| CVE-2026-44492 | 8.6 | — | — | — | axios / axios | Axios is a promise based HTTP client for the browser and Node.js. | 122d ago |
| CVE-2026-40999 | 8.6 | — | — | — | broadcom / spring web services | When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connec | 122d ago |
| CVE-2026-50131 | 8.6 | — | — | — | — | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. | 123d ago |
| CVE-2026-3326 | 8.6 | — | — | — | — | The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL | 123d ago |
| CVE-2026-46491 | 8.6 | — | — | — | — | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. | 124d ago |
| CVE-2026-47907 | 8.6 | — | — | — | adobe / dreamweaver | Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Access Control vulnerability that could | 124d ago |
| CVE-2026-47906 | 8.6 | — | — | — | adobe / dreamweaver | Dreamweaver Desktop versions 21.7 and earlier are affected by a Dependency on Vulnerable Third-Party Component vul | 124d ago |
| CVE-2026-11158 | 8.6 | — | — | — | google / chrome | Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a l | 129d ago |
| CVE-2026-49202 | 8.6 | — | — | — | acer / connect m6e 5g firmware | Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Reso | 129d ago |
| CVE-2026-46273 | 8.6 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MS | 130d ago |
| CVE-2026-20230exploited | 8.6 | 88.2% | 3/3 | +19d | cisco / unified communications manager | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Sess | 130d ago |
| CVE-2022-4992 | 8.6 | — | — | — | — | Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lowe | 131d ago |
| CVE-2019-25719 | 8.6 | — | — | — | — | Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, | 131d ago |
| CVE-2026-37232 | 8.6 | — | — | — | openairinterface / openairinterface5g | An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization | 132d ago |
| CVE-2024-40646 | 8.6 | — | — | — | vertex-app / vertex | Vertex is a management tool for PT (Private Tracker) users to manage streaming and watching videos. | 132d ago |
| CVE-2026-44697 | 8.6 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 135d ago |
| CVE-2026-49127 | 8.6 | — | — | — | — | Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_ | 136d ago |
| CVE-2026-44466 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 136d ago |
| CVE-2026-44465 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 136d ago |
| CVE-2026-44463 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 136d ago |
| CVE-2026-44461 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 136d ago |
| CVE-2026-7862 | 8.6 | — | — | — | — | The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund re | 136d ago |
| CVE-2026-42737 | 8.6 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBookin | 137d ago |
| CVE-2025-30028 | 8.6 | — | — | — | synology / active backup for business | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. | 137d ago |
| CVE-2026-45298exploited | 8.6 | 1.6% | 1/3 | +80d | amirraminfar / dozzle | Dozzle is a realtime log viewer for docker containers. | 138d ago |
| CVE-2026-39310 | 8.6 | — | — | — | — | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowled | 144d ago |
| CVE-2026-8958 | 8.6 | — | — | — | mozilla / firefox | Information disclosure, sandbox escape in the Security: Process Sandboxing component. | 145d ago |
| CVE-2026-6379 | 8.6 | — | — | — | — | The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before | 146d ago |
| CVE-2026-2652exploited | 8.6 | 1.4% | 1/3 | +84d | lfprojects / mlflow | A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes | 150d ago |
| CVE-2026-20224 | 8.6 | — | — | — | cisco / catalyst sd-wan manager | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenti | 150d ago |
| CVE-2026-42595 | 8.6 | — | — | — | thecodingmachine / gotenberg | Gotenberg is a Docker-powered stateless API for PDF files. | 150d ago |
| CVE-2026-42281 | 8.6 | — | — | — | magicmirror / magicmirror | MagicMirror² is an open source modular smart mirror platform. | 150d ago |
| CVE-2026-29205 | 8.6 | — | — | — | cpanel / cpanel | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the | 151d ago |
| CVE-2026-44578 | 8.6 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 151d ago |
| CVE-2026-44001 | 8.6 | — | — | — | vm2 project / vm2 | vm2 is an open source vm/sandbox for Node.js. | 151d ago |
| CVE-2026-33362 | 8.6 | — | — | — | — | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android | 153d ago |
| CVE-2025-10470 | 8.6 | — | — | — | wso2 / identity server | The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting | 153d ago |
| CVE-2026-4690 | 8.6 | — | — | — | mozilla / firefox | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. | 201d ago |
| CVE-2026-4687 | 8.6 | — | — | — | mozilla / firefox | Sandbox escape due to incorrect boundary conditions in the Telemetry component. | 201d ago |
| CVE-2026-22739 | 8.6 | — | — | — | vmware / spring cloud config | Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Conf | 202d ago |
| CVE-2026-33719 | 8.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 202d ago |
| CVE-2026-33513 | 8.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 202d ago |
| CVE-2026-33480 | 8.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 202d ago |
| CVE-2026-33166 | 8.6 | — | — | — | qameta / allure report | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. | 205d ago |
| CVE-2026-33191 | 8.6 | — | — | — | free5gc / udm | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. | 205d ago |
| CVE-2026-33039 | 8.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 205d ago |
| CVE-2026-32721 | 8.6 | — | — | — | openwrt / luci | LuCI is the OpenWrt Configuration Interface. | 206d ago |
| CVE-2026-26139 | 8.6 | — | — | — | microsoft / purview | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over | 206d ago |
| CVE-2026-26138 | 8.6 | — | — | — | microsoft / purview | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over | 206d ago |
| CVE-2026-23659 | 8.6 | — | — | — | microsoft / azure data factory | Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker t | 206d ago |
| CVE-2026-23658 | 8.6 | — | — | — | microsoft / azure devops | Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a | 206d ago |
| CVE-2026-3511 | 8.6 | — | — | — | — | Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram | 206d ago |
| CVE-2026-31998 | 8.6 | — | — | — | openclaw / openclaw | OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat chann | 207d ago |
| CVE-2026-32255exploited | 8.6 | 1.7% | 1/3 | +182d | kan / kan | Kan is an open-source project management tool. | 207d ago |
| CVE-2026-22729 | 8.6 | — | — | — | vmware / spring ai | A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to | 207d ago |
| CVE-2026-28500 | 8.6 | — | — | — | linuxfoundation / onnx | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. | 208d ago |
| CVE-2026-85651 | 8.5 | — | — | — | — | Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing a | 37d ago |
| CVE-2026-85616 | 8.5 | — | — | — | — | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions | 37d ago |
| CVE-2026-70178 | 8.5 | — | — | — | — | Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | 38d ago |
| CVE-2026-69857 | 8.5 | — | — | — | — | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoof | 38d ago |
