Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,772 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59792 |
critical | 9.8 | 0.0060 | 2026-07-10 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project wor | |
CVE-2026-2397 |
critical | 9.8 | 0.0048 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-5801 |
critical | 9.8 | 0.0058 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-57807 |
critical | 9.8 | 0.0073 | 2026-07-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Softwa | |
CVE-2026-9726 |
critical | 9.8 | 0.0056 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-10768 |
critical | 9.8 | 0.0213 | 2026-07-10 | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issu | |
CVE-2026-12535 |
critical | 9.8 | 0.0056 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-11913 |
critical | 9.8 | 0.0056 | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*. | |
CVE-2026-10666 |
critical | 9.8 | 0.0065 | 2026-07-12 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c | |
CVE-2026-57724 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This | |
CVE-2026-57744 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions a | |
CVE-2026-57770 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all | |
CVE-2026-57813 |
critical | 9.8 | 0.0048 | 2026-07-13 | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege | |
CVE-2026-59518 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injec | |
CVE-2026-57433 |
critical | 9.8 | 0.0047 | 2026-07-13 | Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted S | |
CVE-2026-51821 |
critical | 9.8 | 0.0069 | 2026-07-13 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacke | |
CVE-2026-15043 |
critical | 9.8 | 0.0067 | 2026-07-14 | DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on tex | |
CVE-2026-62422 |
critical | 9.8 | 0.0061 | 2026-07-14 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.14843 | |
CVE-2026-62390 |
critical | 9.8 | 0.0069 | 2026-07-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-62392 |
critical | 9.8 | 0.0248 | 2026-07-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi | |
CVE-2026-59836 |
critical | 9.8 | 0.0022 | 2026-07-14 | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, Fort | |
CVE-2026-62644 |
critical | 9.8 | 0.0050 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webm | |
CVE-2026-55010 |
critical | 9.8 | 0.0097 | 2026-07-14 | Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to | |
CVE-2026-55944 |
critical | 9.8 | 0.0153 | 2026-07-14 | 1 PoC | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execu |
CVE-2026-53633 |
critical | 9.8 | 0.0090 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vite | |
CVE-2026-24227 |
critical | 9.8 | 0.0102 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted | |
CVE-2026-38450 |
critical | 9.8 | 0.0104 | 2026-07-14 | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitra | |
CVE-2026-20156 |
critical | 9.8 | 0.0046 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS en | |
CVE-2026-20157 |
critical | 9.8 | 0.0019 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS en | |
CVE-2026-14960 |
critical | 9.8 | 0.0046 | 2026-07-15 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\ | |
CVE-2026-49352 |
critical | 9.8 | 0.0060 | 2026-07-15 | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback | |
CVE-2026-51380 |
critical | 9.8 | 0.0050 | 2026-07-15 | Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a p | |
CVE-2026-56453 |
critical | 9.8 | 0.0035 | 2026-07-16 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remot | |
CVE-2026-3031 |
critical | 9.8 | 0.0070 | 2026-07-16 | Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image | |
CVE-2026-44180 |
critical | 9.8 | 0.0072 | 2026-07-16 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like | |
CVE-2026-53412 |
critical | 9.8 | 0.0053 | 2026-07-16 | Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom | |
CVE-2026-15982 |
critical | 9.8 | 0.0053 | 2026-07-17 | The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for Word | |
CVE-2026-60024 |
critical | 9.8 | 0.0054 | 2026-07-17 | Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Jo | |
CVE-2026-12692 |
critical | 9.8 | 0.0064 | 2026-07-17 | Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentic | |
CVE-2026-8297 |
critical | 9.8 | 0.0047 | 2026-07-17 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-9198 |
critical | 9.8 | 0.2866 | 2026-07-17 | KEV | Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve fu |
CVE-2026-9202 |
critical | 9.8 | 0.0050 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user acco | |
CVE-2026-9103 |
critical | 9.8 | 0.0321 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due | |
CVE-2026-13448 |
critical | 9.8 | 0.0067 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution | |
CVE-2026-13473 |
critical | 9.8 | 0.0067 | 2026-07-17 | IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Stora | |
CVE-2026-36669 |
critical | 9.8 | 0.0066 | 2026-07-17 | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11. | |
CVE-2026-46420 |
critical | 9.8 | 0.0201 | 2026-07-17 | setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, | |
CVE-2026-8505 |
critical | 9.8 | 0.0072 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic | |
CVE-2026-13446 |
critical | 9.8 | 0.0038 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptog | |
CVE-2026-47865 |
critical | 9.8 | 0.0061 | 2026-07-18 | VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with netw |