Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,956 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-112847 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection. | |
CVE-2026-112848 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Inje | |
CVE-2026-112851 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Inje | |
CVE-2026-112853 |
critical | 9.8 | 0.0041 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object I | |
CVE-2026-112854 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allow | |
CVE-2026-112855 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.Thi | |
CVE-2026-112856 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object | |
CVE-2026-112857 |
critical | 9.8 | 0.0041 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injecti | |
CVE-2026-112858 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection | |
CVE-2026-112859 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allo | |
CVE-2026-57116 |
critical | 9.8 | 0.0042 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's Ag | |
CVE-2026-98959 |
critical | 9.8 | 0.0061 | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when m | |
CVE-2026-99078 |
critical | 9.8 | 0.0046 | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK bu | |
CVE-2026-99079 |
critical | 9.8 | 0.0046 | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK bu | |
CVE-2026-53921 |
critical | 9.8 | 0.0112 | 2026-10-23 | 2 PoC | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.1 |
CVE-2026-46651 |
critical | 9.8 | 0.0038 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-46652 |
critical | 9.8 | 0.0070 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-115806 |
critical | 9.8 | 0.0055 | 2026-10-24 | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in | |
CVE-2026-110956 |
critical | 9.8 | 0.0036 | 2026-10-24 | The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine secon | |
CVE-2026-114196 |
critical | 9.8 | 0.0045 | 2026-10-24 | Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Inje | |
CVE-2026-94075 |
critical | 9.8 | 0.0045 | 2026-10-24 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite a | |
CVE-2026-115214 |
critical | 9.8 | 0.0028 | 2026-10-25 | The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity | |
CVE-2026-107092 |
critical | 9.8 | 0.0104 | 2026-10-26 | 1 PoC | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
CVE-2026-107656 |
critical | 9.8 | 0.0085 | 2026-10-26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5 | |
CVE-2026-31158 |
critical | 9.8 | 0.0069 | 2026-10-26 | 1 PoC | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attac |
CVE-2026-65184 |
critical | 9.8 | 0.0042 | 2026-10-26 | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied We | |
CVE-2026-10757 |
critical | 9.8 | 0.0044 | 2026-10-26 | There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows an | |
CVE-2026-115915 |
critical | 9.8 | 0.0066 | 2026-10-26 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO pas | |
CVE-2026-18450 |
critical | 9.8 | 0.0040 | 2026-10-27 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attac | |
CVE-2026-92885 |
critical | 9.8 | 0.0037 | 2026-10-27 | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account T | |
CVE-2026-76934 |
critical | 9.8 | 0.0052 | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affe | |
CVE-2026-76938 |
critical | 9.8 | 0.0064 | 2026-10-27 | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects J | |
CVE-2026-76939 |
critical | 9.8 | 0.0052 | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This issue affec | |
CVE-2026-82116 |
critical | 9.8 | 0.0061 | 2026-10-27 | Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Serv | |
CVE-2026-82117 |
critical | 9.8 | 0.0064 | 2026-10-27 | Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 1 | |
CVE-2026-82118 |
critical | 9.8 | 0.0052 | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: fr | |
CVE-2026-82119 |
critical | 9.8 | 0.0105 | 2026-10-27 | OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-0 | |
CVE-2026-82120 |
critical | 9.8 | 0.0036 | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: fro | |
CVE-2026-86574 |
critical | 9.8 | 0.0052 | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Base: from 11-00 befor | |
CVE-2026-116692 |
critical | 9.8 | 0.0070 | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-110879 |
critical | 9.8 | 0.0120 | 2026-10-28 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected cla | |
CVE-2026-106013 |
critical | 9.8 | 0.0055 | 2026-10-28 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Soc | |
CVE-2026-84999 |
critical | 9.8 | 0.0048 | 2026-10-28 | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all | |
CVE-2026-103688 |
critical | 9.8 | 0.0061 | 2026-10-28 | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded f | |
CVE-2026-109218 |
critical | 9.8 | 0.0064 | 2026-10-28 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up t | |
CVE-2026-86397 |
critical | 9.8 | 0.0034 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-86400 |
critical | 9.8 | 0.0090 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-86384 |
critical | 9.8 | 0.0047 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-103780 |
critical | 9.8 | 0.0083 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-114278 |
critical | 9.8 | 0.0090 | 2026-10-28 | The che-machine-exec service constructs a shell command by concatenating user-controlled input (the |