Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,889 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-38711 |
critical | 9.8 | 0.0275 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-38708 |
critical | 9.8 | 0.0275 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-38713 |
critical | 9.8 | 0.0275 | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300 | |
CVE-2026-51785 |
critical | 9.8 | 0.0115 | 2026-07-31 | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary co | |
CVE-2026-8457 |
critical | 9.8 | 0.0070 | 2026-08-02 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all ve | |
CVE-2026-2346 |
critical | 9.8 | 0.0051 | 2026-08-03 | Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App a | |
CVE-2026-18108 |
critical | 9.8 | 0.0031 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_asser | |
CVE-2026-52102 |
critical | 9.8 | 0.0294 | 2026-08-03 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 all | |
CVE-2026-48333 |
critical | 9.8 | 0.0095 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-14175 |
critical | 9.8 | 0.0052 | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Cons | |
CVE-2026-15721 |
critical | 9.8 | 0.0029 | 2026-08-04 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultan | |
CVE-2026-63455 |
critical | 9.8 | 0.0080 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow | |
CVE-2026-63456 |
critical | 9.8 | 0.0080 | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow | |
CVE-2026-24254 |
critical | 9.8 | 0.0089 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attack | |
CVE-2026-0163 |
critical | 9.8 | 0.0038 | 2026-08-04 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. Th | |
CVE-2026-66902 |
critical | 9.8 | 0.0070 | 2026-08-04 | Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JS | |
CVE-2026-61484 |
critical | 9.8 | 0.0081 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. T | |
CVE-2026-61486 |
critical | 9.8 | 0.0081 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This is | |
CVE-2026-71207 |
critical | 9.8 | 0.0071 | 2026-08-05 | The Stock-Inventory-Management-System application's login.php assigns raw username/password values t | |
CVE-2026-71214 |
critical | 9.8 | 0.0048 | 2026-08-05 | The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derive | |
CVE-2026-71231 |
critical | 9.8 | 0.0066 | 2026-08-05 | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM us | |
CVE-2026-71254 |
critical | 9.8 | 0.0055 | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_fil | |
CVE-2026-71256 |
critical | 9.8 | 0.0055 | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in n | |
CVE-2026-71267 |
critical | 9.8 | 0.0055 | 2026-08-05 | microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller | |
CVE-2026-71278 |
critical | 9.8 | 0.0066 | 2026-08-05 | rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_ | |
CVE-2026-71289 |
critical | 9.8 | 0.0068 | 2026-08-05 | The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default dock | |
CVE-2026-10025 |
critical | 9.8 | 0.0065 | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML Externa | |
CVE-2026-9192 |
critical | 9.8 | 0.0083 | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11 | |
CVE-2026-17617 |
critical | 9.8 | 0.0034 | 2026-08-05 | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SS | |
CVE-2026-20272 |
critical | 9.8 | 0.0057 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So | |
CVE-2026-9205 |
critical | 9.8 | 0.0030 | 2026-08-05 | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key | |
CVE-2026-66909 |
critical | 9.8 | 0.0115 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java | |
CVE-2026-68079 |
critical | 9.8 | 0.0068 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an | |
CVE-2026-5134 |
critical | 9.8 | 0.0048 | 2026-08-06 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-28005 |
critical | 9.8 | 0.0048 | 2026-08-06 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions. | |
CVE-2026-28139 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | |
CVE-2026-54489 |
critical | 9.8 | 0.0062 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a | |
CVE-2026-65507 |
critical | 9.8 | 0.0048 | 2026-08-06 | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | |
CVE-2026-65552 |
critical | 9.8 | 0.0056 | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | |
CVE-2026-65556 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. | |
CVE-2026-65571 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | |
CVE-2026-65572 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | |
CVE-2026-65573 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | |
CVE-2026-65574 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | |
CVE-2026-65575 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | |
CVE-2026-65576 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | |
CVE-2026-65577 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | |
CVE-2026-65578 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | |
CVE-2026-65579 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | |
CVE-2026-65581 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. |