| CVE-2026-63739 | 7.7 | — | — | — | surrealdb / surrealdb | SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that all | 101d ago |
| CVE-2026-64039 | 7.7 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned | 102d ago |
| CVE-2026-7754 | 7.7 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure | 104d ago |
| CVE-2026-62227 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes | 104d ago |
| CVE-2026-62201 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that al | 104d ago |
| CVE-2026-57077 | 7.7 | — | — | — | — | YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. | 105d ago |
| CVE-2026-45313 | 7.7 | — | — | — | — | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. | 106d ago |
| CVE-2026-53514 | 7.7 | — | — | — | better-auth / better auth | Better Auth is an authentication and authorization library for TypeScript. | 106d ago |
| CVE-2026-48799 | 7.7 | — | — | — | — | Postiz is an AI social media scheduling tool. | 106d ago |
| CVE-2026-47164 | 7.7 | — | — | — | — | Vaultwarden is a Bitwarden-compatible server written in Rust. | 106d ago |
| CVE-2026-45806 | 7.7 | — | — | — | — | Penpot is an open-source design tool for design and code collaboration. | 106d ago |
| CVE-2026-61835 | 7.7 | — | — | — | monospace / directus | Directus is a real-time API and App dashboard for managing SQL database content. | 106d ago |
| CVE-2026-61644 | 7.7 | — | — | — | — | FastGPT is a knowledge-based AI application platform. | 106d ago |
| CVE-2026-14251 | 7.7 | — | — | — | — | A flaw was found in the OpenShift GitOps operator. | 106d ago |
| CVE-2026-61520 | 7.7 | — | — | — | — | Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request f | 107d ago |
| CVE-2026-49853 | 7.7 | — | — | — | — | Tornado is a Python web framework and asynchronous networking library. | 107d ago |
| CVE-2026-48332 | 7.7 | — | — | — | adobe / coldfusion | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security featu | 107d ago |
| CVE-2026-48328 | 7.7 | — | — | — | adobe / coldfusion | ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypas | 107d ago |
| CVE-2026-48348 | 7.7 | — | — | — | adobe / animate | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in t | 107d ago |
| CVE-2026-48347 | 7.7 | — | — | — | adobe / animate | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection | 107d ago |
| CVE-2026-15392 | 7.7 | — | — | — | — | DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. | 107d ago |
| CVE-2026-14903 | 7.7 | — | — | — | ivanti / xtraction | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrar | 107d ago |
| CVE-2026-57212 | 7.7 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 111d ago |
| CVE-2026-55659 | 7.7 | — | — | — | — | Grist is spreadsheet software using Python as its formula language. | 111d ago |
| CVE-2026-55516 | 7.7 | — | — | — | snipeitapp / snipe-it | Snipe-IT is an IT asset/license management system. | 111d ago |
| CVE-2026-56689 | 7.7 | — | — | — | dell / powerflex manager | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used i | 111d ago |
| CVE-2026-59832 | 7.7 | — | — | — | — | SiYuan is an open-source personal knowledge management system. | 112d ago |
| CVE-2026-33655 | 7.7 | — | — | — | newapi / new api | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. | 112d ago |
| CVE-2026-55208 | 7.7 | — | — | — | — | Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. | 112d ago |
| CVE-2026-59221 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 112d ago |
| CVE-2026-59216 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 112d ago |
| CVE-2026-58207 | 7.7 | — | — | — | linuxfoundation / nats-server | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. | 113d ago |
| CVE-2026-14373 | 7.7 | — | — | — | — | HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's | 113d ago |
| CVE-2026-55874 | 7.7 | — | — | — | — | SeaweedFS is a distributed storage system. | 113d ago |
| CVE-2026-60002 | 7.7 | — | — | — | openbsd / openssh | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. | 113d ago |
| CVE-2026-55431 | 7.7 | — | — | — | coder / coder | Coder allows organizations to provision remote development environments via Terraform. | 113d ago |
| CVE-2026-54607 | 7.7 | — | — | — | — | FastGPT is a knowledge-based AI application platform. | 114d ago |
| CVE-2026-34044 | 7.7 | — | — | — | — | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | 114d ago |
| CVE-2026-14468 | 7.7 | — | — | — | — | HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry module | 115d ago |
| CVE-2026-6901 | 7.7 | — | — | — | — | Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. | 115d ago |
| CVE-2026-9165 | 7.7 | — | — | — | — | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). | 115d ago |
| CVE-2026-58423 | 7.7 | — | — | — | — | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories | 118d ago |
| CVE-2026-58460 | 7.7 | — | — | — | — | react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious ap | 119d ago |
| CVE-2026-59095 | 7.7 | — | — | — | — | LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated at | 119d ago |
| CVE-2026-59092 | 7.7 | — | — | — | juicedata / juicefs | JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauth | 119d ago |
| CVE-2026-54401 | 7.7 | — | — | — | ui / unifi os server | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) | 119d ago |
| CVE-2026-34592 | 7.7 | — | — | — | — | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | 122d ago |
| CVE-2023-37524 | 7.7 | — | — | — | hcltech / traveler for microsoft outlook | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of | 124d ago |
| CVE-2026-49984 | 7.7 | — | — | — | kestra / kestra | Kestra is an open-source, event-driven orchestration platform. | 125d ago |
| CVE-2026-45807 | 7.7 | — | — | — | kestra / kestra | Kestra is an open-source, event-driven orchestration platform. | 125d ago |
| CVE-2026-55189 | 7.7 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 125d ago |
| CVE-2026-21734 | 7.7 | — | — | — | imaginationtech / ddk | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write o | 125d ago |
| CVE-2026-57920 | 7.7 | — | — | — | peplink / intcontrol 2 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for | 125d ago |
| CVE-2026-10835 | 7.7 | — | — | — | — | The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed t | 125d ago |
| CVE-2026-37149 | 7.7 | — | — | — | — | GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vuln | 126d ago |
| CVE-2026-9099 | 7.7 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 126d ago |
| CVE-2026-54033 | 7.7 | — | — | — | librechat / librechat | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. | 126d ago |
| CVE-2026-56054 | 7.7 | — | — | — | — | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | 126d ago |
| CVE-2026-8666 | 7.7 | — | — | — | rapid7 / insightconnect traceroute | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux all | 126d ago |
| CVE-2026-8665 | 7.7 | — | — | — | rapid7 / insightconnect translate | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remot | 126d ago |
