Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2015-10073
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function
CRITICAL
CVE-2023-25313
AVideo contains Command injection when embedding a video link
CRITICAL
CVE-2023-24997
Apache InLong vulnerable to Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2023-23924
Dompdf vulnerable to URI validation failure on SVG parsing
CRITICAL
CVE-2023-24163
Dromara hutool vulnerable to SQL Injection
CRITICAL
CVE-2023-24162
Dromara Hutool Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2013-2513
flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution
CRITICAL
CVE-2020-22452
phpmyadmin contains SQL Injection vulnerability
CRITICAL
CVE-2022-25894
Remote Code Execution in com.bstek.uflo:uflo-core
CRITICAL
CVE-2023-24441
XML external entity vulnerability on agents in Jenkins MSTest Plugin
CRITICAL
CVE-2023-24456
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
CRITICAL
CVE-2023-24443
XML Entity Expansion in Jenkins TestComplete support Plugin
CRITICAL
CVE-2023-24430
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24429
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24427
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
CRITICAL
CVE-2023-24057
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
CRITICAL
CVE-2021-26642
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2023-22727
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection
CRITICAL
CVE-2022-47105
Jeecg-boot is vulnerable to SQL injection
CRITICAL
CVE-2023-22731
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views
CRITICAL
CVE-2016-15020
SQL Injection in liftkit/database
CRITICAL
CVE-2015-10053
curupira is vulnerable to SQL injection
CRITICAL
CVE-2023-0311
phpMyFAQ Improper Authentication vulnerability
CRITICAL
CVE-2022-1812
Integer overflow in publify_core
CRITICAL
CVE-2023-0299
Publify Improper Input Validation vulnerability
CRITICAL
CVE-2022-45299
webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL
CRITICAL
CVE-2021-4308
WebPA SQL Injection vulnerability
CRITICAL
CVE-2014-125029
PaginationServiceProvider SQL Injection vulnerability
CRITICAL
CVE-2015-10029
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2018-25068
globalpom-utils has Insecure Temporary File
CRITICAL
CVE-2014-125051
himiklab yii2-jqgrid-widget vulnerable to SQL Injection
CRITICAL
CVE-2023-22463
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys
CRITICAL
CVE-2015-10018
DBRisinajumi d2files SQL Injection vulnerability
CRITICAL
CVE-2016-15011
dssp vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2020-36640
bonita-connector-webservice XML External Entity vulnerability
CRITICAL
CVE-2020-36641
aXMLRPC XML External Entity vulnerability
CRITICAL
CVE-2022-45875
Apache DolphinScheduler vulnerable to Improper Input Validation
CRITICAL
CVE-2021-32824
Apache Dubbo vulnerable to remote code execution via Telnet Handler
CRITICAL
CVE-2015-10009
nterchange Code Injection vulnerability
CRITICAL
CVE-2017-20157
Ariadne Component Library vulnerable to Server-Side Request Forgery
CRITICAL
CVE-2022-48195
mellium.im/sasl authentication failure due to insufficient nonce randomness
CRITICAL
CVE-2017-20151
iText RUPS XML External Entity vulnerability
CRITICAL
CVE-2022-44621
Apache Kylin vulnerable to Command injection by Diagnosis Controller
CRITICAL
CVE-2017-20146
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy
CRITICAL
CVE-2022-4725
AWS SDK is vulnerable to server-side request forgery (SSRF)
CRITICAL
CVE-2022-36437
Hazelcast connection caching
CRITICAL
CVE-2020-36632
flat vulnerable to Prototype Pollution
CRITICAL
CVE-2022-47945
ThinkPHP Framework vulnerable to remote code execution
CRITICAL
CVE-2022-4686
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
CRITICAL
CVE-2022-45347
Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability