Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,956 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-83782 |
critical | 9.8 | 0.0101 | 2026-10-13 | Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a n | |
CVE-2026-83869 |
critical | 9.8 | 0.0082 | 2026-10-13 | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code | |
CVE-2026-83910 |
critical | 9.8 | 0.0106 | 2026-10-13 | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. | |
CVE-2026-83935 |
critical | 9.8 | 0.0090 | 2026-10-13 | Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to execute code over a n | |
CVE-2026-84015 |
critical | 9.8 | 0.0087 | 2026-10-13 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthor | |
CVE-2026-85792 |
critical | 9.8 | 0.0089 | 2026-10-13 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an | |
CVE-2026-85806 |
critical | 9.8 | 0.0091 | 2026-10-13 | Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an unauthorized attacke | |
CVE-2026-85809 |
critical | 9.8 | 0.0093 | 2026-10-13 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an | |
CVE-2026-85814 |
critical | 9.8 | 0.0093 | 2026-10-13 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to | |
CVE-2026-88102 |
critical | 9.8 | 0.0063 | 2026-10-13 | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a ne | |
CVE-2026-88156 |
critical | 9.8 | 0.0117 | 2026-10-13 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute c | |
CVE-2026-88178 |
critical | 9.8 | 0.0097 | 2026-10-13 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a | |
CVE-2026-96096 |
critical | 9.8 | 0.0066 | 2026-10-13 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code o | |
CVE-2026-96219 |
critical | 9.8 | 0.0089 | 2026-10-13 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthor | |
CVE-2026-97016 |
critical | 9.8 | 0.0117 | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute co | |
CVE-2026-97749 |
critical | 9.8 | 0.0120 | 2026-10-13 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a netwo | |
CVE-2026-67631 |
critical | 9.8 | 0.0097 | 2026-09-08 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a netw | |
CVE-2026-66302 |
critical | 9.8 | 0.0097 | 2026-09-08 | External control of file name or path in Skype for Business allows an unauthorized attacker to execu | |
CVE-2026-69399 |
critical | 9.8 | 0.0048 | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability | |
CVE-2026-109516 |
critical | 9.8 | 0.0057 | 2026-10-29 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass lead | |
CVE-2026-42922 |
critical | 9.8 | 0.0053 | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2 | |
CVE-2026-113616 |
critical | 9.8 | 0.0034 | 2026-10-29 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code t | |
CVE-2026-115245 |
critical | 9.8 | 0.0046 | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, r | |
CVE-2026-105192 |
critical | 9.8 | 0.0102 | 2026-10-07 | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so w |
CVE-2024-42360 |
critical | 9.8 | 0.0058 | 2024-08-14 | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal | |
CVE-2026-104317 |
critical | 9.8 | 0.0057 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message brok | |
CVE-2026-104339 |
critical | 9.8 | 0.0075 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to | |
CVE-2026-18894 |
critical | 9.8 | 0.0043 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored P | |
CVE-2026-54856 |
critical | 9.8 | 0.0049 | 2026-10-29 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |
CVE-2026-54857 |
critical | 9.8 | 0.0049 | 2026-10-29 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |
CVE-2026-54858 |
critical | 9.8 | 0.0049 | 2026-10-29 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |
CVE-2026-54859 |
critical | 9.8 | 0.0053 | 2026-10-29 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | |
CVE-2026-54860 |
critical | 9.8 | 0.0049 | 2026-10-29 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
CVE-2026-61992 |
critical | 9.8 | 0.0039 | 2026-10-29 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | |
CVE-2026-61997 |
critical | 9.8 | 0.0051 | 2026-10-29 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
CVE-2026-61998 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |
CVE-2026-62001 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | |
CVE-2026-62002 |
critical | 9.8 | 0.0051 | 2026-10-29 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |
CVE-2026-62003 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
CVE-2026-62004 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
CVE-2026-62005 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
CVE-2026-62006 |
critical | 9.8 | 0.0042 | 2026-10-29 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
CVE-2026-62008 |
critical | 9.8 | 0.0042 | 2026-10-29 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
CVE-2026-62009 |
critical | 9.8 | 0.0043 | 2026-10-29 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
CVE-2026-62010 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
CVE-2026-62011 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
CVE-2026-62012 |
critical | 9.8 | 0.0042 | 2026-10-29 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
CVE-2026-62013 |
critical | 9.8 | 0.0045 | 2026-10-29 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
CVE-2026-62014 |
critical | 9.8 | 0.0043 | 2026-10-29 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
CVE-2026-62015 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. |