Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,852 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-97406 |
critical | 9.1 | 0.0022 | 2026-10-20 | XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly i | |
CVE-2026-91225 |
critical | 9.1 | 0.0044 | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Su | |
CVE-2026-119568 |
critical | 9.1 | — | 2026-10-30 | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allow | |
CVE-2025-68809 |
critical | 9.1 | 0.0053 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vfs: fix race on m_flags | |
CVE-2026-43083 |
critical | 9.1 | 0.0056 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB and missing | |
CVE-2026-53224 |
critical | 9.1 | 0.0053 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT ch | |
CVE-2026-64319 |
critical | 9.1 | 0.0052 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply mess | |
CVE-2026-64320 |
critical | 9.1 | 0.0075 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-boun | |
CVE-2026-64392 |
critical | 9.1 | 0.0047 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials f | |
CVE-2026-68083 |
critical | 9.1 | 0.0044 | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in k | |
CVE-2026-72320 |
critical | 9.1 | 0.0052 | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup: fix catc | |
CVE-2026-89537 |
critical | 9.1 | 0.0065 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 M | |
CVE-2026-89631 |
critical | 9.1 | 0.0046 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree conn | |
CVE-2026-89650 |
critical | 9.1 | 0.0050 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets | |
CVE-2026-89671 |
critical | 9.1 | 0.0050 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp- | |
CVE-2026-89672 |
critical | 9.1 | 0.0052 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp- | |
CVE-2026-89713 |
critical | 9.1 | 0.0061 | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission | |
CVE-2026-93228 |
critical | 9.1 | 0.0047 | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chu | |
CVE-2026-33805 |
critical | 9.0 | 0.0044 | 2026-04-15 | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the clie | |
CVE-2026-40572 |
critical | 9.0 | 0.0021 | 2026-04-18 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0. | |
CVE-2026-7372 |
critical | 9.0 | 0.0047 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V | |
CVE-2026-42238 |
critical | 9.0 | 0.0097 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes | |
CVE-2026-32999 |
critical | 9.0 | 0.0031 | 2026-05-28 | Insufficient character filtering in backup agent signing module on Comet Backup server allows authen | |
CVE-2026-35320 |
critical | 9.0 | 0.0037 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-52705 |
critical | 9.0 | 0.0029 | 2026-06-17 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. | |
CVE-2026-55203 |
critical | 9.0 | 0.0033 | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fc | |
CVE-2026-13603 |
critical | 9.0 | 0.0041 | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, | |
CVE-2026-57623 |
critical | 9.0 | 0.0053 | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |
CVE-2026-58289 |
critical | 9.0 | 0.0199 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all | |
CVE-2026-13380 |
critical | 9.0 | 0.0039 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP response | |
CVE-2026-64825 |
critical | 9.0 | 0.0058 | 2026-07-21 | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthentica | |
CVE-2026-60424 |
critical | 9.0 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Co | |
CVE-2026-61174 |
critical | 9.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: I | |
CVE-2026-61201 |
critical | 9.0 | 0.0039 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CRM Common Objects product of Oracle PeopleSoft (componen | |
CVE-2026-61223 |
critical | 9.0 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communicat | |
CVE-2026-16723 |
critical | 9.0 | 0.0066 | 2026-07-23 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerabi | |
CVE-2026-20267 |
critical | 9.0 | 0.0038 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So | |
CVE-2026-71851 |
critical | 9.0 | 0.0055 | 2026-08-07 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate | |
CVE-2026-48381 |
critical | 9.0 | 0.0078 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-18691 |
critical | 9.0 | 0.0036 | 2026-08-11 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable networ | |
CVE-2026-73487 |
critical | 9.0 | 0.0096 | 2026-08-13 | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent n | |
CVE-2026-61029 |
critical | 9.0 | 0.0039 | 2026-08-18 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-70980 |
critical | 9.0 | 0.0039 | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-92892 |
critical | 9.0 | 0.0034 | 2026-10-13 | Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected | |
CVE-2026-105008 |
critical | 9.0 | 0.0066 | 2026-10-13 | No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a | |
CVE-2026-20043 |
critical | 9.0 | 0.0036 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Ope | |
CVE-2026-94267 |
critical | 9.0 | 0.0039 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extend | |
CVE-2025-30046 |
critical | 9.0 | 0.0026 | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communication with ex | |
CVE-2026-85818 |
critical | 9.0 | 0.0041 | 2026-10-13 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker | |
CVE-2026-77903 |
critical | 9.0 | 0.0037 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate |