Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,904 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65581 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | |
CVE-2026-66662 |
critical | 9.8 | 0.0055 | 2026-08-06 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. | |
CVE-2026-67261 |
critical | 9.8 | 0.0232 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a | |
CVE-2026-15734 |
critical | 9.8 | 0.0077 | 2026-08-06 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allo | |
CVE-2026-17032 |
critical | 9.8 | 0.0054 | 2026-08-06 | Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised | |
CVE-2026-48085 |
critical | 9.8 | 0.0059 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-48087 |
critical | 9.8 | 0.0057 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-65400 |
critical | 9.8 | 0.0172 | 2026-08-06 | KEV | Apple macOS contains an improper authentication vulnerability that could allow an attacker on the ne |
CVE-2026-67688 |
critical | 9.8 | 0.0077 | 2026-08-06 | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the | |
CVE-2026-62873 |
critical | 9.8 | 0.0061 | 2026-08-06 | Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorize | |
CVE-2026-71558 |
critical | 9.8 | 0.0099 | 2026-08-07 | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache For | |
CVE-2026-61808 |
critical | 9.8 | 0.0250 | 2026-08-07 | LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRA | |
CVE-2026-28672 |
critical | 9.8 | 0.0263 | 2026-08-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in | |
CVE-2026-32227 |
critical | 9.8 | 0.0069 | 2026-08-10 | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recomme | |
CVE-2026-40920 |
critical | 9.8 | 0.0073 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are re | |
CVE-2026-42537 |
critical | 9.8 | 0.0129 | 2026-08-10 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgr | |
CVE-2026-44416 |
critical | 9.8 | 0.0124 | 2026-08-10 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apach | |
CVE-2026-55799 |
critical | 9.8 | 0.0122 | 2026-08-10 | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are | |
CVE-2026-72565 |
critical | 9.8 | 0.0068 | 2026-08-10 | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attacke | |
CVE-2026-72567 |
critical | 9.8 | 0.0079 | 2026-08-10 | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows | |
CVE-2026-72577 |
critical | 9.8 | 0.0127 | 2026-08-10 | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker t | |
CVE-2026-72580 |
critical | 9.8 | 0.0165 | 2026-08-10 | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote a | |
CVE-2026-72589 |
critical | 9.8 | 0.0195 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthentic | |
CVE-2026-72590 |
critical | 9.8 | 0.0204 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthentic | |
CVE-2026-72592 |
critical | 9.8 | 0.0080 | 2026-08-10 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated | |
CVE-2026-72593 |
critical | 9.8 | 0.0079 | 2026-08-10 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated rem | |
CVE-2026-13206 |
critical | 9.8 | 0.0177 | 2026-08-10 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi | |
CVE-2026-34265 |
critical | 9.8 | 0.0064 | 2026-08-11 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors i | |
CVE-2026-10579 |
critical | 9.8 | 0.0046 | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged | |
CVE-2026-72550 |
critical | 9.8 | 0.0061 | 2026-08-11 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated re | |
CVE-2026-72599 |
critical | 9.8 | 0.0061 | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbi | |
CVE-2026-12571 |
critical | 9.8 | 0.0327 | 2026-08-11 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeov | |
CVE-2026-59124 |
critical | 9.8 | 0.0153 | 2026-08-11 | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unaut | |
CVE-2026-73211 |
critical | 9.8 | 0.0073 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.upda | |
CVE-2026-26035 |
critical | 9.8 | 0.0075 | 2026-08-12 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through | |
CVE-2026-18847 |
critical | 9.8 | 0.0025 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials du | |
CVE-2026-73240 |
critical | 9.8 | 0.0104 | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects | |
CVE-2026-16956 |
critical | 9.8 | 0.0086 | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands d | |
CVE-2026-17218 |
critical | 9.8 | 0.0080 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-o | |
CVE-2026-17083 |
critical | 9.8 | 0.0080 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack- | |
CVE-2026-17111 |
critical | 9.8 | 0.0045 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially c | |
CVE-2026-10543 |
critical | 9.8 | 0.0039 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with | |
CVE-2026-10534 |
critical | 9.8 | 0.0038 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF | |
CVE-2026-18749 |
critical | 9.8 | 0.0051 | 2026-08-12 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttac | |
CVE-2026-16770 |
critical | 9.8 | 0.0073 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in | |
CVE-2026-49819 |
critical | 9.8 | 0.0108 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentica | |
CVE-2026-49827 |
critical | 9.8 | 0.0086 | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1 | |
CVE-2026-28008 |
critical | 9.8 | 0.0061 | 2026-08-13 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions | |
CVE-2026-28148 |
critical | 9.8 | 0.0034 | 2026-08-13 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | |
CVE-2026-28149 |
critical | 9.8 | 0.0056 | 2026-08-13 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. |