Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-36480
Aerospike Java Client vulnerable to unsafe deserialization of server responses
MEDIUM
CVE-2023-38697
protocol-http1 HTTP Request/Response Smuggling vulnerability
HIGH
CVE-2023-38497
Cargo not respecting umask when extracting crate archives
CRITICAL
CVE-2022-39986
RaspAP Command Injection vulnerability
HIGH
CVE-2023-38688
twitch-tui's connection is not encrypted
HIGH
CVE-2023-36542
Apache NiFi Code Injection vulnerability
CRITICAL
CVE-2023-37754
Code injection in PowerJob
CRITICAL
CVE-2023-39020
Code injection in stanford-parser
CRITICAL
CVE-2023-39022
Code injection in oscore
CRITICAL
CVE-2023-39010
Code injection in BoofCV
CRITICAL
CVE-2023-39021
Code injection in wix-embedded-mysql
CRITICAL
CVE-2023-39015
Code injection in webmagic-core
CRITICAL
CVE-2023-39013
Code injection in Duke
CRITICAL
CVE-2023-38992
SQL injection in jeecg-boot
CRITICAL
CVE-2023-38647
Deserialization vulnerability in Helix workflow and REST
CRITICAL
CVE-2023-37895
Remote code execution in Apache Jackrabbit
CRITICAL
CVE-2023-26045
Path traversal and code execution via prototype vulnerability
CRITICAL
CVE-2024-23687
Hard-coded System User Credentials in Folio Data Export Spring module
CRITICAL
CVE-2023-35088
SQL injection in audit endpoint
CRITICAL
CVE-2023-34478
Path Traversal in Apache Shiro
CRITICAL
CVE-2023-34034
Access Control Bypass in Spring Security
CRITICAL
CVE-2023-37266
CasaOS contains weak JWT secrets
CRITICAL
CVE-2023-37265
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
CRITICAL
CVE-2023-26512
rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message
CRITICAL
CVE-2023-3696
Mongoose Prototype Pollution vulnerability
HIGH
CVE-2023-38337
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal
CRITICAL
CVE-2023-37462
org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability
HIGH
CVE-2023-37267
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
CRITICAL
CVE-2023-30429
Apache Pulsar Incorrect Authorization vulnerability
CRITICAL
CVE-2023-37582
RocketMQ NameServer component Code Injection vulnerability
MEDIUM
CVE-2023-32693
Decidim Cross-site Scripting vulnerability in the external link redirections
HIGH
CVE-2023-34089
Decidim Cross-site Scripting vulnerability in the processes filter
HIGH
CVE-2023-34090
Decidim vulnerable to sensitive data disclosure
CRITICAL
CVE-2023-36825
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
HIGH
CVE-2023-33127
Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability
HIGH
CVE-2023-33170
Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability
CRITICAL
CVE-2023-37277
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
HIGH
CVE-2023-1428
gRPC Reachable Assertion issue
CRITICAL
CVE-2023-33246KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
CRITICAL
CVE-2023-31065
Apache InLong Insufficient Session Expiration vulnerability
CRITICAL
CVE-2023-31062
Apache InLong Improper Privilege Management vulnerability
CRITICAL
CVE-2023-31098
Apache InLong has Weak Password Requirements in Apache InLong
HIGH
CVE-2023-36823
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content
CRITICAL
CVE-2022-45802
Apache StreamPark Path Traversal vulnerability
CRITICAL
CVE-2023-26119
HtmlUnit Code Injection vulnerability
CRITICAL
CVE-2023-27603
Apache Linkis Zip Slip issue
CRITICAL
CVE-2023-27602
Apache Linkis Unrestricted File Upload vulnerability
CRITICAL
CVE-2022-24697
Apache Kylin vulnerable to remote code execution
HIGH
CVE-2023-32731
Connection confusion in gRPC
CRITICAL
CVE-2023-36665
protobufjs Prototype Pollution vulnerability