Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,967 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49776 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatica | |
CVE-2026-52693 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
CVE-2026-39574 |
critical | 9.3 | 0.0023 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
CVE-2026-49772 |
critical | 9.3 | 0.0194 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-52715 |
critical | 9.3 | 0.0119 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
CVE-2026-53776 |
critical | 9.3 | 0.0036 | 2026-06-16 | Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass | |
CVE-2026-48777 |
critical | 9.3 | 0.0055 | 2026-06-16 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, | |
CVE-2026-35305 |
critical | 9.3 | 0.0034 | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Th | |
CVE-2026-35306 |
critical | 9.3 | 0.0035 | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Th | |
CVE-2026-46785 |
critical | 9.3 | 0.0020 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-46795 |
critical | 9.3 | 0.0039 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-46805 |
critical | 9.3 | 0.0039 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-46912 |
critical | 9.3 | 0.0027 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Run | |
CVE-2026-46913 |
critical | 9.3 | 0.0014 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Install | |
CVE-2026-22332 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. | |
CVE-2026-22340 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
CVE-2026-39438 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
CVE-2026-39596 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
CVE-2026-48616 |
critical | 9.3 | 0.0033 | 2026-06-17 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access contro | |
CVE-2026-48745 |
critical | 9.3 | 0.0032 | 2026-06-17 | Traccar Client is a GPS tracking mobile app for sending location updates to private servers using th | |
CVE-2026-48875 |
critical | 9.3 | 0.0042 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
CVE-2026-49076 |
critical | 9.3 | 0.0037 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-49079 |
critical | 9.3 | 0.0035 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. | |
CVE-2026-49080 |
critical | 9.3 | 0.0031 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
CVE-2026-49084 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. | |
CVE-2026-54186 |
critical | 9.3 | 0.0029 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
CVE-2026-54187 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | |
CVE-2026-54811 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | |
CVE-2026-54808 |
critical | 9.3 | 0.0031 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54809 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54815 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54819 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-47103 |
critical | 9.3 | 0.0136 | 2026-06-17 | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that | |
CVE-2026-54812 |
critical | 9.3 | 0.0028 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-53805 |
critical | 9.3 | 0.0087 | 2026-06-17 | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vuln | |
CVE-2026-48768 |
critical | 9.3 | 0.0033 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/ge | |
CVE-2026-55740 |
critical | 9.3 | 0.0028 | 2026-06-18 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) | |
CVE-2026-11717 |
critical | 9.3 | 0.0018 | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateO | |
CVE-2026-11718 |
critical | 9.3 | 0.0019 | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateO | |
CVE-2026-54419 |
critical | 9.3 | 0.0044 | 2026-06-18 | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commi | |
CVE-2026-54390 |
critical | 9.3 | 0.0060 | 2026-06-18 | 1 PoC | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that a |
CVE-2026-12048 |
critical | 9.3 | 0.0027 | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text retur | |
CVE-2026-54414 |
critical | 9.3 | 0.0066 | 2026-06-19 | FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/fo | |
CVE-2026-56073 |
critical | 9.3 | 0.0023 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allo | |
CVE-2026-56081 |
critical | 9.3 | 0.0043 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and cont | |
CVE-2024-58351 |
critical | 9.3 | 0.0093 | 2026-06-20 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the | |
CVE-2026-55450 |
critical | 9.3 | 0.0119 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unaut | |
CVE-2026-56121 |
critical | 9.3 | 0.0141 | 2026-06-24 | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or | |
CVE-2026-46423 |
critical | 9.3 | 0.0022 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-55666 |
critical | 9.3 | 0.0041 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8 |