Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-45135
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
CRITICAL
CVE-2023-45134
XWiki Platform XSS vulnerability from account in the create page form via template provider
CRITICAL
CVE-2023-37913
org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
CRITICAL
CVE-2023-37908
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
CRITICAL
CVE-2023-44794
SaToken privilege escalation vulnerability
CRITICAL
CVE-2023-31581
Sureness uses hardcoded key
HIGH
CVE-2024-0241
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs
HIGH
CVE-2023-46115
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
HIGH
CVE-2023-46277
Pleaser privilege escalation vulnerability
MEDIUM
CVE-2023-45819
TinyMCE XSS vulnerability in notificationManager.open API
MEDIUM
CVE-2023-45818
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
MEDIUM
CVE-2023-45814
Bunkum tokens cached in the AuthenticationService are susceptible to a use-after-free
HIGH
CVE-2023-45812
Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions
MEDIUM
CVE-2024-43806
rustix's `rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosion
CRITICAL
CVE-2023-42627
Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module
CRITICAL
CVE-2023-45144
XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter
CRITICAL
CVE-2023-45128
CSRF Token Reuse Vulnerability
CRITICAL
CVE-2023-44311
Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class
CRITICAL
CVE-2023-42628
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget
CRITICAL
CVE-2023-42497
Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page
CRITICAL
CVE-2023-45138
XWiki Change Request Application UI XSS and remote code execution through change request title
CRITICAL
CVE-2023-45133
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
CRITICAL
CVE-2023-43668
Authorization Bypass in Apache InLong
CRITICAL
CVE-2023-5572
Server-Side Request Forgery (SSRF) in vriteio/vrite
MEDIUM
CVE-2023-38250
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38249
Magento Open Source allows SQL Injection
LOW
CVE-2023-38219
Magento Open Source allows Cross-Site Scripting (XSS)
MEDIUM
CVE-2023-38221
Magento Open Source allows SQL Injection
MEDIUM
CVE-2023-38218
Magento Open Source allows Incorrect Authorization
CRITICAL
CVE-2023-44981
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper
HIGH
CVE-2023-36435
MsQuic Remote Denial of Service Vulnerability
MEDIUM
CVE-2023-44487KEV
HTTP/2 Stream Cancellation Attack
HIGH
CVE-2023-38171
Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel
HIGH
CVE-2023-36414
Azure Identity SDK Remote Code Execution Vulnerability
MEDIUM
CVE-2023-36566
Microsoft Common Data Model SDK Denial of Service Vulnerability
HIGH
GHSA-wqcr-xm43-hpqr
Vulnerable version of libwebp and can be exploited with a malicious source image
CRITICAL
CVE-2023-32188
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
CRITICAL
CVE-2023-5214
Puppet Bolt privilege escalation vulnerability
CRITICAL
CVE-2023-26153
geokit-rails Command Injection vulnerability
HIGH
CVE-2023-36465
Decidim has broken access control in templates
MEDIUM
CVE-2023-44390
HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content
HIGH
GHSA-7vpr-3ppw-qrpj
Imageflow affected by libwebp zero-day and should not be used with malicious source images.
CRITICAL
CVE-2023-43644
sing-box vulnerable to improper authentication in the SOCKS inbound
CRITICAL
CVE-2023-40989
SQL injection in jeecgboot
HIGH
CVE-2023-42805
Denial of Service issue in quinn-proto
CRITICAL
CVE-2023-42810
systeminformation SSID Command Injection Vulnerability
HIGH
CVE-2023-42444
phonenumber panics on parsing crafted RFC3966 inputs
HIGH
CVE-2023-42447
blurhash panics on parsing crafted inputs
CRITICAL
CVE-2023-42454
SQLpage vulnerable to public exposure of database credentials
CRITICAL
CVE-2015-5467
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter