Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,691 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-63158 |
critical | 9.1 | 0.0041 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows a | |
CVE-2026-63159 |
critical | 9.1 | 0.0033 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability tha | |
CVE-2026-63160 |
critical | 9.1 | 0.0033 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me tok | |
CVE-2026-105216 |
critical | 9.1 | 0.0019 | 2026-10-04 | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network | |
CVE-2026-105222 |
critical | 9.1 | 0.0019 | 2026-10-04 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by | |
CVE-2026-105223 |
critical | 9.1 | 0.0020 | 2026-10-05 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconf | |
CVE-2026-62916 |
critical | 9.1 | 0.0086 | 2026-09-03 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorize | |
CVE-2025-49794 |
critical | 9.1 | 0.0083 | 2025-06-16 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements u | |
CVE-2026-33805 |
critical | 9.0 | 0.0044 | 2026-04-15 | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the clie | |
CVE-2026-40572 |
critical | 9.0 | 0.0021 | 2026-04-18 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0. | |
CVE-2026-7372 |
critical | 9.0 | 0.0047 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V | |
CVE-2026-42238 |
critical | 9.0 | 0.0097 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes | |
CVE-2026-32999 |
critical | 9.0 | 0.0031 | 2026-05-28 | Insufficient character filtering in backup agent signing module on Comet Backup server allows authen | |
CVE-2026-35320 |
critical | 9.0 | 0.0037 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-52705 |
critical | 9.0 | 0.0029 | 2026-06-17 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. | |
CVE-2026-55203 |
critical | 9.0 | 0.0033 | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fc | |
CVE-2026-13603 |
critical | 9.0 | 0.0041 | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, | |
CVE-2026-57623 |
critical | 9.0 | 0.0053 | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |
CVE-2026-58289 |
critical | 9.0 | 0.0199 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all | |
CVE-2026-13380 |
critical | 9.0 | 0.0039 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP response | |
CVE-2026-64825 |
critical | 9.0 | 0.0058 | 2026-07-21 | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthentica | |
CVE-2026-60424 |
critical | 9.0 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Co | |
CVE-2026-61174 |
critical | 9.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: I | |
CVE-2026-61201 |
critical | 9.0 | 0.0039 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CRM Common Objects product of Oracle PeopleSoft (componen | |
CVE-2026-61223 |
critical | 9.0 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communicat | |
CVE-2026-16723 |
critical | 9.0 | 0.0066 | 2026-07-23 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerabi | |
CVE-2026-20267 |
critical | 9.0 | 0.0038 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So | |
CVE-2026-71851 |
critical | 9.0 | 0.0055 | 2026-08-07 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate | |
CVE-2026-48381 |
critical | 9.0 | 0.0078 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-18691 |
critical | 9.0 | 0.0036 | 2026-08-11 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable networ | |
CVE-2026-73487 |
critical | 9.0 | 0.0096 | 2026-08-13 | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent n | |
CVE-2026-61029 |
critical | 9.0 | 0.0039 | 2026-08-18 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-70980 |
critical | 9.0 | 0.0039 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-92892 |
critical | 9.0 | 0.0034 | 2026-10-13 | Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected | |
CVE-2026-105008 |
critical | 9.0 | 0.0066 | 2026-10-13 | No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a | |
CVE-2026-20043 |
critical | 9.0 | 0.0036 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Ope | |
CVE-2026-94267 |
critical | 9.0 | 0.0039 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extend | |
CVE-2025-30046 |
critical | 9.0 | 0.0026 | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with ex | |
CVE-2026-85818 |
critical | 9.0 | 0.0041 | 2026-10-13 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker | |
CVE-2026-77903 |
critical | 9.0 | 0.0037 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate | |
CVE-2026-103693 |
critical | 9.0 | — | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 d |