Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2024-21392
Microsoft Security Advisory CVE-2024-21392: .NET Denial of Service Vulnerability
HIGH
CVE-2024-28121
StimulusReflex arbitrary method call
HIGH
CVE-2024-28199
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
HIGH
CVE-2024-28123
Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
CRITICAL
CVE-2024-28213
nGrinder vulnerable to unsafe Java objects deserialization
HIGH
CVE-2024-28101
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
HIGH
CVE-2024-27934
*const c_void / ExternalPointer unsoundness leading to use-after-free
HIGH
CVE-2024-27933
Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
HIGH
CVE-2024-27936
Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping
HIGH
CVE-2024-27935
Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
HIGH
CVE-2024-27929
Use After Free in SixLabors.ImageSharp
CRITICAL
CVE-2024-27922
HTTP Handling Vulnerability in the Bare server
HIGH
CVE-2024-27304
pgproto3 SQL Injection via Protocol Message Size Overflow
HIGH
CVE-2024-27308
Mio's tokens for named pipes may be delivered after deregistration
CRITICAL
CVE-2024-27307
JSONata expression can pollute the "Object" prototype
CRITICAL
CVE-2024-27302
Authorization Bypass Through User-Controlled Key in go-zero
CRITICAL
CVE-2024-27298
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
MEDIUM
CVE-2024-25126
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
MEDIUM
CVE-2024-27285
YARD's default template vulnerable to Cross-site Scripting in generated frames.html
MEDIUM
CVE-2024-26144
Rails has possible Sensitive Session Information Leak in Active Storage
MEDIUM
CVE-2024-26143
Rails has possible XSS Vulnerability in Action Controller
CRITICAL
CVE-2023-51518
Apache James server: Privilege escalation via JMX pre-authentication deserialization
CRITICAL
CVE-2024-25124
Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
CRITICAL
CVE-2024-1597
org.postgresql:postgresql vulnerable to SQL Injection via line comment generation
CRITICAL
CVE-2023-47795
Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25603
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-26269
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting
CRITICAL
CVE-2024-26266
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2023-40191
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2023-42496
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2023-42498
Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting
CRITICAL
CVE-2024-25601
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25152
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25602
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting
CRITICAL
CVE-2024-25147
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
HIGH
CVE-2024-58366
Externally Controlled Format String in Scripting Functions
MEDIUM
CVE-2024-58365
Uncaught Exception in Macro Expecting Native Function to Exist
MEDIUM
CVE-2024-58364
Uncaught Exception Handling Parsing Errors on Line Terminators
MEDIUM
CVE-2023-51447
Cross-site scripting (XSS) in the dynamic file uploads
MEDIUM
CVE-2023-48220
Possibility to circumvent the invitation token expiry period
CRITICAL
CVE-2024-25610
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults)
CRITICAL
CVE-2023-49109
Remote Code Execution in Apache Dolphinscheduler
CRITICAL
CVE-2024-1651
Deserialization of Untrusted Data in Torrentpier
HIGH
CVE-2024-20719
Magento Open Source allows Cross-Site Scripting (XSS)
HIGH
CVE-2024-20720
Magento Open Source allows OS Command Injection
CRITICAL
CVE-2024-0057
NuGet Client Security Feature Bypass Vulnerability
HIGH
CVE-2024-21386
Microsoft Security Advisory CVE-2024-21386: .NET Denial of Service Vulnerability
HIGH
CVE-2023-46950
XSS sidekiq-unique-jobs UI server vulnerability
MEDIUM
CVE-2024-21491
svix vulnerable to Authentication Bypass
CRITICAL
CVE-2024-25108
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions