Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,966 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44257 |
critical | 9.3 | 0.0039 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip | |
CVE-2026-44258 |
critical | 9.3 | 0.0036 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk function valida | |
CVE-2026-32661 |
critical | 9.3 | 0.0047 | 2026-05-13 | Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Sec | |
CVE-2026-40621 |
critical | 9.3 | 0.0049 | 2026-05-13 | ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. | |
CVE-2026-42062 |
critical | 9.3 | 0.0163 | 2026-05-13 | ELECOM wireless LAN access point devices contain an OS command injection in processing of username p | |
CVE-2026-41315 |
critical | 9.3 | 0.0103 | 2026-05-14 | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthoriz | |
CVE-2026-8634 |
critical | 9.3 | 0.0095 | 2026-05-14 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attacke | |
CVE-2026-44666 |
critical | 9.3 | 0.0038 | 2026-05-14 | HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3 | |
CVE-2026-8398 |
critical | 9.3 | 0.0146 | 2026-05-15 | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integr |
CVE-2026-42155 |
critical | 9.3 | 0.0037 | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-45010 |
critical | 9.3 | 0.0043 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerab | |
CVE-2026-46364 |
critical | 9.3 | 0.0171 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::gar | |
CVE-2026-4320 |
critical | 9.3 | 0.0025 | 2026-05-18 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unaut | |
CVE-2026-42097 |
critical | 9.3 | 0.0094 | 2026-05-19 | Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "mod | |
CVE-2026-42727 |
critical | 9.3 | 0.0029 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42747 |
critical | 9.3 | 0.0024 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42755 |
critical | 9.3 | 0.0024 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42761 |
critical | 9.3 | 0.0023 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-35087 |
critical | 9.3 | 0.0066 | 2026-05-27 | Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypa | |
CVE-2026-35090 |
critical | 9.3 | 0.0063 | 2026-05-27 | In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticate | |
CVE-2026-44590 |
critical | 9.3 | 0.0114 | 2026-05-27 | Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the G | |
CVE-2026-8979 |
critical | 9.3 | 0.0078 | 2026-05-28 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. A | |
CVE-2026-8980 |
critical | 9.3 | 0.0052 | 2026-05-28 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An au | |
CVE-2026-24444 |
critical | 9.3 | 0.0053 | 2026-05-28 | SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded pas | |
CVE-2026-9037 |
critical | 9.3 | 0.0025 | 2026-05-28 | A firmware update mechanism in the affected charging controller fails to validate the authenticity o | |
CVE-2026-46395 |
critical | 9.3 | 0.0029 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `h | |
CVE-2026-39494 |
critical | 9.3 | 0.0039 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42647 |
critical | 9.3 | 0.0132 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-11849 |
critical | 9.3 | 0.0035 | 2026-06-12 | The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnera | |
CVE-2026-53787 |
critical | 9.3 | 0.0564 | 2026-06-12 | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary fil | |
CVE-2026-5482 |
critical | 9.3 | 0.0044 | 2026-06-15 | Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extensio | |
CVE-2026-49952 |
critical | 9.3 | 0.0472 | 2026-06-15 | Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that | |
CVE-2026-39441 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. | |
CVE-2026-39492 |
critical | 9.3 | 0.0036 | 2026-06-15 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | |
CVE-2026-39493 |
critical | 9.3 | 0.0036 | 2026-06-15 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. | |
CVE-2026-39502 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
CVE-2026-39511 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
CVE-2026-39512 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. | |
CVE-2026-39519 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. | |
CVE-2026-39530 |
critical | 9.3 | 0.0030 | 2026-06-15 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
CVE-2026-40771 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. | |
CVE-2026-40798 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. | |
CVE-2026-42381 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. | |
CVE-2026-42386 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. | |
CVE-2026-42639 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. | |
CVE-2026-42665 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. | |
CVE-2026-45439 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
CVE-2026-48886 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-49067 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | |
CVE-2026-49776 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatica |