Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,964 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-68770 |
critical | 9.3 | 0.0091 | 2026-07-31 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achi | |
CVE-2026-68771 |
critical | 9.3 | 0.0115 | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node tha | |
CVE-2026-67324 |
critical | 9.3 | 0.0064 | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of - | |
CVE-2026-67341 |
critical | 9.3 | 0.0054 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUN | |
CVE-2026-67342 |
critical | 9.3 | 0.0054 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for t | |
CVE-2026-68582 |
critical | 9.3 | 0.0033 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerabi | |
CVE-2026-65321 |
critical | 9.3 | 0.0077 | 2026-08-02 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attacker | |
CVE-2026-18588 |
critical | 9.3 | 0.0110 | 2026-08-03 | A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets | |
CVE-2026-64827 |
critical | 9.3 | 0.0083 | 2026-08-03 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a | |
CVE-2026-41452 |
critical | 9.3 | 0.0374 | 2026-08-03 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that al | |
CVE-2026-18667 |
critical | 9.3 | 0.0072 | 2026-08-03 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privi | |
CVE-2026-61514 |
critical | 9.3 | 0.0083 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability t | |
CVE-2026-61515 |
critical | 9.3 | 0.0244 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vul | |
CVE-2026-69098 |
critical | 9.3 | 0.0091 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection e | |
CVE-2026-69110 |
critical | 9.3 | 0.0084 | 2026-08-04 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthentic | |
CVE-2026-69703 |
critical | 9.3 | 0.0059 | 2026-08-04 | Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_ | |
CVE-2026-70552 |
critical | 9.3 | 0.0083 | 2026-08-04 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher | |
CVE-2026-70553 |
critical | 9.3 | 0.0127 | 2026-08-04 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to | |
CVE-2026-70554 |
critical | 9.3 | 0.0123 | 2026-08-04 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to e | |
CVE-2026-9195 |
critical | 9.3 | 0.0065 | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 | |
CVE-2026-67531 |
critical | 9.3 | 0.0073 | 2026-08-06 | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the s | |
CVE-2026-53975 |
critical | 9.3 | 0.0168 | 2026-08-06 | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remot | |
CVE-2026-53976 |
critical | 9.3 | 0.0261 | 2026-08-06 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/rea | |
CVE-2026-65508 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | |
CVE-2026-65520 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | |
CVE-2026-65546 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | |
CVE-2026-66447 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | |
CVE-2026-70558 |
critical | 9.3 | 0.0082 | 2026-08-06 | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directl | |
CVE-2026-59118 |
critical | 9.3 | 0.0072 | 2026-08-06 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over | |
CVE-2026-19264 |
critical | 9.3 | 0.0101 | 2026-08-07 | Postiz is an open-source social media scheduling tool. The route that serves locally stored media jo | |
CVE-2026-71944 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71945 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71946 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71947 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71948 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71949 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71950 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71951 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71952 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71953 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71954 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c | |
CVE-2026-71955 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain | |
CVE-2026-71956 |
critical | 9.3 | 0.0317 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain | |
CVE-2026-71957 |
critical | 9.3 | 0.0107 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain | |
CVE-2026-71958 |
critical | 9.3 | 0.0107 | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain | |
CVE-2026-71983 |
critical | 9.3 | 0.0246 | 2026-08-08 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71984 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71985 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71986 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71987 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the |