Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,960 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-53982 |
critical | 9.3 | 0.0061 | 2025-12-23 | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=st | |
CVE-2025-25034 |
critical | 9.3 | 0.0496 | 2025-06-20 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7 | |
CVE-2025-71334 |
critical | 9.3 | 0.0436 | 2026-06-25 | Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that | |
CVE-2026-105207 |
critical | 9.3 | 0.0031 | 2026-10-04 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and externa | |
CVE-2026-105215 |
critical | 9.3 | 0.0034 | 2026-10-04 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 | |
CVE-2026-81694 |
critical | 9.3 | 0.0025 | 2026-08-27 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted dri | |
CVE-2026-82854 |
critical | 9.3 | 0.0198 | 2026-08-31 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.siz | |
CVE-2023-22793 |
critical | 9.3 | 0.0053 | 2026-10-29 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on serve | |
CVE-2026-72288 |
critical | 9.3 | 0.0019 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race b | |
CVE-2026-72329 |
critical | 9.3 | 0.0019 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: net/liquidio: drop cached VF pc | |
CVE-2026-80551 |
critical | 9.3 | 0.0020 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDA | |
CVE-2026-80554 |
critical | 9.3 | 0.0020 | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number | |
CVE-2026-89448 |
critical | 9.3 | 0.0014 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Force requesting AC | |
CVE-2026-89930 |
critical | 9.3 | 0.0019 | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB fl | |
CVE-2026-119597 |
critical | 9.3 | — | 2026-10-30 | OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthent | |
CVE-2026-119660 |
critical | 9.3 | — | 2026-10-30 | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated att | |
CVE-2026-61730 |
critical | 9.3 | — | 2026-10-30 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations nee | |
CVE-2026-119706 |
critical | 9.3 | — | 2026-10-30 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerabili | |
CVE-2026-93291 |
critical | 9.3 | 0.0024 | 2026-09-24 | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-m | |
CVE-2026-101986 |
critical | 9.3 | 0.0058 | 2026-10-14 | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved | |
CVE-2026-101990 |
critical | 9.3 | 0.0057 | 2026-10-14 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks | |
CVE-2026-39732 |
critical | 9.3 | — | 2026-10-30 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |
CVE-2026-78403 |
critical | 9.3 | — | 2026-10-30 | Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server o | |
CVE-2026-80098 |
critical | 9.3 | 0.0049 | 2026-09-03 | Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker t | |
CVE-2026-69356 |
critical | 9.3 | 0.0076 | 2026-09-08 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex | |
CVE-2026-117656 |
critical | 9.3 | — | 2026-10-30 | Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple st | |
CVE-2026-83662 |
critical | 9.3 | 0.0103 | 2026-10-13 | Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An att | |
CVE-2025-34522 |
critical | 9.2 | 0.0056 | 2025-08-27 | A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Dat | |
CVE-2025-40938 |
critical | 9.2 | 0.0038 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device | |
CVE-2026-35615 |
critical | 9.2 | 0.0042 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() | |
CVE-2026-5189 |
critical | 9.2 | 0.0053 | 2026-04-15 | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3 | |
CVE-2026-39918 |
critical | 9.2 | 0.0066 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where th | |
CVE-2026-41264 |
critical | 9.2 | 0.0179 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-41265 |
critical | 9.2 | 0.0057 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-27843 |
critical | 9.2 | 0.0052 | 2026-04-24 | A vulnerability exists in SenseLive X3050's web management interface that allows critical configurat | |
CVE-2026-41930 |
critical | 9.2 | 0.0035 | 2026-05-06 | Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-a | |
CVE-2026-44126 |
critical | 9.2 | 0.0047 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which ca | |
CVE-2026-8178 |
critical | 9.2 | 0.0060 | 2026-05-08 | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, th | |
CVE-2026-7428 |
critical | 9.2 | 0.0024 | 2026-05-12 | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for Postg | |
CVE-2026-8072 |
critical | 9.2 | 0.0015 | 2026-05-12 | Insecure generation of credentials in the local SAT (Technical Support) access functionality of the | |
CVE-2026-42945 |
critical | 9.2 | 0.6805 | 2026-05-13 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vu | |
CVE-2026-42281 |
critical | 9.2 | 0.0162 | 2026-05-14 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Se | |
CVE-2026-0481 |
critical | 9.2 | 0.0031 | 2026-05-15 | Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a re | |
CVE-2026-41552 |
critical | 9.2 | 0.0050 | 2026-05-15 | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due | |
CVE-2026-7182 |
critical | 9.2 | 0.0040 | 2026-05-15 | Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitiz | |
CVE-2026-46725 |
critical | 9.2 | 0.0262 | 2026-05-19 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely pr | |
CVE-2026-48242 |
critical | 9.2 | 0.0030 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, user | |
CVE-2026-49973 |
critical | 9.2 | 0.0054 | 2026-06-11 | Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows u | |
CVE-2026-49757 |
critical | 9.2 | 0.0062 | 2026-06-15 | Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account tak | |
CVE-2026-48853 |
critical | 9.2 | 0.0078 | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabi |