Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2025-27509
Fleet has SAML authentication vulnerability due to improper SAML response validation
HIGH
CVE-2025-25362
Spacy-LLM Server-Side Template Injection (SSTI) vulnerability
CRITICAL
CVE-2025-27517
Volt Allows RCE Via User-Crafted Requests
CRITICAL
CVE-2023-38693
Lucee RCE/XXE Vulnerability
MEDIUM
CVE-2025-27513
OpenTelemetry .NET has Denial of Service (DoS) Vulnerability in API Package
HIGH
CVE-2025-26319
FlowiseAI Flowise arbitrary file upload vulnerability
CRITICAL
CVE-2025-27507
IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations
MEDIUM
CVE-2025-27111
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
MEDIUM
CVE-2025-27220
CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement
MEDIUM
CVE-2025-27219
CGI has Denial of Service (DoS) potential in Cookie.parse
MEDIUM
CVE-2024-42512
Security Update for the OPC UA .NET Standard Stack
MEDIUM
CVE-2024-42513
Security Update for the OPC UA .NET Standard Stack
CRITICAL
CVE-2025-27590
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account
CRITICAL
GHSA-jg6f-48ff-5xrw
IBC-Go has Non-deterministic JSON Unmarshalling of IBC Acknowledgement
HIGH
CVE-2025-23389
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
CRITICAL
CVE-2024-47051
Mautic allows Remote Code Execution and File Deletion in Asset Uploads
CRITICAL
CVE-2023-25574
LTI JupyterHub Authenticator does not properly validate JWT Signature
HIGH
CVE-2025-26525
Moodle has an arbitrary file read risk through pdfTeX
HIGH
CVE-2025-26530
Moodle allows reflected XSS via question bank filter
HIGH
CVE-2025-26533
Moodle has a SQL injection risk in course search module list filter
HIGH
CVE-2025-26529
Moodle has a stored XSS risk in admin live log
MEDIUM
CVE-2025-26803
Phusion Passenger denial of service
CRITICAL
CVE-2025-25279
Mattermost allows reading arbitrary files related to importing boards
CRITICAL
CVE-2025-20051
Mattermost allows reading arbitrary files
HIGH
CVE-2025-27088
S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation
CRITICAL
GHSA-f8qm-hmm3-fv7f
Namada-apps allows Excessive Computation in Mempool Validation
CRITICAL
GHSA-82vg-5v4f-f9wq
Namada-apps can Crash with Excessive Computation in Mempool Validation
CRITICAL
CVE-2025-24893KEV
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
MEDIUM
CVE-2024-57716
AutoQueryable leaks sensitive information
CRITICAL
CVE-2025-0868
DocsGPT Allows Remote Code Execution
MEDIUM
CVE-2025-25196
OpenFGA Authorization Bypass
MEDIUM
CVE-2025-26620
Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens
CRITICAL
CVE-2025-24895
AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass
CRITICAL
CVE-2025-24894
The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass
HIGH
CVE-2025-1302
JSONPath Plus allows Remote Code Execution
CRITICAL
CVE-2024-56180
Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
CRITICAL
CVE-2024-52577
Apache Ignite: Possible RCE when deserializing incoming messages by the server node
HIGH
CVE-2025-26511
Instaclustr Cassandra-Lucene-Index allows bypass of Cassandra RBAC
HIGH
CVE-2025-1247
Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance
CRITICAL
CVE-2024-57602
Easy!Appointments Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2024-57604
MaysWind ezBookkeeping has Improper Privilege Management
CRITICAL
CVE-2025-25200
Inefficient Regular Expression Complexity in koa
MEDIUM
CVE-2025-25184
Possible Log Injection in Rack::CommonLogger
CRITICAL
CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
HIGH
CVE-2025-24438
Magento stored Cross-Site Scripting (XSS) vulnerability
HIGH
CVE-2025-24411
Magento Improper Access Control vulnerability
HIGH
CVE-2025-24406
Adobe Commerce Path Traversal
HIGH
CVE-2025-24414
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24417
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24415
Magento Stored Cross-Site Scripting (XSS) Vulnerability