Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-33901
ImageMagick has a heap Buffer Overflow in ImageMagick MVG decoder
HIGH
CVE-2026-32271
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
HIGH
CVE-2026-32272
Craft Commerce hasVariant/hasProduct Blind SQL Injection
HIGH
CVE-2026-33908
ImageMagick has a Stack Overflow in DestroyXMLTree()
HIGH
CVE-2026-5795
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
HIGH
CVE-2026-40323
SP1 V6 Recursion Circuit Row-Count Binding Gap
CRITICAL
CVE-2026-40576
excel-mcp-server has a Path Traversal issue
MEDIUM
CVE-2026-33899
ImageMagick has a heap-Buffer-Overflow write of a single zero byte when parsing xml.
HIGH
CVE-2026-40262
Note Mark has Stored XSS via Unrestricted Asset Upload
MEDIUM
CVE-2026-34238
ImageMagick has an integer overflow in despeckle operation causing a heap buffer overflow on 32-bit builds
MEDIUM
CVE-2026-33900
ImageMagick has a heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds
HIGH
CVE-2026-35582
Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix
CRITICAL
CVE-2026-23891
Decidim has a cross-site scripting (XSS) in user name
HIGH
CVE-2026-35337
Apache Storm: Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2026-4810
Google Agent Development Kit (ADK) has a Code Injection and Missing Authentication vulnerability
HIGH
CVE-2019-25710
Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php
CRITICAL
CVE-2026-5059
aws-mcp has a Command Injection Remote Code Execution Vulnerability
HIGH
CVE-2026-41139
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
CRITICAL
CVE-2026-41679
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
MEDIUM
CVE-2026-40306
DNN: Same HostGUID for all new installs
CRITICAL
CVE-2026-5412
Juju: CloudSpec method leaking cloud credentials
CRITICAL
CVE-2026-40258
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
HIGH
CVE-2026-40321
DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload
CRITICAL
CVE-2026-40189
goshs has a file-based ACL authorization bypass in goshs state-changing routes
CRITICAL
CVE-2026-40093
nimiq-blockchain is missing a wall-clock upper bound on block timestamps
CRITICAL
CVE-2026-40289
PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions
CRITICAL
CVE-2026-40288
PraisonAI has critical RCE via `type: job` workflow YAML
HIGH
CVE-2026-40318
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
CRITICAL
CVE-2026-40157
PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`
CRITICAL
CVE-2026-40154
PraisonAI Vulnerable Untrusted Remote Template Code Execution
HIGH
CVE-2026-40107
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering
CRITICAL
CVE-2026-34177
LXD: VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf
CRITICAL
CVE-2026-34178
LXD: Importing a crafted backup leads to project restriction bypass
CRITICAL
CVE-2026-34179
LXD: Update of type field in restricted TLS certificate allows privilege escalation to cluster admin
MEDIUM
CVE-2026-40021
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
HIGH
CVE-2026-23869
React Server Components have a Denial of Service Vulnerability
HIGH
CVE-2026-35595
Vikunja vulnerable to Privilege Escalation via Project Reparenting
HIGH
CVE-2026-35204
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
MEDIUM
CVE-2026-35186
Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend
CRITICAL
CVE-2026-34987
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
HIGH
CVE-2026-39304
Apache ActiveMQ: Denial of Service via Out of Memory vulnerability
CRITICAL
CVE-2026-1115
parisneo/lollms vulnerable to stored XSS in the social feature
HIGH
CVE-2026-34486KEV
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
HIGH
CVE-2026-34483
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
HIGH
CVE-2026-34487
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
HIGH
CVE-2026-24880
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
HIGH
CVE-2026-29129
Apache Tomcat: Configured cipher preference order not preserved
CRITICAL
CVE-2026-29145
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
HIGH
CVE-2026-29146
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
HIGH
CVE-2026-40069
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts