Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
371 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-105134 |
critical | 10.0 | 0.8176 | 2026-10-04 | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to exec |
CVE-2026-48908 |
critical | 10.0 | 0.8851 | 2026-06-20 | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability |
CVE-2026-20182 |
critical | 10.0 | 0.9182 | 2026-05-14 | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allow |
CVE-2026-2699 |
critical | 9.8 | 0.5839 | 2026-04-02 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to acce | |
CVE-2026-0740 |
critical | 9.8 | 0.6290 | 2026-04-07 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to m | |
CVE-2026-41089 |
critical | 9.8 | 0.7962 | 2026-05-12 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over | |
CVE-2024-21762 |
critical | 9.8 | 0.8459 | 2024-02-09 | KEV | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated a |
CVE-2026-39808 |
critical | 9.8 | 0.9319 | 2026-04-14 | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthentic |
CVE-2026-63077 |
critical | 9.8 | 0.9356 | 2026-07-27 | KEV | JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unaut |
CVE-2026-48356 |
critical | 9.3 | 0.5908 | 2026-07-14 | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability |
CVE-2026-42208 |
critical | 9.3 | 0.8942 | 2026-05-08 | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the |
CVE-2026-41940 |
critical | 9.3 | 0.9853 | 2026-04-29 | KEV | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass |
CVE-2026-21589 |
critical | 9.3 | 0.9948 | 2026-10-05 | KEV | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management |
CVE-2026-42945 |
critical | 9.2 | 0.6805 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vu | |
CVE-2026-111497 |
critical | 9.2 | 0.8799 | 2026-10-22 | KEV | Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated |
CVE-2026-109619 |
critical | 9.2 | 1.0000 | 2026-10-21 | KEV | PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote cod |
CVE-2026-109618 |
critical | 9.2 | 1.0000 | 2026-10-21 | KEV 710 PoC | PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code e |
CVE-2026-55040 |
critical | 9.1 | 0.6954 | 2026-07-14 | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attac |
CVE-2026-71362 |
critical | 9.1 | 0.9049 | 2026-08-11 | KEV | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an att |
CVE-2026-2701 |
high | 8.8 | 0.5454 | 2026-04-02 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote c | |
CVE-2023-29525 |
high | 8.8 | 0.7775 | 2023-04-19 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of | |
CVE-2026-42271 |
high | 8.7 | 0.9144 | 2026-05-08 | KEV | BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, |
CVE-2026-0257 |
high | 7.8 | 0.9501 | 2026-05-13 | KEV | Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to b |
CVE-2026-105133 |
medium | 6.9 | 0.7947 | 2026-10-04 | KEV | Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker |
CVE-2026-42897 |
medium | 6.1 | 0.7066 | 2026-05-14 | KEV | Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation i |
CVE-2026-32202 |
medium | 4.3 | 0.7090 | 2026-04-14 | KEV | Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unautho |
CVE-2023-49897 |
— | — | 0.5045 | — | KEV | FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated user |
CVE-2024-38094 |
— | — | 0.5089 | — | KEV | Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. |
CVE-2023-32434 |
— | — | 0.5152 | — | KEV | Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an |
CVE-2026-53435 |
— | — | 0.5313 | 2026-06-10 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins | |
CVE-2023-45249 |
— | — | 0.5325 | — | KEV | Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due t |
CVE-2025-14611 |
— | — | 0.5330 | — | KEV | Gladinet CentreStack and TrioFox contain a hardcoded cryptographic keys vulnerability for their impl |
CVE-2023-41064 |
— | — | 0.5340 | — | KEV | Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a ma |
CVE-2023-20118 |
— | — | 0.5411 | — | KEV | Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the we |
CVE-2026-85102 |
— | — | 0.5414 | — | KEV | Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access |
CVE-2024-43461 |
— | — | 0.5449 | — | KEV | Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical infor |
CVE-2024-38812 |
— | — | 0.5457 | — | KEV | VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of t |
CVE-2025-58034 |
— | — | 0.5472 | — | KEV | Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated att |
CVE-2026-2441 |
— | — | 0.5496 | — | KEV | Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to po |
CVE-2022-29499 |
— | — | 0.5524 | — | KEV | The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorre |
CVE-2025-14174 |
— | — | 0.5533 | — | KEV | Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a re |
CVE-2025-32463 |
— | — | 0.5550 | — | KEV | Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulner |
CVE-2022-37055 |
— | — | 0.5553 | — | KEV | D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, i |
CVE-2025-25181 |
— | — | 0.5555 | — | KEV | Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote |
CVE-2023-6549 |
— | — | 0.5763 | — | KEV | Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a |
CVE-2024-9380 |
— | — | 0.5832 | — | KEV | Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administ |
CVE-2024-8956 |
— | — | 0.5879 | — | KEV | PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability tha |
CVE-2023-21529 |
— | — | 0.5929 | — | KEV | Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated |
CVE-2023-21608 |
— | — | 0.5943 | — | KEV | Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in t |
CVE-2026-33634 |
— | — | 0.5973 | — | KEV | Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to |