Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,770 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-46909 |
critical | 9.8 | 0.0048 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr | |
CVE-2026-46919 |
critical | 9.8 | 0.0036 | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C | |
CVE-2026-10094 |
critical | 9.8 | 0.0038 | 2026-06-17 | A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 t | |
CVE-2026-27395 |
critical | 9.8 | 0.0034 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. | |
CVE-2026-27429 |
critical | 9.8 | 0.0056 | 2026-06-17 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
CVE-2026-32966 |
critical | 9.8 | 0.0039 | 2026-06-17 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apa | |
CVE-2026-39529 |
critical | 9.8 | 0.0037 | 2026-06-17 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |
CVE-2026-40725 |
critical | 9.8 | 0.0037 | 2026-06-17 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | |
CVE-2026-42380 |
critical | 9.8 | 0.0051 | 2026-06-17 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | |
CVE-2026-49058 |
critical | 9.8 | 0.0032 | 2026-06-17 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. | |
CVE-2026-49075 |
critical | 9.8 | 0.0037 | 2026-06-17 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | |
CVE-2026-49107 |
critical | 9.8 | 0.0037 | 2026-06-17 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |
CVE-2026-49767 |
critical | 9.8 | 0.0055 | 2026-06-17 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-52706 |
critical | 9.8 | 0.0047 | 2026-06-17 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |
CVE-2026-54194 |
critical | 9.8 | 0.0037 | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-54803 |
critical | 9.8 | 0.0045 | 2026-06-17 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. | |
CVE-2026-54806 |
critical | 9.8 | 0.0070 | 2026-06-17 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |
CVE-2026-54807 |
critical | 9.8 | 0.0034 | 2026-06-17 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. | |
CVE-2026-49108 |
critical | 9.8 | 0.0030 | 2026-06-17 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. | |
CVE-2026-47846 |
critical | 9.8 | 0.0048 | 2026-06-18 | Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When | |
CVE-2026-50242 |
critical | 9.8 | 0.0061 | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 20 | |
CVE-2026-56141 |
critical | 9.8 | 0.0052 | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 20 | |
CVE-2026-48773 |
critical | 9.8 | 0.0069 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 ha | |
CVE-2026-7664 |
critical | 9.8 | 0.0050 | 2026-06-22 | IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP p | |
CVE-2026-9072 |
critical | 9.8 | 0.0072 | 2026-06-22 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intellige | |
CVE-2026-53055 |
critical | 9.8 | 0.0043 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - preven | |
CVE-2026-8592 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin | |
CVE-2026-8660 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux | |
CVE-2026-8665 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Lin | |
CVE-2026-8666 |
critical | 9.8 | 0.0120 | 2026-06-25 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plug | |
CVE-2026-41120 |
critical | 9.8 | 0.0039 | 2026-06-25 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untru | |
CVE-2026-48930 |
critical | 9.8 | 0.0032 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authorit | |
CVE-2026-57878 |
critical | 9.8 | 0.0095 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC201 | |
CVE-2026-57879 |
critical | 9.8 | 0.0095 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 | |
CVE-2026-57880 |
critical | 9.8 | 0.0095 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 | |
CVE-2026-57881 |
critical | 9.8 | 0.0065 | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 | |
CVE-2026-53914 |
critical | 9.8 | 0.0033 | 2026-06-26 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the buil | |
CVE-2026-57926 |
critical | 9.8 | 0.0034 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollut | |
CVE-2026-56030 |
critical | 9.8 | 0.0048 | 2026-06-26 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. | |
CVE-2026-56032 |
critical | 9.8 | 0.0056 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | |
CVE-2026-56033 |
critical | 9.8 | 0.0048 | 2026-06-26 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. | |
CVE-2026-56057 |
critical | 9.8 | 0.0056 | 2026-06-26 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. | |
CVE-2026-0685 |
critical | 9.8 | 0.0093 | 2026-06-26 | Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine | |
CVE-2026-9711 |
critical | 9.8 | 0.0054 | 2026-06-30 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to S | |
CVE-2026-13766 |
critical | 9.8 | 0.0055 | 2026-06-30 | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. | |
CVE-2026-8402 |
critical | 9.8 | 0.0047 | 2026-06-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-14241 |
critical | 9.8 | 0.0043 | 2026-06-30 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti | |
CVE-2026-10109 |
critical | 9.8 | 0.0086 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due | |
CVE-2026-11546 |
critical | 9.8 | 0.0040 | 2026-06-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re | |
CVE-2026-11714 |
critical | 9.8 | 0.0037 | 2026-06-30 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability |