| CVE-2026-8660 | 7.7 | — | — | — | rapid7 / insightconnect ping | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote a | 126d ago |
| CVE-2026-8592 | 7.7 | — | — | — | rapid7 / insightconnect awk | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows | 126d ago |
| CVE-2026-33235 | 7.7 | — | — | — | — | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence | 127d ago |
| CVE-2026-54699 | 7.7 | — | — | — | — | Warp is an agentic development environment. | 127d ago |
| CVE-2026-9710 | 7.7 | — | — | — | — | The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request | 127d ago |
| CVE-2026-9709 | 7.7 | — | — | — | — | The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, all | 127d ago |
| CVE-2026-54322 | 7.7 | — | — | — | — | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. | 128d ago |
| CVE-2026-54018 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 128d ago |
| CVE-2026-54304 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 128d ago |
| CVE-2026-49465 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 128d ago |
| CVE-2026-54313 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 128d ago |
| CVE-2026-54311 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 128d ago |
| CVE-2026-56268 | 7.7 | — | — | — | flowiseai / flowise | Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endp | 129d ago |
| CVE-2026-42129 | 7.7 | — | — | — | grafana / loki datasource | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Lok | 129d ago |
| CVE-2026-41156 | 7.7 | — | — | — | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement o | 132d ago |
| CVE-2026-34192 | 7.7 | — | — | — | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path l | 132d ago |
| CVE-2026-54017 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 133d ago |
| CVE-2026-32174 | 7.7 | — | — | — | microsoft / azure ai bot service | Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network. | 133d ago |
| CVE-2026-54193 | 7.7 | — | — | — | — | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. | 134d ago |
| CVE-2025-60223 | 7.7 | — | — | — | — | Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions. | 134d ago |
| CVE-2026-47684 | 7.7 | — | — | — | — | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. | 135d ago |
| CVE-2026-40779 | 7.7 | — | — | — | — | Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions. | 136d ago |
| CVE-2026-40727 | 7.7 | — | — | — | — | Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions. | 136d ago |
| CVE-2026-53833 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allow | 139d ago |
| CVE-2026-53832 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to | 139d ago |
| CVE-2026-46717 | 7.7 | — | — | — | — | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. | 139d ago |
| CVE-2026-47260 | 7.7 | — | — | — | — | Koel is a free, open-source music streaming solution. | 139d ago |
| CVE-2026-53812 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows auth | 140d ago |
| CVE-2026-50245 | 7.7 | — | — | — | — | Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authenticatio | 140d ago |
| CVE-2026-50005 | 7.7 | — | — | — | — | Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access | 140d ago |
| CVE-2026-47170 | 7.7 | — | — | — | — | Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface | 140d ago |
| CVE-2026-44692 | 7.7 | — | — | — | — | Sharp is a content management framework built for Laravel as a package. | 141d ago |
| CVE-2026-50567 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 141d ago |
| CVE-2026-49823 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 141d ago |
| CVE-2026-49822 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 141d ago |
| CVE-2026-49821 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 141d ago |
| CVE-2026-46518 | 7.7 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 141d ago |
| CVE-2026-47937 | 7.7 | — | — | — | adobe / acrobat dc | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element | 142d ago |
| CVE-2026-49957 | 7.7 | — | — | — | — | Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated | 142d ago |
| CVE-2026-52906 | 7.7 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead o | 142d ago |
| CVE-2026-11297 | 7.7 | — | — | — | google / chrome | Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allow | 146d ago |
| CVE-2026-45497 | 7.7 | — | — | — | microsoft / copilot | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an | 146d ago |
| CVE-2026-4035 | 7.7 | — | — | — | lfprojects / mlflow | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI | 148d ago |
| CVE-2026-44285 | 7.7 | — | — | — | — | FastGPT is an AI Agent building platform. | 153d ago |
| CVE-2026-47179 | 7.7 | — | — | — | — | Arcane is an interface for managing Docker containers, images, networks, and volumes. | 153d ago |
| CVE-2026-10107 | 7.7 | — | — | — | — | MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authent | 153d ago |
| CVE-2026-42965 | 7.7 | — | — | — | redhat / openshift container platform | A flaw was found in the OpenShift Router. | 153d ago |
| CVE-2026-46823 | 7.7 | — | — | — | oracle / public sector financials | Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component | 154d ago |
| CVE-2026-46821 | 7.7 | — | — | — | oracle / financials common modules | Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Compon | 154d ago |
| CVE-2026-42398 | 7.7 | — | — | — | elastic / kibana | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to | 154d ago |
| CVE-2026-45296 | 7.7 | — | — | — | — | OpenReplay is a self-hosted session replay suite. | 154d ago |
| CVE-2026-46123 | 7.7 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtio_bt: clamp rx length before s | 154d ago |
| CVE-2026-9804 | 7.7 | — | — | — | — | A flaw was found in KubeVirt's virt-exportserver component. | 154d ago |
| CVE-2026-48146 | 7.7 | — | — | — | — | Budibase is an open-source low-code platform. | 155d ago |
| CVE-2026-46427 | 7.7 | — | — | — | — | Budibase is an open-source low-code platform. | 155d ago |
| CVE-2026-45715 | 7.7 | — | — | — | — | Budibase is an open-source low-code platform. | 155d ago |
| CVE-2026-45548 | 7.7 | — | — | — | — | Budibase is an open-source low-code platform. | 155d ago |
| CVE-2026-45061 | 7.7 | — | — | — | — | Budibase is an open-source low-code platform. | 155d ago |
| CVE-2026-2253 | 7.7 | — | — | — | hitachi / vantara pentaho data integration and analytics | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3 | 155d ago |
| CVE-2026-8856 | 7.7 | — | — | — | ibm / http server | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write acces | 156d ago |
