Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,691 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56004 |
critical | 10.0 | 0.0066 | 2026-07-02 | A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12 | |
CVE-2026-48316 |
critical | 10.0 | 0.0112 | 2026-07-06 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera | |
CVE-2026-57572 |
critical | 10.0 | 0.0094 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv | |
CVE-2026-56291 |
critical | 10.0 | 0.1485 | 2026-07-09 | KEV | Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows |
CVE-2026-59726 |
critical | 10.0 | 0.0302 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-co | |
CVE-2026-57211 |
critical | 10.0 | 0.0063 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ man | |
CVE-2026-57216 |
critical | 10.0 | 0.0050 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9- | |
CVE-2026-57827 |
critical | 10.0 | 0.0233 | 2026-07-11 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The J | |
CVE-2026-61447 |
critical | 10.0 | 0.1524 | 2026-07-11 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python( | |
CVE-2026-57719 |
critical | 10.0 | 0.0052 | 2026-07-13 | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen- | |
CVE-2026-57811 |
critical | 10.0 | 0.0056 | 2026-07-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic | |
CVE-2026-56451 |
critical | 10.0 | 0.0050 | 2026-07-14 | A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do n | |
CVE-2026-10577 |
critical | 10.0 | 0.0041 | 2026-07-14 | A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a ne | |
CVE-2026-62643 |
critical | 10.0 | 0.0025 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) | |
CVE-2026-54433 |
critical | 10.0 | 0.0031 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS | |
CVE-2026-15409 |
critical | 10.0 | 0.0679 | 2026-07-14 | KEV | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a |
CVE-2026-46339 |
critical | 10.0 | 0.0276 | 2026-07-15 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d | |
CVE-2026-45336 |
critical | 10.0 | 0.0056 | 2026-07-16 | HireFlow is a web-based interview management system for managing candidates, scheduling interviews, | |
CVE-2026-44181 |
critical | 10.0 | 0.0077 | 2026-07-16 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like | |
CVE-2026-44182 |
critical | 10.0 | 0.0063 | 2026-07-16 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like | |
CVE-2026-54159 |
critical | 10.0 | 0.0075 | 2026-07-17 | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4 | |
CVE-2026-44359 |
critical | 10.0 | 0.0180 | 2026-07-20 | Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtast | |
CVE-2026-46412 |
critical | 10.0 | 0.0076 | 2026-07-20 | @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with Op | |
CVE-2026-61424 |
critical | 10.0 | 0.0044 | 2026-07-20 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.1 | |
CVE-2026-61900 |
critical | 10.0 | 0.0044 | 2026-07-20 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1. | |
CVE-2026-16367 |
critical | 10.0 | 0.0055 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability wa | |
CVE-2026-8982 |
critical | 10.0 | 0.0048 | 2026-07-21 | Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. T | |
CVE-2026-8983 |
critical | 10.0 | 0.0069 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that | |
CVE-2026-47056 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Ser | |
CVE-2026-60217 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60358 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-60360 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Co | |
CVE-2026-60379 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messa | |
CVE-2026-60389 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messa | |
CVE-2026-60644 |
critical | 10.0 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-8984 |
critical | 10.0 | 0.0091 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via | |
CVE-2026-8985 |
critical | 10.0 | 0.0709 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /te | |
CVE-2026-60366 |
critical | 10.0 | 0.0055 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-59555 |
critical | 10.0 | 0.0060 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-64812 |
critical | 10.0 | 0.0048 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Devel | |
CVE-2026-64813 |
critical | 10.0 | 0.0052 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote | |
CVE-2026-65906 |
critical | 10.0 | 0.0066 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was po | |
CVE-2026-6516 |
critical | 10.0 | 0.0473 | 2026-07-23 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code | |
CVE-2026-42933 |
critical | 10.0 | 0.0051 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerabilit | |
CVE-2026-56191 |
critical | 10.0 | 0.0090 | 2026-07-24 | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tamp | |
CVE-2026-58275 |
critical | 10.0 | 0.0092 | 2026-07-24 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a netw | |
CVE-2026-62825 |
critical | 10.0 | 0.0092 | 2026-07-24 | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges ove | |
CVE-2026-56163 |
critical | 10.0 | 0.0090 | 2026-07-24 | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unautho | |
CVE-2026-57106 |
critical | 10.0 | 0.0090 | 2026-07-24 | Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privil | |
CVE-2026-58630 |
critical | 10.0 | 0.0086 | 2026-07-24 | Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges o |