Aggregating NVD, CVE, and multi-source threat feeds, this list provides deep analysis of high-risk threats such as RCE. By integrating CVSS and EPSS models, the system dynamically tracks Exp (Exploit) resources and PoC availability to accurately assess Exploitability. Combined with official Patches and remediation strategies, it helps prioritize Vulnerability Management workflows, significantly shortening response cycles and securing your critical assets.
Assigner (CNA / source)：[email protected] Remove this filter
| CVE | Description | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|
| CVE-2023-0028 | Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+. | 5.7 | 40.92% | 2022-12-31 | 2026-06-17 |
| CVE-2023-2564 | OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0. | 10.0 | 40.52% | 2023-05-07 | 2026-06-17 |
| CVE-2024-1601 | An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the `/delete_discussion` endpoint, which internally calls the vulnerable `delete_discussion()` function. By sending a specially crafted payload in the 'id' parameter, an attacker can manipulate SQL queries to delete all records from the 'discussion' | 9.8 | 40.42% | 2024-04-15 | 2026-06-17 |
| CVE-2024-2083 | A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory. | 9.9 | 39.09% | 2024-04-15 | 2026-06-17 |
| CVE-2022-4732 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2. | 7.2 | 38.24% | 2022-12-27 | 2026-06-17 |
| CVE-2022-0482 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | 9.1 | 38.13% | 2022-03-09 | 2026-06-17 |
| CVE-2021-3817 | wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | 9.8 | 37.82% | 2021-12-09 | 2026-06-17 |
| CVE-2024-4325 | A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, there | 8.6 | 37.37% | 2024-06-06 | 2026-06-17 |
| CVE-2023-0678 | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. | 5.3 | 37.30% | 2023-02-04 | 2026-06-17 |
| CVE-2024-6587 | A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to send the request to the domain specified by `api_base`. This request includes the OpenAI API key. A malicious user can set the `api_base` to their own domain and intercept the OpenAI API key, leading to unauthorized access and potential misuse of the API key. | 7.5 | 37.20% | 2024-09-13 | 2026-06-17 |
| CVE-2023-6021 | LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 | 7.5 | 37.08% | 2023-11-16 | 2026-06-17 |
| CVE-2022-0848 | OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. | 9.8 | 35.44% | 2022-03-04 | 2026-06-17 |
| CVE-2022-4606 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. | 9.8 | 35.44% | 2022-12-18 | 2026-06-17 |
| CVE-2024-4320 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter t | 9.8 | 34.35% | 2024-06-06 | 2026-06-17 |
| CVE-2022-4068 | A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account. | 5.4 | 33.97% | 2022-11-20 | 2026-06-17 |
| CVE-2023-5375 | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. | 6.1 | 33.63% | 2023-10-04 | 2026-06-17 |
| CVE-2022-2564 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. | 9.8 | 32.68% | 2022-07-28 | 2026-06-17 |
| CVE-2023-0048 | Code Injection in GitHub repository lirantal/daloradius prior to master-branch. | 8.8 | 32.28% | 2023-01-04 | 2026-06-17 |
| CVE-2024-1600 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statem | 9.3 | 31.09% | 2024-04-10 | 2026-06-17 |
| CVE-2024-4322 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version of the application. The vulnerability is due to improper handling of user-supplied input in the `list_personalities` function, where the `category` parameter can be controlled to specify arbitrary | 7.5 | 30.99% | 2024-05-16 | 2026-06-17 |