Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
MEDIUM
CVE-2023-25015
Clockwork Web contains a Cross-Site Request Forgery Vulnerability with Rails < 5.2
CRITICAL
CVE-2023-25313
AVideo contains Command injection when embedding a video link
HIGH
CVE-2023-23969EPSS 6.1%
Django contains Uncontrolled Resource Consumption via cached header
CRITICAL
CVE-2023-24997
Apache InLong vulnerable to Deserialization of Untrusted Data vulnerability
CRITICAL
CVE-2023-23924
Dompdf vulnerable to URI validation failure on SVG parsing
CRITICAL
CVE-2023-24163
Dromara hutool vulnerable to SQL Injection
CRITICAL
CVE-2023-24162
Dromara Hutool Deserialization of Untrusted Data vulnerability
MEDIUM
CVE-2023-0569
Publify contains Weak Password Requirements
MEDIUM
CVE-2023-23627
Improper neutralization of `noscript` element content may allow XSS in Sanitize
CRITICAL
CVE-2013-2513
flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution
HIGH
CVE-2015-8314
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
MEDIUM
CVE-2015-2179
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table
CRITICAL
CVE-2020-22452
phpmyadmin contains SQL Injection vulnerability
CRITICAL
CVE-2022-25894
Remote Code Execution in com.bstek.uflo:uflo-core
CRITICAL
CVE-2023-24441
XML external entity vulnerability on agents in Jenkins MSTest Plugin
CRITICAL
CVE-2023-24456
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
CRITICAL
CVE-2023-24443
XML Entity Expansion in Jenkins TestComplete support Plugin
CRITICAL
CVE-2023-24430
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24429
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
CRITICAL
CVE-2023-24427
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
CRITICAL
CVE-2023-24057
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
MEDIUM
CVE-2023-22742
git2-rs fails to verify SSH keys by default
HIGH
GHSA-q95h-cqrv-8jv5
ExifTool vulnerable to arbitrary code execution
CRITICAL
CVE-2021-26642
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2023-22727
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection
HIGH
CVE-2023-22499
Deno is vulnerable to race condition via interactive permission prompt spoofing
CRITICAL
CVE-2022-47105
Jeecg-boot is vulnerable to SQL injection
HIGH
CVE-2009-4123
jruby-openssl gem for JRuby fails to do proper certificate validation
MEDIUM
CVE-2023-22797
Open Redirect Vulnerability in Action Pack
HIGH
CVE-2022-44566
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
HIGH
CVE-2023-22794
SQL Injection Vulnerability via ActiveRecord comments
HIGH
CVE-2022-44570
Denial of service via header parsing in Rack
HIGH
CVE-2023-21893
Component takeover in Oracle Data Provider for .NET
CRITICAL
CVE-2023-22731
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views
HIGH
CVE-2022-47318
Code injection in ruby git
CRITICAL
CVE-2016-15020
SQL Injection in liftkit/database
CRITICAL
CVE-2015-10053
curupira is vulnerable to SQL injection
CRITICAL
CVE-2023-0311
phpMyFAQ Improper Authentication vulnerability
CRITICAL
CVE-2022-1812
Integer overflow in publify_core
MEDIUM
CVE-2022-2815
Publify Core does not strip metadata from images
CRITICAL
CVE-2023-0299
Publify Improper Input Validation vulnerability
CRITICAL
CVE-2022-45299
webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL
HIGH
CVE-2023-21538
.NET Denial of Service Vulnerability
HIGH
CVE-2023-22895
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
HIGH
CVE-2022-46648
ruby-git has potential remote code execution vulnerability
CRITICAL
CVE-2021-4308
WebPA SQL Injection vulnerability
CRITICAL
CVE-2014-125029
PaginationServiceProvider SQL Injection vulnerability
CRITICAL
CVE-2015-10029
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference
MEDIUM
CVE-2020-36644
Inline SVG vulnerable to Cross-site Scripting
CRITICAL
CVE-2018-25068
globalpom-utils has Insecure Temporary File