Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-1537
Answer vulnerable to Authentication Bypass by Capture-replay
CRITICAL
CVE-2023-28609
Ansible Semaphore mishandles authentication
CRITICAL
CVE-2023-28115
PHAR deserialization allowing remote code execution
CRITICAL
CVE-2022-48367
Access control issue in ezsystems/ezpublish-kernel
CRITICAL
CVE-2023-24774
Funadmin vulnerable to SQL injection
CRITICAL
CVE-2023-1307
Froxlor is vulnerable to authentication bypass
CRITICAL
CVE-2023-24777
SQL Injection in Funadmin
CRITICAL
CVE-2023-26489
wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64
CRITICAL
CVE-2023-24782
SQL Injection in Funadmin
CRITICAL
CVE-2023-24773
SQL Injection in Funadmin
CRITICAL
CVE-2023-27479
org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection
CRITICAL
CVE-2023-1269
Easy!Appointments uses hard-coded credentials
CRITICAL
CVE-2023-23638
Apache Dubbo vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-24780
SQL Injection in Funadmin
CRITICAL
CVE-2023-24775
SQL Injection in Funadmin
CRITICAL
CVE-2023-24781
SQL Injection in Funadmin
CRITICAL
CVE-2021-36394
Moodle Session Fixation vulnerability
CRITICAL
CVE-2023-24776
Remote code execution in Funadmin
CRITICAL
CVE-2021-36393
Moodle SQL Injection vulnerability
CRITICAL
CVE-2021-36392
Moodle SQL Injection vulnerability
CRITICAL
CVE-2023-26477
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-26471
XWiki Platform users may execute anything with superadmin right through comments and async macro
CRITICAL
CVE-2023-26055
XWiki Platform may allow privilege escalation to programming rights via user's first name
CRITICAL
CVE-2023-26472
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
CRITICAL
CVE-2023-26474
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CRITICAL
CVE-2023-26475
xwiki-platform vulnerable to Remote Code Execution in Annotations
CRITICAL
CVE-2022-2024
Gogs OS Command Injection vulnerability
CRITICAL
CVE-2023-22578
Sequelize - Default support for “raw attributes” when using parentheses
CRITICAL
CVE-2022-23535
LiteDB may deserialize bad JSON on object type using _type
CRITICAL
CVE-2022-36231
Code injection in pdf_info
CRITICAL
CVE-2022-4492
Undertow client not checking server identity presented by server certificate in https connections
CRITICAL
CVE-2023-22579
Unsafe fall-through in getWhereConditions
CRITICAL
CVE-2023-25813
Sequelize vulnerable to SQL Injection via replacements
CRITICAL
CVE-2023-25158
GeoTools OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25157
GeoServer OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25613
Apache Kerby LdapIdentityBackend LDAP Injection vulnerability
CRITICAL
CVE-2014-125087
java-xmlbuilder vulnerable to XML External Entity Reference
CRITICAL
CVE-2021-32163
Privilege escalation in MOSN
CRITICAL
CVE-2023-23947
Users with any cluster secret update access may update out-of-bounds cluster secrets
CRITICAL
CVE-2023-25765
Sandbox escape in Jenkins Email Extension Plugin
CRITICAL
CVE-2023-0789
Command Injection in thorsten/phpmyfaq
CRITICAL
CVE-2023-0788
Code Injection in thorsten/phpmyfaq
CRITICAL
CVE-2023-25168
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system
CRITICAL
CVE-2015-10077
SQL injection in webbuilders-group silverstripe-kapost-bridge
CRITICAL
CVE-2022-4903
CodenameOne Pending Intent vulnerability
CRITICAL
CVE-2022-4203
openssl-src contains Read Buffer Overflow in X.509 Name Constraint
CRITICAL
CVE-2022-45982
Deserialization of Untrusted Data in thinkphp
CRITICAL
CVE-2023-0744
Answer contains Improper Access Control vulnerability
CRITICAL
CVE-2021-3538
go.uuid has Predictable UUID Identifiers
CRITICAL
CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924