Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,769 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-35157 |
critical | 9.8 | 0.0032 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a | |
CVE-2026-43914 |
critical | 9.8 | 0.0029 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security v | |
CVE-2026-41293 |
critical | 9.8 | 0.0170 | 2026-05-12 | Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11 | |
CVE-2026-43512 |
critical | 9.8 | 0.0133 | 2026-05-12 | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. T | |
CVE-2025-65719 |
critical | 9.8 | 0.0058 | 2026-05-12 | An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a vi | |
CVE-2026-43992 |
critical | 9.8 | 0.0022 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write | |
CVE-2026-26083 |
critical | 9.8 | 0.0073 | 2026-05-12 | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4 | |
CVE-2026-41089 |
critical | 9.8 | 0.7962 | 2026-05-12 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over | |
CVE-2026-44277 |
critical | 9.8 | 0.0055 | 2026-05-12 | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0 | |
CVE-2026-42854 |
critical | 9.8 | 0.0057 | 2026-05-12 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 | |
CVE-2026-8500 |
critical | 9.8 | 0.0165 | 2026-05-13 | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small CGI applica | |
CVE-2026-6510 |
critical | 9.8 | 0.0044 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorizat | |
CVE-2026-2347 |
critical | 9.8 | 0.0043 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technolog | |
CVE-2026-44717 |
critical | 9.8 | 0.0048 | 2026-05-15 | MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. | |
CVE-2026-8507 |
critical | 9.8 | 0.0065 | 2026-05-17 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When pa | |
CVE-2026-8721 |
critical | 9.8 | 0.0045 | 2026-05-17 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Pass | |
CVE-2026-42731 |
critical | 9.8 | 0.0033 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-ot | |
CVE-2026-42758 |
critical | 9.8 | 0.0032 | 2026-05-27 | Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ign | |
CVE-2026-7524 |
critical | 9.8 | 0.0079 | 2026-05-27 | IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of | |
CVE-2026-44887 |
critical | 9.8 | 0.0054 | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Aler | |
CVE-2026-44888 |
critical | 9.8 | 0.0039 | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Aler | |
CVE-2026-8362 |
critical | 9.8 | 0.0039 | 2026-05-27 | A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long UR | |
CVE-2026-8363 |
critical | 9.8 | 0.0040 | 2026-05-27 | A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL | |
CVE-2026-8364 |
critical | 9.8 | 0.0038 | 2026-05-27 | Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port | |
CVE-2026-45083 |
critical | 9.8 | 0.0041 | 2026-05-27 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-4408 |
critical | 9.8 | 0.0250 | 2026-05-28 | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers an | |
CVE-2026-10879 |
critical | 9.8 | 0.0049 | 2026-06-05 | DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more tha | |
CVE-2026-11362 |
critical | 9.8 | 0.0045 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog: | |
CVE-2026-45748 |
critical | 9.8 | 0.0173 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-46389 |
critical | 9.8 | 0.0034 | 2026-06-05 | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs | |
CVE-2026-11561 |
critical | 9.8 | 0.0045 | 2026-06-11 | Improper neutralization of special elements used in an expression language statement ('expression la | |
CVE-2026-7852 |
critical | 9.8 | 0.0036 | 2026-06-11 | Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRAD NAC allo | |
CVE-2026-49261 |
critical | 9.8 | 0.0158 | 2026-06-11 | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11 | |
CVE-2026-49060 |
critical | 9.8 | 0.0184 | 2026-06-11 | Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege E | |
CVE-2026-42846 |
critical | 9.8 | 0.0073 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's | |
CVE-2026-45060 |
critical | 9.8 | 0.0044 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p | |
CVE-2026-49875 |
critical | 9.8 | 0.0052 | 2026-06-12 | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory w | |
CVE-2026-50628 |
critical | 9.8 | 0.0071 | 2026-06-12 | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP addres | |
CVE-2026-47210 |
critical | 9.8 | 0.0172 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerabilit | |
CVE-2026-54133 |
critical | 9.8 | 0.0044 | 2026-06-12 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem | |
CVE-2026-6853 |
critical | 9.8 | 0.0035 | 2026-06-12 | Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe | |
CVE-2026-50083 |
critical | 9.8 | 0.0036 | 2026-06-12 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is | |
CVE-2026-50085 |
critical | 9.8 | 0.0041 | 2026-06-12 | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards th | |
CVE-2026-50086 |
critical | 9.8 | 0.0029 | 2026-06-12 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the p | |
CVE-2026-53407 |
critical | 9.8 | 0.0023 | 2026-06-12 | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for A | |
CVE-2026-41157 |
critical | 9.8 | 0.0036 | 2026-06-12 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trig | |
CVE-2026-9862 |
critical | 9.8 | 0.0099 | 2026-06-15 | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in th | |
CVE-2026-48114 |
critical | 9.8 | 0.0037 | 2026-06-15 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versi | |
CVE-2026-27053 |
critical | 9.8 | 0.0039 | 2026-06-15 | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | |
CVE-2026-34901 |
critical | 9.8 | 0.0032 | 2026-06-15 | Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. |