Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,691 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-53424 |
critical | 9.1 | 0.0060 | 2026-08-20 | Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authent | |
CVE-2026-17003 |
critical | 9.1 | 0.0044 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confid | |
CVE-2026-17060 |
critical | 9.1 | 0.0071 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info | |
CVE-2026-17423 |
critical | 9.1 | 0.0045 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info | |
CVE-2026-18670 |
critical | 9.1 | 0.0053 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-18716 |
critical | 9.1 | 0.0039 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain | |
CVE-2025-51679 |
critical | 9.1 | 0.0063 | 2026-08-26 | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can | |
CVE-2026-63569 |
critical | 9.1 | 0.0040 | 2026-10-02 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legi | |
CVE-2025-70516 |
critical | 9.1 | 0.0033 | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authenticati | |
CVE-2026-109772 |
critical | 9.1 | 0.0018 | 2026-10-13 | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and | |
CVE-2024-34324 |
critical | 9.1 | 0.0030 | 2026-10-13 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking atta | |
CVE-2026-93895 |
critical | 9.1 | 0.0039 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticate | |
CVE-2026-93909 |
critical | 9.1 | 0.0034 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentica | |
CVE-2026-95695 |
critical | 9.1 | 0.0032 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker | |
CVE-2026-98549 |
critical | 9.1 | 0.0039 | 2026-10-18 | In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs ac | |
CVE-2024-4457 |
critical | 9.1 | 0.0042 | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JDBC user st | |
CVE-2026-113682 |
critical | 9.1 | 0.0056 | 2026-10-20 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicA | |
CVE-2026-112712 |
critical | 9.1 | 0.0031 | 2026-10-20 | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9 | |
CVE-2026-101590 |
critical | 9.1 | 0.0042 | 2026-10-20 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-se | |
CVE-2026-87302 |
critical | 9.1 | 0.0042 | 2026-10-20 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-91265 |
critical | 9.1 | 0.0042 | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr | |
CVE-2026-91305 |
critical | 9.1 | 0.0042 | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Install | |
CVE-2026-91341 |
critical | 9.1 | 0.0044 | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou | |
CVE-2026-91490 |
critical | 9.1 | 0.0040 | 2026-10-20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-87095 |
critical | 9.1 | 0.0024 | 2026-10-21 | Sensitive information disclosure and manipulation due to improper authorization checks. The followin | |
CVE-2026-89035 |
critical | 9.1 | 0.0027 | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interfa | |
CVE-2025-31699 |
critical | 9.1 | 0.0035 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still w | |
CVE-2026-114139 |
critical | 9.1 | 0.0051 | 2026-10-21 | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and | |
CVE-2026-91403 |
critical | 9.1 | 0.0037 | 2026-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-96355 |
critical | 9.1 | 0.0042 | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webfor | |
CVE-2026-114219 |
critical | 9.1 | 0.0034 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated | |
CVE-2026-114607 |
critical | 9.1 | 0.0042 | 2026-10-22 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until | |
CVE-2026-114611 |
critical | 9.1 | 0.0023 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deploym | |
CVE-2026-105014 |
critical | 9.1 | 0.0067 | 2026-10-22 | Improper neutralization of special elements used in a command ('command injection') in Azure Pipelin | |
CVE-2026-107685 |
critical | 9.1 | 0.0027 | 2026-10-23 | Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm | |
CVE-2026-114820 |
critical | 9.1 | 0.0025 | 2026-10-24 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-116163 |
critical | 9.1 | 0.0028 | 2026-10-25 | Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass becaus | |
CVE-2026-115693 |
critical | 9.1 | 0.0027 | 2026-10-26 | Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path at | |
CVE-2026-112362 |
critical | 9.1 | 0.0037 | 2026-10-27 | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 | |
CVE-2026-115216 |
critical | 9.1 | 0.0024 | 2026-10-27 | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when | |
CVE-2026-108014 |
critical | 9.1 | 0.0013 | 2026-10-27 | Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.w | |
CVE-2026-108015 |
critical | 9.1 | 0.0013 | 2026-10-27 | Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.w | |
CVE-2026-108142 |
critical | 9.1 | 0.0040 | 2026-10-27 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator | |
CVE-2026-112352 |
critical | 9.1 | 0.0132 | 2026-10-27 | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauth | |
CVE-2026-14571 |
critical | 9.1 | 0.0043 | 2026-10-28 | A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of a | |
CVE-2026-118264 |
critical | 9.1 | — | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw | |
CVE-2026-55040 |
critical | 9.1 | 0.6954 | 2026-07-14 | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attac |
CVE-2026-96252 |
critical | 9.1 | 0.0056 | 2026-10-13 | Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) all | |
CVE-2026-70188 |
critical | 9.1 | 0.0094 | 2026-10-13 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all | |
CVE-2026-63149 |
critical | 9.1 | 0.0037 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows att |