Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,966 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40157 |
critical | 9.4 | 0.0038 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .pr | |
CVE-2026-3893 |
critical | 9.4 | 0.0037 | 2026-04-28 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with netw | |
CVE-2026-41571 |
critical | 9.4 | 0.0037 | 2026-05-04 | Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/d | |
CVE-2026-42613 |
critical | 9.4 | 0.0114 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login | |
CVE-2026-42882 |
critical | 9.4 | 0.0055 | 2026-05-11 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentic | |
CVE-2026-44262 |
critical | 9.4 | 0.0586 | 2026-05-12 | Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when docume | |
CVE-2026-44592 |
critical | 9.4 | 0.0016 | 2026-05-14 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (th | |
CVE-2026-45035 |
critical | 9.4 | 0.0038 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Tabby regist | |
CVE-2026-9739 |
critical | 9.4 | 0.0028 | 2026-05-27 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we i | |
CVE-2026-11535 |
critical | 9.4 | 0.0015 | 2026-06-12 | An unauthorized access vulnerability exists in the PcSuite APP. The vulnerability can be exploited b | |
CVE-2026-55743 |
critical | 9.4 | 0.0039 | 2026-06-17 | The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (de | |
CVE-2026-44939 |
critical | 9.4 | 0.0128 | 2026-06-19 | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/ | |
CVE-2026-11746 |
critical | 9.4 | 0.0023 | 2026-06-22 | A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling | |
CVE-2026-44089 |
critical | 9.4 | 0.0031 | 2026-06-23 | Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstec | |
CVE-2026-52830 |
critical | 9.4 | 0.0065 | 2026-07-02 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer | |
CVE-2026-60002 |
critical | 9.4 | 0.0030 | 2026-07-08 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key | |
CVE-2026-23556 |
critical | 9.4 | 0.0014 | 2026-07-09 | When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leake | |
CVE-2026-23559 |
critical | 9.4 | 0.0017 | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti | |
CVE-2026-23560 |
critical | 9.4 | 0.0017 | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti | |
CVE-2026-23561 |
critical | 9.4 | 0.0017 | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti | |
CVE-2026-23562 |
critical | 9.4 | 0.0017 | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti | |
CVE-2026-42486 |
critical | 9.4 | 0.0017 | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti | |
CVE-2026-61876 |
critical | 9.4 | 0.0162 | 2026-07-12 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allo | |
CVE-2026-61451 |
critical | 9.4 | 0.0031 | 2026-07-15 | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-suppli | |
CVE-2026-12693 |
critical | 9.4 | 0.0046 | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Pla | |
CVE-2026-63830 |
critical | 9.4 | 0.0044 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy ac | |
CVE-2026-53595 |
critical | 9.4 | 0.0194 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-61186 |
critical | 9.4 | 0.0041 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (compon | |
CVE-2026-61203 |
critical | 9.4 | 0.0046 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Exp | |
CVE-2026-65605 |
critical | 9.4 | 0.0079 | 2026-07-23 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (databas | |
CVE-2026-66395 |
critical | 9.4 | 0.0056 | 2026-07-27 | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p | |
CVE-2026-48088 |
critical | 9.4 | 0.0038 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-50516 |
critical | 9.4 | 0.0083 | 2026-08-11 | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to eleva | |
CVE-2026-73032 |
critical | 9.4 | 0.0056 | 2026-08-11 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e | |
CVE-2026-66147 |
critical | 9.4 | 0.0176 | 2026-08-11 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G | |
CVE-2026-50561 |
critical | 9.4 | 0.0068 | 2026-08-12 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor | |
CVE-2026-73296 |
critical | 9.4 | 0.0365 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t | |
CVE-2026-57580 |
critical | 9.4 | 0.0059 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Sourc | |
CVE-2026-62629 |
critical | 9.4 | 0.0041 | 2026-08-18 | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Securi | |
CVE-2026-71166 |
critical | 9.4 | 0.0046 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-71167 |
critical | 9.4 | 0.0046 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-73920 |
critical | 9.4 | 0.0046 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-16839 |
critical | 9.4 | 0.0052 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info | |
CVE-2026-76311 |
critical | 9.4 | 0.0045 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who | |
CVE-2026-111811 |
critical | 9.4 | 0.0036 | 2026-10-21 | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, a | |
CVE-2026-112408 |
critical | 9.4 | 0.0074 | 2026-10-21 | Missing verification of source of a communication channel in the default_bucket() function in Amazon | |
CVE-2026-79872 |
critical | 9.4 | 0.0056 | 2026-10-22 | A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to | |
CVE-2025-30047 |
critical | 9.4 | 0.0038 | 2026-10-23 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The | |
CVE-2025-30050 |
critical | 9.4 | 0.0022 | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports t | |
CVE-2026-115557 |
critical | 9.4 | 0.0053 | 2026-10-24 | Python has added a denylist for known compromised certificates to the "ssl" module to ensure user sa |