Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2020-10806
eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2019-19212
Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php
CRITICAL
CVE-2020-5203
Fat-Free Framework arbitrary code execution
CRITICAL
CVE-2020-9757
SEOmatic for CraftCMS allows Server-Side Template Injection
CRITICAL
CVE-2019-17268
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
CRITICAL
CVE-2020-3716
Magento deserialization vulnerability
CRITICAL
CVE-2020-3718
Magento security bypass vulnerability
CRITICAL
CVE-2020-7995
Dolibarr Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2015-2784
papercrop does not properly handle crop input
CRITICAL
CVE-2019-10774
php-shellcommand command injection vulnerability
CRITICAL
CVE-2019-8158
Magento 2 Community Edition XML Injection
CRITICAL
CVE-2019-8144
Magento 2 Community Edition RCE Vulnerability
CRITICAL
CVE-2019-8136
Magento 2 Community Edition Insecure Component
CRITICAL
CVE-2015-0270
Zend Framework Allows SQL Injection
CRITICAL
CVE-2019-15929
Craft CMS possibility of brute force attempts
CRITICAL
CVE-2018-7269
Yii SQL injection vulnerability
CRITICAL
CVE-2019-16699
sr_freecap for Typo3 RCE Vulnerability
CRITICAL
CVE-2019-16700
slub_events for Typo3 Arbitrary File Upload
CRITICAL
CVE-2019-15521
Spoon Library as used in Fork CMS allows PHP object injection
CRITICAL
CVE-2019-11202
Rancher Recreates Default User With Known Password Despite Deletion
CRITICAL
CVE-2019-14271
Moby Docker cp broken with debian containers
CRITICAL
CVE-2019-12468
Wikimedia MediaWiki Incorrect Access Control vulnerability
CRITICAL
CVE-2019-11512
Contao SQL injection in the file manager
CRITICAL
CVE-2015-3907
CodeIgniter Rest Server XXE Vulnerability
CRITICAL
CVE-2019-12149
silverstripe restfulserver and registry modules SQL injection vulnerability
CRITICAL
CVE-2019-11768
phpMyAdmin SQL injection in Designer feature
CRITICAL
CVE-2017-11365
Symfony Incorrect Access Control
CRITICAL
CVE-2019-12277
Blogifier does not properly restrict APIs
CRITICAL
CVE-2019-11830
PharStreamWrapper for Typo3 unsafe deserialization vulnerability
CRITICAL
CVE-2019-11576
Gitea Allows 1FA Even for 2FA-Enrolled Accounts
CRITICAL
CVE-2019-9901
EnvoyProxy Envoy Missing HTTP URL path normalization
CRITICAL
CVE-2017-16558
Contao SQL injection in the backend and listing module
CRITICAL
CVE-2018-20434
LibreNMS arbitrary OS commands execution
CRITICAL
CVE-2022-1811
Publify vulnerable to cross site scripting
CRITICAL
CVE-2022-22978
Authorization bypass in Spring Security
CRITICAL
CVE-2022-30600
Incorrect Calculation in moodle
CRITICAL
CVE-2022-30599
SQL injection in moodle
CRITICAL
CVE-2014-4172
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
CRITICAL
CVE-2012-3503
Katello uses hard coded credential
CRITICAL
CVE-2013-6288
Apache Solr for TYPO3 (solr) extension is vulnerable to Insecure Unserialize
CRITICAL
CVE-2015-7695
Zend Framework SQL injection vector using null byte for PDO
CRITICAL
CVE-2016-3082
Remote Code Execution in Apache Struts
CRITICAL
CVE-2017-7888
Dolibarr ERP and CRM Insecure Encryption
CRITICAL
CVE-2017-7886
Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter
CRITICAL
CVE-2017-0252
ChakraCore RCE Vulnerability
CRITICAL
CVE-2017-9436
TeamPass SQL injection in users.queries.php
CRITICAL
CVE-2016-5734
phpMyAdmin Code Injection vulnerability
CRITICAL
CVE-2016-6629
phpMyAdmin Authentication Bypass
CRITICAL
CVE-2016-9866
phpMyAdmin CSRF Vulnerability
CRITICAL
CVE-2017-9246
New Relic .NET Agent contains SQL Injection