Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,691 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-46778 |
critical | 10.0 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-46781 |
critical | 10.0 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-46798 |
critical | 10.0 | 0.0048 | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-46800 |
critical | 10.0 | 0.0048 | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-46803 |
critical | 10.0 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Securit | |
CVE-2026-46846 |
critical | 10.0 | 0.0036 | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Securit | |
CVE-2026-46978 |
critical | 10.0 | 0.0031 | 2026-06-17 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daem | |
CVE-2026-0063 |
critical | 10.0 | 0.0015 | 2026-06-17 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier rest | |
CVE-2026-0064 |
critical | 10.0 | 0.0012 | 2026-06-17 | In multiple places, there is a possible persistent denial of service due to resource exhaustion. Thi | |
CVE-2026-0068 |
critical | 10.0 | 0.0012 | 2026-06-17 | In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC | |
CVE-2026-0071 |
critical | 10.0 | 0.0015 | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This | |
CVE-2026-0081 |
critical | 10.0 | 0.0015 | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could | |
CVE-2026-0082 |
critical | 10.0 | 0.0016 | 2026-06-17 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permissi | |
CVE-2026-0083 |
critical | 10.0 | 0.0012 | 2026-06-17 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This c | |
CVE-2026-0092 |
critical | 10.0 | 0.0022 | 2026-06-17 | In Package Manager, there is a possible device lock controller bypass due to a missing permission ch | |
CVE-2026-25470 |
critical | 10.0 | 0.0065 | 2026-06-17 | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress < | |
CVE-2026-28575 |
critical | 10.0 | 0.0013 | 2026-06-17 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/Pac | |
CVE-2026-28587 |
critical | 10.0 | 0.0011 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information | |
CVE-2026-28615 |
critical | 10.0 | 0.0012 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions byp | |
CVE-2026-48055 |
critical | 10.0 | 0.0070 | 2026-06-17 | Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versi | |
CVE-2026-3490 |
critical | 10.0 | 0.0082 | 2026-06-17 | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire | |
CVE-2026-28573 |
critical | 10.0 | 0.0014 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission | |
CVE-2026-49257 |
critical | 10.0 | 0.0062 | 2026-06-18 | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. I | |
CVE-2026-48772 |
critical | 10.0 | 0.0023 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, | |
CVE-2026-45480 |
critical | 10.0 | 0.0090 | 2026-06-19 | Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privile | |
CVE-2026-48908 |
critical | 10.0 | 0.8851 | 2026-06-20 | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability |
CVE-2026-48939 |
critical | 10.0 | 0.2007 | 2026-06-20 | KEV | iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the u |
CVE-2026-10561 |
critical | 10.0 | 0.0082 | 2026-06-22 | IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python exe | |
CVE-2026-53753 |
critical | 10.0 | 0.0290 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expres | |
CVE-2026-12485 |
critical | 10.0 | 0.0060 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove | |
CVE-2026-12846 |
critical | 10.0 | 0.0060 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove | |
CVE-2026-12847 |
critical | 10.0 | 0.0060 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove | |
CVE-2026-12848 |
critical | 10.0 | 0.0060 | 2026-06-24 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove | |
CVE-2026-46752 |
critical | 10.0 | 0.0048 | 2026-06-25 | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache | |
CVE-2026-57700 |
critical | 10.0 | 0.0052 | 2026-06-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Mali | |
CVE-2026-2053 |
critical | 10.0 | 0.0039 | 2026-06-26 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not suffi | |
CVE-2026-49869 |
critical | 10.0 | 0.0209 | 2026-06-26 | KEV | Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote |
CVE-2026-53576 |
critical | 10.0 | 0.0330 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authe | |
CVE-2026-56290 |
critical | 10.0 | 0.3087 | 2026-06-29 | KEV | Joomlack Page Builder contains an improper access control vulnerability that could allow for remote |
CVE-2026-48276 |
critical | 10.0 | 0.0126 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with | |
CVE-2026-48277 |
critical | 10.0 | 0.0129 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera | |
CVE-2026-48281 |
critical | 10.0 | 0.0142 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera | |
CVE-2026-48282 |
critical | 10.0 | 0.4239 | 2026-06-30 | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution |
CVE-2026-48283 |
critical | 10.0 | 0.0126 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with | |
CVE-2026-48286 |
critical | 10.0 | 0.0117 | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth | |
CVE-2026-10134 |
critical | 10.0 | 0.0232 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl | |
CVE-2026-13773 |
critical | 10.0 | 0.0610 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in | |
CVE-2026-13782 |
critical | 10.0 | 0.0032 | 2026-06-30 | Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had | |
CVE-2026-57624 |
critical | 10.0 | 0.0086 | 2026-07-02 | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. | |
CVE-2026-50746 |
critical | 10.0 | 0.0169 | 2026-07-02 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability |