Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2025-24410
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24412
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24416
Magento Stored Cross-Site Scripting (XSS) Vulnerability
HIGH
CVE-2025-24409
Adobe Commerce Improper Authorization vulnerability
HIGH
CVE-2025-24413
Magento Stored Cross-Site Scripting (XSS) Vulnerability
CRITICAL
CVE-2024-12366
PandasAI interactive prompt function Remote Code Execution (RCE)
MEDIUM
CVE-2025-25188
Hickory DNS's DNSSEC validation may accept broken authentication chains
MEDIUM
CVE-2025-25186
Possible DoS by memory exhaustion in net-imap
CRITICAL
CVE-2025-24786
WhoDB has a path traversal opening Sqlite3 database
CRITICAL
CVE-2025-24981
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
CRITICAL
CVE-2024-36404
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
CRITICAL
CVE-2025-24964
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
HIGH
CVE-2025-23015
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
MEDIUM
GHSA-f8mx-cwfh-7hr2
TShock allows chat while not fully connected, possible ban evasion
CRITICAL
CVE-2025-24370
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CRITICAL
CVE-2025-23215
PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
HIGH
CVE-2025-24802
Soundness issue with Plonky2 look up tables
CRITICAL
CVE-2025-0851
Deep Java Library path traversal issue
MEDIUM
CVE-2025-24788
Snowflake.Data has weak temporary files permissions
CRITICAL
CVE-2025-24800
ismp-grandpa crate accepted incorrect signatures
HIGH
CVE-2025-24814
Apache Solr vulnerable to Execution with Unnecessary Privileges
CRITICAL
CVE-2024-45479
Apache Ranger UI vulnerable to Server Side Request Forgery
MEDIUM
CVE-2024-10761
XSS/HTML Injection Vulnerability in Umbraco Preview Badge
HIGH
CVE-2024-11218
Buildah allows build breakout using malicious Containerfiles and concurrent builds
MEDIUM
CVE-2025-24011
Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes
MEDIUM
CVE-2025-24012
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
CRITICAL
CVE-2025-25286
Crayfish allows Remote Code Execution via Homarus Authorization header
CRITICAL
CVE-2025-23061
Mongoose search injection vulnerability
HIGH
CVE-2024-52281
Rancher UI has Stored Cross-site Scripting vulnerability
HIGH
CVE-2025-21176
Microsoft Security Advisory CVE-2025-21176 | .NET and Visual Studio Remote Code Execution Vulnerability
HIGH
CVE-2025-21172
Microsoft Security Advisory CVE-2025-21172 | .NET and Visual Studio Remote Code Execution Vulnerability
HIGH
CVE-2025-21171
Microsoft Security Advisory CVE-2025-21171 | .NET Remote Code Execution Vulnerability
MEDIUM
CVE-2025-23041
Umbraco Forms's Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length
HIGH
CVE-2024-50338
Git Credential Manager carriage-return character in remote URL allows malicious repository to leak credentials
CRITICAL
CVE-2025-23025
XWiki Realtime WYSIWYG Editor extension allows privilege escalation (PR) through realtime WYSIWYG editing
CRITICAL
CVE-2024-49375
Rasa Allows Remote Code Execution via Remote Model Loading
MEDIUM
CVE-2024-56323
OpenFGA Authorization Bypass
HIGH
CVE-2024-55225
Vaultwarden vulnerable to user impersonation
MEDIUM
CVE-2025-22145EPSS 0.1%
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
CRITICAL
CVE-2024-54676
Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
HIGH
CVE-2025-21620
fetch: Authorization headers not dropped when redirecting cross-origin
CRITICAL
CVE-2025-21613
go-git has an Argument Injection via the URL field
HIGH
CVE-2024-56513
Karmada PULL Mode Cluster Privilege Escalation
CRITICAL
CVE-2024-56198
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
HIGH
CVE-2024-25133
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation
HIGH
CVE-2024-56734
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
MEDIUM
CVE-2024-56733
Password Pusher Allows Session Token Interception Leading to Potential Hijacking
CRITICAL
CVE-2024-52046
Apache MINA Deserialization RCE Vulnerability
CRITICAL
CVE-2024-43441
Apache HugeGraph-Server: Fixed JWT Token (Secret)
CRITICAL
CVE-2024-39930
Gogs has an argument Injection in the built-in SSH server