Browse CVEs by Ecosystem and Severity
5,773 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2022-43402
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
CRITICAL
CVE-2022-39198
Hessian Lite for Apache Dubbo deserialization vulnerability
MEDIUM
CVE-2022-24512
.NET Remote Code Execution Vulnerability
HIGH
CVE-2022-41323EPSS 8.1%
Django denial-of-service vulnerability in internationalized URLs
HIGH
CVE-2022-35698
Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
CRITICAL
CVE-2022-42889
Arbitrary code execution in Apache Commons Text
CRITICAL
CVE-2022-40871
Dolibarr vulnerable to Eval Injection
HIGH
CVE-2022-41032
NuGet Elevation of Privilege Vulnerability
HIGH
CVE-2022-3358
Using a Custom Cipher with `NID_undef` may lead to NULL encryption
HIGH
CVE-2022-39292
Exposure of sensitive Slack webhook URLs in debug logs and traces
MEDIUM
CVE-2022-39281
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
CRITICAL
CVE-2018-21246
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
CRITICAL
CVE-2018-17057
TCPDF vulnerable to attackers triggering deserialization of arbitrary data
MEDIUM
CVE-2022-3171
protobuf-java has a potential Denial of Service issue
CRITICAL
CVE-2022-40314
Moodle remote code execution
CRITICAL
CVE-2022-40315
Moodle Minor SQL injection risk in admin user browsing
CRITICAL
CVE-2022-39256
Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
CRITICAL
CVE-2021-36782
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
HIGH
CVE-2022-39224
arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.
CRITICAL
CVE-2022-38916
Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type
HIGH
CVE-2022-39974
WASM3 Improper Input Validation vulnerability
CRITICAL
CVE-2022-36084
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch
HIGH
CVE-2022-36086
linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`
CRITICAL
CVE-2022-36098
XWiki Platform Mentions UI vulnerable to Cross-site Scripting
CRITICAL
CVE-2022-36099
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
CRITICAL
CVE-2022-36100
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
HIGH
CVE-2022-38013
.NET Denial of Service Vulnerability
HIGH
CVE-2022-3212
axum-core has no default limit put on request bodies
HIGH
CVE-2022-3029
NLnet Labs Routinator has Reachable Assertion vulnerability
CRITICAL
CVE-2022-25765
PDFKit vulnerable to Command Injection
CRITICAL
CVE-2022-36376
Rank Math SEO plugin vulnerable to Server-Side Request Forgery
CRITICAL
CVE-2020-21516
FeehiCMS has an arbitrary file upload vulnerability
CRITICAL
GHSA-9q5j-jm53-v7vr
lz4-sys vulnerable to memory corruption via issue in liblz4
CRITICAL
CVE-2022-37021
Apache Geode vulnerable to Deserialization of Untrusted Data
HIGH
CVE-2022-29145
.NET Denial of Service Vulnerability
HIGH
CVE-2022-29117
.NET Denial of Service Vulnerability
HIGH
CVE-2022-25888
Uncontrolled Resource Consumption in opcua
HIGH
CVE-2022-35909
Incorrect Access Control and Cross Site Scripting in Jellyfin
CRITICAL
CVE-2022-35540
Use of Hard-coded Credentials in AgileConfig.Client
CRITICAL
CVE-2020-36599
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
MEDIUM
CVE-2022-35956
update_by_case before 0.1.3 can be vulnerable to sql injection
HIGH
CVE-2022-36359EPSS 0.8%
Django vulnerable to Reflected File Download attack
HIGH
CVE-2022-36125
Apache Avro Rust SDK corrupted data read can cause crash
HIGH
CVE-2022-35724
Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU
HIGH
CVE-2022-36124
Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints
CRITICAL
CVE-2022-2713
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
HIGH
CVE-2022-35922
Rust-WebSocket memory allocation based on untrusted length
MEDIUM
CVE-2016-3098
administrate vulnerable to Cross-Site Request Forgery
CRITICAL
CVE-2022-25168
Apache Hadoop argument injection vulnerability
HIGH
CVE-2022-35737
`libsqlite3-sys` via C SQLite improperly validates array index