Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,964 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-55981 |
critical | 9.6 | 0.0023 | 2026-10-23 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to mo | |
CVE-2026-116863 |
critical | 9.6 | 0.0018 | 2026-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite a | |
CVE-2026-48360 |
critical | 9.6 | 0.0045 | 2026-10-27 | Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerabil | |
CVE-2026-118305 |
critical | 9.6 | 0.0037 | 2026-10-27 | Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to p | |
CVE-2026-118306 |
critical | 9.6 | 0.0037 | 2026-10-27 | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to | |
CVE-2026-118308 |
critical | 9.6 | 0.0031 | 2026-10-27 | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potential | |
CVE-2026-118309 |
critical | 9.6 | 0.0031 | 2026-10-27 | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remo | |
CVE-2026-118310 |
critical | 9.6 | 0.0031 | 2026-10-27 | Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a r | |
CVE-2026-118312 |
critical | 9.6 | 0.0031 | 2026-10-27 | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to pote | |
CVE-2026-118316 |
critical | 9.6 | 0.0029 | 2026-10-27 | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to | |
CVE-2026-118321 |
critical | 9.6 | 0.0035 | 2026-10-27 | Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a re | |
CVE-2026-118332 |
critical | 9.6 | 0.0029 | 2026-10-27 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote at | |
CVE-2026-118340 |
critical | 9.6 | 0.0035 | 2026-10-27 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to poten | |
CVE-2026-118342 |
critical | 9.6 | 0.0029 | 2026-10-27 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to | |
CVE-2026-118355 |
critical | 9.6 | 0.0029 | 2026-10-27 | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attack | |
CVE-2026-115904 |
critical | 9.6 | 0.0074 | 2026-10-28 | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior t | |
CVE-2026-69400 |
critical | 9.6 | 0.0094 | 2026-08-20 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a | |
CVE-2026-48561 |
critical | 9.6 | 0.0086 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat | |
CVE-2026-50380 |
critical | 9.6 | 0.0082 | 2026-07-14 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a ne | |
CVE-2026-55008 |
critical | 9.6 | 0.0086 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex | |
CVE-2026-102238 |
critical | 9.6 | 0.0082 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code | |
CVE-2026-119261 |
critical | 9.6 | 0.0021 | 2026-10-30 | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker | |
CVE-2026-119263 |
critical | 9.6 | 0.0020 | 2026-10-30 | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote atta | |
CVE-2026-62863 |
critical | 9.6 | — | 2026-10-30 | MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE m | |
CVE-2026-65669 |
critical | 9.6 | 0.0086 | 2026-09-08 | Improper neutralization of special elements in output used by a downstream component ('injection') i | |
CVE-2026-81376 |
critical | 9.6 | 0.0090 | 2026-09-08 | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to | |
CVE-2026-47172 |
critical | 9.5 | 0.0041 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-47174 |
critical | 9.5 | 0.0039 | 2026-06-11 | In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build wo | |
CVE-2026-12046 |
critical | 9.5 | 0.0104 | 2026-06-19 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_i | |
CVE-2026-48909 |
critical | 9.5 | 0.0494 | 2026-06-20 | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation | |
CVE-2026-49468 |
critical | 9.5 | 0.0303 | 2026-06-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84. | |
CVE-2026-10539 |
critical | 9.5 | 0.0042 | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied inpu | |
CVE-2026-22093 |
critical | 9.5 | 0.0026 | 2026-07-13 | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the ce | |
CVE-2026-6875 |
critical | 9.5 | 0.0143 | 2026-07-13 | ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow | |
CVE-2026-13385 |
critical | 9.5 | 0.0014 | 2026-07-15 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS | |
CVE-2026-8986 |
critical | 9.5 | 0.0328 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when proce | |
CVE-2026-58073 |
critical | 9.5 | 0.0032 | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonat | |
CVE-2026-70470 |
critical | 9.5 | 0.0097 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-70477 |
critical | 9.5 | 0.0081 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-54210 |
critical | 9.5 | 0.0066 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities | |
CVE-2026-54211 |
critical | 9.5 | 0.0064 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulne | |
CVE-2026-54212 |
critical | 9.5 | 0.0066 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable t | |
CVE-2026-19001 |
critical | 9.5 | 0.0054 | 2026-08-12 | The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an app | |
CVE-2026-77992 |
critical | 9.5 | 0.0044 | 2026-08-22 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 | |
CVE-2026-97631 |
critical | 9.5 | 0.0063 | 2026-10-22 | 3 PoC | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer O |
CVE-2026-103594 |
critical | 9.5 | 0.0043 | 2026-10-27 | A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allo | |
CVE-2026-116366 |
critical | 9.5 | — | 2026-10-30 | 1 PoC | An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an una |
CVE-2026-35030 |
critical | 9.4 | 0.0063 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83. | |
CVE-2026-40157 |
critical | 9.4 | 0.0038 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .pr | |
CVE-2026-3893 |
critical | 9.4 | 0.0037 | 2026-04-28 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with netw |