Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-49581
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
HIGH
CVE-2025-49582
XWiki's required right warnings for macros are incomplete
HIGH
CVE-2025-28382
OpenC3 COSMOS Vulnerable to Directory Traversal via openc3-api/tables endpoint
CRITICAL
CVE-2025-28384
OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint
CRITICAL
CVE-2024-38824
Salt vulnerable to directory traversal attack in file receiving method
CRITICAL
CVE-2024-56158
XWiki allows SQL injection in query endpoint of REST API with Oracle
HIGH
CVE-2025-48446
Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability
HIGH
CVE-2025-48445
Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability
HIGH
CVE-2025-30399
Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability
CRITICAL
CVE-2025-36852
@nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests
HIGH
CVE-2025-30220
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
CRITICAL
CVE-2025-47110
Magneto contains stored XSS vulnerability
HIGH
CVE-2025-43585
Magento Improper Authorization leading to security feature bypass
CRITICAL
CVE-2024-34711
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
HIGH
CVE-2025-27818
Apache Kafka Deserialization of Untrusted Data vulnerability
HIGH
CVE-2025-27819
Apache Kafka Deserialization of Untrusted Data vulnerability
CRITICAL
GHSA-826p-4gcg-35vw
GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
MEDIUM
CVE-2024-47081EPSS 0.1%
Requests vulnerable to .netrc credentials leak via malicious URLs
CRITICAL
CVE-2025-49652
BackendAI Missing Authentication for Critical Function
CRITICAL
CVE-2025-49136
listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
HIGH
CVE-2025-27531
Apache InLong Deserialization of Untrusted Data Vulnerability
MEDIUM
CVE-2025-49007
ReDoS Vulnerability in Rack::Multipart handle_mime_head
MEDIUM
CVE-2025-48432EPSS 0.1%
Django Improper Output Neutralization for Logs vulnerability
HIGH
CVE-2025-5791
users may append `root` to group listings
MEDIUM
CVE-2025-48953
Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads
HIGH
CVE-2025-48947
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies
MEDIUM
CVE-2025-48935
Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
HIGH
CVE-2025-24015
Deno's AES GCM authentication tags are not verified
CRITICAL
CVE-2025-48951
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2025-49223
billboard.js allows prototype pollution via the function generate
CRITICAL
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
CRITICAL
CVE-2025-49113KEV
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
HIGH
CVE-2025-41235
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
HIGH
CVE-2025-48948
Navidrome Transcoding Permission Bypass Vulnerability Report
HIGH
CVE-2025-48949
Navidrome allows SQL Injection via role parameter
CRITICAL
CVE-2025-48865
Fabio allows HTTP clients to manipulate custom headers it adds
HIGH
CVE-2025-48936
ZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection
CRITICAL
CVE-2025-47933
Argo CD allows cross-site scripting on repositories page
HIGH
CVE-2025-48734
Apache Commons Improper Access Control vulnerability
HIGH
CVE-2025-48881
Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
HIGH
CVE-2025-27522
Apache InLong: JDBC Vulnerability during verification processing
MEDIUM
CVE-2025-48054
radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
MEDIUM
CVE-2025-48371
OpenFGA Authorization Bypass
MEDIUM
CVE-2025-48378
DNN allows Stored Cross-Site Scripting (XSS) with svg files rendered inline
MEDIUM
CVE-2025-48377
Reflected Cross-Site Scripting (XSS) in module actions in edit mode
CRITICAL
CVE-2025-48200
The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution
HIGH
CVE-2025-48201
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location
HIGH
CVE-2025-48205
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference
MEDIUM
CVE-2025-48069
Insufficient input sanitization in ejson2env
HIGH
CVE-2025-47290
containerd allows host filesystem access on pull