Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:94"
626 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-10789 |
critical | 9.6 | 0.0070 | 2026-06-22 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the M | |
CVE-2026-48519 |
critical | 9.6 | 0.0078 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the " | |
CVE-2026-33646 |
critical | 9.6 | 0.0046 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes . | |
CVE-2026-14453 |
critical | 9.6 | 0.0084 | 2026-07-13 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-t | |
CVE-2026-71319 |
critical | 9.6 | 0.0063 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (developm | |
CVE-2026-6875 |
critical | 9.5 | 0.0143 | 2026-07-13 | ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow | |
CVE-2026-70477 |
critical | 9.5 | 0.0081 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-77992 |
critical | 9.5 | 0.0044 | 2026-08-22 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 | |
CVE-2025-30050 |
critical | 9.4 | 0.0022 | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports t | |
CVE-2026-104383 |
critical | 9.4 | 0.0037 | 2026-10-28 | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2 | |
CVE-2026-41137 |
critical | 9.4 | 0.0145 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-44262 |
critical | 9.4 | 0.0586 | 2026-05-12 | Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when docume | |
CVE-2026-45833 |
critical | 9.4 | 0.0034 | 2026-06-12 | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a | |
CVE-2026-55413 |
critical | 9.4 | 0.0032 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tool | |
CVE-2026-61444 |
critical | 9.4 | 0.0050 | 2026-07-10 | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the a | |
CVE-2026-69254 |
critical | 9.4 | 0.0069 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-69256 |
critical | 9.4 | 0.0101 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-69259 |
critical | 9.4 | 0.0082 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-69264 |
critical | 9.4 | 0.0111 | 2026-08-04 | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI | |
CVE-2026-73032 |
critical | 9.4 | 0.0056 | 2026-08-11 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e | |
CVE-2026-66147 |
critical | 9.4 | 0.0176 | 2026-08-11 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G | |
CVE-2024-58351 |
critical | 9.3 | 0.0093 | 2026-06-20 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the | |
CVE-2021-48016 |
critical | 9.3 | — | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP R | |
CVE-2026-8634 |
critical | 9.3 | 0.0095 | 2026-05-14 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attacke | |
CVE-2026-45261 |
critical | 9.3 | 0.0052 | 2026-05-28 | GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, | |
CVE-2026-47103 |
critical | 9.3 | 0.0136 | 2026-06-17 | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that | |
CVE-2026-58116 |
critical | 9.3 | 0.0090 | 2026-06-30 | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit | |
CVE-2026-58138 |
critical | 9.3 | 0.0914 | 2026-06-30 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit | |
CVE-2026-58449 |
critical | 9.3 | 0.0135 | 2026-06-30 | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body | |
CVE-2026-12257 |
critical | 9.3 | 0.0070 | 2026-07-13 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. | |
CVE-2026-59865 |
critical | 9.3 | 0.0436 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read | |
CVE-2026-59866 |
critical | 9.3 | 0.0141 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms | |
CVE-2026-65008 |
critical | 9.3 | 0.0249 | 2026-07-21 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData | |
CVE-2026-68770 |
critical | 9.3 | 0.0091 | 2026-07-31 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achi | |
CVE-2026-18667 |
critical | 9.3 | 0.0072 | 2026-08-03 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privi | |
CVE-2026-70553 |
critical | 9.3 | 0.0127 | 2026-08-04 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to | |
CVE-2026-67531 |
critical | 9.3 | 0.0073 | 2026-08-06 | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the s | |
CVE-2026-75827 |
critical | 9.3 | 0.0086 | 2026-08-18 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare | |
CVE-2026-63146 |
critical | 9.3 | 0.0066 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, atta | |
CVE-2026-114053 |
critical | 9.2 | 0.0046 | 2026-10-21 | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Tra | |
CVE-2026-39918 |
critical | 9.2 | 0.0066 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where th | |
CVE-2026-13014 |
critical | 9.2 | 0.0070 | 2026-07-13 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated | |
CVE-2026-69255 |
critical | 9.2 | 0.0060 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-58256 |
critical | 9.1 | 0.0057 | 2026-10-27 | GRR is a resource management and reservation application. Prior to the advisory-reported fixed versi | |
CVE-2026-67074 |
critical | 9.1 | — | 2026-10-28 | HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to exec | |
CVE-2026-42607 |
critical | 9.1 | 0.0438 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with administrative | |
CVE-2026-42555 |
critical | 9.1 | 0.0058 | 2026-05-14 | Valtimo is an open-source business process automation platform. com.ritense.valtimo:document from 12 | |
CVE-2026-41258 |
critical | 9.1 | 0.0032 | 2026-05-15 | OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and | |
CVE-2026-39465 |
critical | 9.1 | 0.0068 | 2026-06-15 | Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions. | |
CVE-2026-37637 |
critical | 9.1 | 0.0060 | 2026-06-29 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the fi |