Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-62515
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
MEDIUM
CVE-2025-11849
Mammoth is vulnerable to Directory Traversal
CRITICAL
CVE-2025-62417
bagisto has CSV Formula Injection in Create New Product
CRITICAL
CVE-2025-61922
PrestaShop Checkout allows customer account takeover via email
MEDIUM
CVE-2025-11842
Smidge is vulnerable to Path Traversal
CRITICAL
CVE-2025-54539
Apache ActiveMQ NMS AMQP Client has a Deserialization of Untrusted Data vulnerability
HIGH
CVE-2025-58073
Mattermost has a Missing Authorization vulnerability
HIGH
CVE-2025-58075
Mattermost has a Missing Authorization vulnerability
CRITICAL
CVE-2025-62410
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
MEDIUM
CVE-2025-55248
Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability
HIGH
CVE-2025-55247
Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability
HIGH
CVE-2025-62370
alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
HIGH
CVE-2025-54264
Magento vulnerable to stored Cross-Site Scripting (XSS)
HIGH
CVE-2025-54263
Magento provides incorrect authorization through a security feature bypass
HIGH
CVE-2025-34267
Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages
CRITICAL
CVE-2025-55315
Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability
HIGH
CVE-2025-59250
JDBC Driver for SQL Server has improper input validation issue
HIGH
CVE-2025-61688
Omni vulnerable to information leak via API
HIGH
CVE-2025-11695
MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string
HIGH
CVE-2025-62162
cel-rust May Panic During Parsing of Invalid CEL Expressions
CRITICAL
CVE-2025-61927
Happy DOM: VM Context Escape can lead to Remote Code Execution
LOW
CVE-2025-61921
Sinatra is vulnerable to ReDoS through ETag header value generation
HIGH
CVE-2025-61919
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
MEDIUM
CVE-2025-61780
Rack has a Possible Information Disclosure Vulnerability
CRITICAL
CVE-2025-10283
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
CRITICAL
CVE-2025-10284
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
HIGH
CVE-2025-11573
Amazon.IonDotnet is vulnerable to Denial of Service attacks
HIGH
CVE-2025-71380
n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host
CRITICAL
CVE-2025-61913
Flowise is vulnerable to arbitrary file write through its WriteFileTool
HIGH
CVE-2025-61787
Deno is Vulnerable to Command Injection on Windows During Batch File Execution
CRITICAL
CVE-2025-10353
Melis Platform CMS Unauthenticated File Upload Leading to RCE
CRITICAL
CVE-2025-10351
Melis Platform CMS SQL Injection
CRITICAL
CVE-2025-10352
Melis Platform CMS Unauthenticated Admin Account Creation
CRITICAL
CVE-2025-61778
Akka.Remote TLS did not properly implement certificate-based authentication
HIGH
CVE-2025-61772
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
HIGH
CVE-2025-61771
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
HIGH
CVE-2025-61770
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
CRITICAL
CVE-2025-59159
SillyTavern Web Interface Vulnerable DNS Rebinding
CRITICAL
CVE-2025-52472
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
CRITICAL
CVE-2025-49594
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
CRITICAL
CVE-2025-55346
Flowise vulnerable to RCE via Dynamic function constructor injection
CRITICAL
CVE-2025-50538
Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
HIGH
CVE-2025-54286
Canonical LXD CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
HIGH
CVE-2025-61734
Apache Kylin Files or Directories Accessible to External Parties
HIGH
CVE-2025-56588
Dolibarr vulnerable to RCE via the computed field parameter
CRITICAL
CVE-2025-61588
risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
CRITICAL
CVE-2025-59681
CRITICAL
CVE-2025-61622
Apache Pyfory python is vulnerable to deserialization of untrusted data
HIGH
CVE-2025-61595
github.com/MANTRA-Chain/mantrachain/x/tokenfactory tx gas limit is not enforced in send hooks
MEDIUM
CVE-2025-55797
FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint