Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:94"
641 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-45528 |
high | 7.3 | 0.0016 | 2026-10-23 | An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute ar | |
CVE-2026-41134 |
high | 7.3 | 0.0042 | 2026-04-22 | Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affect | |
CVE-2026-0236 |
high | 7.3 | 0.0016 | 2026-05-13 | A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly rest | |
CVE-2026-54057 |
high | 7.3 | 0.0017 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-con | |
CVE-2026-54453 |
high | 7.2 | 0.0044 | 2026-10-28 | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and h | |
CVE-2026-26026 |
high | 7.2 | 0.1153 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template inje | |
CVE-2026-3120 |
high | 7.2 | 0.0118 | 2026-05-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and | |
CVE-2026-43874 |
high | 7.2 | 0.0029 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side | |
CVE-2026-43680 |
high | 7.2 | 0.0046 | 2026-05-12 | A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console pr | |
CVE-2026-15410 |
high | 7.2 | 0.1179 | 2026-07-14 | KEV | SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions cou |
CVE-2026-62350 |
high | 7.2 | 0.0046 | 2026-07-15 | TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to | |
CVE-2026-71232 |
high | 7.2 | 0.0054 | 2026-08-05 | MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP fu | |
CVE-2026-76293 |
high | 7.2 | 0.0047 | 2026-10-21 | In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role wi | |
CVE-2026-113673 |
high | 7.2 | 0.0060 | 2026-10-24 | The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined tex | |
CVE-2026-115301 |
high | 7.2 | 0.0025 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine u | |
CVE-2026-113718 |
high | 7.1 | 0.0024 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xons | |
CVE-2026-118905 |
high | 7.1 | 0.0014 | 2026-10-29 | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js version | |
CVE-2026-61450 |
high | 7.1 | 0.0542 | 2026-07-10 | Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or | |
CVE-2026-73291 |
high | 7.1 | 0.0039 | 2026-08-12 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to v | |
CVE-2025-59042 |
high | 7.0 | 0.0013 | 2025-09-09 | PyInstaller bundles a Python application and all its dependencies into a single package. Due to a sp | |
CVE-2026-72718 |
high | 7.0 | 0.0022 | 2026-08-10 | goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` com | |
CVE-2026-6594 |
medium | 6.9 | 0.0034 | 2026-04-20 | A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing | |
CVE-2026-51385 |
medium | 6.9 | 0.0053 | 2026-07-20 | An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to exec | |
CVE-2026-116253 |
medium | 6.9 | 0.0049 | 2026-10-26 | A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.in | |
CVE-2026-48192 |
medium | 6.8 | 0.0032 | 2026-06-30 | A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10. | |
CVE-2026-35255 |
medium | 6.6 | 0.0018 | 2026-05-06 | Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open S | |
CVE-2026-90872 |
medium | 6.6 | — | 2026-10-29 | Improper neutralization of directives in dynamically evaluated code in the Manager web console of Pr | |
CVE-2026-56185 |
medium | 6.5 | 0.0084 | 2026-07-14 | Improper authentication in Windows Admin Center allows an authorized attacker to disclose informatio | |
CVE-2025-66533 |
medium | 6.5 | 0.0031 | 2025-12-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP Gi | |
CVE-2026-35211 |
medium | 6.5 | 0.0052 | 2026-07-08 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | |
CVE-2026-18894 |
medium | 6.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored P | |
CVE-2026-18245 |
medium | 6.4 | 0.0099 | 2026-07-30 | Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allo | |
CVE-2026-7669 |
medium | 6.3 | 0.0037 | 2026-05-02 | A vulnerability was detected in sgl-project SGLang up to 0.5.9. Impacted is the function get_tokeniz | |
CVE-2026-42879 |
medium | 6.3 | 0.0023 | 2026-05-27 | FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authe | |
CVE-2026-66148 |
medium | 6.3 | 0.0110 | 2026-08-11 | An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) | |
CVE-2026-59894 |
medium | 6.2 | 0.0013 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.p | |
CVE-2026-18874 |
medium | 6.2 | 0.0054 | 2026-08-19 | A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malici | |
CVE-2026-65804 |
medium | 6.1 | 0.0041 | 2026-08-03 | Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows | |
CVE-2026-27674 |
medium | 6.1 | 0.0019 | 2026-04-14 | Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an | |
CVE-2026-58025 |
medium | 5.9 | 0.0050 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerabil | |
CVE-2026-40602 |
medium | 5.6 | 0.0010 | 2026-04-21 | The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up t | |
CVE-2026-5970 |
medium | 5.5 | 0.0039 | 2026-04-09 | A vulnerability was detected in FoundationAgents MetaGPT up to 0.8.1. This affects the function chec | |
CVE-2026-5971 |
medium | 5.5 | 0.0039 | 2026-04-09 | A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the functi | |
CVE-2026-6110 |
medium | 5.5 | 0.0041 | 2026-04-12 | A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. This affects the function ge | |
CVE-2026-6603 |
medium | 5.5 | 0.0031 | 2026-04-20 | A vulnerability was determined in modelscope agentscope up to 1.0.18. Affected by this vulnerability | |
CVE-2026-6621 |
medium | 5.5 | 0.0034 | 2026-04-20 | A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknow | |
CVE-2026-7703 |
medium | 5.5 | 0.0031 | 2026-05-03 | A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown fu | |
CVE-2026-13500 |
medium | 5.5 | 0.0052 | 2026-06-28 | A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the | |
CVE-2026-14722 |
medium | 5.5 | 0.0054 | 2026-07-05 | A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown funct | |
CVE-2026-14749 |
medium | 5.5 | 0.0054 | 2026-07-05 | A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be |