Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-29067
ZITADEL Vulnerable to Account Takeover Due to Improper Instance Validation in V2 Login
CRITICAL
CVE-2025-67494
ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Login
CRITICAL
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
HIGH
CVE-2025-66631
Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)
HIGH
CVE-2025-66627
Critical Use-After-Free in Wasmi's Linear Memory
CRITICAL
CVE-2025-66568
Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation
CRITICAL
CVE-2025-66567
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
CRITICAL
CVE-2025-65964
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
CRITICAL
CVE-2025-66516
Apache Tika has XXE vulnerability
HIGH
GHSA-2cgv-28vr-rv6j
libcrux incorrectly calculates on aarch64
HIGH
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
CRITICAL
CVE-2025-55182KEV
React Server Components are Vulnerable to RCE
CRITICAL
CVE-2025-44005
Step CA Has Authorization Bypass in ACME and SCEP Provisioners
HIGH
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
HIGH
CVE-2025-64443
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode
HIGH
CVE-2025-66468
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
CRITICAL
CVE-2025-65896
asyncmy is vulnerable to SQL injection via crafted dict keys
HIGH
CVE-2025-13827
GrapesJsBuilder File Upload allows all file uploads
CRITICAL
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
HIGH
CVE-2025-13353
gokey allows secret recovery from a seed file without the master password
HIGH
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
HIGH
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
HIGH
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
HIGH
CVE-2025-12060
Keras Directory Traversal Vulnerability
CRITICAL
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
HIGH
CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
HIGH
CVE-2025-66299
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
HIGH
CVE-2025-66296
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
HIGH
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
HIGH
CVE-2025-12183
LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS
CRITICAL
CVE-2025-12421
Mattermost fails to to verify the token used during code exchange
CRITICAL
CVE-2025-12419
Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication
CRITICAL
CVE-2025-34351
Ray's New Token Authentication is Disabled By Default
HIGH
CVE-2025-66035
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
CRITICAL
CVE-2025-62593
Ray is vulnerable to Critical RCE via Safari & Firefox Browsers through DNS Rebinding Attack
HIGH
CVE-2025-65966
OneUptime Unauthorized User Creation via API
CRITICAL
CVE-2025-59390
Apache Druid’s Kerberos authenticator uses a weak fallback secret
CRITICAL
GHSA-2fjw-whxm-9v4q
libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)
HIGH
CVE-2025-66017
cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures
CRITICAL
CVE-2025-66016
cggmp21 has a missing check in the ZK proof used in CGGMP21
HIGH
CVE-2025-58360KEV
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
MEDIUM
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
HIGH
CVE-2025-65947
thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS
CRITICAL
CVE-2025-41115
Grafana Incorrect Privilege Assignment vulnerability
MEDIUM
CVE-2025-64751
OpenFGA Improper Policy Enforcement
HIGH
CVE-2025-65109
Minder does not sandbox http.send in Rego programs
HIGH
CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
HIGH
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
CRITICAL
CVE-2025-65108
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
CRITICAL
CVE-2025-64767
@hpke/core reuses AEAD nonces