Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,964 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-71988 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71989 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71990 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71991 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71992 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-71993 |
critical | 9.3 | 0.0246 | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the | |
CVE-2026-63106 |
critical | 9.3 | 0.0050 | 2026-08-10 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product l | |
CVE-2026-47754 |
critical | 9.3 | 0.0047 | 2026-08-10 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versi | |
CVE-2026-48158 |
critical | 9.3 | 0.0067 | 2026-08-10 | use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and | |
CVE-2026-16626 |
critical | 9.3 | 0.0045 | 2026-08-10 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft | |
CVE-2026-48159 |
critical | 9.3 | 0.0067 | 2026-08-10 | use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05- | |
CVE-2026-48160 |
critical | 9.3 | 0.0067 | 2026-08-10 | react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and 2026-05-19 | |
CVE-2026-48161 |
critical | 9.3 | 0.0067 | 2026-08-10 | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the de | |
CVE-2026-19425 |
critical | 9.3 | 0.0064 | 2026-08-11 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability | |
CVE-2026-72785 |
critical | 9.3 | 0.0027 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-pane | |
CVE-2026-48046 |
critical | 9.3 | 0.0036 | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions p | |
CVE-2026-69102 |
critical | 9.3 | 0.0064 | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in appli | |
CVE-2026-73090 |
critical | 9.3 | 0.0040 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity | |
CVE-2026-73034 |
critical | 9.3 | 0.0570 | 2026-08-11 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers | |
CVE-2026-66659 |
critical | 9.3 | 0.0040 | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-64639 |
critical | 9.3 | 0.0055 | 2026-08-12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low | |
CVE-2026-73519 |
critical | 9.3 | 0.0124 | 2026-08-12 | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every buil | |
CVE-2026-59506 |
critical | 9.3 | 0.0041 | 2026-08-13 | : Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to P | |
CVE-2026-59507 |
critical | 9.3 | 0.0034 | 2026-08-13 | : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Impro | |
CVE-2026-28001 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
CVE-2026-28142 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | |
CVE-2026-61966 |
critical | 9.3 | 0.0040 | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | |
CVE-2026-61969 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | |
CVE-2026-66436 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. | |
CVE-2026-66472 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | |
CVE-2026-66478 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | |
CVE-2026-67614 |
critical | 9.3 | 0.0096 | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SS | |
CVE-2026-74880 |
critical | 9.3 | 0.0056 | 2026-08-17 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and | |
CVE-2026-74886 |
critical | 9.3 | 0.0068 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the Plugin | |
CVE-2026-74890 |
critical | 9.3 | 0.0021 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCiph | |
CVE-2026-74254 |
critical | 9.3 | 0.0039 | 2026-08-17 | Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Pag | |
CVE-2026-75110 |
critical | 9.3 | 0.0066 | 2026-08-17 | MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is en | |
CVE-2026-64849 |
critical | 9.3 | 0.1002 | 2026-08-17 | KEV | MLflow contains a server-side request forgery vulnerability that can allow attackers to reach intern |
CVE-2026-75626 |
critical | 9.3 | 0.0033 | 2026-08-18 | SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s | |
CVE-2026-75627 |
critical | 9.3 | 0.0084 | 2026-08-18 | Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unaut | |
CVE-2026-74902 |
critical | 9.3 | 0.0020 | 2026-08-18 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flo | |
CVE-2026-75827 |
critical | 9.3 | 0.0086 | 2026-08-18 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare | |
CVE-2026-75832 |
critical | 9.3 | 0.0030 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in | |
CVE-2026-75835 |
critical | 9.3 | 0.0031 | 2026-08-18 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerabili | |
CVE-2026-75837 |
critical | 9.3 | 0.0049 | 2026-08-18 | Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required sec | |
CVE-2026-75852 |
critical | 9.3 | 0.0066 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB | |
CVE-2026-75854 |
critical | 9.3 | 0.0089 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-pro | |
CVE-2026-73187 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | |
CVE-2026-73339 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | |
CVE-2026-73355 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions. |