Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2026-23966
sm-crypto Affected by Private Key Recovery in SM2-PKE
MEDIUM
CVE-2026-0895
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport
CRITICAL
CVE-2026-23524
Laravel Redis Horizontal Scaling Insecure Deserialization
MEDIUM
CVE-2026-23952
ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load
MEDIUM
CVE-2026-56364
ImageMagick has a Memory Leak in LoadOpenCLDeviceBenchmark() when parsing malformed XML
HIGH
CVE-2026-23950EPSS 0.0%
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS
MEDIUM
CVE-2026-23874
ImageMagick MSL: Stack overflow via infinite recursion in ProcessMSLScript
MEDIUM
CVE-2026-23885
AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper
CRITICAL
CVE-2026-23947
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
CRITICAL
CVE-2026-23518
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
MEDIUM
CVE-2026-22808
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
CRITICAL
CVE-2025-65482
XDocReport affected by an XML External Entity (XXE) vulnerability
CRITICAL
CVE-2025-64087
XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability
CRITICAL
CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
MEDIUM
CVE-2026-22770
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
CRITICAL
CVE-2026-22822
External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function
HIGH
CVE-2026-23745EPSS 0.0%
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
CRITICAL
CVE-2026-23744
REC in MCPJam inspector due to HTTP Endpoint exposes
HIGH
CVE-2026-23742
Skipper is vulnerable to arbitrary code execution through lua filters
CRITICAL
CVE-2026-26216
Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter
MEDIUM
GHSA-mpwp-4h2m-765c
Active Job - Object injection security vulnerability
HIGH
GHSA-5qw5-wf2q-f538
ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection
HIGH
CVE-2026-22864
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass
CRITICAL
CVE-2026-22863
Deno node:crypto doesn't finalize cipher
HIGH
CVE-2026-23622
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
HIGH
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
CRITICAL
CVE-2026-23520
Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE
MEDIUM
CVE-2021-47776
Umbraco CMS contains a server-side request forgery vulnerability
HIGH
CVE-2026-23519
RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`
HIGH
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
HIGH
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
HIGH
CVE-2026-23492
Pimcore Has an Incomplete Patch for CVE-2023-30848
CRITICAL
CVE-2026-22686
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain
MEDIUM
CVE-2022-50807
Concrete5 CMS contains an XPath injection vulnerability
MEDIUM
CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
CRITICAL
CVE-2026-22813
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
HIGH
CVE-2026-22812
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
CRITICAL
CVE-2025-68924
UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
CRITICAL
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
CRITICAL
CVE-2025-68271
openc3-api Vulnerable to Unauthenticated Remote Code Execution
HIGH
CVE-2026-22771
Envoy Extension Policy lua scripts injection causes arbitrary command execution
MEDIUM
CVE-2026-22705
RustCrypto: Signatures has timing side-channel in ML-DSA decomposition
HIGH
CVE-2026-22700
RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE
HIGH
CVE-2025-68493
Apache Struts 2 is Missing XML Validation
CRITICAL
CVE-2026-22584
Salesforce Uni2TS has a Code Injection vulnerability
HIGH
CVE-2026-22699
SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()
HIGH
CVE-2026-22612
Fickling vulnerable to detection bypass due to "builtins" blindness
HIGH
CVE-2026-22698
SM2-PKE has 32-bit Biased Nonce Vulnerability
HIGH
CVE-2026-22609
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
HIGH
CVE-2026-22608
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection