Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2014-125051
himiklab yii2-jqgrid-widget vulnerable to SQL Injection
CRITICAL
CVE-2023-22463
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys
CRITICAL
CVE-2015-10018
DBRisinajumi d2files SQL Injection vulnerability
CRITICAL
CVE-2016-15011
dssp vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2020-36640
bonita-connector-webservice XML External Entity vulnerability
CRITICAL
CVE-2020-36641
aXMLRPC XML External Entity vulnerability
HIGH
CVE-2023-22626
PgHero Allows Information Disclosure Through EXPLAIN Feature
CRITICAL
CVE-2022-45875
Apache DolphinScheduler vulnerable to Improper Input Validation
CRITICAL
CVE-2021-32824
Apache Dubbo vulnerable to remote code execution via Telnet Handler
MEDIUM
CVE-2024-22049
httparty has multipart/form-data request tampering vulnerability
CRITICAL
CVE-2015-10009
nterchange Code Injection vulnerability
MEDIUM
CVE-2017-20159
keynote Cross-site Scripting vulnerability
CRITICAL
CVE-2017-20157
Ariadne Component Library vulnerable to Server-Side Request Forgery
CRITICAL
CVE-2022-48195
mellium.im/sasl authentication failure due to insufficient nonce randomness
CRITICAL
CVE-2017-20151
iText RUPS XML External Entity vulnerability
CRITICAL
CVE-2022-44621
Apache Kylin vulnerable to Command injection by Diagnosis Controller
CRITICAL
CVE-2017-20146
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy
CRITICAL
CVE-2022-4725
AWS SDK is vulnerable to server-side request forgery (SSRF)
CRITICAL
CVE-2022-36437
Hazelcast connection caching
MEDIUM
CVE-2019-25088
Oxidized Web vulnerable to Cross-site Scripting
CRITICAL
CVE-2020-36632
flat vulnerable to Prototype Pollution
CRITICAL
CVE-2022-47945
ThinkPHP Framework vulnerable to remote code execution
CRITICAL
CVE-2022-4686
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
MEDIUM
CVE-2022-46171
Tauri Filesystem Scope Glob Pattern is too Permissive
MEDIUM
CVE-2020-36624
text_helpers uses web link to untrusted target with window.opener access
CRITICAL
CVE-2022-45347
Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability
CRITICAL
CVE-2022-4643
docconv OS Command Injection vulnerability
CRITICAL
CVE-2022-40145
Apache Karaf vulnerable to potential code injection
CRITICAL
CVE-2021-4262
laravel-jqgrid vulnerable to SQL Injection
HIGH
CVE-2021-4250
active_attr Improper Resource Shutdown or Release vulnerability
CRITICAL
CVE-2021-4248
DNS NuGet package uses insufficiently random values
HIGH
CVE-2022-41089
.NET Remote Code Execution Vulnerability
CRITICAL
CVE-2022-47406
TYPO3 vulnerable to Insufficient Session Expiration
HIGH
CVE-2022-3996
Denial of service by double-checked locking in openssl-src
CRITICAL
CVE-2022-46364
Apache CXF Server-Side Request Forgery vulnerability
MEDIUM
CVE-2022-23520
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
MEDIUM
CVE-2022-23519
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
MEDIUM
CVE-2022-23518
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
HIGH
CVE-2022-23517
Inefficient Regular Expression Complexity in rails-html-sanitizer
HIGH
CVE-2022-23516
Uncontrolled Recursion in Loofah
MEDIUM
CVE-2022-23515
Improper neutralization of data URIs may allow XSS in Loofah
HIGH
CVE-2022-23514
Inefficient Regular Expression Complexity in Loofah
CRITICAL
CVE-2022-4375
Mingsoft MCMS vulnerable to SQL Injection
MEDIUM
CVE-2022-23494
Cross-site scripting vulnerability in TinyMCE alerts
HIGH
CVE-2022-23496
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
HIGH
CVE-2022-23476
Unchecked return value from xmlTextReaderExpand
HIGH
CVE-2022-23486
libp2p DoS vulnerability from lack of resource management
CRITICAL
CVE-2022-45046
camel-ldap component allows LDAP Injection when using the filter option
CRITICAL
CVE-2022-46366
Apache Tapestry allows deserialization of untrusted data
CRITICAL
CVE-2022-44262
ff4j is vulnerable to Remote Code Execution (RCE)