Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-42889
Arbitrary code execution in Apache Commons Text
CRITICAL
CVE-2022-40871
Dolibarr vulnerable to Eval Injection
CRITICAL
CVE-2018-21246
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
CRITICAL
CVE-2018-17057
TCPDF vulnerable to attackers triggering deserialization of arbitrary data
CRITICAL
CVE-2022-40314
Moodle remote code execution
CRITICAL
CVE-2022-40315
Moodle Minor SQL injection risk in admin user browsing
CRITICAL
CVE-2022-39256
Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
CRITICAL
CVE-2021-36782
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
CRITICAL
CVE-2022-38916
Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2022-36084
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch
CRITICAL
CVE-2022-36098
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
CRITICAL
CVE-2022-36099
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
CRITICAL
CVE-2022-36100
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
CRITICAL
CVE-2022-25765
PDFKit vulnerable to Command Injection
CRITICAL
CVE-2022-36376
Rank Math SEO plugin vulnerable to Server-Side Request Forgery
CRITICAL
CVE-2020-21516
FeehiCMS has an arbitrary file upload vulnerability
CRITICAL
GHSA-9q5j-jm53-v7vr
lz4-sys vulnerable to memory corruption via issue in liblz4
CRITICAL
CVE-2022-37021
Apache Geode vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2022-35540
Use of Hard-coded Credentials in AgileConfig.Client
CRITICAL
CVE-2020-36599
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
CRITICAL
CVE-2022-2713
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
CRITICAL
CVE-2022-25168
Apache Hadoop argument injection vulnerability
CRITICAL
CVE-2022-31181
PrestaShop eval injection possible if shop vulnerable to SQL injection
CRITICAL
CVE-2022-31183
fs2-io skips mTLS client verification
CRITICAL
CVE-2022-35649
Moodle PostScript Code Injection
CRITICAL
CVE-2022-35912
Grails framework Remote Code Execution via Data Binding
CRITICAL
CVE-2016-1000273
Java Melody vulnerable to cross-site scripting
CRITICAL
CVE-2022-35628
SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation"
CRITICAL
CVE-2022-32224
Active Record RCE bug with Serialized Columns
CRITICAL
CVE-2022-2321
Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2022-34265EPSS 92.8%
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
CRITICAL
CVE-2022-2274
openssl-src heap memory corruption with RSA private key operation
CRITICAL
CVE-2014-0156
OS Command Injection in awesome spawn
CRITICAL
CVE-2022-33107
Deserialization of Untrusted Data in topthink/framework
CRITICAL
CVE-2022-33127
Improper handling of double quotes in file name in Diffy in Windows environment
CRITICAL
CVE-2022-31035
Argo CD's external URLs for Deployments can include JavaScript
CRITICAL
CVE-2022-31053
Signature forgery in Biscuit
CRITICAL
GHSA-x4mq-m75f-mx8m
Delegate functions are missing `Send` bound
CRITICAL
GHSA-3jch-9qgp-4844
Generated code can read and write out of bounds in safe code
CRITICAL
CVE-2019-25010
Type confusion if __private_get_type_id__ is overriden
CRITICAL
CVE-2021-37404
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2
CRITICAL
CVE-2022-1986
OS Command Injection in file editor in Gogs
CRITICAL
CVE-2022-32511
JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
CRITICAL
CVE-2022-30324
Privilege escalation in Hashicorp Nomad
CRITICAL
CVE-2021-33473
Arbitrary file write in dragonfly
CRITICAL
CVE-2022-30123
Possible shell escape sequence injection vulnerability in Rack
CRITICAL
CVE-2022-26945
HashiCorp go-getter command injection
CRITICAL
CVE-2020-25816
Token leases could outlive their TTL in HashiCorp Vault
CRITICAL
CVE-2019-8149
Magento Broken authentication and session managememt
CRITICAL
CVE-2019-7139
Magento 2 Community Edition SQLi Vulnerability