Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,770 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-7663 |
critical | 9.8 | 0.0052 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p | |
CVE-2026-7803 |
critical | 9.8 | 0.0064 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio | |
CVE-2026-7871 |
critical | 9.8 | 0.0069 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with | |
CVE-2026-11541 |
critical | 9.8 | 0.0042 | 2026-06-30 | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se | |
CVE-2026-13775 |
critical | 9.8 | 0.0032 | 2026-06-30 | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp | |
CVE-2026-13776 |
critical | 9.8 | 0.0035 | 2026-06-30 | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com | |
CVE-2026-14104 |
critical | 9.8 | 0.0052 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 | |
CVE-2026-14121 |
critical | 9.8 | 0.0046 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attac | |
CVE-2026-57692 |
critical | 9.8 | 0.0053 | 2026-07-01 | Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. T | |
CVE-2026-24270 |
critical | 9.8 | 0.0081 | 2026-07-01 | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A s | |
CVE-2026-51947 |
critical | 9.8 | 0.0107 | 2026-07-01 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pi | |
CVE-2026-52186 |
critical | 9.8 | 0.0069 | 2026-07-01 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to e | |
CVE-2026-57621 |
critical | 9.8 | 0.0056 | 2026-07-02 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. | |
CVE-2026-57677 |
critical | 9.8 | 0.0056 | 2026-07-02 | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions | |
CVE-2026-5524 |
critical | 9.8 | 0.0348 | 2026-07-02 | The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote | |
CVE-2026-4767 |
critical | 9.8 | 0.0061 | 2026-07-02 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allow | |
CVE-2026-54408 |
critical | 9.8 | 0.0057 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability | |
CVE-2026-4321 |
critical | 9.8 | 0.0047 | 2026-07-03 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-12481 |
critical | 9.8 | 0.0072 | 2026-07-03 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improp | |
CVE-2026-20896 |
critical | 9.8 | 0.0276 | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by defaul | |
CVE-2026-26292 |
critical | 9.8 | 0.0065 | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror op | |
CVE-2026-27780 |
critical | 9.8 | 0.0064 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive | |
CVE-2026-58422 |
critical | 9.8 | 0.0043 | 2026-07-03 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts | |
CVE-2026-14535 |
critical | 9.8 | 0.0056 | 2026-07-04 | In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unc | |
CVE-2026-24014 |
critical | 9.8 | 0.0069 | 2026-07-06 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trig | |
CVE-2026-43867 |
critical | 9.8 | 0.0093 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc compon | |
CVE-2026-46454 |
critical | 9.8 | 0.0083 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd componen | |
CVE-2026-46455 |
critical | 9.8 | 0.0069 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloa | |
CVE-2026-46456 |
critical | 9.8 | 0.0079 | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs com | |
CVE-2026-48204 |
critical | 9.8 | 0.0073 | 2026-07-06 | Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr | |
CVE-2026-11405 |
critical | 9.8 | 0.0076 | 2026-07-06 | The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() | |
CVE-2026-33264 |
critical | 9.8 | 0.0165 | 2026-07-07 | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro | |
CVE-2026-53481 |
critical | 9.8 | 0.0063 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-53483 |
critical | 9.8 | 0.0063 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-13019 |
critical | 9.8 | 0.0085 | 2026-07-07 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing aut | |
CVE-2026-13020 |
critical | 9.8 | 0.0047 | 2026-07-07 | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions | |
CVE-2026-14739 |
critical | 9.8 | 0.0041 | 2026-07-07 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extre | |
CVE-2026-9695 |
critical | 9.8 | 0.0061 | 2026-07-08 | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2 | |
CVE-2026-14454 |
critical | 9.8 | 0.0066 | 2026-07-08 | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishan | |
CVE-2026-8307 |
critical | 9.8 | 0.0047 | 2026-07-08 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-3144 |
critical | 9.8 | 0.0041 | 2026-07-08 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to | |
CVE-2026-9074 |
critical | 9.8 | 0.0051 | 2026-07-08 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated | |
CVE-2026-8649 |
critical | 9.8 | 0.0046 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Tra | |
CVE-2026-44024 |
critical | 9.8 | 0.0109 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS | |
CVE-2026-52200 |
critical | 9.8 | 0.0093 | 2026-07-08 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar | |
CVE-2026-5955 |
critical | 9.8 | 0.0047 | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-12116 |
critical | 9.8 | 0.0070 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the to | |
CVE-2026-51599 |
critical | 9.8 | 0.0053 | 2026-07-09 | An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build | |
CVE-2026-28564 |
critical | 9.8 | 0.0068 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoT | |
CVE-2026-40008 |
critical | 9.8 | 0.0060 | 2026-07-10 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in |