Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2024-39697
panic on parsing crafted phonenumber inputs
HIGH
CVE-2024-39677
NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities
MEDIUM
CVE-2024-39308
RailsAdmin Cross-site Scripting vulnerability in the list view
HIGH
CVE-2024-33862
OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability
LOW
CVE-2024-39689EPSS 21.2%
Certifi removes GLOBALTRUST root certificate
HIGH
CVE-2024-39943
rejetto HFS vulnerable to OS Command Execution by remote authenticated users
CRITICAL
CVE-2024-39223
Missing key verification in gost
MEDIUM
CVE-2024-39316
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
MEDIUM
CVE-2024-6382
MongoDB Rust driver may issue unintended commands
CRITICAL
CVE-2024-38513
Session Middleware Token Injection Vulnerability
CRITICAL
CVE-2024-36401KEV
Remote Code Execution (RCE) vulnerability in geoserver
CRITICAL
CVE-2024-39309
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
HIGH
CVE-2024-38999
jrburke requirejs vulnerable to prototype pollution
HIGH
CVE-2024-38996
Prototype pollution in ag-grid-community via the _.mergeDeep function
CRITICAL
CVE-2019-25211
Gin mishandles a wildcard at the end of an origin string
HIGH
CVE-2024-38528
Unlimited number of NTS-KE connections can crash ntpd-rs server
CRITICAL
CVE-2024-37843
Craft CMS SQL injection vulnerability via the GraphQL API endpoint
HIGH
CVE-2024-38516
Aimeos HTML client may potentially reveal sensitive information in error log
CRITICAL
CVE-2024-38369
XWiki programming rights may be inherited by inclusion
CRITICAL
CVE-2024-37899
XWiki Platform allows remote code execution from user account
MEDIUM
CVE-2024-38356
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
MEDIUM
CVE-2024-38357
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
CRITICAL
CVE-2023-32191
rke's credentials are stored in the RKE1 Cluster state ConfigMap
HIGH
CVE-2023-22650
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
CRITICAL
CVE-2024-37902
DeepJavaLibrary API absolute path traversal
CRITICAL
CVE-2024-36573
obx Prototype Pollution
HIGH
CVE-2024-36760
Rhai stack overflow vulenrability
CRITICAL
CVE-2024-34103
Magento Open Source Improper Authentication vulnerability
CRITICAL
CVE-2024-34102KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
HIGH
CVE-2024-34104
Magento Open Source Improper Authorization vulnerability
HIGH
CVE-2024-35252
Azure Storage Movement Client Library Denial of Service Vulnerability
MEDIUM
CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
HIGH
CVE-2024-35241
Composer has a command injection via malicious git branch name
HIGH
CVE-2024-35242
Composer has multiple command injections via malicious git/hg branch names
HIGH
CVE-2024-37153
Contract balance not updating correctly after interchain transaction
CRITICAL
CVE-2024-5262
Files or Directories Accessible to External Parties in ProjectDiscovery
MEDIUM
CVE-2024-28103
Missing security headers in Action Pack on non-HTML responses
MEDIUM
CVE-2024-32464
ActionText ContentAttachment can Contain Unsanitized HTML
CRITICAL
CVE-2024-37273
Jan path traversal vulnerability
CRITICAL
CVE-2024-36858
Jan path traversal vulnerability
CRITICAL
CVE-2024-36400
Unable to generate the correct character set
CRITICAL
CVE-2024-36042
Silverpeas authentication bypass
HIGH
CVE-2024-37031
activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends
CRITICAL
CVE-2024-3584
qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint
HIGH
CVE-2024-34008
Moodle CSRF risk in analytics management of models
HIGH
CVE-2014-6072
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
MEDIUM
CVE-2024-35240
Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality
HIGH
CVE-2024-35231
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
MEDIUM
CVE-2024-32978
Kaminari Insecure File Permissions Vulnerability
CRITICAL
CVE-2024-25738
VuFind Server-Side Request Forgery (SSRF) vulnerability