Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,752 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-46858 |
critical | 9.1 | 0.0045 | 2026-06-17 | Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager ( | |
CVE-2026-46892 |
critical | 9.1 | 0.0040 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edward | |
CVE-2026-46910 |
critical | 9.1 | 0.0035 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr | |
CVE-2026-46930 |
critical | 9.1 | 0.0040 | 2026-06-17 | Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Bu | |
CVE-2026-46949 |
critical | 9.1 | 0.0040 | 2026-06-17 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (componen | |
CVE-2026-24611 |
critical | 9.1 | 0.0044 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. | |
CVE-2026-32967 |
critical | 9.1 | 0.0034 | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. T | |
CVE-2026-50203 |
critical | 9.1 | 0.0063 | 2026-06-17 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)` | |
CVE-2026-48814 |
critical | 9.1 | 0.0044 | 2026-06-17 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP | |
CVE-2026-49454 |
critical | 9.1 | 0.0023 | 2026-06-18 | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0 | |
CVE-2026-9265 |
critical | 9.1 | 0.0063 | 2026-06-20 | Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8 | |
CVE-2026-11373 |
critical | 9.1 | 0.0057 | 2026-06-22 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Clien | |
CVE-2026-9006 |
critical | 9.1 | 0.0039 | 2026-06-22 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) wi | |
CVE-2026-9733 |
critical | 9.1 | 0.0052 | 2026-06-23 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state | |
CVE-2026-44726 |
critical | 9.1 | 0.0023 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's | |
CVE-2026-45688 |
critical | 9.1 | 0.0049 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-45689 |
critical | 9.1 | 0.0053 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-37637 |
critical | 9.1 | 0.0060 | 2026-06-29 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the fi | |
CVE-2026-53434 |
critical | 9.1 | 0.0059 | 2026-06-29 | Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for | |
CVE-2026-55276 |
critical | 9.1 | 0.0061 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles | |
CVE-2026-10560 |
critical | 9.1 | 0.0048 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil | |
CVE-2026-13449 |
critical | 9.1 | 0.0041 | 2026-06-30 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e | |
CVE-2026-7874 |
critical | 9.1 | 0.0027 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due | |
CVE-2026-13851 |
critical | 9.1 | 0.0031 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 15 | |
CVE-2026-13852 |
critical | 9.1 | 0.0031 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 15 | |
CVE-2026-13872 |
critical | 9.1 | 0.0029 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 15 | |
CVE-2026-7839 |
critical | 9.1 | 0.0066 | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded defaul | |
CVE-2026-56015 |
critical | 9.1 | 0.0065 | 2026-07-03 | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix l | |
CVE-2026-20706 |
critical | 9.1 | 0.0059 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope c | |
CVE-2026-22547 |
critical | 9.1 | 0.0052 | 2026-07-03 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including l | |
CVE-2026-25718 |
critical | 9.1 | 0.0056 | 2026-07-03 | Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowi | |
CVE-2026-26232 |
critical | 9.1 | 0.0050 | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single | |
CVE-2026-26247 |
critical | 9.1 | 0.0050 | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during a | |
CVE-2026-24013 |
critical | 9.1 | 0.0063 | 2026-07-06 | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers l | |
CVE-2026-40047 |
critical | 9.1 | 0.0243 | 2026-07-06 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in | |
CVE-2026-48203 |
critical | 9.1 | 0.0060 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), | |
CVE-2026-48205 |
critical | 9.1 | 0.0060 | 2026-07-06 | Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS comp | |
CVE-2026-6900 |
critical | 9.1 | 0.0022 | 2026-07-06 | Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue a | |
CVE-2026-14740 |
critical | 9.1 | 0.0066 | 2026-07-07 | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial | |
CVE-2026-41042 |
critical | 9.1 | 0.0151 | 2026-07-08 | Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which exe | |
CVE-2026-54061 |
critical | 9.1 | 0.0047 | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes | |
CVE-2026-14261 |
critical | 9.1 | 0.0103 | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution | |
CVE-2026-54003 |
critical | 9.1 | 0.0074 | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with n | |
CVE-2026-40005 |
critical | 9.1 | 0.0054 | 2026-07-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-51119 |
critical | 9.1 | 0.0054 | 2026-07-10 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUs | |
CVE-2026-15089 |
critical | 9.1 | 0.0040 | 2026-07-10 | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration | |
CVE-2026-41041 |
critical | 9.1 | 0.0060 | 2026-07-13 | URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This | |
CVE-2026-13221 |
critical | 9.1 | 0.0049 | 2026-07-13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce s | |
CVE-2026-58102 |
critical | 9.1 | 0.0034 | 2026-07-13 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certi | |
CVE-2026-27690 |
critical | 9.1 | 0.0068 | 2026-07-14 | Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could s |