| CVE-2026-73650 | 8.2 | — | — | — | — | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. | 60d ago |
| CVE-2026-17220 | 8.2 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication | 60d ago |
| CVE-2026-13048 | 8.2 | — | — | — | — | Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an a | 60d ago |
| CVE-2026-70461 | 8.2 | — | — | — | samba / rsync | rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated atta | 60d ago |
| CVE-2026-70458 | 8.2 | — | — | — | — | rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by | 60d ago |
| CVE-2026-70456 | 8.2 | — | — | — | — | rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a m | 60d ago |
| CVE-2026-14679 | 8.2 | — | — | — | postgresql / postgresql | Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via | 60d ago |
| CVE-2026-73613 | 8.2 | — | — | — | — | filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache ev | 60d ago |
| CVE-2026-59501 | 8.2 | — | — | — | — | : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solu | 60d ago |
| CVE-2026-18945 | 8.2 | — | — | — | — | The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order | 60d ago |
| CVE-2026-17485 | 8.2 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive infor | 61d ago |
| CVE-2026-10543 | 8.2 | — | — | — | ibm / db2 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially cr | 61d ago |
| CVE-2026-73303 | 8.2 | — | — | — | — | Budibase is an open-source low-code platform. | 61d ago |
| CVE-2026-17445 | 8.2 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to im | 61d ago |
| CVE-2026-19426 | 8.2 | — | — | — | — | POS System developed by FitSoft has a Missing Authentication vulnerability. | 61d ago |
| CVE-2026-13171 | 8.2 | — | — | — | — | The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registratio | 61d ago |
| CVE-2026-64954 | 8.2 | — | — | — | — | Velociraptor allows scheduling new collections via VQL queries in notebooks. | 61d ago |
| CVE-2026-6484 | 8.2 | — | — | — | — | In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution. | 62d ago |
| CVE-2026-48763 | 8.2 | — | — | — | — | TypeBot is a chatbot builder tool. | 62d ago |
| CVE-2026-19550 | 8.2 | — | — | — | redhat / enterprise linux | A flaw was found in FreeIPA. | 62d ago |
| CVE-2026-48771 | 8.2 | — | — | — | — | ishankportfolio is a portfolio website. | 62d ago |
| CVE-2026-69306 | 8.2 | — | — | — | microsoft / visual studio code | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security f | 62d ago |
| CVE-2026-21279 | 8.2 | — | — | — | adobe / coldfusion | is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. | 62d ago |
| CVE-2026-72922 | 8.2 | — | — | — | — | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence | 62d ago |
| CVE-2026-14886 | 8.2 | — | — | — | — | Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass t | 63d ago |
| CVE-2026-68118 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RE | 63d ago |
| CVE-2026-12984 | 8.2 | — | — | — | — | Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Da | 63d ago |
| CVE-2026-16257 | 8.2 | — | — | — | — | The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoin | 63d ago |
| CVE-2026-66838 | 8.2 | — | — | — | elixir-ecto / postgrex | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto | 66d ago |
| CVE-2026-66708 | 8.2 | — | — | — | — | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | 67d ago |
| CVE-2026-16268 | 8.2 | — | — | — | — | The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before | 67d ago |
| CVE-2026-14829 | 8.2 | — | — | — | — | The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does | 67d ago |
| CVE-2026-71315 | 8.2 | — | — | — | — | Nuxt is an open-source web development framework for Vue.js. | 68d ago |
| CVE-2026-10025 | 8.2 | — | — | — | ibm / qradar security information and event manager | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) | 68d ago |
| CVE-2026-71264 | 8.2 | — | — | — | — | WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, u | 68d ago |
| CVE-2026-71252 | 8.2 | — | — | — | — | toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-br | 68d ago |
| CVE-2026-6627 | 8.2 | — | — | — | — | The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modificat | 68d ago |
| CVE-2026-64578 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before r | 68d ago |
| CVE-2026-70486 | 8.2 | — | — | — | — | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 69d ago |
| CVE-2026-47623 | 8.2 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. | 69d ago |
| CVE-2026-24253 | 8.2 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. | 69d ago |
| CVE-2026-58080 | 8.2 | — | — | — | eclipse / milo | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMappe | 69d ago |
| CVE-2026-10849 | 8.2 | — | — | — | zephyrproject / zephyr | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the upda | 70d ago |
| CVE-2026-15055 | 8.2 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. | 71d ago |
| CVE-2026-14920 | 8.2 | — | — | — | — | ## Summary | 71d ago |
| CVE-2026-53501 | 8.2 | — | — | — | — | Thumbor is an open-source photo thumbnail service by globo.com. | 73d ago |
| CVE-2026-53500 | 8.2 | — | — | — | — | Thumbor is an open-source photo thumbnail service by globo.com. | 73d ago |
| CVE-2026-18141 | 8.2 | — | — | — | — | A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). | 73d ago |
| CVE-2026-56672 | 8.2 | — | — | — | — | ComfyUI is a node-based diffusion model GUI, API, and backend. | 73d ago |
| CVE-2026-56670 | 8.2 | — | — | — | — | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. | 73d ago |
| CVE-2026-12722 | 8.2 | — | — | — | — | Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management P | 74d ago |
| CVE-2026-54727 | 8.2 | — | — | — | — | proot-distro is a utility for managing proot containers. | 75d ago |
| CVE-2026-54574 | 8.2 | — | — | — | — | proot-distro is a utility for managing proot containers. | 75d ago |
| CVE-2026-58188 | 8.2 | — | — | — | apache / traffic server | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. | 75d ago |
| CVE-2026-58184 | 8.2 | — | — | — | apache / traffic server | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR cond | 75d ago |
| CVE-2026-58159 | 8.2 | — | — | — | apache / traffic server | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. | 75d ago |
| CVE-2026-22068 | 8.2 | — | — | — | apache / traffic server | Regular Expression without Anchors vulnerability in Apache Traffic Server. | 75d ago |
| CVE-2026-54691 | 8.2 | — | — | — | — | datamodel-code-generator generates Python data models from schema definitions. | 76d ago |
| CVE-2026-54690 | 8.2 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 76d ago |
| CVE-2026-14996 | 8.2 | — | — | — | ibm / aspera faspex | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management. | 76d ago |
