Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-47000
ZITADEL's Service Users Deactivation not Working
HIGH
CVE-2024-46999
ZITADEL's User Grant Deactivation not Working
HIGH
CVE-2024-7254
protobuf-java has potential Denial of Service issue
HIGH
CVE-2024-46983
SOFA Hessian Remote Command Execution (RCE) Vulnerability
CRITICAL
CVE-2023-27584
Dragonfly2 has hard coded cyptographic key
CRITICAL
CVE-2024-46946
LangChain Experimental Eval Injection vulnerability
CRITICAL
CVE-2023-47105
Chaosblade vulnerable to OS command execution
HIGH
GHSA-7x4w-cj9r-h4v9
Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)
HIGH
CVE-2024-46987
Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)
HIGH
CVE-2024-46986
Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)
MEDIUM
CVE-2024-8796
Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length
MEDIUM
CVE-2024-45496
OpenShift Controller Manager Improper Privilege Management
MEDIUM
CVE-2024-7387
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer
MEDIUM
CVE-2024-39910
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor
MEDIUM
CVE-2024-32034
Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log
CRITICAL
GHSA-cvp8-5r8g-fhvq
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
HIGH
CVE-2024-58362
Untrusted Query Object Evaluation in RPC API
CRITICAL
CVE-2024-6091
AutoGPT bypass of the shell commands denylist settings
CRITICAL
CVE-2024-45409
SAML authentication bypass via Incorrect XPath selector
LOW
CVE-2024-43796EPSS 0.1%
express vulnerable to XSS via response.redirect()
CRITICAL
CVE-2024-44902
ThinkPHP deserialization vulnerability
MEDIUM
CVE-2024-45411
Twig has a possible sandbox bypass
CRITICAL
CVE-2024-39205
pyload-ng vulnerable to RCE with js2py sandbox escape
HIGH
CVE-2024-45294
XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
CRITICAL
CVE-2024-45758
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
HIGH
CVE-2024-7884
ic-cdk has a memory leak when calling a canister method via `ic_cdk::call`
HIGH
CVE-2024-8418
Missing connection timeout in Aardvark-dns
HIGH
CVE-2024-45311
Denial of service in quinn-proto when using `Endpoint::retry()`
MEDIUM
CVE-2024-45389
DOM clobbering could escalate to Cross-site Scripting (XSS)
MEDIUM
CVE-2024-45302
CRLF Injection in RestSharp's `RestRequest.AddHeader` method
MEDIUM
CVE-2024-44930
Serilog Client IP Spoofing vulnerability
HIGH
CVE-2024-45048
XXE in PHPSpreadsheet encoding is returned
HIGH
CVE-2024-41964
Kirby has insufficient permission checks in the language settings
HIGH
CVE-2024-43783
Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies
HIGH
CVE-2024-43414
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
MEDIUM
CVE-2024-43791
request_store has Incorrect Default Permissions
CRITICAL
CVE-2024-45201
LlamaIndex includes an exec call for `import {cls_name}`
HIGH
CVE-2024-43398
REXML denial of service vulnerability
CRITICAL
CVE-2024-42490
GoAuthentik vulnerable to Insufficient Authorization for several API endpoints
HIGH
CVE-2024-40453
squirrelly Code Injection vulnerability
MEDIUM
CVE-2024-43377
Umbraco CMS Improper Access Control vulnerability
CRITICAL
CVE-2024-43202
Apache Dolphinscheduler Code Injection vulnerability
CRITICAL
CVE-2024-43400
XWiki Platform allows XSS through XClass name in string properties
MEDIUM
CVE-2024-43380
fugit parse and parse_nat stall on lengthy input
MEDIUM
CVE-2024-44073
Miniscript allows stack consumption
CRITICAL
CVE-2024-32231
SQL injection in github.com/stashapp/stash
HIGH
CVE-2024-43410
Russh has an OOM Denial of Service due to allocation of untrusted amount
HIGH
CVE-2024-43367
Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
HIGH
CVE-2024-39402
Magento OS Command ('OS Command Injection') vulnerability
HIGH
CVE-2024-39400
Magento DOM-based Cross-Site Scripting (XSS) vulnerability