Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,734 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-66012 |
critical | 10.0 | 0.0076 | 2026-07-25 | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint | |
CVE-2026-16812 |
critical | 10.0 | 0.0176 | 2026-07-27 | KEV | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow |
CVE-2026-11756 |
critical | 10.0 | 0.0081 | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE pla | |
CVE-2026-65880 |
critical | 10.0 | 0.0077 | 2026-07-28 | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An | |
CVE-2026-16498 |
critical | 10.0 | 0.0046 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue | |
CVE-2026-65883 |
critical | 10.0 | 0.0081 | 2026-07-29 | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guar | |
CVE-2026-65884 |
critical | 10.0 | 0.0052 | 2026-07-29 | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method | |
CVE-2026-65887 |
critical | 10.0 | 0.0052 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The | |
CVE-2026-65888 |
critical | 10.0 | 0.0052 | 2026-07-29 | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogi | |
CVE-2026-54735 |
critical | 10.0 | 0.0061 | 2026-07-29 | Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Pr | |
CVE-2026-16326 |
critical | 10.0 | 0.0054 | 2026-07-29 | In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless | |
CVE-2026-67429 |
critical | 10.0 | 0.0057 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.dow | |
CVE-2026-66803 |
critical | 10.0 | 0.0090 | 2026-07-30 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a ne | |
CVE-2026-18452 |
critical | 10.0 | 0.0063 | 2026-07-31 | DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauth | |
CVE-2026-33591 |
critical | 10.0 | 0.0071 | 2026-08-03 | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker | |
CVE-2026-48323 |
critical | 10.0 | 0.0137 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a | |
CVE-2026-48330 |
critical | 10.0 | 0.0104 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-48331 |
critical | 10.0 | 0.0095 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that | |
CVE-2026-64633 |
critical | 10.0 | 0.0060 | 2026-08-04 | A vulnerability allowing remote unauthenticated code execution on the agent host. | |
CVE-2026-48168 |
critical | 10.0 | 0.0150 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Acti | |
CVE-2026-65553 |
critical | 10.0 | 0.0086 | 2026-08-06 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 | |
CVE-2026-66665 |
critical | 10.0 | 0.0052 | 2026-08-06 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | |
CVE-2026-56162 |
critical | 10.0 | 0.0090 | 2026-08-06 | Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges | |
CVE-2026-63508 |
critical | 10.0 | 0.0080 | 2026-08-06 | Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthori | |
CVE-2026-65667 |
critical | 10.0 | 0.0080 | 2026-08-06 | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over | |
CVE-2026-66915 |
critical | 10.0 | 0.0082 | 2026-08-10 | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attac | |
CVE-2026-58231 |
critical | 10.0 | 0.0086 | 2026-08-11 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and s | |
CVE-2026-58115 |
critical | 10.0 | 0.0095 | 2026-08-11 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < | |
CVE-2026-48056 |
critical | 10.0 | 0.0055 | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions p | |
CVE-2026-17061 |
critical | 10.0 | 0.0081 | 2026-08-11 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 20 | |
CVE-2026-27302 |
critical | 10.0 | 0.0117 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-71398 |
critical | 10.0 | 0.0117 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-45618 |
critical | 10.0 | 0.0082 | 2026-08-11 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possi | |
CVE-2026-67282 |
critical | 10.0 | 0.0078 | 2026-08-12 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unaut | |
CVE-2026-73299 |
critical | 10.0 | 0.0178 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the T | |
CVE-2026-59500 |
critical | 10.0 | 0.0050 | 2026-08-13 | : Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (develope | |
CVE-2026-27544 |
critical | 10.0 | 0.0086 | 2026-08-13 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |
CVE-2026-61962 |
critical | 10.0 | 0.0069 | 2026-08-13 | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | |
CVE-2026-74253 |
critical | 10.0 | 0.0032 | 2026-08-17 | Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in | |
CVE-2026-73343 |
critical | 10.0 | 0.0086 | 2026-08-18 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | |
CVE-2026-61241 |
critical | 10.0 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID L | |
CVE-2026-70880 |
critical | 10.0 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (compon | |
CVE-2026-70921 |
critical | 10.0 | 0.0043 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-76008 |
critical | 10.0 | 0.0102 | 2026-08-19 | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the | |
CVE-2026-76604 |
critical | 10.0 | 0.0070 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabr | |
CVE-2026-76605 |
critical | 10.0 | 0.0070 | 2026-08-22 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | |
CVE-2026-76606 |
critical | 10.0 | 0.0050 | 2026-08-22 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |
CVE-2026-76607 |
critical | 10.0 | 0.0041 | 2026-08-22 | Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2. | |
CVE-2026-77995 |
critical | 10.0 | 0.0041 | 2026-08-24 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, O | |
CVE-2026-105134 |
critical | 10.0 | 0.8176 | 2026-10-04 | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to exec |