| CVE-2026-3476 | 7.8 | — | — | — | 3ds / solidworks | A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an a | 227d ago |
| CVE-2026-3086 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-3084 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-3082 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-3081 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-32708 | 7.8 | — | — | — | dronecode / px4 drone autopilot | PX4 autopilot is a flight control solution for drones. | 227d ago |
| CVE-2026-2923 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-2922 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-2921 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability. | 227d ago |
| CVE-2026-2920 | 7.8 | — | — | — | gstreamer / gstreamer | GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. | 227d ago |
| CVE-2025-15554 | 7.8 | — | — | — | truesec / lapswebui | Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a wo | 227d ago |
| CVE-2025-15552 | 7.8 | — | — | — | truesec / lapswebui | Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a work | 227d ago |
| CVE-2017-20218 | 7.8 | — | — | — | — | Serviio PRO 1.8 contains an unquoted search path vulnerability in the Windows service that allows local users to e | 227d ago |
| CVE-2016-20033 | 7.8 | — | — | — | wowza / streaming engine | Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users t | 227d ago |
| CVE-2026-0957 | 7.8 | — | — | — | ni / dasylab | There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted file in Digilent | 230d ago |
| CVE-2026-0956 | 7.8 | — | — | — | ni / dasylab | There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent D | 230d ago |
| CVE-2026-0955 | 7.8 | — | — | — | ni / dasylab | There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent D | 230d ago |
| CVE-2026-0954 | 7.8 | — | — | — | ni / dasylab | There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted DSB file in Digil | 230d ago |
| CVE-2026-27940 | 7.8 | — | — | — | ggml / llama.cpp | llama.cpp is an inference of several LLM models in C/C++. | 231d ago |
| CVE-2026-3989 | 7.8 | — | — | — | lmsys / sglang | SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. | 231d ago |
| CVE-2025-12690 | 7.8 | — | — | — | forcepoint / next generation firewall | Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affec | 232d ago |
| CVE-2026-63464 | 7.7 | — | — | — | — | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. | 55d ago |
| CVE-2026-19306 | 7.7 | — | — | — | — | IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server fil | 55d ago |
| CVE-2026-19304 | 7.7 | — | — | — | — | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information | 55d ago |
| CVE-2026-19283 | 7.7 | — | — | — | — | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an aut | 55d ago |
| CVE-2026-18905 | 7.7 | — | — | — | — | IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authent | 55d ago |
| CVE-2026-81832 | 7.7 | — | — | — | — | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for | 55d ago |
| CVE-2026-75035 | 7.7 | — | — | — | — | A flaw was found in Rancher Manager. | 56d ago |
| CVE-2026-55658 | 7.7 | — | — | — | — | Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance poo | 56d ago |
| CVE-2026-85211 | 7.7 | — | — | — | — | Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.p | 56d ago |
| CVE-2026-85178 | 7.7 | — | — | — | — | Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint f | 56d ago |
| CVE-2026-75033 | 7.7 | — | — | — | — | A flaw was found in Rancher Manager. | 56d ago |
| CVE-2023-20576 | 7.7 | — | — | — | — | Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially | 57d ago |
| CVE-2026-73775 | 7.7 | — | — | — | hpe / arubaos-cx | Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to a | 58d ago |
| CVE-2026-84199 | 7.7 | — | — | — | — | Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. | 58d ago |
| CVE-2026-84196 | 7.7 | — | — | — | — | Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows auth | 58d ago |
| CVE-2026-84195 | 7.7 | — | — | — | — | Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requ | 58d ago |
| CVE-2026-53553 | 7.7 | — | — | — | — | Goploy is an open-source automation deployment system. | 59d ago |
| CVE-2026-79750 | 7.7 | — | — | — | — | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separa | 59d ago |
| CVE-2026-82871 | 7.7 | — | — | — | — | ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authentic | 59d ago |
| CVE-2026-82869 | 7.7 | — | — | — | — | ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint | 59d ago |
| CVE-2026-16600 | 7.7 | — | — | — | — | The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and | 61d ago |
| CVE-2026-41012 | 7.7 | — | — | — | — | Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director | 61d ago |
| CVE-2026-81490 | 7.7 | — | — | — | — | A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sa | 62d ago |
| CVE-2026-82242 | 7.7 | — | — | — | — | Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate | 62d ago |
| CVE-2026-75889 | 7.7 | — | — | — | — | Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonito | 63d ago |
| CVE-2026-81679 | 7.7 | — | — | — | — | OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification R | 63d ago |
| CVE-2026-81576 | 7.7 | — | — | — | — | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and reli | 63d ago |
| CVE-2026-77017 | 7.7 | — | — | — | — | The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor conf | 63d ago |
| CVE-2026-47879 | 7.7 | — | — | — | — | Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the pr | 63d ago |
| CVE-2026-61617 | 7.7 | — | — | — | — | Wings is the server control plane for the Pterodactyl game-server management panel. | 64d ago |
| CVE-2026-61792 | 7.7 | — | — | — | — | Weblate is a web-based continuous localization platform used to manage software translations. | 64d ago |
| CVE-2026-75797 | 7.7 | — | — | — | — | The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local file | 64d ago |
| CVE-2026-57171 | 7.7 | — | — | — | — | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. | 64d ago |
| CVE-2026-79245 | 7.7 | — | — | — | google / chrome | Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the rend | 65d ago |
| CVE-2026-79659 | 7.7 | — | — | — | — | Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that u | 65d ago |
| CVE-2026-19851 | 7.7 | — | — | — | — | A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an | 65d ago |
| CVE-2026-56707 | 7.7 | — | — | — | — | Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-ob | 65d ago |
| CVE-2026-71366 | 7.7 | — | — | — | — | A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. | 66d ago |
| CVE-2026-34948 | 7.7 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 68d ago |
