Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,752 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42196 |
critical | 9.9 | 0.0056 | 2026-05-12 | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMid | |
CVE-2026-45568 |
critical | 9.9 | 0.0054 | 2026-07-16 | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Pyth | |
CVE-2026-61237 |
critical | 9.9 | 0.0038 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft | |
CVE-2026-61239 |
critical | 9.9 | 0.0037 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft | |
CVE-2026-69083 |
critical | 9.9 | 0.0047 | 2026-08-03 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetConten | |
CVE-2026-69084 |
critical | 9.9 | 0.0157 | 2026-08-03 | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-su | |
CVE-2026-69085 |
critical | 9.9 | 0.0139 | 2026-08-03 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint | |
CVE-2026-60916 |
critical | 9.9 | 0.0037 | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (compon | |
CVE-2026-62452 |
critical | 9.9 | 0.0038 | 2026-08-18 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C | |
CVE-2026-73930 |
critical | 9.9 | 0.0037 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-102649 |
critical | 9.9 | 0.0046 | 2026-10-26 | Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13. | |
CVE-2026-94510 |
critical | 9.9 | 0.0057 | 2026-10-08 | Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attack | |
CVE-2019-15598 |
critical | 9.8 | 0.0274 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker | |
CVE-2020-21012 |
critical | 9.8 | 0.0350 | 2021-10-01 | Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection | |
CVE-2023-0758 |
critical | 9.8 | 0.0061 | 2023-02-09 | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects | |
CVE-2023-0745 |
critical | 9.8 | 0.0051 | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can be abused | |
CVE-2023-24482 |
critical | 9.8 | 0.0081 | 2023-02-14 | A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V | |
CVE-2023-23080 |
critical | 9.8 | 0.0246 | 2023-02-27 | Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10 | |
CVE-2023-1357 |
critical | 9.8 | 0.0055 | 2023-03-12 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Sh | |
CVE-2023-25207 |
critical | 9.8 | 0.0089 | 2023-03-13 | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. | |
CVE-2023-31039 |
critical | 9.8 | 0.0152 | 2023-05-08 | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary | |
CVE-2023-30191 |
critical | 9.8 | 0.0076 | 2023-05-17 | PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontContro | |
CVE-2023-2186 |
critical | 9.8 | 0.0071 | 2023-06-07 | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send | |
CVE-2023-29129 |
critical | 9.8 | 0.0089 | 2023-06-13 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < | |
CVE-2023-29531 |
critical | 9.8 | 0.0097 | 2023-06-19 | An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory cor | |
CVE-2023-29542 |
critical | 9.8 | 0.0094 | 2023-06-19 | A newline in a filename could have been used to bypass the file extension security mechanisms that r | |
CVE-2023-34416 |
critical | 9.8 | 0.0093 | 2023-06-19 | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these | |
CVE-2022-44276 |
critical | 9.8 | 0.0230 | 2023-06-28 | In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. | |
CVE-2021-25827 |
critical | 9.8 | 0.0150 | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header | |
CVE-2023-34844 |
critical | 9.8 | 0.0095 | 2023-06-29 | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container | |
CVE-2024-21762 |
critical | 9.8 | 0.8459 | 2024-02-09 | KEV | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated a |
CVE-2024-26011 |
critical | 9.8 | 0.0060 | 2024-11-12 | A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through | |
CVE-2025-49710 |
critical | 9.8 | 0.0074 | 2025-06-11 | An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerabil | |
CVE-2025-6424 |
critical | 9.8 | 0.0796 | 2025-06-24 | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was | |
CVE-2025-11708 |
critical | 9.8 | 0.0051 | 2025-10-14 | Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, F | |
CVE-2025-11709 |
critical | 9.8 | 0.0042 | 2025-10-14 | A compromised web process was able to trigger out of bounds reads and writes in a more privileged pr | |
CVE-2025-11710 |
critical | 9.8 | 0.0042 | 2025-10-14 | A compromised web process using malicious IPC messages could have caused the privileged browser proc | |
CVE-2025-49901 |
critical | 9.8 | 0.0073 | 2025-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link D | |
CVE-2025-62025 |
critical | 9.8 | 0.0058 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects | |
CVE-2025-60553 |
critical | 9.8 | 0.0041 | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime parameter i | |
CVE-2025-60355 |
critical | 9.8 | 0.0053 | 2025-10-28 | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via Free | |
CVE-2025-52910 |
critical | 9.8 | 0.0039 | 2025-11-04 | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2 | |
CVE-2025-63334 |
critical | 9.8 | 0.0118 | 2025-11-05 | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulne | |
CVE-2025-58627 |
critical | 9.8 | 0.0045 | 2025-11-06 | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugi | |
CVE-2025-65358 |
critical | 9.8 | 0.0041 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the | |
CVE-2025-65656 |
critical | 9.8 | 0.0046 | 2025-12-02 | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager | |
CVE-2025-50526 |
critical | 9.8 | 0.0118 | 2025-12-23 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch | |
CVE-2025-29229 |
critical | 9.8 | 0.0127 | 2025-12-23 | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. | |
CVE-2025-51511 |
critical | 9.8 | 0.0038 | 2025-12-23 | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanag | |
CVE-2024-44065 |
critical | 9.8 | 0.0038 | 2025-12-26 | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbooka |