Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-32463
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
MEDIUM
CVE-2024-32036
SixLabors.ImageSharp vulnerable to data leakage
MEDIUM
CVE-2024-32035
SixLabors.ImageSharp vulnerable to Memory Allocation with Excessive Size Value
MEDIUM
CVE-2024-32884
gix-transport indirect code execution via malicious username
CRITICAL
CVE-2024-28056
AWS Amplify CLI has incorrect trust policy management
CRITICAL
CVE-2024-21508
mysql2 Remote Code Execution (RCE) via the readCodeFor function
CRITICAL
CVE-2024-32644
Evmos transaction execution not accounting for all state transition after interaction with precompiles
CRITICAL
CVE-2024-31819
WWBN AVideo Remote Code Execution
CRITICAL
CVE-2024-2029
LocalAI Command Injection in audioToWav
CRITICAL
CVE-2024-31997
XWiki Platform remote code execution from account through UIExtension parameters
CRITICAL
CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
CRITICAL
CVE-2024-31988
XWiki Platform CSRF remote code execution through the realtime HTML Converter API
CRITICAL
CVE-2024-31987
XWiki Platform remote code execution from account via custom skins support
CRITICAL
CVE-2024-31986
XWiki Platform CSRF remote code execution through scheduler job's document reference
CRITICAL
CVE-2024-31984
XWiki Platform: Remote code execution through space title and Solr space facet
CRITICAL
CVE-2024-31983
XWiki Platform: Remote code execution from edit in multilingual wikis via translations
CRITICAL
CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
CRITICAL
CVE-2024-31981
XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
CRITICAL
CVE-2024-31465
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
MEDIUM
CVE-2024-20759
Magento Open Source allows Cross-Site Scripting (XSS)
HIGH
CVE-2024-20758
Magento Open Source allows Improper Input Validation
MEDIUM
CVE-2024-29992
Azure Identity Library for .NET Information Disclosure Vulnerability
CRITICAL
CVE-2024-31864
Apache Zeppelin remote code execution by adding malicious JDBC connection string
CRITICAL
CVE-2024-31866
Improper escaping in Apache Zeppelin
HIGH
CVE-2024-27284
cassandra-rs's non-idiomatic use of iterators leads to use after free
CRITICAL
CVE-2024-27448
MailDev Remote Code Execution
HIGH
CVE-2024-29891
ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass
HIGH
CVE-2024-29187
WiX based installers are vulnerable to binary hijack when run as SYSTEM
HIGH
CVE-2024-29188
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
MEDIUM
CVE-2024-29034
CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained
MEDIUM
CVE-2024-29041EPSS 0.1%
Express.js Open Redirect in malformed URLs
LOW
CVE-2024-27281
RDoc RCE vulnerability with .rdoc_options
CRITICAL
CVE-2024-27280
StringIO buffer overread vulnerability
CRITICAL
CVE-2024-29650
@thi.ng/paths Prototype Pollution vulnerability
MEDIUM
CVE-2024-28863EPSS 0.4%
Denial of service while parsing a tar file due to lack of folders count validation
HIGH
CVE-2024-28855
Improper HTML sanitization in ZITADEL
MEDIUM
CVE-2024-28862
ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.
CRITICAL
CVE-2024-21652
Bypassing Brute Force Protection via Application Crash and In-Memory Data Loss
CRITICAL
CVE-2024-28125
FitNesse allows execution of arbitrary OS commands
HIGH
CVE-2024-28854
tls-listener affected by the slow loris vulnerability with default configuration
HIGH
CVE-2024-28181
TurboBoost Commands vulnerable to arbitrary method invocation
CRITICAL
CVE-2024-28175
Cross-site scripting on application summary component
HIGH
CVE-2024-28252
CoreWCF NetFraming based services can leave connections open when they should be closed
CRITICAL
CVE-2024-27102
Pterodactyl Wings vulnerable to improper isolation of server file access
CRITICAL
CVE-2024-28752
SSRF vulnerability using the Aegis DataBinding in Apache CXF
CRITICAL
CVE-2023-28102
discordrb OS Command Injection vulnerability
HIGH
GHSA-2x7m-gf85-3745
Remote Denial of Service Vulnerability in Microsoft QUIC
HIGH
CVE-2024-27894
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
CRITICAL
CVE-2024-27317
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
HIGH
CVE-2024-27135
Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution