Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-2479
appium-desktop OS Command Injection vulnerability
CRITICAL
CVE-2023-28473
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section
CRITICAL
CVE-2023-30349
Remote code execution in JFinal CMS
CRITICAL
CVE-2020-36070
Remote code execution in Voyager
CRITICAL
CVE-2022-37454
Buffer overflow in sponge queue functions
CRITICAL
CVE-2023-30839
SQL filter bypass leading to arbitrary write requests using "SQL Manager"
CRITICAL
CVE-2023-22651
Rancher Webhook is misconfigured during upgrade process
CRITICAL
CVE-2023-29924
PowerJob vulnerable to incorrect access control
CRITICAL
CVE-2023-29525
XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration
CRITICAL
CVE-2023-29527
XWiki Platform vulnerable to code injection from account through AWM view sheet
CRITICAL
CVE-2023-29526
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode
CRITICAL
CVE-2023-29524
XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet
CRITICAL
CVE-2023-29523
XWiki Platform vulnerable to code injection in display method used in user profiles
CRITICAL
CVE-2023-29516
XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector
CRITICAL
CVE-2023-29514
XWiki vulnerable to Code Injection in template provider administration
CRITICAL
CVE-2023-29512
xwiki-platform-web-templates vulnerable to Eval Injection
CRITICAL
CVE-2023-20873
Spring Boot Security Bypass with Wildcard Pattern Matching on Cloud Foundry
CRITICAL
CVE-2023-29926
PowerJob vulnerable to remote code execution
CRITICAL
CVE-2023-22621
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
CRITICAL
CVE-2023-29510
Code injection via unescaped translations in xwiki-platform
CRITICAL
CVE-2023-2138
@nuxtlabs/github-module made Use of Hard-coded Credentials
CRITICAL
CVE-2023-24831
Apache IoTDB Grafana Connector vulnerable to Improper Authentication
CRITICAL
CVE-2023-22946
Apache Spark vulnerable to Improper Privilege Management
CRITICAL
CVE-2023-29205
org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
CRITICAL
CVE-2023-29511
xwiki-platform-administration-ui vulnerable to privilege escalation
CRITICAL
CVE-2023-30537
org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalation
CRITICAL
CVE-2023-29509
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29214
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29212
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29211
org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
CRITICAL
CVE-2023-29210
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
CRITICAL
CVE-2023-29209
org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
CRITICAL
CVE-2023-26122
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization
CRITICAL
CVE-2023-26121
safe-eval vulnerable to Prototype Pollution via the safeEval function
CRITICAL
CVE-2023-29215
Apache Linkis JDBC EngineConn has deserialization vulnerability
CRITICAL
CVE-2023-29216
Apache Linkis DatasourceManager module has deserialization vulnerability
CRITICAL
CVE-2023-25330
MyBatis-Plus vulnerable to SQL injection via TenantPlugin
CRITICAL
CVE-2021-28235
Etcd-io Improper Authentication vulnerability
CRITICAL
CVE-2020-20913
Ming-Soft MCMS vulnerable to SQL injection
CRITICAL
CVE-2023-1800
sjqzhang go-fastdfs vulnerable to path traversal
CRITICAL
CVE-2023-29141
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
CRITICAL
CVE-2023-1784
jeecg-boot vulnerable to improper authentication
CRITICAL
CVE-2023-28462
Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed
CRITICAL
CVE-2023-28326
Apache OpenMeetings missing authentication and can allow user impersonation
CRITICAL
CVE-2023-20860
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
CRITICAL
CVE-2023-28444
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
CRITICAL
CVE-2023-28445
Deno improperly handles resizable ArrayBuffer
CRITICAL
CVE-2023-28333
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input
CRITICAL
CVE-2023-25655
baserCMS allows any file to be uploaded
CRITICAL
CVE-2023-25654
baserCMS File Uploader Remote Code Execution (RCE) vulnerability