Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-4643
docconv OS Command Injection vulnerability
CRITICAL
CVE-2022-40145
Apache Karaf vulnerable to potential code injection
CRITICAL
CVE-2021-4262
laravel-jqgrid vulnerable to SQL Injection
CRITICAL
CVE-2021-4248
DNS NuGet package uses insufficiently random values
CRITICAL
CVE-2022-47406
TYPO3 vulnerable to Insufficient Session Expiration
CRITICAL
CVE-2022-46364
Apache CXF Server-Side Request Forgery vulnerability
CRITICAL
CVE-2022-4375
Mingsoft MCMS vulnerable to SQL Injection
CRITICAL
CVE-2022-45046
camel-ldap component allows LDAP Injection when using the filter option
CRITICAL
CVE-2022-46366
Apache Tapestry allows deserialization of untrusted data
CRITICAL
CVE-2022-44262
ff4j is vulnerable to Remote Code Execution (RCE)
CRITICAL
CVE-2022-44136
Zenario CMS is vulnerable to Remote Code Execution (RCE).
CRITICAL
CVE-2022-45933
KubeView vulnerable to full cluster takeover due to improper authentication
CRITICAL
CVE-2022-45207
Jeecg-boot vulnerable to SQL injection via updateNullByEmptyString
CRITICAL
CVE-2022-41705
Badaso vulnerable to Remote Code Execution (RCE)
CRITICAL
CVE-2022-45462
Command injection in Apache DolphinScheduler Alert Plugins
CRITICAL
CVE-2022-4116
Code injection in quarkus dev ui config editor
CRITICAL
CVE-2022-41937
Missing Authorization in Filter Stream Converter Application of XWiki-platform
CRITICAL
CVE-2022-41934
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
CRITICAL
CVE-2022-41931
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
CRITICAL
CVE-2022-41928
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
CRITICAL
CVE-2022-41924
Tailscale Windows daemon is vulnerable to RCE via CSRF
CRITICAL
CVE-2022-4093
SQL injection in Dolibarr
CRITICAL
CVE-2022-4070
Insufficient Session Expiration in librenms/librenms
CRITICAL
CVE-2022-43138
Dolibarr vulnerable to privilege escalation
CRITICAL
CVE-2022-45395
XML External Entity Reference in Jenkins CCCC Plugin
CRITICAL
CVE-2022-45047
Unsafe deserialization in Apache MINA SSHD
CRITICAL
CVE-2022-42122
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module
CRITICAL
CVE-2022-42120
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module
CRITICAL
CVE-2022-45378
Apache SOAP contains unauthenticated RPCRouterServlet
CRITICAL
CVE-2022-45136
Apache Jena vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-39395
Vela Insecure Defaults
CRITICAL
CVE-2022-39396
Remote code execution via MongoDB BSON parser through prototype pollution
CRITICAL
CVE-2022-42920
Apache Commons BCEL vulnerable to out-of-bounds write
CRITICAL
CVE-2022-44797
btcd mishandles witness size checking
CRITICAL
CVE-2022-3023
TiDB vulnerable to Use of Externally-Controlled Format String
CRITICAL
CVE-2022-3827
Centreon vulnerable to SQL Injection
CRITICAL
CVE-2022-3602
X.509 Email Address 4-byte Buffer Overflow
CRITICAL
CVE-2022-39353
xmldom allows multiple root nodes in a DOM
CRITICAL
CVE-2022-31692
Spring Security authorization rules can be bypassed via forward or include dispatcher types
CRITICAL
CVE-2022-3771
easyii CMS's File Upload Management vulnerable to unrestricted upload
CRITICAL
CVE-2022-3754
phpMyFAQ contains Weak Password Requirements
CRITICAL
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
CRITICAL
CVE-2022-42468
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
CRITICAL
CVE-2022-41711
Badaso vulnerable to Remote Code Execution via malicious file upload
CRITICAL
CVE-2022-2421
Insufficient validation when decoding a Socket.IO packet
CRITICAL
CVE-2022-39345
Gin-vue-admin subject to Remote Code Execution via file upload vulnerability
CRITICAL
CVE-2022-38580
Skipper vulnerable to SSRF via X-Skipper-Proxy
CRITICAL
CVE-2022-43403
Jenkins Script Security Plugin sandbox bypass vulnerability
CRITICAL
CVE-2022-43402
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
CRITICAL
CVE-2022-39198
Hessian Lite for Apache Dubbo deserialization vulnerability