Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,960 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-69525 |
critical | 9.8 | 0.0097 | 2026-09-08 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code ov | |
CVE-2026-69579 |
critical | 9.8 | 0.0097 | 2026-09-08 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a net | |
CVE-2026-69730 |
critical | 9.8 | 0.0097 | 2026-09-08 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | |
CVE-2026-69819 |
critical | 9.8 | 0.0097 | 2026-09-08 | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a network. | |
CVE-2026-72979 |
critical | 9.8 | 0.0097 | 2026-09-08 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network | |
CVE-2026-72982 |
critical | 9.8 | 0.0097 | 2026-09-08 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over | |
CVE-2026-72983 |
critical | 9.8 | 0.0097 | 2026-09-08 | Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execu | |
CVE-2026-77493 |
critical | 9.8 | 0.0097 | 2026-09-08 | Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a n | |
CVE-2026-78509 |
critical | 9.8 | 0.0097 | 2026-09-08 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute co | |
CVE-2026-63377 |
critical | 9.8 | — | 2026-10-30 | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data us | |
CVE-2026-109220 |
critical | 9.8 | — | 2026-10-31 | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable | |
CVE-2026-34205 |
critical | 9.6 | 0.0027 | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy first. Ho | |
CVE-2026-33976 |
critical | 9.6 | 0.0072 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a | |
CVE-2026-5288 |
critical | 9.6 | 0.0032 | 2026-04-01 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attac | |
CVE-2026-5289 |
critical | 9.6 | 0.0035 | 2026-04-01 | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who | |
CVE-2026-5290 |
critical | 9.6 | 0.0032 | 2026-04-01 | Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who | |
CVE-2026-35044 |
critical | 9.6 | 0.0039 | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and model infe | |
CVE-2026-23818 |
critical | 9.6 | 0.0032 | 2026-04-07 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Pr | |
CVE-2026-40088 |
critical | 9.6 | 0.0042 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow | |
CVE-2026-40154 |
critical | 9.6 | 0.0030 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched templat | |
CVE-2026-1115 |
critical | 9.6 | 0.0126 | 2026-04-10 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/l | |
CVE-2026-27303 |
critical | 9.6 | 0.0061 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data | |
CVE-2026-6296 |
critical | 9.6 | 0.0056 | 2026-04-15 | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to | |
CVE-2026-6919 |
critical | 9.6 | 0.0029 | 2026-04-23 | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who ha | |
CVE-2026-6920 |
critical | 9.6 | 0.0021 | 2026-04-23 | Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attac | |
CVE-2026-7321 |
critical | 9.6 | 0.0026 | 2026-04-28 | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulner | |
CVE-2026-5166 |
critical | 9.6 | 0.0033 | 2026-04-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBI | |
CVE-2026-42090 |
critical | 9.6 | 0.0048 | 2026-05-04 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop | |
CVE-2026-7908 |
critical | 9.6 | 0.0022 | 2026-05-06 | Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to po | |
CVE-2026-7910 |
critical | 9.6 | 0.0022 | 2026-05-06 | Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had co | |
CVE-2026-35428 |
critical | 9.6 | 0.0093 | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud S | |
CVE-2026-43899 |
critical | 9.6 | 0.0040 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and ag | |
CVE-2026-45321 |
critical | 9.6 | 0.0328 | 2026-05-12 | KEV | TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be |
CVE-2026-34263 |
critical | 9.6 | 0.0061 | 2026-05-12 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to | |
CVE-2026-34659 |
critical | 9.6 | 0.0063 | 2026-05-12 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrus | |
CVE-2026-44482 |
critical | 9.6 | 0.0034 | 2026-05-14 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock sup | |
CVE-2026-8511 |
critical | 9.6 | 0.0023 | 2026-05-14 | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potential | |
CVE-2026-8580 |
critical | 9.6 | 0.0021 | 2026-05-14 | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potenti | |
CVE-2026-45311 |
critical | 9.6 | 0.0057 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool ex | |
CVE-2026-45323 |
critical | 9.6 | 0.0032 | 2026-05-28 | MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node name | |
CVE-2026-45374 |
critical | 9.6 | 0.0039 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawn | |
CVE-2026-12027 |
critical | 9.6 | 0.0022 | 2026-06-11 | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote a | |
CVE-2026-52703 |
critical | 9.6 | 0.0044 | 2026-06-15 | Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. | |
CVE-2026-46786 |
critical | 9.6 | 0.0021 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-46789 |
critical | 9.6 | 0.0042 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-46853 |
critical | 9.6 | 0.0048 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c | |
CVE-2026-46856 |
critical | 9.6 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c | |
CVE-2026-12440 |
critical | 9.6 | 0.0025 | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a r | |
CVE-2026-10789 |
critical | 9.6 | 0.0070 | 2026-06-22 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the M | |
CVE-2026-48519 |
critical | 9.6 | 0.0078 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the " |