Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,768 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2024-44065 |
critical | 9.8 | 0.0038 | 2025-12-26 | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbooka | |
CVE-2024-25182 |
critical | 9.8 | 0.0039 | 2025-12-29 | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. | |
CVE-2024-27480 |
critical | 9.8 | 0.0039 | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. | |
CVE-2023-54223 |
critical | 9.8 | 0.0045 | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix invalid buf | |
CVE-2026-22738 |
critical | 9.8 | 0.0111 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value | |
CVE-2026-34475 |
critical | 9.8 | 0.0021 | 2026-03-27 | Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url sce | |
CVE-2026-33943 |
critical | 9.8 | 0.0065 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In v | |
CVE-2026-20093 |
critical | 9.8 | 0.0101 | 2026-04-01 | A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) | |
CVE-2026-20160 |
critical | 9.8 | 0.0093 | 2026-04-01 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated | |
CVE-2026-34072 |
critical | 9.8 | 0.0046 | 2026-04-01 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log | |
CVE-2026-34159 |
critical | 9.8 | 0.0162 | 2026-04-01 | llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's | |
CVE-2026-34236 |
critical | 9.8 | 0.0022 | 2026-04-01 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before ve | |
CVE-2026-34456 |
critical | 9.8 | 0.0046 | 2026-04-01 | Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vi | |
CVE-2026-4101 |
critical | 9.8 | 0.0037 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-2699 |
critical | 9.8 | 0.5839 | 2026-04-02 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to acce | |
CVE-2026-34841 |
critical | 9.8 | 0.0023 | 2026-04-06 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a | |
CVE-2026-0740 |
critical | 9.8 | 0.6290 | 2026-04-07 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to m | |
CVE-2026-1114 |
critical | 9.8 | 0.0054 | 2026-04-07 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper acc | |
CVE-2026-5734 |
critical | 9.8 | 0.0033 | 2026-04-07 | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thun | |
CVE-2026-5735 |
critical | 9.8 | 0.0026 | 2026-04-07 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evi | |
CVE-2025-62818 |
critical | 9.8 | 0.0046 | 2026-04-07 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, | |
CVE-2026-4277 |
critical | 9.8 | 0.0046 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissio | |
CVE-2026-35490 |
critical | 9.8 | 0.0054 | 2026-04-07 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login | |
CVE-2026-5442 |
critical | 9.8 | 0.0060 | 2026-04-09 | A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields are encoded | |
CVE-2026-5443 |
critical | 9.8 | 0.0057 | 2026-04-09 | A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM images. Pix | |
CVE-2026-6057 |
critical | 9.8 | 0.0093 | 2026-04-10 | FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload A | |
CVE-2026-33707 |
critical | 9.8 | 0.0043 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password r | |
CVE-2026-40190 |
critical | 9.8 | 0.0031 | 2026-04-10 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, th | |
CVE-2026-4149 |
critical | 9.8 | 0.0100 | 2026-04-11 | Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerabil | |
CVE-2026-40393 |
critical | 9.8 | 0.0043 | 2026-04-12 | In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because | |
CVE-2026-25205 |
critical | 9.8 | 0.0019 | 2026-04-13 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write. | |
CVE-2026-25207 |
critical | 9.8 | 0.0019 | 2026-04-13 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue | |
CVE-2026-25208 |
critical | 9.8 | 0.0025 | 2026-04-13 | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue af | |
CVE-2026-40446 |
critical | 9.8 | 0.0023 | 2026-04-13 | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source E | |
CVE-2026-5936 |
critical | 9.8 | 0.0019 | 2026-04-13 | An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to | |
CVE-2026-6264 |
critical | 9.8 | 0.0074 | 2026-04-14 | A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote co | |
CVE-2026-40288 |
critical | 9.8 | 0.0061 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of prais | |
CVE-2026-39808 |
critical | 9.8 | 0.9319 | 2026-04-14 | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthentic |
CVE-2026-39813 |
critical | 9.8 | 0.2222 | 2026-04-14 | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSand | |
CVE-2026-1555 |
critical | 9.8 | 0.0098 | 2026-04-15 | The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type va | |
CVE-2026-20184 |
critical | 9.8 | 0.0052 | 2026-04-15 | A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services | |
CVE-2026-30993 |
critical | 9.8 | 0.0052 | 2026-04-15 | Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in t | |
CVE-2026-6443 |
critical | 9.8 | 0.0050 | 2026-04-17 | All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versi | |
CVE-2026-41153 |
critical | 9.8 | 0.0026 | 2026-04-17 | In JetBrains Junie before 252.549.29 command execution was possible via malicious project file | |
CVE-2026-35546 |
critical | 9.8 | 0.0059 | 2026-04-17 | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted arch | |
CVE-2026-40351 |
critical | 9.8 | 0.0063 | 2026-04-17 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login en | |
CVE-2026-40492 |
critical | 9.8 | 0.0041 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, | |
CVE-2026-40493 |
critical | 9.8 | 0.0037 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, | |
CVE-2026-40494 |
critical | 9.8 | 0.0033 | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, metadata, | |
CVE-2026-6760 |
critical | 9.8 | 0.0028 | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 |