Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,740 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2024-34323 |
critical | 10.0 | 0.0036 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (I | |
CVE-2026-111057 |
critical | 10.0 | 0.0070 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From | |
CVE-2026-101809 |
critical | 10.0 | 0.0054 | 2026-10-20 | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification M | |
CVE-2026-81212 |
critical | 10.0 | 0.0027 | 2026-10-20 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary w | |
CVE-2026-87337 |
critical | 10.0 | 0.0044 | 2026-10-20 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-91299 |
critical | 10.0 | 0.0046 | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: | |
CVE-2026-113744 |
critical | 10.0 | 0.0062 | 2026-10-21 | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the fu | |
CVE-2026-105944 |
critical | 10.0 | 0.0070 | 2026-10-21 | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user | |
CVE-2026-111813 |
critical | 10.0 | 0.0049 | 2026-10-21 | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagic | |
CVE-2026-114382 |
critical | 10.0 | 0.0067 | 2026-10-21 | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStat | |
CVE-2026-114383 |
critical | 10.0 | 0.0065 | 2026-10-21 | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAd | |
CVE-2026-110264 |
critical | 10.0 | 0.0131 | 2026-10-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 b | |
CVE-2026-114575 |
critical | 10.0 | 0.0221 | 2026-10-22 | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the funct | |
CVE-2026-102785 |
critical | 10.0 | 0.0077 | 2026-10-22 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 | |
CVE-2026-79844 |
critical | 10.0 | 0.0069 | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthentic | |
CVE-2026-79846 |
critical | 10.0 | 0.0137 | 2026-10-22 | Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unaut | |
CVE-2026-79847 |
critical | 10.0 | 0.0082 | 2026-10-22 | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated re | |
CVE-2026-79848 |
critical | 10.0 | 0.0070 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to | |
CVE-2026-79849 |
critical | 10.0 | 0.0070 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to | |
CVE-2026-79850 |
critical | 10.0 | 0.0069 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to | |
CVE-2026-79851 |
critical | 10.0 | 0.0076 | 2026-10-22 | Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthe | |
CVE-2026-110063 |
critical | 10.0 | 0.0089 | 2026-10-22 | Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Mac | |
CVE-2026-83938 |
critical | 10.0 | 0.0071 | 2026-10-22 | Missing authentication for critical function in Azure Kubernetes Configuration Service allows an una | |
CVE-2026-97785 |
critical | 10.0 | 0.0065 | 2026-10-22 | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over | |
CVE-2026-115905 |
critical | 10.0 | 0.0032 | 2026-10-26 | zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, Zip | |
CVE-2026-65145 |
critical | 10.0 | 0.0053 | 2026-10-27 | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentica | |
CVE-2026-105781 |
critical | 10.0 | 0.0052 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-61564 |
critical | 10.0 | 0.0054 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/ | |
CVE-2026-61567 |
critical | 10.0 | 0.0053 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLi | |
CVE-2026-65770 |
critical | 10.0 | 0.0105 | 2026-08-20 | Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed | |
CVE-2026-65816 |
critical | 10.0 | 0.0097 | 2026-08-20 | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevat | |
CVE-2026-69502 |
critical | 10.0 | 0.0080 | 2026-08-21 | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate | |
CVE-2026-69555 |
critical | 10.0 | 0.0080 | 2026-08-20 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a ne | |
CVE-2026-65801 |
critical | 10.0 | 0.0090 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to e | |
CVE-2026-69836 |
critical | 10.0 | 0.0153 | 2026-08-20 | 2 PoC | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c |
CVE-2026-96207 |
critical | 10.0 | 0.0067 | 2026-10-08 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to eleva | |
CVE-2026-69399 |
critical | 10.0 | 0.0048 | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability | |
CVE-2026-69865 |
critical | 10.0 | 0.0080 | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori | |
CVE-2026-70200 |
critical | 10.0 | 0.0060 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a | |
CVE-2026-83944 |
critical | 10.0 | 0.0044 | 2026-09-17 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges ov | |
CVE-2026-85889 |
critical | 10.0 | 0.0067 | 2026-09-17 | Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to | |
CVE-2026-55572 |
critical | 10.0 | 0.0052 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and | |
CVE-2026-61991 |
critical | 10.0 | — | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | |
CVE-2026-84295 |
critical | 10.0 | — | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 o | |
CVE-2026-91216 |
critical | 10.0 | 0.0052 | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). | |
CVE-2026-29200 |
critical | 9.9 | 0.0030 | 2026-05-04 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11. | |
CVE-2026-42864 |
critical | 9.9 | 0.0027 | 2026-05-11 | FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/rai | |
CVE-2026-42196 |
critical | 9.9 | 0.0056 | 2026-05-12 | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMid | |
CVE-2026-45568 |
critical | 9.9 | 0.0054 | 2026-07-16 | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Pyth | |
CVE-2026-61237 |
critical | 9.9 | 0.0038 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft |