Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,967 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-32956 |
critical | 9.3 | 0.0052 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vul | |
CVE-2026-5963 |
critical | 9.3 | 0.0037 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remot | |
CVE-2026-5964 |
critical | 9.3 | 0.0037 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remot | |
CVE-2026-32311 |
critical | 9.3 | 0.0051 | 2026-04-20 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, tr | |
CVE-2026-5965 |
critical | 9.3 | 0.0164 | 2026-04-21 | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated l | |
CVE-2026-40872 |
critical | 9.3 | 0.0036 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-41064 |
critical | 9.3 | 0.0034 | 2026-04-22 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fi | |
CVE-2026-34415 |
critical | 9.3 | 0.0357 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability | |
CVE-2026-41468 |
critical | 9.3 | 0.0039 | 2026-04-22 | Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbo | |
CVE-2026-6885 |
critical | 9.3 | 0.0050 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File U | |
CVE-2026-6886 |
critical | 9.3 | 0.0045 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication By | |
CVE-2026-6887 |
critical | 9.3 | 0.0036 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vul | |
CVE-2026-23751 |
critical | 9.3 | 0.0088 | 2026-04-23 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) | |
CVE-2026-6074 |
critical | 9.3 | 0.0055 | 2026-04-23 | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the | |
CVE-2026-25874 |
critical | 9.3 | 0.1555 | 2026-04-23 | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeli | |
CVE-2026-6942 |
critical | 9.3 | 0.0192 | 2026-04-23 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows rem | |
CVE-2026-26210 |
critical | 9.3 | 0.0070 | 2026-04-23 | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve ba | |
CVE-2026-33102 |
critical | 9.3 | 0.0040 | 2026-04-23 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker | |
CVE-2026-41274 |
critical | 9.3 | 0.0050 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-25775 |
critical | 9.3 | 0.0040 | 2026-04-24 | A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update | |
CVE-2026-35503 |
critical | 9.3 | 0.0055 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be perf | |
CVE-2026-39462 |
critical | 9.3 | 0.0039 | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface in which password updates are n | |
CVE-2026-40620 |
critical | 9.3 | 0.0055 | 2026-04-24 | A vulnerability in SenseLive X3050’s embedded management service allows full administrative control | |
CVE-2026-40630 |
critical | 9.3 | 0.0073 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certa | |
CVE-2026-25660 |
critical | 9.3 | 0.0045 | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyz | |
CVE-2026-39920 |
critical | 9.3 | 0.0054 | 2026-04-24 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administ | |
CVE-2026-6911 |
critical | 9.3 | 0.0025 | 2026-04-24 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT to | |
CVE-2026-42363 |
critical | 9.3 | 0.0019 | 2026-04-27 | An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVis | |
CVE-2026-41940 |
critical | 9.3 | 0.9853 | 2026-04-29 | KEV | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass |
CVE-2026-7161 |
critical | 9.3 | 0.0022 | 2026-05-04 | An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVis | |
CVE-2026-41922 |
critical | 9.3 | 0.0498 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41923 |
critical | 9.3 | 0.0309 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41924 |
critical | 9.3 | 0.0320 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41925 |
critical | 9.3 | 0.0400 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-41926 |
critical | 9.3 | 0.0123 | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerabilit | |
CVE-2026-40797 |
critical | 9.3 | 0.0035 | 2026-05-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2023-54342 |
critical | 9.3 | 0.0046 | 2026-05-05 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the | |
CVE-2023-54344 |
critical | 9.3 | 0.0055 | 2026-05-05 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows un | |
CVE-2026-0300 |
critical | 9.3 | 0.4171 | 2026-05-06 | KEV | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authenticatio |
CVE-2026-41586 |
critical | 9.3 | 0.0053 | 2026-05-07 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing s | |
CVE-2026-42208 |
critical | 9.3 | 0.8942 | 2026-05-08 | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the |
CVE-2026-8076 |
critical | 9.3 | 0.0032 | 2026-05-08 | Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform | |
CVE-2026-44125 |
critical | 9.3 | 0.0039 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multip | |
CVE-2026-44128 |
critical | 9.3 | 0.0085 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution i | |
CVE-2026-41583 |
critical | 9.3 | 0.0028 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-scr | |
CVE-2026-44643 |
critical | 9.3 | 0.0048 | 2026-05-11 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Pr | |
CVE-2026-43900 |
critical | 9.3 | 0.0037 | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and ag | |
CVE-2026-41551 |
critical | 9.3 | 0.0049 | 2026-05-12 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a pat | |
CVE-2026-42300 |
critical | 9.3 | 0.0026 | 2026-05-12 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the S | |
CVE-2026-34660 |
critical | 9.3 | 0.0044 | 2026-05-12 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization |