Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,768 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-6768 |
critical | 9.8 | 0.0029 | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 | |
CVE-2026-6771 |
critical | 9.8 | 0.0031 | 2026-04-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firef | |
CVE-2026-40050 |
critical | 9.8 | 0.0060 | 2026-04-21 | CrowdStrike has released security updates to address a critical unauthenticated path traversal vulne | |
CVE-2026-40884 |
critical | 9.8 | 0.0048 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authenticat | |
CVE-2026-33519 |
critical | 9.8 | 0.0031 | 2026-04-21 | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Win | |
CVE-2026-34275 |
critical | 9.8 | 0.0038 | 2026-04-21 | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component | |
CVE-2026-41144 |
critical | 9.8 | 0.0043 | 2026-04-22 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedde | |
CVE-2026-6023 |
critical | 9.8 | 0.0054 | 2026-04-22 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is | |
CVE-2026-33608 |
critical | 9.8 | 0.0038 | 2026-04-22 | An attacker can send a notify request that causes a new secondary domain to be added to the bind bac | |
CVE-2026-26354 |
critical | 9.8 | 0.0050 | 2026-04-22 | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1 | |
CVE-2026-29198 |
critical | 9.8 | 0.0042 | 2026-04-23 | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injec | |
CVE-2026-5935 |
critical | 9.8 | 0.0034 | 2026-04-23 | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow a | |
CVE-2026-3960 |
critical | 9.8 | 0.0094 | 2026-04-23 | A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/I | |
CVE-2025-50229 |
critical | 9.8 | 0.0036 | 2026-04-23 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. | |
CVE-2026-41267 |
critical | 9.8 | 0.0033 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-41268 |
critical | 9.8 | 0.1744 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-33819 |
critical | 9.8 | 0.0084 | 2026-04-23 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code | |
CVE-2026-1949 |
critical | 9.8 | 0.0061 | 2026-04-24 | Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT re | |
CVE-2026-1950 |
critical | 9.8 | 0.0031 | 2026-04-24 | Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerabili | |
CVE-2026-1951 |
critical | 9.8 | 0.0061 | 2026-04-24 | Delta Electronics AS320T has no checking of the length of the buffer with the directory name vulne | |
CVE-2026-41492 |
critical | 9.8 | 0.0308 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process | |
CVE-2026-41635 |
critical | 9.8 | 0.0062 | 2026-04-27 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes | |
CVE-2026-41409 |
critical | 9.8 | 0.0043 | 2026-04-27 | The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname | |
CVE-2026-22337 |
critical | 9.8 | 0.0032 | 2026-04-27 | Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privileg | |
CVE-2026-41873 |
critical | 9.8 | 0.0044 | 2026-04-28 | ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response | |
CVE-2026-24178 |
critical | 9.8 | 0.0057 | 2026-04-28 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system w | |
CVE-2026-22070 |
critical | 9.8 | 0.0021 | 2026-04-30 | ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal. | |
CVE-2026-42799 |
critical | 9.8 | 0.0028 | 2026-04-30 | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vuln | |
CVE-2026-4670 |
critical | 9.8 | 0.0504 | 2026-04-30 | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allow | |
CVE-2026-2311 |
critical | 9.8 | 0.0020 | 2026-04-30 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i We | |
CVE-2026-42778 |
critical | 9.8 | 0.0066 | 2026-05-01 | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original is | |
CVE-2026-42779 |
critical | 9.8 | 0.0123 | 2026-05-01 | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original is | |
CVE-2026-42370 |
critical | 9.8 | 0.0055 | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V | |
CVE-2026-25293 |
critical | 9.8 | 0.0018 | 2026-05-04 | Buffer overflow due to incorrect authorization in PLC FW | |
CVE-2026-42076 |
critical | 9.8 | 0.0170 | 2026-05-04 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command inje | |
CVE-2026-42376 |
critical | 9.8 | 0.0046 | 2026-05-04 | D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor. The de | |
CVE-2026-42221 |
critical | 9.8 | 0.0134 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3. | |
CVE-2026-42222 |
critical | 9.8 | 0.0034 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated boot | |
CVE-2026-6508 |
critical | 9.8 | 0.0022 | 2026-05-07 | Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Lid | |
CVE-2026-30496 |
critical | 9.8 | 0.0033 | 2026-05-07 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API o | |
CVE-2025-63706 |
critical | 9.8 | 0.0152 | 2026-05-07 | NPM package next-npm-version1.0.1 is vulnerable to Command injection. | |
CVE-2026-5788 |
critical | 9.8 | 0.0082 | 2026-05-07 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a | |
CVE-2026-7413 |
critical | 9.8 | 0.0058 | 2026-05-07 | A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticat | |
CVE-2026-7414 |
critical | 9.8 | 0.0053 | 2026-05-07 | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. | |
CVE-2026-7415 |
critical | 9.8 | 0.0054 | 2026-05-07 | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connections with | |
CVE-2023-46453 |
critical | 9.8 | 0.0090 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative c | |
CVE-2026-8153 |
critical | 9.8 | 0.0285 | 2026-05-08 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5 | |
CVE-2026-41497 |
critical | 9.8 | 0.0054 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command | |
CVE-2026-41507 |
critical | 9.8 | 0.0039 | 2026-05-08 | math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal co | |
CVE-2026-42072 |
critical | 9.8 | 0.0044 | 2026-05-08 | Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, grap |