Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-51092
LibreNMS has an Authenticated OS Command Injection
CRITICAL
CVE-2021-3902
Improper Restriction of XML External Entity Reference in dompdf/dompdf
CRITICAL
CVE-2021-3838
Deserialization of Untrusted Data in dompdf/dompdf
MEDIUM
CVE-2024-45594
decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds
HIGH
CVE-2024-48510
DotNetZip Directory Traversal vulnerability
CRITICAL
CVE-2024-43498
.NET Remote Code Execution Vulnerability
HIGH
CVE-2024-43499
.NET Denial of Service Vulnerability
HIGH
CVE-2024-43415
Decidim-Awesome has SQL injection in AdminAccountability
HIGH
CVE-2024-51135
powertac-server XML External Entity vulnerability
MEDIUM
CVE-2024-27529
wasm3 uncontrolled memory allocation vulnerability
HIGH
CVE-2024-52009
Git credentials are exposed in Atlantis logs
HIGH
CVE-2024-52007
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`
MEDIUM
CVE-2024-51987
HTTP Client uses incorrect token after refresh
CRITICAL
CVE-2024-51990
jj vulnerable to path traversal via crafted Git repositories
HIGH
CVE-2024-51504
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
HIGH
CVE-2024-38286
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
CRITICAL
CVE-2024-10081
codechecker vulnerable to authentication bypass when using specifically crafted URLs
CRITICAL
CVE-2024-51757
happy-dom allows for server side code to be executed by a <script> tag
HIGH
CVE-2024-51736
Symfony vulnerable to command execution hijack on Windows with Process class
LOW
CVE-2024-50345EPSS 0.3%
Symfony vulnerable to open redirect via browser-sanitized URLs
LOW
CVE-2024-51756
cap-std doesn't fully sandbox all the Windows device filenames
LOW
CVE-2024-51745
Wasmtime doesn't fully sandbox all the Windows device filenames
HIGH
CVE-2024-51132
HAPI FHIR XML External Entity (XXE) vulnerability
CRITICAL
CVE-2024-51735
Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE
MEDIUM
CVE-2024-48061
Langflow vulnerable to remote code execution
CRITICAL
CVE-2024-51501
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
HIGH
CVE-2024-51127
hornetq vulnerable to file overwrite, sensitive information disclosure
HIGH
CVE-2024-23590
Apache Kylin Session Fixation vulnerability
MEDIUM
CVE-2024-21510
Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
HIGH
CVE-2024-49381
Plenti arbitrary file deletion vulnerability
HIGH
CVE-2024-49380
Plenti arbitrary file write vulnerability
HIGH
CVE-2024-51478
YesWiki Uses a Broken or Risky Cryptographic Algorithm
HIGH
CVE-2024-42835
langflow has vulnerability in PythonCodeTool component
HIGH
CVE-2024-43383
Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability
HIGH
CVE-2024-48307
JeecgBoot SQL Injection vulnerability
HIGH
CVE-2024-48112
ThinkPHP deserialization vulnerability
MEDIUM
CVE-2024-50353
ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected
CRITICAL
CVE-2024-0132
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
MEDIUM
CVE-2024-49771
MPXJ has a Potential Path Traversal Vulnerability
MEDIUM
CVE-2024-49761
REXML ReDoS vulnerability
CRITICAL
CVE-2024-38821
Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications
HIGH
CVE-2024-48230
SQL injection in funadmin
HIGH
CVE-2024-48229
SQL injection in funadmin
HIGH
CVE-2024-48222
SQL injection in funadmin
HIGH
CVE-2024-48226
SQL injection in funadmin
HIGH
CVE-2024-48218
SQL injection in funadmin
HIGH
CVE-2024-48225
SQL injection in funadmin
HIGH
CVE-2024-48223
SQL injection in funadmin
CRITICAL
CVE-2024-22036
Rancher Remote Code Execution via Cluster/Node Drivers
HIGH
CVE-2022-45157
Exposure of vSphere's CPI and CSI credentials in Rancher