Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-39932
Gogs allows argument injection during the previewing of changes
CRITICAL
CVE-2024-39931
Gogs allows deletion of internal files
HIGH
CVE-2024-55947
Path Traversal in file update API in gogs
HIGH
CVE-2024-54148
Remote Command Execution in file editing in gogs
HIGH
CVE-2024-56337
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
LOW
CVE-2024-55186
Oqtane Framework Insecure Direct Object Reference vulnerability
HIGH
CVE-2024-55470
Oqtane Framework Incorrect Access Control vulnerability
MEDIUM
CVE-2024-55471
Oqtane Framework Insecure Direct Object Reference vulnerability
CRITICAL
CVE-2024-28892
GoCast OS Command Injection vulnerability
HIGH
CVE-2024-56329
Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback
HIGH
CVE-2024-25131
OpenShift Must Gather Operator Improper Input Validation vulnerability
HIGH
CVE-2024-56327
pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
HIGH
CVE-2024-56159
Astro's server source code is exposed to the public if sourcemaps are enabled
CRITICAL
CVE-2024-56145KEV
Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled
HIGH
GHSA-hvm9-wc8j-mgrc
TShock Security Escalation Exploit
HIGH
CVE-2024-21546
UniSharp Laravel Filemanager Code Injection vulnerability
HIGH
CVE-2024-50379
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
HIGH
CVE-2024-55661
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
CRITICAL
CVE-2024-55662
XWiki allows remote code execution through the extension sheet
CRITICAL
CVE-2024-55875
http4k has a potential XXE (XML External Entity Injection) vulnerability
CRITICAL
CVE-2024-55877
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
CRITICAL
CVE-2024-55879
XWiki allows RCE from script right in configurable sections
CRITICAL
CVE-2024-45337
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
CRITICAL
CVE-2024-53677
Apache Struts file upload logic is flawed
LOW
CVE-2024-54133
Possible Content Security Policy bypass in Action Dispatch
CRITICAL
CVE-2024-54152
Angular Expressions - Remote Code Execution when using locals
LOW
CVE-2024-55636
Drupal core contains a potential PHP Object Injection vulnerability
HIGH
CVE-2024-55638
Drupal core contains a potential PHP Object Injection vulnerability
HIGH
CVE-2024-55637
Drupal core contains a potential PHP Object Injection vulnerability
HIGH
CVE-2024-54149
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
LOW
CVE-2024-53947
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
HIGH
CVE-2024-53908
Django SQL injection in HasKey(lhs, rhs) on Oracle
HIGH
CVE-2024-53857
rPGP Potential Resource Exhaustion when handling Untrusted Messages
HIGH
CVE-2024-53856
rPGP Panics on Malformed Untrusted Input
HIGH
GHSA-wwq9-3cpr-mm53
Borsh serialization of HashMap is non-canonical
LOW
CVE-2024-53989
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53987
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53988
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53986
rails-html-sanitizer has XSS vulnerability with certain configurations
LOW
CVE-2024-53985
rails-html-sanitize has XSS vulnerability with certain configurations
HIGH
CVE-2024-53900
Mongoose search injection vulnerability
HIGH
CVE-2024-52596
SimpleSAMLphp xml-common XXE vulnerability
MEDIUM
CVE-2024-11862
Devolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications
HIGH
CVE-2024-49203
Querydsl vulnerable to HQL injection through orderBy
MEDIUM
CVE-2024-11738
rustls network-reachable panic in `Acceptor::accept`
MEDIUM
CVE-2024-58359
SurrealDB has an Uncaught Exception Sorting Tables by Random Order
MEDIUM
CVE-2024-58357
SurrealDB has an Uncaught Exception in Function Generating Random Time
LOW
CVE-2024-52796
Password Pusher rate limiter can be bypassed by forging proxy headers
CRITICAL
CVE-2024-47533
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CRITICAL
CVE-2024-52316
Apache Tomcat - Authentication Bypass