Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
36 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-20182 |
critical | 10.0 | 0.9182 | 2026-05-14 | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allow |
CVE-2026-48908 |
critical | 10.0 | 0.8851 | 2026-06-20 | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability |
CVE-2026-48939 |
critical | 10.0 | 0.2007 | 2026-06-20 | KEV | iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the u |
CVE-2026-49869 |
critical | 10.0 | 0.0209 | 2026-06-26 | KEV | Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote |
CVE-2026-56290 |
critical | 10.0 | 0.3087 | 2026-06-29 | KEV | Joomlack Page Builder contains an improper access control vulnerability that could allow for remote |
CVE-2026-48282 |
critical | 10.0 | 0.4239 | 2026-06-30 | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution |
CVE-2026-56291 |
critical | 10.0 | 0.1485 | 2026-07-09 | KEV | Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows |
CVE-2026-15409 |
critical | 10.0 | 0.0679 | 2026-07-14 | KEV | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a |
CVE-2026-16812 |
critical | 10.0 | 0.0100 | 2026-07-27 | KEV | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow |
CVE-2026-105134 |
critical | 10.0 | 0.8176 | 2026-10-04 | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to exec |
CVE-2024-21762 |
critical | 9.8 | 0.8459 | 2024-02-09 | KEV | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated a |
CVE-2026-39808 |
critical | 9.8 | 0.9319 | 2026-04-14 | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthentic |
CVE-2026-9198 |
critical | 9.8 | 0.2866 | 2026-07-17 | KEV | Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve fu |
CVE-2026-63077 |
critical | 9.8 | 0.9356 | 2026-07-27 | KEV | JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unaut |
CVE-2026-65400 |
critical | 9.8 | 0.0172 | 2026-08-06 | KEV | Apple macOS contains an improper authentication vulnerability that could allow an attacker on the ne |
CVE-2026-104286 |
critical | 9.8 | 0.0457 | 2026-10-01 | KEV | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL cha |
CVE-2026-50522 |
critical | 9.8 | 0.0304 | 2026-07-14 | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an |
CVE-2026-58644 |
critical | 9.8 | 0.1587 | 2026-07-14 | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unaut |
CVE-2026-45321 |
critical | 9.6 | 0.0328 | 2026-05-12 | KEV | TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be |
CVE-2026-114625 |
critical | 9.4 | 0.0103 | 2026-10-22 | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote |
CVE-2026-41940 |
critical | 9.3 | 0.9853 | 2026-04-29 | KEV | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass |
CVE-2026-0300 |
critical | 9.3 | 0.4171 | 2026-05-06 | KEV | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authenticatio |
CVE-2026-42208 |
critical | 9.3 | 0.8942 | 2026-05-08 | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the |
CVE-2026-8398 |
critical | 9.3 | 0.0146 | 2026-05-15 | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integr |
CVE-2026-48356 |
critical | 9.3 | 0.5908 | 2026-07-14 | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability |
CVE-2026-9586 |
critical | 9.3 | 0.1898 | 2026-07-17 | KEV | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote atta |
CVE-2026-16232 |
critical | 9.3 | 0.0352 | 2026-07-22 | KEV | Check Point SmartConsole contains an improper authentication vulnerability which could allow an unau |
CVE-2026-64849 |
critical | 9.3 | 0.1002 | 2026-08-17 | KEV | MLflow contains a server-side request forgery vulnerability that can allow attackers to reach intern |
CVE-2026-19490 |
critical | 9.3 | 0.3265 | 2026-08-19 | KEV | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving |
CVE-2026-21589 |
critical | 9.3 | 0.9948 | 2026-10-05 | KEV | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management |
CVE-2026-110447 |
critical | 9.2 | 0.1163 | 2026-10-14 | KEV | Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains a |
CVE-2026-109618 |
critical | 9.2 | 1.0000 | 2026-10-21 | KEV 710 PoC | PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code e |
CVE-2026-109619 |
critical | 9.2 | 1.0000 | 2026-10-21 | KEV | PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote cod |
CVE-2026-111497 |
critical | 9.2 | 0.8799 | 2026-10-22 | KEV | Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated |
CVE-2026-71362 |
critical | 9.1 | 0.9049 | 2026-08-11 | KEV | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an att |
CVE-2026-55040 |
critical | 9.1 | 0.6954 | 2026-07-14 | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attac |