Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,966 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57679 |
critical | 9.3 | 0.0040 | 2026-07-02 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. | |
CVE-2026-57683 |
critical | 9.3 | 0.0040 | 2026-07-02 | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. | |
CVE-2026-58466 |
critical | 9.3 | 0.0080 | 2026-07-02 | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthe | |
CVE-2026-59099 |
critical | 9.3 | 0.0055 | 2026-07-02 | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthen | |
CVE-2026-41106 |
critical | 9.3 | 0.0072 | 2026-07-02 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker | |
CVE-2026-58473 |
critical | 9.3 | 0.0051 | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated at | |
CVE-2026-59705 |
critical | 9.3 | 0.0064 | 2026-07-07 | mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthe | |
CVE-2026-2342 |
critical | 9.3 | 0.0039 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-58122 |
critical | 9.3 | 0.0037 | 2026-07-09 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthentic | |
CVE-2026-58123 |
critical | 9.3 | 0.0465 | 2026-07-09 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that al | |
CVE-2026-15378 |
critical | 9.3 | 0.0053 | 2026-07-10 | A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacke | |
CVE-2026-15143 |
critical | 9.3 | 0.0054 | 2026-07-10 | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allow | |
CVE-2026-61459 |
critical | 9.3 | 0.0236 | 2026-07-10 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools | |
CVE-2026-20744 |
critical | 9.3 | 0.0076 | 2026-07-10 | The charging station websocket endpoint accepts connections without proper authentication, which co | |
CVE-2026-56271 |
critical | 9.3 | 0.0066 | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets | |
CVE-2026-22095 |
critical | 9.3 | 0.0139 | 2026-07-13 | The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-22096 |
critical | 9.3 | 0.0055 | 2026-07-13 | The webserver running on port 8090 does not require authentication. This allows for sensitive inform | |
CVE-2026-22097 |
critical | 9.3 | 0.0033 | 2026-07-13 | The firmware update mechanism does not include cryptographic signature validation. This allows anyon | |
CVE-2026-22102 |
critical | 9.3 | 0.0053 | 2026-07-13 | A POST request sent to a specific webserver endpoint can be used to write to arbitrary file location | |
CVE-2026-22103 |
critical | 9.3 | 0.0139 | 2026-07-13 | The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-57702 |
critical | 9.3 | 0.0045 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57707 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57726 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57739 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-59515 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-12257 |
critical | 9.3 | 0.0070 | 2026-07-13 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. | |
CVE-2026-60121 |
critical | 9.3 | 0.0330 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj | |
CVE-2026-61498 |
critical | 9.3 | 0.0401 | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj | |
CVE-2026-6847 |
critical | 9.3 | 0.0088 | 2026-07-13 | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a cri | |
CVE-2026-61500 |
critical | 9.3 | 0.0191 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Ma | |
CVE-2026-59801 |
critical | 9.3 | 0.0262 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote a | |
CVE-2026-62327 |
critical | 9.3 | 0.0627 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that | |
CVE-2026-48356 |
critical | 9.3 | 0.4458 | 2026-07-14 | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability |
CVE-2026-61736 |
critical | 9.3 | 0.0142 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server default | |
CVE-2026-61740 |
critical | 9.3 | 0.0051 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is d | |
CVE-2026-52842 |
critical | 9.3 | 0.0025 | 2026-07-15 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched | |
CVE-2026-52843 |
critical | 9.3 | 0.0023 | 2026-07-15 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() | |
CVE-2026-50562 |
critical | 9.3 | 0.0021 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c | |
CVE-2026-55445 |
critical | 9.3 | 0.0053 | 2026-07-15 | Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. | |
CVE-2026-54733 |
critical | 9.3 | 0.0088 | 2026-07-16 | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Dire | |
CVE-2026-59864 |
critical | 9.3 | 0.0133 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` | |
CVE-2026-59865 |
critical | 9.3 | 0.0436 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read | |
CVE-2026-59866 |
critical | 9.3 | 0.0141 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms | |
CVE-2026-63087 |
critical | 9.3 | 0.0071 | 2026-07-16 | Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote a | |
CVE-2026-62241 |
critical | 9.3 | 0.0067 | 2026-07-17 | clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-de | |
CVE-2026-9586 |
critical | 9.3 | 0.1898 | 2026-07-17 | KEV | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote atta |
CVE-2026-15091 |
critical | 9.3 | 0.0057 | 2026-07-17 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary sc | |
CVE-2026-63938 |
critical | 9.3 | 0.0020 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request ind | |
CVE-2026-63939 |
critical | 9.3 | 0.0020 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct m | |
CVE-2026-63940 |
critical | 9.3 | 0.0019 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O reque |