Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,768 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40289 |
critical | 9.1 | 0.0042 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of prais | |
CVE-2026-40313 |
critical | 9.1 | 0.0031 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows | |
CVE-2026-31908 |
critical | 9.1 | 0.0052 | 2026-04-14 | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configu | |
CVE-2026-2332 |
critical | 9.1 | 0.0131 | 2026-04-14 | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are u | |
CVE-2026-33807 |
critical | 9.1 | 0.0043 | 2026-04-15 | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that cau | |
CVE-2026-33808 |
critical | 9.1 | 0.0048 | 2026-04-15 | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express mid | |
CVE-2026-5426 |
critical | 9.1 | 0.0101 | 2026-04-16 | Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to F | |
CVE-2026-40525 |
critical | 9.1 | 0.0057 | 2026-04-17 | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot O | |
CVE-2026-40324 |
critical | 9.1 | 0.0090 | 2026-04-18 | Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1 | |
CVE-2026-40582 |
critical | 9.1 | 0.0050 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/us | |
CVE-2026-40887 |
critical | 9.1 | 0.0176 | 2026-04-21 | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to version | |
CVE-2026-40903 |
critical | 9.1 | 0.0024 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerabil | |
CVE-2026-34285 |
critical | 9.1 | 0.0041 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-34286 |
critical | 9.1 | 0.0041 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-34287 |
critical | 9.1 | 0.0035 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-40910 |
critical | 9.1 | 0.0027 | 2026-04-21 | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTT | |
CVE-2026-33598 |
critical | 9.1 | 0.0107 | 2026-04-22 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAd | |
CVE-2026-41248 |
critical | 9.1 | 0.0032 | 2026-04-24 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher | |
CVE-2026-7381 |
critical | 9.1 | 0.0044 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewri | |
CVE-2026-33845 |
critical | 9.1 | 0.0207 | 2026-04-30 | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero off | |
CVE-2026-34000 |
critical | 9.1 | 0.0049 | 2026-05-05 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry pr | |
CVE-2026-34002 |
critical | 9.1 | 0.0049 | 2026-05-05 | A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB ( | |
CVE-2026-40010 |
critical | 9.1 | 0.0038 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be e | |
CVE-2026-44597 |
critical | 9.1 | 0.0045 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a re | |
CVE-2026-44603 |
critical | 9.1 | 0.0034 | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026- | |
CVE-2026-5787 |
critical | 9.1 | 0.0069 | 2026-05-07 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 a | |
CVE-2026-7821 |
critical | 9.1 | 0.0051 | 2026-05-07 | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allo | |
CVE-2026-41691 |
critical | 9.1 | 0.0031 | 2026-05-07 | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that a | |
CVE-2026-25199 |
critical | 9.1 | 0.0050 | 2026-05-08 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to oth | |
CVE-2026-42193 |
critical | 9.1 | 0.0013 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhook | |
CVE-2026-41872 |
critical | 9.1 | 0.0016 | 2026-05-12 | "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A | |
CVE-2026-27851 |
critical | 9.1 | 0.0041 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are inc | |
CVE-2026-45091 |
critical | 9.1 | 0.0033 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. | |
CVE-2026-43515 |
critical | 9.1 | 0.0122 | 2026-05-12 | Improper Authorization vulnerability when multiple method constraints define an HTTP method for the | |
CVE-2026-29204 |
critical | 9.1 | 0.0032 | 2026-05-12 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit | |
CVE-2026-33117 |
critical | 9.1 | 0.0048 | 2026-05-12 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptograph | |
CVE-2026-41103 |
critical | 9.1 | 0.0538 | 2026-05-12 | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluen | |
CVE-2026-44196 |
critical | 9.1 | 0.0030 | 2026-05-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a cri | |
CVE-2026-42889 |
critical | 9.1 | 0.0037 | 2026-05-12 | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an | |
CVE-2026-42584 |
critical | 9.1 | 0.0084 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-44351 |
critical | 9.1 | 0.0025 | 2026-05-13 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authenticatio | |
CVE-2026-6512 |
critical | 9.1 | 0.0026 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, | |
CVE-2026-44542 |
critical | 9.1 | 0.0052 | 2026-05-14 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9- | |
CVE-2026-46470 |
critical | 9.1 | 0.0021 | 2026-05-14 | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audio tracks, | |
CVE-2026-44699 |
critical | 9.1 | 0.0026 | 2026-05-15 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not c | |
CVE-2023-24215 |
critical | 9.1 | 0.0024 | 2026-05-18 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unaut | |
CVE-2026-49002 |
critical | 9.1 | 0.0029 | 2026-05-27 | Access control failure means that an application does not effectively check user access permissions, | |
CVE-2026-9270 |
critical | 9.1 | 0.0033 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does | |
CVE-2026-50638 |
critical | 9.1 | 0.0034 | 2026-06-10 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injec | |
CVE-2026-9648 |
critical | 9.1 | 0.0022 | 2026-06-11 | The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS cli |