Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,906 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-28185 |
critical | 9.8 | 0.0027 | 2026-08-13 | Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. | |
CVE-2026-61967 |
critical | 9.8 | 0.0048 | 2026-08-13 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. | |
CVE-2026-66424 |
critical | 9.8 | 0.0048 | 2026-08-13 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. | |
CVE-2026-66465 |
critical | 9.8 | 0.0061 | 2026-08-13 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | |
CVE-2026-66691 |
critical | 9.8 | 0.0048 | 2026-08-13 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | |
CVE-2026-73649 |
critical | 9.8 | 0.0073 | 2026-08-13 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, t | |
CVE-2026-50770 |
critical | 9.8 | 0.0061 | 2026-08-17 | An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges | |
CVE-2026-50772 |
critical | 9.8 | 0.0068 | 2026-08-17 | An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via | |
CVE-2026-50774 |
critical | 9.8 | 0.0061 | 2026-08-17 | An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Ma | |
CVE-2026-67678 |
critical | 9.8 | 0.0077 | 2026-08-17 | File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute ar | |
CVE-2026-47698 |
critical | 9.8 | 0.0097 | 2026-08-17 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.j | |
CVE-2026-67967 |
critical | 9.8 | 0.0065 | 2026-08-17 | Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary | |
CVE-2026-67960 |
critical | 9.8 | 0.0073 | 2026-08-17 | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController. | |
CVE-2026-38165 |
critical | 9.8 | 0.0087 | 2026-08-17 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration | |
CVE-2026-67919 |
critical | 9.8 | 0.0093 | 2026-08-17 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.ja | |
CVE-2026-15748 |
critical | 9.8 | 0.0409 | 2026-08-18 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up | |
CVE-2026-34884 |
critical | 9.8 | 0.0069 | 2026-08-18 | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking | |
CVE-2026-74987 |
critical | 9.8 | 0.0072 | 2026-08-18 | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of thes | |
CVE-2026-74988 |
critical | 9.8 | 0.0061 | 2026-08-18 | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed eviden | |
CVE-2026-74989 |
critical | 9.8 | 0.0057 | 2026-08-18 | Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruptio | |
CVE-2026-74990 |
critical | 9.8 | 0.0072 | 2026-08-18 | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firef | |
CVE-2026-32470 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | |
CVE-2026-59940 |
critical | 9.8 | 0.0081 | 2026-08-18 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap | |
CVE-2026-73341 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | |
CVE-2026-73366 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | |
CVE-2026-73376 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | |
CVE-2026-73380 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | |
CVE-2026-73397 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | |
CVE-2026-73996 |
critical | 9.8 | 0.0052 | 2026-08-18 | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | |
CVE-2026-47627 |
critical | 9.8 | 0.0073 | 2026-08-18 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path | |
CVE-2026-60672 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60696 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60698 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60721 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg | |
CVE-2026-60727 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg | |
CVE-2026-60782 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmissio | |
CVE-2026-60821 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Busi | |
CVE-2026-60858 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Secu | |
CVE-2026-60921 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-60946 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-60947 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-60958 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-60970 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-60971 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-60977 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core | |
CVE-2026-61018 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-61258 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID L | |
CVE-2026-61272 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Run | |
CVE-2026-61318 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C | |
CVE-2026-62457 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component |