Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Filtered Results
2,691 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-29131 |
critical | 10.0 | 0.0042 | 2023-07-11 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consis | |
CVE-2025-58963 |
critical | 10.0 | 0.0049 | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Uploa | |
CVE-2025-11367 |
critical | 10.0 | 0.0063 | 2025-11-12 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization | |
CVE-2025-67108 |
critical | 10.0 | 0.0031 | 2025-12-23 | eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resultin | |
CVE-2024-57521 |
critical | 10.0 | 0.0068 | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrar | |
CVE-2026-4370 |
critical | 10.0 | 0.0038 | 2026-04-01 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4. | |
CVE-2026-32871 |
critical | 10.0 | 0.0091 | 2026-04-02 | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvi | |
CVE-2026-34208 |
critical | 10.0 | 0.0056 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to | |
CVE-2026-34976 |
critical | 10.0 | 0.0207 | 2026-04-06 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin muta | |
CVE-2026-39305 |
critical | 10.0 | 0.0031 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains | |
CVE-2026-39337 |
critical | 10.0 | 0.0072 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication re | |
CVE-2026-40114 |
critical | 10.0 | 0.0024 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accepts an arbi | |
CVE-2026-34865 |
critical | 10.0 | 0.0021 | 2026-04-13 | Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerab | |
CVE-2026-31843 |
critical | 10.0 | 0.0138 | 2026-04-16 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/a | |
CVE-2026-40911 |
critical | 10.0 | 0.0065 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's Web | |
CVE-2026-41679 |
critical | 10.0 | 0.3167 | 2026-04-23 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. | |
CVE-2026-26150 |
critical | 10.0 | 0.0057 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate p | |
CVE-2026-35431 |
critical | 10.0 | 0.0051 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthoriz | |
CVE-2026-3325 |
critical | 10.0 | 0.0027 | 2026-04-29 | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_ | |
CVE-2026-26015 |
critical | 10.0 | 0.0117 | 2026-04-29 | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.16.0, an at | |
CVE-2026-42996 |
critical | 10.0 | 0.0057 | 2026-05-01 | JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio | |
CVE-2026-42369 |
critical | 10.0 | 0.0054 | 2026-05-04 | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and | |
CVE-2026-26332 |
critical | 10.0 | 0.0071 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attack | |
CVE-2026-7411 |
critical | 10.0 | 0.0368 | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization | |
CVE-2026-35435 |
critical | 10.0 | 0.0116 | 2026-05-07 | Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to | |
CVE-2026-41900 |
critical | 10.0 | 0.0091 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3 | |
CVE-2026-6213 |
critical | 10.0 | 0.0033 | 2026-05-08 | A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local | |
CVE-2026-41070 |
critical | 10.0 | 0.0044 | 2026-05-08 | openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC bas | |
CVE-2026-42160 |
critical | 10.0 | 0.0032 | 2026-05-08 | Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dat | |
CVE-2026-42869 |
critical | 10.0 | 0.0056 | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations nee | |
CVE-2026-42288 |
critical | 10.0 | 0.0072 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is | |
CVE-2026-20182 |
critical | 10.0 | 0.9182 | 2026-05-14 | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allow |
CVE-2026-44523 |
critical | 10.0 | 0.0015 | 2026-05-14 | Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy i | |
CVE-2026-41553 |
critical | 10.0 | 0.0065 | 2026-05-15 | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Executi | |
CVE-2026-2031 |
critical | 10.0 | 0.0053 | 2026-05-15 | An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Applicat | |
CVE-2026-45829 |
critical | 10.0 | 0.1515 | 2026-05-18 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python | |
CVE-2026-8054 |
critical | 10.0 | 0.0158 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish | |
CVE-2026-45087 |
critical | 10.0 | 0.0873 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe | |
CVE-2026-11414 |
critical | 10.0 | 0.0048 | 2026-06-05 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the | |
CVE-2026-47131 |
critical | 10.0 | 0.0076 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call | |
CVE-2026-47137 |
critical | 10.0 | 0.0038 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gw | |
CVE-2026-47140 |
critical | 10.0 | 0.0098 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangero | |
CVE-2026-47208 |
critical | 10.0 | 0.0104 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox br | |
CVE-2026-52704 |
critical | 10.0 | 0.0031 | 2026-06-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P | |
CVE-2026-40772 |
critical | 10.0 | 0.0036 | 2026-06-15 | Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. | |
CVE-2026-48836 |
critical | 10.0 | 0.0057 | 2026-06-15 | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | |
CVE-2026-35292 |
critical | 10.0 | 0.0048 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp | |
CVE-2026-35301 |
critical | 10.0 | 0.0048 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp | |
CVE-2026-35307 |
critical | 10.0 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-35308 |
critical | 10.0 | 0.0047 | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Th |