Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-53874
picklescan missing detection by simple obfuscation of a `builtins.eval` call
CRITICAL
CVE-2026-25481
Langroid has WAF Bypass Leading to RCE in TableChatAgent
CRITICAL
CVE-2026-25142
SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE
HIGH
CVE-2026-25059
OpenList vulnerable to Path Traversal in file copy and remove handlers
CRITICAL
CVE-2026-23515
Signal K set-system-time plugin vulnerable to RCE - Command Injection
CRITICAL
CVE-2026-22778
vLLM has RCE In Video Processing
CRITICAL
CVE-2024-5986
H2O has an External Control of File Name or Path vulnerability
HIGH
CVE-2026-1531
foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set
HIGH
CVE-2026-1530
fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation
HIGH
CVE-2026-24788
RaspAP raspap-webgui contains an OS Command Injection vulnerability
HIGH
CVE-2025-67601
Rancher CLI skips TLS verification on Rancher CLI login command
CRITICAL
CVE-2026-25141
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
CRITICAL
CVE-2026-25130
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
MEDIUM
CVE-2026-24687
Umbraco.Forms has Path Traversal and File Enumeration Vulnerabilities in Linux/Mac
CRITICAL
CVE-2026-25047
deepHas vulnerable to Prototype Pollution via constructor.prototype
CRITICAL
CVE-2026-25539
SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE
HIGH
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
HIGH
CVE-2026-23864
React Server Components have multiple Denial of Service Vulnerabilities
HIGH
CVE-2026-24769
NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload
CRITICAL
CVE-2026-24838
DotNetNuke.Core Vulnerable to Stored XSS via Module Title
HIGH
CVE-2026-22243
EGroupware has SQL Injection in Nextmatch Filter Processing
MEDIUM
CVE-2020-36962
Tendenci is Vulnerable to CSV Formula Injection through its Contact Form Message Field
HIGH
CVE-2026-24842EPSS 0.0%
node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
HIGH
CVE-2026-24837
DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal
HIGH
CVE-2026-24836
DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes
HIGH
CVE-2026-24785
Clatter has a PSK Validity Rule Violation issue
MEDIUM
CVE-2026-24784
DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer
HIGH
CVE-2026-24783
soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives
HIGH
CVE-2026-24778
Ghost vulnerable to XSS via malicious Portal preview links
CRITICAL
GHSA-5w5r-mf82-595p
Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema
HIGH
CVE-2026-24765
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
CRITICAL
CVE-2026-23830
SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor
HIGH
CVE-2020-36939
Cassandra Web - Remote File Read
CRITICAL
CVE-2026-22039
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
CRITICAL
CVE-2026-1470
n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
CRITICAL
CVE-2026-22709
vm2 has a Sandbox Escape
CRITICAL
CVE-2026-22696
dcap-qvl has Missing Verification for QE Identity
CRITICAL
CVE-2016-15057
Apache Continuum vulnerable to Command Injection through Installations REST API
CRITICAL
CVE-2025-66719
Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value
MEDIUM
CVE-2026-24128
XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages
HIGH
CVE-2025-67847
Moodle affected by a code injection vulnerability
HIGH
CVE-2026-0770
Langflow affected by Remote Code Execution via validate_code() exec()
HIGH
CVE-2026-23954
Incus container image templating arbitrary host file read and write
HIGH
CVE-2026-23953
Incus container environment configuration newline injection
HIGH
CVE-2026-63763
SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions
HIGH
CVE-2026-24124
Dragonfly Manager Job API Unauthenticated Access
HIGH
CVE-2026-24058
Soft Serve Affected by an Authentication Bypass
MEDIUM
CVE-2025-13465EPSS 0.0%
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
HIGH
CVE-2026-0933
Wrangler affected by OS Command Injection in `wrangler pages deploy`
HIGH
CVE-2021-47853
phpPgAdmin contains a remote command execution vulnerability