Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-71320
Picklescan has Incomplete List of Disallowed Inputs
HIGH
CVE-2025-71323
Picklescan does not block ctypes
HIGH
CVE-2025-71321
Picklescan vulnerable to Arbitrary File Writing
CRITICAL
CVE-2025-13158
apidoc-core has a prototype pollution vulnerability
CRITICAL
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
CRITICAL
CVE-2025-14931
Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
HIGH
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
HIGH
CVE-2025-68696
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
CRITICAL
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
HIGH
CVE-2025-51511
Cadmium CMS has a background arbitrary file upload vulnerability
MEDIUM
CVE-2025-67288
Umbraco CMS has an arbitrary file upload vulnerability
LOW
CVE-2025-67291
Piranha has stored cross-site scripting (XSS) vulnerability
LOW
CVE-2025-67290
Piranha has stored cross-site scripting (XSS) vulnerability
CRITICAL
CVE-2025-68613KEV
n8n Vulnerable to Remote Code Execution via Expression Injection
HIGH
CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
MEDIUM
CVE-2025-68161EPSS 0.3%
Apache Log4j does not verify the TLS hostname in its Socket Appender
MEDIUM
CVE-2025-14762
AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue
CRITICAL
CVE-2025-63389
Ollama Platform has missing authentication enabling attackers to perform model management operations
MEDIUM
CVE-2025-14759
Amazon S3 Encryption Client for .NET has a Key Commitment Issue
MEDIUM
CVE-2023-53929
phpMyFAQ contains a CSV injection vulnerability
MEDIUM
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
MEDIUM
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
CRITICAL
CVE-2025-67165
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
CRITICAL
CVE-2025-67164
Pagekit CMS is vulnerable to OS Command Injection via Storage component
CRITICAL
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
HIGH
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
MEDIUM
CVE-2025-65581
ABP Account Module has an Open Redirect through Improper validation in its register function
HIGH
CVE-2025-14443
openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References
MEDIUM
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
HIGH
CVE-2025-11393
Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access
CRITICAL
CVE-2025-66844
Grav may be vulnerable to SSRF attack via Twig Templates
CRITICAL
CVE-2025-13888
OpenShift GitOps authenticated attackers can obtain cluster root access through forged ArgoCD custom resources
HIGH
CVE-2025-66001
NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)
CRITICAL
CVE-2025-65854
MineAdmin has an insecure default password
HIGH
CVE-2025-67779
Denial of Service Vulnerability in React Server Components
HIGH
CVE-2025-26866
Apache HugeGraph-Server: RAFT and deserialization vulnerability
HIGH
CVE-2025-55184
Denial of Service Vulnerability in React Server Components
MEDIUM
CVE-2025-65807
sd changes the group ownership of the source file
CRITICAL
CVE-2025-67719
Ibexa User Bundle is missing password change validation
HIGH
CVE-2025-66628
ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
HIGH
CVE-2025-66474
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
MEDIUM
CVE-2025-66472
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
HIGH
CVE-2025-8110KEV
Gogs vulnerable to a bypass of CVE-2024-55947
CRITICAL
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
CRITICAL
CVE-2025-14307
Robocode has an insecure temporary file creation vulnerability in the AutoExtract component
CRITICAL
CVE-2025-14306
Robocode vulnerable to Directory Traversal in recursivelyDelete Method
CRITICAL
CVE-2025-67510
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
HIGH
CVE-2025-66626
RCE via ZipSlip and symbolic links in argoproj/argo-workflows
MEDIUM
CVE-2025-66625
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
HIGH
CVE-2025-67495
ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Login