnerable to prototype pollution
CRITICAL
CVE-2023-39532
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution
CRITICAL
CVE-2023-39526
PrestaShop SQL manager vulnerability
CRITICAL
CVE-2023-4195
Cockpit PHP Remote File Inclusion vulnerability
CRITICAL
CVE-2023-29689
PyroCMS remote code execution vulnerability
CRITICAL
CVE-2023-36480
Aerospike Java Client vulnerable to unsafe deserialization of server responses
CRITICAL
CVE-2022-39986
RaspAP Command Injection vulnerability
CRITICAL
CVE-2023-37754
Code injection in PowerJob
CRITICAL
CVE-2023-39020
Code injection in stanford-parser
CRITICAL
CVE-2023-39022
Code injection in oscore
CRITICAL
CVE-2023-39010
Code injection in BoofCV
CRITICAL
CVE-2023-39021
Code injection in wix-embedded-mysql
CRITICAL
CVE-2023-39015
Code injection in webmagic-core
CRITICAL
CVE-2023-39013
Code injection in Duke
CRITICAL
CVE-2023-38992
SQL injection in jeecg-boot
CRITICAL
CVE-2023-38647
Deserialization vulnerability in Helix workflow and REST
CRITICAL
CVE-2023-37895
Remote code execution in Apache Jackrabbit
CRITICAL
CVE-2023-26045
Path traversal and code execution via prototype vulnerability
CRITICAL
CVE-2024-23687
Hard-coded System User Credentials in Folio Data Export Spring module
CRITICAL
CVE-2023-35088
SQL injection in audit endpoint
CRITICAL
CVE-2023-34478
Path Traversal in Apache Shiro
CRITICAL
CVE-2023-34034
Access Control Bypass in Spring Security
CRITICAL
CVE-2023-37266
CasaOS contains weak JWT secrets
CRITICAL
CVE-2023-37265
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
CRITICAL
CVE-2023-26512
rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message
CRITICAL
CVE-2023-3696
Mongoose Prototype Pollution vulnerability
CRITICAL
CVE-2023-37462
org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability
CRITICAL
CVE-2023-30429
Apache Pulsar Incorrect Authorization vulnerability
CRITICAL
CVE-2023-37582
RocketMQ NameServer component Code Injection vulnerability
CRITICAL
CVE-2023-36825
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
CRITICAL
CVE-2023-37277
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
CRITICAL
CVE-2023-33246KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
CRITICAL
CVE-2023-31065
Apache InLong Insufficient Session Expiration vulnerability
CRITICAL
CVE-2023-31062
Apache InLong Improper Privilege Management vulnerability
CRITICAL
CVE-2023-31098
Apache InLong has Weak Password Requirements in Apache InLong
CRITICAL
CVE-2022-45802
Apache StreamPark Path Traversal vulnerability