| CVE-2026-59835 | 8.6 | — | — | — | fortinet / fortisandbox | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4. | 89d ago |
| CVE-2026-62242 | 8.6 | — | — | — | — | Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthentic | 90d ago |
| CVE-2026-61462 | 8.6 | — | — | — | — | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers | 90d ago |
| CVE-2026-57709 | 8.6 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membersh | 90d ago |
| CVE-2026-57389 | 8.6 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groun | 90d ago |
| CVE-2026-12582 | 8.6 | — | — | — | — | The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter | 90d ago |
| CVE-2026-61426 | 8.6 | — | — | — | — | PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key req | 92d ago |
| CVE-2026-52747 | 8.6 | — | — | — | owasp / modsecurity | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. | 93d ago |
| CVE-2026-55638 | 8.6 | — | — | — | — | 9Router is an AI router & token saver. | 93d ago |
| CVE-2026-56261 | 8.6 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /craw | 93d ago |
| CVE-2026-55604 | 8.6 | — | — | — | — | DeepSeek MCP Server is an MCP server for DeepSeek V4. | 94d ago |
| CVE-2026-60105exploited | 8.6 | 1.5% | 1/3 | +61d | — | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused | 95d ago |
| CVE-2026-58192 | 8.6 | — | — | — | appium / appium\/storage-plugin | Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. | 95d ago |
| CVE-2026-55418 | 8.6 | — | — | — | — | FastGPT is an open source AI knowledge base platform. | 96d ago |
| CVE-2026-59707 | 8.6 | — | — | — | — | LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint t | 96d ago |
| CVE-2026-57573 | 8.6 | — | — | — | kidocode / crawl4ai | Crawl4AI is an open-source LLM-friendly web crawler and scraper. | 97d ago |
| CVE-2026-4249 | 8.6 | — | — | — | wso2 / api control plane | The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without suffi | 97d ago |
| CVE-2026-55117 | 8.6 | — | — | — | ui / unifi access | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Ap | 101d ago |
| CVE-2026-54408 | 8.6 | — | — | — | ui / unifi protect | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi | 101d ago |
| CVE-2026-54407 | 8.6 | — | — | — | ui / unifi protect | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi | 101d ago |
| CVE-2026-54403 | 8.6 | — | — | — | ui / unifi os server | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices | 101d ago |
| CVE-2026-13849 | 8.6 | — | — | — | google / chrome | Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowe | 103d ago |
| CVE-2026-48285 | 8.6 | — | — | — | adobe / coldfusion | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability | 103d ago |
| CVE-2026-11590 | 8.6 | — | — | — | — | The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array | 103d ago |
| CVE-2026-56285 | 8.6 | — | — | — | — | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded | 104d ago |
| CVE-2026-58049 | 8.6 | — | — | — | — | FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor | 105d ago |
| CVE-2026-49991 | 8.6 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 107d ago |
| CVE-2026-55441 | 8.6 | — | — | — | — | mise manages dev tools like node, python, cmake, and terraform. | 107d ago |
| CVE-2026-56035 | 8.6 | — | — | — | — | Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. | 107d ago |
| CVE-2026-57877 | 8.6 | — | — | — | — | An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and ea | 107d ago |
| CVE-2026-53217 | 8.6 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packe | 108d ago |
| CVE-2026-12053 | 8.6 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain cond | 108d ago |
| CVE-2026-47389 | 8.6 | — | — | — | — | Mastodon is a free, open-source social network server based on ActivityPub. | 109d ago |
| CVE-2026-48721 | 8.6 | — | — | — | — | Warp is an agentic development environment. | 109d ago |
| CVE-2026-49269 | 8.6 | — | — | — | — | Apple M1 GPUs retain register file data between compute shader dispatches from different processes. | 109d ago |
| CVE-2026-54762 | 8.6 | — | — | — | traefik / traefik | Traefik is an HTTP reverse proxy and load balancer. | 110d ago |
| CVE-2026-53755 | 8.6 | — | — | — | kidocode / crawl4ai | Crawl4AI is an open-source LLM friendly web crawler & scraper. | 110d ago |
| CVE-2026-56266 | 8.6 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and | 111d ago |
| CVE-2026-55602 | 8.6 | — | — | — | chimurai / http-proxy-middleware | http-proxy-middleware is node.js http-proxy middleware. | 111d ago |
| CVE-2025-7737 | 8.6 | — | — | — | — | DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. | 114d ago |
| CVE-2025-69128 | 8.6 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allo | 116d ago |
| CVE-2026-27400 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. | 116d ago |
| CVE-2026-22343 | 8.6 | — | — | — | — | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. | 116d ago |
| CVE-2025-69139 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions. | 116d ago |
| CVE-2026-46776 | 8.6 | — | — | — | oracle / unified directory | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). | 116d ago |
| CVE-2026-22312 | 8.6 | — | — | — | — | The device has a webserver that exposes a REST API authenticated with a constant token. | 117d ago |
| CVE-2026-42089 | 8.6 | — | — | — | — | Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a gener | 117d ago |
| CVE-2026-10649 | 8.6 | — | — | — | — | A flaw was found in Pacemaker. | 117d ago |
| CVE-2025-71261 | 8.6 | — | — | — | — | An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before | 117d ago |
| CVE-2026-47825 | 8.6 | — | — | — | — | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain c | 118d ago |
| CVE-2026-40769 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & | 118d ago |
| CVE-2026-47835 | 8.6 | — | — | — | vmware / spring ai | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasti | 118d ago |
| CVE-2026-12057 | 8.6 | — | — | — | foxit / ai | When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept | 118d ago |
| CVE-2026-54410 | 8.6 | — | — | — | — | nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TC | 119d ago |
| CVE-2026-11527 | 8.6 | — | — | — | — | Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open( | 119d ago |
| CVE-2026-50085 | 8.6 | — | — | — | aqara / board service | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the plat | 121d ago |
| CVE-2026-47209 | 8.6 | — | — | — | — | vm2 is an open source vm/sandbox for Node.js. | 121d ago |
| CVE-2026-47139 | 8.6 | — | — | — | — | vm2 is an open source vm/sandbox for Node.js. | 121d ago |
| CVE-2026-45169 | 8.6 | — | — | — | paloaltonetworks / idira privileged access manager vault | Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhib | 121d ago |
| CVE-2026-47368 | 8.6 | — | — | — | — | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices | 121d ago |
