Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,964 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-39878 |
critical | 9.3 | 0.0043 | 2026-07-20 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the | |
CVE-2026-63766 |
critical | 9.3 | 0.0215 | 2026-07-20 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where AS | |
CVE-2026-63767 |
critical | 9.3 | 0.0112 | 2026-07-20 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserializa | |
CVE-2026-64625 |
critical | 9.3 | 0.0060 | 2026-07-20 | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped | |
CVE-2026-65008 |
critical | 9.3 | 0.0249 | 2026-07-21 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData | |
CVE-2026-65048 |
critical | 9.3 | 0.0054 | 2026-07-21 | Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored c | |
CVE-2026-47708 |
critical | 9.3 | 0.0038 | 2026-07-21 | MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, | |
CVE-2026-60220 |
critical | 9.3 | 0.0038 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60248 |
critical | 9.3 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60631 |
critical | 9.3 | 0.0020 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60632 |
critical | 9.3 | 0.0038 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-61175 |
critical | 9.3 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: I | |
CVE-2026-61207 |
critical | 9.3 | 0.0035 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle PeopleSoft (component: | |
CVE-2026-16416 |
critical | 9.3 | 0.0013 | 2026-07-21 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local attacker to | |
CVE-2026-8152 |
critical | 9.3 | 0.0041 | 2026-07-22 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site | |
CVE-2026-16232 |
critical | 9.3 | 0.0352 | 2026-07-22 | KEV | Check Point SmartConsole contains an improper authentication vulnerability which could allow an unau |
CVE-2026-59514 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | |
CVE-2026-59525 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-59526 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-61948 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | |
CVE-2026-61950 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | |
CVE-2026-65687 |
critical | 9.3 | 0.0087 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner | |
CVE-2026-65688 |
critical | 9.3 | 0.0087 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner | |
CVE-2026-65689 |
critical | 9.3 | 0.0087 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner | |
CVE-2026-65761 |
critical | 9.3 | 0.0104 | 2026-07-23 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0. | |
CVE-2026-65700 |
critical | 9.3 | 0.0152 | 2026-07-23 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that | |
CVE-2026-65701 |
critical | 9.3 | 0.0069 | 2026-07-23 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability | |
CVE-2026-63359 |
critical | 9.3 | 0.0075 | 2026-07-23 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an | |
CVE-2026-62835 |
critical | 9.3 | 0.0097 | 2026-07-24 | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over | |
CVE-2026-61884 |
critical | 9.3 | 0.0056 | 2026-07-24 | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an inst | |
CVE-2026-55971 |
critical | 9.3 | 0.0098 | 2026-07-27 | Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache T | |
CVE-2026-59527 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-59533 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | |
CVE-2026-59538 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | |
CVE-2026-59549 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. | |
CVE-2026-59550 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. | |
CVE-2026-16462 |
critical | 9.3 | 0.0075 | 2026-07-28 | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unaut | |
CVE-2026-14973 |
critical | 9.3 | 0.0045 | 2026-07-28 | IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written out | |
CVE-2026-18191 |
critical | 9.3 | 0.0069 | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated | |
CVE-2026-60112 |
critical | 9.3 | 0.0079 | 2026-07-29 | AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that | |
CVE-2026-60113 |
critical | 9.3 | 0.0083 | 2026-07-29 | AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing au | |
CVE-2026-67191 |
critical | 9.3 | 0.0096 | 2026-07-29 | Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that | |
CVE-2026-18236 |
critical | 9.3 | 0.0022 | 2026-07-29 | A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmat | |
CVE-2026-41939 |
critical | 9.3 | 0.0110 | 2026-07-29 | Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildF | |
CVE-2026-67426 |
critical | 9.3 | 0.0037 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the stand | |
CVE-2026-54363 |
critical | 9.3 | 0.0069 | 2026-07-30 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthentic | |
CVE-2026-11707 |
critical | 9.3 | 0.0038 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte | |
CVE-2026-67208 |
critical | 9.3 | 0.0722 | 2026-07-30 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remo | |
CVE-2026-67594 |
critical | 9.3 | 0.0085 | 2026-07-30 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthen | |
CVE-2026-66418 |
critical | 9.3 | 0.0063 | 2026-07-30 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent |