Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:94"
637 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40967 |
high | 8.6 | 0.0039 | 2026-04-28 | In Spring AI, various FilterExpressionConverter implementations accept a filter expression object an | |
CVE-2026-42203 |
high | 8.6 | 0.0037 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1 | |
CVE-2026-49493 |
high | 8.6 | 0.0033 | 2026-06-05 | Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which | |
CVE-2026-56382 |
high | 8.6 | 0.0068 | 2026-06-21 | Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code exec | |
CVE-2026-55441 |
high | 8.6 | 0.0018 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feat | |
CVE-2026-59833 |
high | 8.6 | 0.0049 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note a | |
CVE-2026-61446 |
high | 8.6 | 0.0032 | 2026-07-15 | PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plug | |
CVE-2026-67340 |
high | 8.6 | 0.0092 | 2026-08-01 | ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang | |
CVE-2026-69088 |
high | 8.6 | 0.0029 | 2026-08-03 | Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class:: | |
CVE-2026-61523 |
high | 8.6 | 0.0119 | 2026-08-03 | WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that | |
CVE-2026-58074 |
high | 8.6 | 0.0053 | 2026-08-04 | A vulnerability allowing a high-privileged user to execute arbitrary code on the server. | |
CVE-2026-104082 |
high | 8.6 | 0.0087 | 2026-10-09 | SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker | |
CVE-2026-55543 |
high | 8.5 | 0.0021 | 2026-10-16 | TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set g | |
CVE-2026-49113 |
high | 8.5 | 0.0037 | 2026-06-17 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. | |
CVE-2026-57315 |
high | 8.5 | 0.0058 | 2026-06-26 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions. | |
CVE-2026-53511 |
high | 8.5 | 0.0022 | 2026-07-07 | calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitr | |
CVE-2026-61433 |
high | 8.5 | 0.0021 | 2026-07-15 | PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Pytho | |
CVE-2026-9147 |
high | 8.5 | 0.0022 | 2026-07-18 | uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and | |
CVE-2026-73248 |
high | 8.5 | 0.0020 | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_templ | |
CVE-2026-75858 |
high | 8.5 | 0.0036 | 2026-08-18 | CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code | |
CVE-2026-75911 |
high | 8.5 | 0.0025 | 2026-08-18 | CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter f | |
CVE-2026-40287 |
high | 8.4 | 0.0025 | 2026-04-14 | PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code | |
CVE-2026-44334 |
high | 8.4 | 0.0025 | 2026-05-08 | PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-402 | |
CVE-2026-42049 |
high | 8.4 | 0.0020 | 2026-07-14 | jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx inserts the android:versionName value from an | |
CVE-2026-66065 |
high | 8.4 | 0.0024 | 2026-08-03 | Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user- | |
CVE-2026-47781 |
high | 8.4 | 0.0019 | 2026-08-04 | PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automati | |
CVE-2026-54661 |
high | 8.3 | 0.0048 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior | |
CVE-2026-54662 |
high | 8.3 | 0.0035 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-54664 |
high | 8.3 | 0.0048 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior | |
CVE-2026-54666 |
high | 8.3 | 0.0036 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior | |
CVE-2026-33941 |
high | 8.2 | 0.0030 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 thr | |
CVE-2026-54271 |
high | 8.2 | 0.0030 | 2026-06-22 | protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix | |
CVE-2026-40563 |
high | 8.1 | 0.0046 | 2026-05-04 | Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas | |
CVE-2026-35194 |
high | 8.1 | 0.0038 | 2026-05-15 | Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x al | |
CVE-2026-46851 |
high | 8.1 | 0.0046 | 2026-06-17 | Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (compone | |
CVE-2026-55388 |
high | 8.1 | 0.0048 | 2026-06-22 | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's co | |
CVE-2026-47398 |
high | 8.1 | 0.0050 | 2026-07-21 | PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-443 | |
CVE-2026-53510 |
high | 8.1 | 0.0069 | 2026-07-31 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates atta | |
CVE-2026-18781 |
high | 8.1 | 0.0054 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not v | |
CVE-2026-79887 |
high | 8.1 | 0.0059 | 2026-10-22 | A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achi | |
CVE-2026-33435 |
high | 8.0 | 0.0071 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filte | |
CVE-2026-21575 |
high | 8.0 | 0.0059 | 2026-07-21 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sou | |
CVE-2026-65937 |
high | 8.0 | 0.0041 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend con | |
CVE-2026-50650 |
high | 7.8 | 0.0046 | 2026-07-14 | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized a | |
CVE-2026-86320 |
high | 7.8 | 0.0029 | 2026-09-17 | A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources wit | |
CVE-2026-96442 |
high | 7.8 | 0.0020 | 2026-09-23 | A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using l | |
CVE-2026-85359 |
high | 7.8 | 0.0030 | 2026-10-13 | Improper control of generation of code ('code injection') in Windows Performance Monitor allows an a | |
CVE-2026-113776 |
high | 7.8 | 0.0027 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, | |
CVE-2026-118614 |
high | 7.8 | 0.0020 | 2026-10-28 | Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability | |
CVE-2026-118616 |
high | 7.8 | 0.0020 | 2026-10-28 | Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allow |