Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,964 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-73365 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | |
CVE-2026-74015 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | |
CVE-2026-75784 |
critical | 9.3 | 0.0110 | 2026-08-18 | A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the functio | |
CVE-2026-75926 |
critical | 9.3 | 0.0028 | 2026-08-18 | Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code runnin | |
CVE-2026-50161 |
critical | 9.3 | 0.0072 | 2026-08-18 | libre is a generic library for real-time communications with asynchronous input and output support. | |
CVE-2026-52735 |
critical | 9.3 | 0.0051 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept a block that zcashd | |
CVE-2026-62618 |
critical | 9.3 | 0.0035 | 2026-08-18 | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Securi | |
CVE-2026-70673 |
critical | 9.3 | 0.0035 | 2026-08-18 | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Securi | |
CVE-2026-70855 |
critical | 9.3 | 0.0036 | 2026-08-18 | Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Tr | |
CVE-2026-70998 |
critical | 9.3 | 0.0035 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-71037 |
critical | 9.3 | 0.0038 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-71065 |
critical | 9.3 | 0.0035 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-19490 |
critical | 9.3 | 0.3265 | 2026-08-19 | KEV | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving |
CVE-2026-71960 |
critical | 9.3 | 0.0053 | 2026-08-19 | Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnera | |
CVE-2026-75143 |
critical | 9.3 | 0.0070 | 2026-08-19 | FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavforma | |
CVE-2026-66794 |
critical | 9.3 | 0.0062 | 2026-08-19 | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This | |
CVE-2026-16822 |
critical | 9.3 | 0.0025 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC p | |
CVE-2026-66592 |
critical | 9.3 | 0.0040 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-19586 |
critical | 9.3 | 0.0572 | 2026-08-20 | A pre-authentication OS command injection vulnerability has been identified in Omada gateways config | |
CVE-2026-77644 |
critical | 9.3 | 0.0043 | 2026-08-20 | A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliabili | |
CVE-2026-76571 |
critical | 9.3 | 0.0042 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter i | |
CVE-2026-76602 |
critical | 9.3 | 0.0039 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The | |
CVE-2026-77994 |
critical | 9.3 | 0.0039 | 2026-08-24 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla | |
CVE-2026-92812 |
critical | 9.3 | 0.0044 | 2026-09-16 | Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard | |
CVE-2026-75885 |
critical | 9.3 | 0.0073 | 2026-09-18 | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/d | |
CVE-2026-100886 |
critical | 9.3 | 0.0115 | 2026-09-27 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. | |
CVE-2026-100752 |
critical | 9.3 | 0.0032 | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7. | |
CVE-2026-101108 |
critical | 9.3 | 0.0032 | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - | |
CVE-2026-21589 |
critical | 9.3 | 0.9948 | 2026-10-05 | KEV 13 PoC | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management |
CVE-2026-39746 |
critical | 9.3 | 0.0037 | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-39795 |
critical | 9.3 | 0.0030 | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-109566 |
critical | 9.3 | 0.0044 | 2026-10-12 | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows rem | |
CVE-2026-106629 |
critical | 9.3 | 0.0087 | 2026-10-13 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could | |
CVE-2026-106630 |
critical | 9.3 | 0.0087 | 2026-10-13 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could | |
CVE-2020-37282 |
critical | 9.3 | 0.0345 | 2026-10-14 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers | |
CVE-2026-110635 |
critical | 9.3 | 0.0252 | 2026-10-14 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js h | |
CVE-2026-110640 |
critical | 9.3 | 0.0273 | 2026-10-14 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to e | |
CVE-2026-111643 |
critical | 9.3 | 0.0058 | 2026-10-16 | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauth | |
CVE-2026-111693 |
critical | 9.3 | 0.0050 | 2026-10-16 | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allo | |
CVE-2026-98464 |
critical | 9.3 | 0.0014 | 2026-10-18 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtime | |
CVE-2026-112296 |
critical | 9.3 | 0.0042 | 2026-10-19 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthentica | |
CVE-2026-112780 |
critical | 9.3 | 0.0072 | 2026-10-19 | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to | |
CVE-2026-109444 |
critical | 9.3 | 0.0070 | 2026-10-20 | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers | |
CVE-2026-77930 |
critical | 9.3 | 0.0069 | 2026-10-20 | EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to r | |
CVE-2026-91622 |
critical | 9.3 | 0.0022 | 2026-10-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply | |
CVE-2026-91644 |
critical | 9.3 | 0.0022 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-113736 |
critical | 9.3 | 0.0092 | 2026-10-21 | A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function | |
CVE-2026-114108 |
critical | 9.3 | 0.0053 | 2026-10-21 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allo | |
CVE-2026-114119 |
critical | 9.3 | 0.0043 | 2026-10-21 | Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administr | |
CVE-2026-76475 |
critical | 9.3 | 0.0033 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams f |