| CVE-2025-15485 | 8.2 | — | — | — | — | The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, a | 40d ago |
| CVE-2026-84696 | 8.2 | — | — | — | — | Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the | 41d ago |
| CVE-2026-84370 | 8.2 | — | — | — | — | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. | 41d ago |
| CVE-2026-73779 | 8.2 | — | — | — | hpe / arubaos-cx | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an un | 41d ago |
| CVE-2026-73710 | 8.2 | — | — | — | arubanetworks / fabric composer | Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacke | 41d ago |
| CVE-2026-84187 | 8.2 | — | — | — | — | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated a | 41d ago |
| CVE-2026-77348 | 8.2 | — | — | — | — | Wallos is an open-source, self-hostable personal subscription tracker. | 42d ago |
| CVE-2026-82876 | 8.2 | — | — | — | — | Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware | 42d ago |
| CVE-2026-82473 | 8.2 | — | — | — | — | KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication veri | 44d ago |
| CVE-2026-76548 | 8.2 | — | — | — | — | The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload featur | 44d ago |
| CVE-2026-18904 | 8.2 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject una | 45d ago |
| CVE-2026-18891 | 8.2 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitiv | 45d ago |
| CVE-2026-82285 | 8.2 | — | — | — | — | bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/repor | 45d ago |
| CVE-2026-82234 | 8.2 | — | — | — | — | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetc | 45d ago |
| CVE-2026-80615 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy o | 45d ago |
| CVE-2026-81730 | 8.2 | — | — | — | dolibarr / dolibarr erp\/crm | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME header | 46d ago |
| CVE-2026-59324 | 8.2 | — | — | — | vmware / spring integration | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads | 46d ago |
| CVE-2026-59316 | 8.2 | — | — | — | broadcom / spring authorization server | Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. | 46d ago |
| CVE-2026-80208 | 8.2 | — | — | — | — | APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserControlle | 46d ago |
| CVE-2026-75871 | 8.2 | — | — | — | gitlab / gitlab | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway | 46d ago |
| CVE-2026-19889 | 8.2 | — | — | — | — | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway | 46d ago |
| CVE-2026-81574 | 8.2 | — | — | — | — | In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, | 46d ago |
| CVE-2026-47877 | 8.2 | — | — | — | vmware / spring security | Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity enc | 46d ago |
| CVE-2026-80549 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not oper | 47d ago |
| CVE-2026-77538 | 8.2 | — | — | — | — | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi | 47d ago |
| CVE-2026-18794 | 8.2 | — | — | — | — | The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes | 47d ago |
| CVE-2026-80236 | 8.2 | — | — | — | — | Efence developed by Thinking Software Technology has a SQL Injection vulnerability. | 47d ago |
| CVE-2026-55571 | 8.2 | — | — | — | — | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. | 48d ago |
| CVE-2026-47626 | 8.2 | — | — | — | — | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cau | 48d ago |
| CVE-2026-24263 | 8.2 | — | — | — | — | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cau | 48d ago |
| CVE-2026-24262 | 8.2 | — | — | — | — | NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cau | 48d ago |
| CVE-2026-79674 | 8.2 | — | — | — | nltk / nltk | NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows | 48d ago |
| CVE-2026-55533 | 8.2 | — | — | — | — | PraisonAI is a multi-agent teams system. | 48d ago |
| CVE-2026-55528 | 8.2 | — | — | — | — | PraisonAI is a multi-agent teams system. | 48d ago |
| CVE-2026-76842 | 8.2 | — | — | — | — | The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encod | 49d ago |
| CVE-2026-78209 | 8.2 | — | — | — | — | exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV o | 50d ago |
| CVE-2026-74704 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malfo | 51d ago |
| CVE-2026-74697 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to p | 51d ago |
| CVE-2026-63135 | 8.2 | — | — | — | — | YOURLS is a self-hosted, customizable URL shortener written in PHP. | 52d ago |
| CVE-2026-61824 | 8.2 | — | — | — | — | Defuddle cleans up HTML pages. | 52d ago |
| CVE-2026-54682 | 8.2 | — | — | — | — | DiscordChatExporter saves Discord chat logs to a file. | 52d ago |
| CVE-2026-19442 | 8.2 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI) | 53d ago |
| CVE-2026-18840 | 8.2 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improp | 53d ago |
| CVE-2026-18670 | 8.2 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and poten | 53d ago |
| CVE-2026-16943 | 8.2 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a heap | 53d ago |
| CVE-2026-65842 | 8.2 | — | — | — | — | Plate is a rich-text editor with AI and shadcn/ui. | 53d ago |
| CVE-2026-49825 | 8.2 | — | — | — | — | lxml is a library for processing XML and HTML in the Python language. | 53d ago |
| CVE-2026-76402 | 8.2 | — | — | — | splunk / connect for kafka | In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Represen | 54d ago |
| CVE-2026-16933 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through F | 54d ago |
| CVE-2026-16857 | 8.2 | — | — | — | ibm / aix | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS | 54d ago |
| CVE-2026-16707 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through F | 54d ago |
| CVE-2026-16661 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through F | 54d ago |
| CVE-2026-17494 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interf | 54d ago |
| CVE-2026-17100 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950 | 54d ago |
| CVE-2026-17093 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through F | 54d ago |
| CVE-2026-16930 | 8.2 | — | — | — | ibm / power system e1180 \(9080-heu\) firmware | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by | 54d ago |
| CVE-2026-19234 | 8.2 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vu | 54d ago |
| CVE-2026-41424 | 8.2 | — | — | — | — | Wazuh is a free and open source platform used for threat prevention, detection, and response. | 54d ago |
| CVE-2026-63407 | 8.2 | — | — | — | — | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. | 54d ago |
| CVE-2026-16686 | 8.2 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due | 54d ago |
