Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-26119
HtmlUnit Code Injection vulnerability
CRITICAL
CVE-2023-27603
Apache Linkis Zip Slip issue
CRITICAL
CVE-2023-27602
Apache Linkis Unrestricted File Upload vulnerability
CRITICAL
CVE-2022-24697
Apache Kylin vulnerable to remote code execution
CRITICAL
CVE-2023-36665
protobufjs Prototype Pollution vulnerability
CRITICAL
CVE-2023-36812
Remote Code Execution for 2.4.1 and earlier
CRITICAL
CVE-2023-36468
Upgrading doesn't prevent exploiting vulnerable XWiki documents
CRITICAL
CVE-2023-36469
XWiki Platform vulnerable to Code injection through NotificationRSSService
CRITICAL
CVE-2023-36470
XWiki Platform vulnerable to Code Injection in icon themes
CRITICAL
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
CRITICAL
CVE-2022-4361
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
CRITICAL
CVE-2023-33190
Improper configuration of RBAC permissions obtaining cluster control permissions
CRITICAL
CVE-2021-31635
jFinal Server-Side Template Injection vulnerability
CRITICAL
CVE-2023-3128
Grafana vulnerable to Authentication Bypass by Spoofing
CRITICAL
CVE-2023-32571
Dynamic Linq vulnerable to remote code execution
CRITICAL
CVE-2023-35161
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page
CRITICAL
CVE-2023-35160
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template
CRITICAL
CVE-2023-35159
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
CRITICAL
CVE-2023-35158
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template
CRITICAL
CVE-2023-35156
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template
CRITICAL
CVE-2023-36097
fuadmin vulnerable to insecure file upload
CRITICAL
CVE-2023-29931
laravel-s vulnerable to Local File Inclusion
CRITICAL
CVE-2023-34340
Apache Accumulo Improper Authentication vulnerability
CRITICAL
CVE-2023-35162
XWiki Platform vulnerable to cross-site scripting via xcontinue parameter in previewactions template
CRITICAL
CVE-2023-35152
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults
CRITICAL
CVE-2023-35150
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application
CRITICAL
CVE-2023-34465
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights
CRITICAL
CVE-2023-34464
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
CRITICAL
CVE-2020-21489
Liufee CMS File Upload vulnerability
CRITICAL
CVE-2020-21174
liufee CMS File Upload vulnerability
CRITICAL
CVE-2023-35839
Solon vulnerable to deserialization of untrusted data
CRITICAL
CVE-2023-34659
jeecg-boot SQL injection vulnerability
CRITICAL
CVE-2023-35042
GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
CRITICAL
CVE-2023-3173
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2023-33496
xxl-rpc deserialization vulnerability
CRITICAL
CVE-2023-22647
Rancher vulnerable to Privilege Escalation via manipulation of Secrets
CRITICAL
CVE-2023-33965
Brook's tproxy server is vulnerable to a drive-by command injection.
CRITICAL
CVE-2015-20108
ruby-saml vulnerable to XPath injection
CRITICAL
CVE-2023-33189
Pomerium vulnerable to Incorrect Authorization with specially crafted requests
CRITICAL
CVE-2023-30145
Server-Side Template Injection in Camaleon CMS
CRITICAL
CVE-2023-32692
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
CRITICAL
CVE-2023-31890
glazedlists XML Deserialization vulnerability
CRITICAL
CVE-2022-47937
Apache Sling Commons JSON bundle vulnerable to Improper Input Validation
CRITICAL
CVE-2023-27238
LavaLite vulnerable to web cache poisoning
CRITICAL
CVE-2023-32070
Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers
CRITICAL
CVE-2023-32069
Privilege escalation (PR)/RCE from account through class sheet
CRITICAL
CVE-2023-31047EPSS 0.1%
Django bypasses validation when using one form field to upload multiple files
CRITICAL
CVE-2023-2531
AzuraCast missing brute force prevention
CRITICAL
CVE-2023-30331
Server-side template injection in beetl
CRITICAL
CVE-2023-25826
Command injection in OpenTSDB