Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:94"
626 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40217 |
— | — | 0.1553 | 2026-04-10 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting | |
CVE-2026-41246 |
— | — | 0.0049 | 2026-04-23 | Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32. | |
CVE-2026-40466 |
— | — | 0.0478 | 2026-04-24 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability i | |
CVE-2026-41044 |
— | — | 0.0098 | 2026-04-24 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability i | |
CVE-2026-24118 |
— | — | 0.0091 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox br | |
CVE-2026-24120 |
— | — | 0.0090 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is | |
CVE-2026-24781 |
— | — | 0.0119 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox br | |
CVE-2026-8094 |
— | — | 0.0045 | 2026-05-07 | Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunde | |
CVE-2026-43997 |
— | — | 0.0098 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Obj | |
CVE-2026-44005 |
— | — | 0.0083 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable pro | |
CVE-2026-44006 |
— | — | 0.0081 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.g | |
CVE-2026-44513 |
— | — | 0.0107 | 2026-05-14 | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code by | |
CVE-2026-41523 |
— | — | 0.0091 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert | |
CVE-2026-44016 |
— | — | 0.0059 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with th | |
CVE-2026-72530 |
— | — | 0.0169 | — | KEV | TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote atta |
CVE-2026-60004 |
— | — | 0.2399 | — | KEV | Gitea contains a code injection vulnerability that allows an attacker with repository write access t |
CVE-2026-0322 |
— | — | 0.0174 | — | KEV | Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated |
CVE-2008-4250 |
— | — | — | — | KEV | Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows |
CVE-2009-0238 |
— | — | — | — | KEV | Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker t |
CVE-2009-1151 |
— | — | — | — | KEV | Setup script used to generate configuration can be fooled using a crafted POST request to include ar |
CVE-2009-0556 |
— | — | — | — | KEV | Microsoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to |
CVE-2009-0557 |
— | — | — | — | KEV | Microsoft Office contains an object record corruption vulnerability that allows remote attackers to |
CVE-2012-0391 |
— | — | — | — | KEV | The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input valida |
CVE-2012-0158 |
— | — | — | — | KEV | Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, |
CVE-2012-1535 |
— | — | — | — | KEV | Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or |
CVE-2013-4810 |
— | — | — | — | KEV | HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management |