Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-1269
Easy!Appointments uses hard-coded credentials
CRITICAL
CVE-2023-23638
Apache Dubbo vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-24780
SQL Injection in Funadmin
CRITICAL
CVE-2023-24775
SQL Injection in Funadmin
CRITICAL
CVE-2023-24781
SQL Injection in Funadmin
CRITICAL
CVE-2021-36394
Moodle Session Fixation vulnerability
CRITICAL
CVE-2023-24776
Remote code execution in Funadmin
CRITICAL
CVE-2021-36393
Moodle SQL Injection vulnerability
CRITICAL
CVE-2021-36392
Moodle SQL Injection vulnerability
CRITICAL
CVE-2023-26477
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
CRITICAL
CVE-2023-26471
XWiki Platform users may execute anything with superadmin right through comments and async macro
CRITICAL
CVE-2023-26055
XWiki Platform may allow privilege escalation to programming rights via user's first name
CRITICAL
CVE-2023-26472
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
CRITICAL
CVE-2023-26474
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
CRITICAL
CVE-2023-26475
xwiki-platform vulnerable to Remote Code Execution in Annotations
CRITICAL
CVE-2022-2024
Gogs OS Command Injection vulnerability
CRITICAL
CVE-2023-22578
Sequelize - Default support for “raw attributes” when using parentheses
CRITICAL
CVE-2022-23535
LiteDB may deserialize bad JSON on object type using _type
CRITICAL
CVE-2022-36231
Code injection in pdf_info
CRITICAL
CVE-2022-4492
Undertow client not checking server identity presented by server certificate in https connections
CRITICAL
CVE-2023-22579
Unsafe fall-through in getWhereConditions
CRITICAL
CVE-2023-25813
Sequelize vulnerable to SQL Injection via replacements
CRITICAL
CVE-2023-25158
GeoTools OGC Filter SQL Injection Vulnerabilities
CRITICAL
CVE-2023-25157
GeoServer OGC Filter SQL Injection Vulnerabilities
HIGH
CVE-2022-48282
MongoDB .NET/C# Driver vulnerable to Deserialization of Untrusted Data
CRITICAL
CVE-2023-25613
Apache Kerby LdapIdentityBackend LDAP Injection vulnerability
CRITICAL
CVE-2014-125087
java-xmlbuilder vulnerable to XML External Entity Reference
CRITICAL
CVE-2021-32163
Privilege escalation in MOSN
CRITICAL
CVE-2023-23947
Users with any cluster secret update access may update out-of-bounds cluster secrets
CRITICAL
CVE-2023-25765
Sandbox escape in Jenkins Email Extension Plugin
HIGH
CVE-2023-24580EPSS 22.1%
Resource exhaustion in Django
HIGH
CVE-2023-21808
.NET Remote Code Execution Vulnerability
CRITICAL
CVE-2023-0789
Command Injection in thorsten/phpmyfaq
CRITICAL
CVE-2023-0788
Code Injection in thorsten/phpmyfaq
CRITICAL
CVE-2023-25168
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system
CRITICAL
CVE-2015-10077
SQL injection in webbuilders-group silverstripe-kapost-bridge
CRITICAL
CVE-2022-4903
CodenameOne Pending Intent vulnerability
HIGH
CVE-2023-0215
openssl-src vulnerable to Use-after-free following `BIO_new_NDEF`
CRITICAL
CVE-2022-4203
openssl-src contains Read Buffer Overflow in X.509 Name Constraint
HIGH
CVE-2023-0216
openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions
HIGH
CVE-2022-4450
openssl-src contains Double free after calling `PEM_read_bio_ex`
HIGH
CVE-2023-0217
openssl-src subject to NULL dereference validating DSA public key
HIGH
CVE-2023-0401
openssl-src contains `NULL` dereference during PKCS7 data verification
HIGH
CVE-2023-0286
Vulnerable OpenSSL included in cryptography wheels
HIGH
CVE-2023-24814
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
CRITICAL
CVE-2022-45982
Deserialization of Untrusted Data in thinkphp
CRITICAL
CVE-2023-0744
Answer contains Improper Access Control vulnerability
CRITICAL
CVE-2021-3538
go.uuid has Predictable UUID Identifiers
CRITICAL
CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
CRITICAL
CVE-2015-10073
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function