Browse CVEs by Ecosystem and Severity
2,578 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2019-5715
Silverstripe Framework SQLi Vulnerability
CRITICAL
CVE-2019-10641
Contao Does Not Invalidate Existing Sessions When Password Changes
CRITICAL
CVE-2018-1000076
RubyGems Improper Verification of Cryptographic Signature vulnerability
CRITICAL
CVE-2016-9299
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
CRITICAL
CVE-2017-12633
Apache Camel camel-hessian component vulnerable to Java object deserialization
CRITICAL
CVE-2018-1000120
curl FTP path confusion leads to NIL byte out of bounds write
CRITICAL
CVE-2015-5243
phpWhois arbitrary code execution via a crafted whois record
CRITICAL
CVE-2016-7954
Bundler allows attacker to inject arbitrary code via secondary Gem source
CRITICAL
CVE-2018-19281
Centreon allows SNMP trap SQL Injection
CRITICAL
CVE-2013-3221
Active Record component in Ruby on Rails has a data-type injection vulnerability
CRITICAL
CVE-2016-3087
Apache Struts vulnerable to arbitrary remote code execution due to improper input validation
CRITICAL
CVE-2016-4438
Arbitrary code execution in Apache Struts 2
CRITICAL
CVE-2018-6521
SimpleSAMLphp Use of insecure connection charset (sqlauth module)
CRITICAL
CVE-2018-16395
Ruby Openssl Allows Incorrect Value Comparison
CRITICAL
CVE-2017-9232
Juju uses a UNIX domain socket without setting appropriate permissions
CRITICAL
CVE-2017-6925
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
CRITICAL
CVE-2017-5651
Expected Behavior Violation in Apache Tomcat
CRITICAL
CVE-2017-18264
phpMyAdmin Improper Privilege Management
CRITICAL
CVE-2017-11767
ChakraCore vulnerable to privilege escalation
CRITICAL
CVE-2017-11366
Codiad Vulnerable to Shell Command Injection
CRITICAL
CVE-2017-1000245
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
CRITICAL
CVE-2017-0903
RubyGems vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2017-0899
RubyGems Code Injection vulnerability
CRITICAL
CVE-2019-3809
Moodle Blind SSRF Risk in /badges/mybackpack.php
CRITICAL
CVE-2015-8103
Jenkins CLI Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2015-5254
Improper Input Validation in Apache ActiveMQ
CRITICAL
CVE-2015-3253
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
CRITICAL
CVE-2016-4000
Deserialization of Untrusted Data in Jython
CRITICAL
CVE-2015-7501
Deserialization of Untrusted Data in Apache commons collections
CRITICAL
CVE-2016-5019
Apache MyFaces Trinidad Deserialization Vulnerability
CRITICAL
CVE-2016-6814
Deserialization of Untrusted Data in Groovy
CRITICAL
CVE-2017-5648
Exposure of Resource to Wrong Sphere in Apache Tomcat
CRITICAL
CVE-2017-1000009
Akeneo PIM vulnerable to shell injection in the mass edition
CRITICAL
CVE-2019-9194
elFinder command injection vulnerability in the PHP connector
CRITICAL
CVE-2019-11018
ThinkAdmin Administrator cookies still working after password change
CRITICAL
CVE-2019-11068
Nokogiri vulnerable to libxslt protection mechanism bypass
CRITICAL
CVE-2019-1000001
TeamPass Storing Passwords in a Recoverable Format vulnerability
CRITICAL
CVE-2018-8500
ChakraCore RCE Vulnerability
CRITICAL
CVE-2018-16975
Elefant CMS PHP Code Execution Vulnerability
CRITICAL
CVE-2017-2096
smalruby and smalruby-editor vulnerable to OS Command Injection
CRITICAL
CVE-2016-8735KEV
Apache Tomcat Improper Access Control vulnerability
CRITICAL
CVE-2018-14009
Codiad remote code execution vulnerability
CRITICAL
CVE-2019-10643
Contao Does Not Expire Tokens Correctly
CRITICAL
CVE-2017-10906
Fluentd Escape Sequence Injection Vulnerability
CRITICAL
CVE-2016-6637
Cloud Foundry vulnerable to Cross-Site Request Forgery
CRITICAL
CVE-2017-4992
Cloud Foundry UAA privilege escalation with user invitations
CRITICAL
CVE-2016-2785
Puppet Improper Access Control
CRITICAL
CVE-2017-8046
Remote code execution in PATCH requests in Spring Data REST
CRITICAL
CVE-2016-5018
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
CRITICAL
CVE-2017-5641
Apache Flex BlazeDS unsafe deserialization