Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,962 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-114220 |
critical | 9.3 | 0.0019 | 2026-10-22 | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unaut | |
CVE-2026-112327 |
critical | 9.3 | 0.0033 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2021-48014 |
critical | 9.3 | 0.0203 | 2026-10-22 | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_sv | |
CVE-2021-48016 |
critical | 9.3 | 0.0044 | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP R | |
CVE-2022-51026 |
critical | 9.3 | 0.0061 | 2026-10-22 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthentic | |
CVE-2026-79873 |
critical | 9.3 | 0.0024 | 2026-10-22 | Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated | |
CVE-2026-79874 |
critical | 9.3 | 0.0024 | 2026-10-22 | An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumv | |
CVE-2026-79875 |
critical | 9.3 | 0.0023 | 2026-10-22 | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an un | |
CVE-2026-79876 |
critical | 9.3 | 0.0023 | 2026-10-22 | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow | |
CVE-2026-19677 |
critical | 9.3 | 0.0053 | 2026-10-23 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0. | |
CVE-2026-112860 |
critical | 9.3 | 0.0032 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-25784 |
critical | 9.3 | 0.0034 | 2026-10-23 | Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (c | |
CVE-2026-55486 |
critical | 9.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-115812 |
critical | 9.3 | 0.0053 | 2026-10-23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1. | |
CVE-2026-111402 |
critical | 9.3 | 0.0035 | 2026-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-112866 |
critical | 9.3 | 0.0036 | 2026-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-110475 |
critical | 9.3 | 0.0048 | 2026-10-26 | This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication a | |
CVE-2026-116214 |
critical | 9.3 | 0.0046 | 2026-10-26 | MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthe | |
CVE-2026-116485 |
critical | 9.3 | 0.0235 | 2026-10-26 | danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated | |
CVE-2026-59106 |
critical | 9.3 | 0.0055 | 2026-10-26 | A security vulnerability has been identified in the WolfProt interface implementation. Insufficient | |
CVE-2026-93328 |
critical | 9.3 | 0.0053 | 2026-10-26 | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Dat | |
CVE-2026-112346 |
critical | 9.3 | 0.0101 | 2026-10-26 | OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnera | |
CVE-2026-102788 |
critical | 9.3 | 0.0039 | 2026-10-27 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store prod | |
CVE-2026-102789 |
critical | 9.3 | 0.0032 | 2026-10-27 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < | |
CVE-2026-117532 |
critical | 9.3 | 0.0068 | 2026-10-27 | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structur | |
CVE-2026-117564 |
critical | 9.3 | 0.0060 | 2026-10-27 | nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated | |
CVE-2026-117601 |
critical | 9.3 | 0.0018 | 2026-10-27 | Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool trans | |
CVE-2026-117603 |
critical | 9.3 | 0.0019 | 2026-10-27 | Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plu | |
CVE-2026-104350 |
critical | 9.3 | 0.0060 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An | |
CVE-2026-114595 |
critical | 9.3 | 0.0050 | 2026-10-27 | In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause | |
CVE-2026-118333 |
critical | 9.3 | 0.0019 | 2026-10-27 | Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to | |
CVE-2026-118337 |
critical | 9.3 | 0.0019 | 2026-10-27 | Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker t | |
CVE-2026-111411 |
critical | 9.3 | 0.0034 | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-115607 |
critical | 9.3 | 0.0024 | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-118690 |
critical | 9.3 | 0.0069 | 2026-10-28 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenti | |
CVE-2026-70306 |
critical | 9.3 | 0.0101 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-49798 |
critical | 9.3 | 0.0036 | 2026-07-14 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. | |
CVE-2026-62834 |
critical | 9.3 | 0.0053 | 2026-08-20 | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attack | |
CVE-2026-70279 |
critical | 9.3 | 0.0129 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex | |
CVE-2026-63146 |
critical | 9.3 | 0.0066 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, atta | |
CVE-2018-25254 |
critical | 9.3 | 0.0091 | 2026-04-04 | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability that allows | |
CVE-2026-70009 |
critical | 9.3 | 0.0053 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows a | |
CVE-2026-32557 |
critical | 9.3 | 0.0037 | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-114358 |
critical | 9.3 | 0.0050 | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user su | |
CVE-2026-115964 |
critical | 9.3 | 0.0032 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-97854 |
critical | 9.3 | 0.0137 | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vu | |
CVE-2026-92152 |
critical | 9.3 | 0.0067 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedde | |
CVE-2026-111732 |
critical | 9.3 | 0.0040 | 2026-10-29 | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from | |
CVE-2026-118762 |
critical | 9.3 | 0.0032 | 2026-10-29 | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/f | |
CVE-2026-89010 |
critical | 9.3 | 0.0317 | 2026-09-11 | WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticat |