Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-53836
XWiki Rendering is vulnerable to RCE attacks when processing nested macros
CRITICAL
CVE-2025-53835
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
CRITICAL
CVE-2025-53833
LaRecipe is vulnerable to Server-Side Template Injection attacks
CRITICAL
CVE-2025-53623
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
HIGH
CVE-2025-53689
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
HIGH
CVE-2025-53506
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
HIGH
CVE-2025-52520
Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits
HIGH
CVE-2025-53632
Chall-Manager is vulnerable to Path Traversal when extracting/decoding a zip archive
MEDIUM
CVE-2025-53549
Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation
CRITICAL
CVE-2025-53624
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token
HIGH
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity
HIGH
CVE-2025-0928
Juju allows arbitrary executable uploads via authenticated endpoint without authorization
CRITICAL
CVE-2025-6514
mcp-remote exposed to OS command injection via untrusted MCP server connections
HIGH
CVE-2025-53513
Juju zip slip vulnerability via authenticated endpoint
HIGH
CVE-2025-53547
Helm vulnerable to Code Injection through malicious chart.yaml content
HIGH
CVE-2025-53369
Citizen Short Description stored XSS vulnerability through wikitext
HIGH
CVE-2025-53370
Citizen vulnerable to Stored XSS through short descriptions
HIGH
CVE-2025-53368
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
MEDIUM
CVE-2025-34075
HashiCorp Vagrant has code injection vulnerability through default synced folders
HIGH
CVE-2025-53110
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
HIGH
CVE-2025-53109
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
CRITICAL
CVE-2025-26074
Conductor vulnerable to OS command injection through unrestricted access to Java classes
HIGH
CVE-2025-53093
TabberNeue vulnerable to Stored XSS through wikitext
MEDIUM
CVE-2025-6442
Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling
CRITICAL
CVE-2025-50213
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator
HIGH
CVE-2025-52477
Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens
MEDIUM
CVE-2025-49147
Umbraco CMS disclosure of configured password requirements
CRITICAL
CVE-2024-56731
Gogs allows deletion of internal files which leads to remote command execution
CRITICAL
CVE-2025-6545
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
MEDIUM
CVE-2025-52570
letmein connection limiter allows an arbitrary amount of simultaneous connections
CRITICAL
CVE-2025-2828
HIGH
CVE-2025-4366
Pingora has a Request Smuggling Vulnerability
HIGH
CVE-2025-52488
DNN.PLATFORM leaks NTLM hash via SMB Share Interaction with malicious user input
HIGH
CVE-2025-52487
DNN.PLATFORM possibly allows bypass of IP Filters
MEDIUM
CVE-2025-52485
DNN.PLATFORM Allows Stored Cross-Site Scripting (XSS) in Activity Feed
MEDIUM
CVE-2025-52486
DNN.PLATFORM Allows Reflected Cross-Site Scripting (XSS) in some TokenReplace situations with SkinObjects
CRITICAL
CVE-2025-4981
Mattermost allows authenticated users to write files to arbitrary locations
CRITICAL
CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
HIGH
CVE-2025-47771
PowSyBl Core allows deserialization of untrusted SparseMatrix data
HIGH
GHSA-6q65-j4jw-9cg8
DotVVM allows path traversal when deployed in Debug mode
MEDIUM
CVE-2025-49015
Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
CRITICAL
CVE-2025-3248
Langflow Unauth RCE
HIGH
CVE-2025-6087
OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint
CRITICAL
CVE-2025-49825
Teleport allows remote authentication bypass
MEDIUM
CVE-2025-49124
Apache Tomcat installer for Windows has an untrusted search path vulnerability
HIGH
CVE-2025-3594
Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler
CRITICAL
CVE-2025-49596
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
HIGH
CVE-2025-49585
XWiki does not require right warnings for XClass definitions
HIGH
CVE-2025-49586
XWiki allows remote code execution through preview of XClass changes in AWM editor
MEDIUM
CVE-2025-49587
XWiki does not require right warnings for notification displayer objects