| CVE-2026-26147 | 7.7 | — | — | — | microsoft / azure stack hci | Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a ne | 159d ago |
| CVE-2026-39965 | 7.7 | — | — | — | — | TypeBot is a chatbot builder tool. | 160d ago |
| CVE-2026-34911 | 7.7 | — | — | — | ui / unifi os server | A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found | 160d ago |
| CVE-2026-9133 | 7.7 | — | — | — | — | Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. | 162d ago |
| CVE-2026-45338 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 167d ago |
| CVE-2026-45303 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 167d ago |
| CVE-2026-45370 | 7.7 | — | — | — | — | python-utcp is the python implementation of UTCP. | 168d ago |
| CVE-2026-42283 | 7.7 | — | — | — | devspace / devspace | DevSpace is a client-only developer tool for cloud-native development with Kubernetes. | 168d ago |
| CVE-2026-42832 | 7.7 | — | — | — | microsoft / excel | Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally. | 170d ago |
| CVE-2026-42141 | 7.7 | — | — | — | — | Xibo is an open source digital signage platform with a web content management system and Windows display player so | 170d ago |
| CVE-2026-33821 | 7.7 | — | — | — | microsoft / dynamics 365 customer insights | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate | 170d ago |
| CVE-2026-45218 | 7.7 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP | 170d ago |
| CVE-2026-27662 | 7.7 | — | — | — | — | Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding se | 170d ago |
| CVE-2026-43890 | 7.7 | — | — | — | — | Outline is a service that allows for collaborative documentation. | 171d ago |
| CVE-2026-43884 | 7.7 | — | — | — | — | WWBN AVideo is an open source video platform. | 171d ago |
| CVE-2026-44738 | 7.7 | — | — | — | getgrav / grav | Grav is a file-based Web platform. | 171d ago |
| CVE-2026-33356 | 7.7 | — | — | — | — | In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe | 171d ago |
| CVE-2026-33399 | 7.7 | — | — | — | wallosapp / wallos | Wallos is an open-source, self-hostable personal subscription tracker. | 219d ago |
| CVE-2026-32064 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC o | 222d ago |
| CVE-2026-25086 | 7.7 | — | — | — | — | Under certain conditions, an attacker could bind to the same port used by WebCTRL. | 222d ago |
| CVE-2026-22558 | 7.7 | — | — | — | — | An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor wi | 224d ago |
| CVE-2026-31891 | 7.7 | — | — | — | agentejo / cockpit | Cockpit is a headless content management system. | 225d ago |
| CVE-2026-2092 | 7.7 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 225d ago |
| CVE-2026-28521 | 7.7 | — | — | — | tuya / arduino-tuyaopen | arduino-TuyaOpen before version 1.2.1 contains an out-of-bounds memory read vulnerability in the TuyaIoT component | 227d ago |
| CVE-2026-21887 | 7.7 | — | — | — | citeum / opencti | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | 231d ago |
| CVE-2026-21670 | 7.7 | — | — | — | veeam / veeam backup \& replication | A vulnerability allowing a low-privileged user to extract saved SSH credentials. | 231d ago |
| CVE-2026-32131 | 7.7 | — | — | — | zitadel / zitadel | ZITADEL is an open source identity management platform. | 232d ago |
| CVE-2026-32123 | 7.7 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 232d ago |
| CVE-2026-32121 | 7.7 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 232d ago |
| CVE-2026-31881 | 7.7 | — | — | — | runtipi / runtipi | Runtipi is a personal homeserver orchestrator. | 232d ago |
| CVE-2026-57777 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic W | 55d ago |
| CVE-2026-85197 | 7.6 | — | — | — | — | A flaw was found in libsoup. | 55d ago |
| CVE-2026-85213 | 7.6 | — | — | — | — | Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including get | 56d ago |
| CVE-2026-53635 | 7.6 | — | — | — | — | Open edX Platform enables the authoring and delivery of online learning at any scale. | 57d ago |
| CVE-2025-46418 | 7.6 | — | — | — | — | Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition. | 57d ago |
| CVE-2026-73774 | 7.6 | — | — | — | hpe / arubaos-cx | A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthentic | 58d ago |
| CVE-2026-73714 | 7.6 | — | — | — | arubanetworks / fabric composer | A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. | 58d ago |
| CVE-2026-40463 | 7.6 | — | — | — | — | WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. | 59d ago |
| CVE-2026-82017 | 7.6 | — | — | — | — | IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability | 62d ago |
| CVE-2026-82243 | 7.6 | — | — | — | — | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoi | 62d ago |
| CVE-2026-38822 | 7.6 | — | — | — | — | In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated cl | 62d ago |
| CVE-2026-59284 | 7.6 | — | — | — | broadcom / spring cloud commons | There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. | 63d ago |
| CVE-2026-66155 | 7.6 | — | — | — | — | A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All ver | 63d ago |
| CVE-2026-47666 | 7.6 | — | — | — | — | Penpot is an open-source design and prototyping platform. | 63d ago |
| CVE-2026-77368 | 7.6 | — | — | — | — | SeaweedFS is a distributed storage system for files and blobs. | 64d ago |
| CVE-2026-79938 | 7.6 | — | — | — | dell / powerprotect cyber recovery | Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. | 64d ago |
| CVE-2026-29988 | 7.6 | — | — | — | — | A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT dev | 64d ago |
| CVE-2026-80186 | 7.6 | — | — | — | — | A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. | 65d ago |
| CVE-2026-55532 | 7.6 | — | — | — | — | PraisonAI is a multi-agent teams system. | 65d ago |
| CVE-2026-69104 | 7.6 | — | — | — | — | An authenticated user may initiate repository migration operations without required repository permissions, potent | 65d ago |
| CVE-2026-79667 | 7.6 | — | — | — | — | Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on sev | 65d ago |
| CVE-2026-78270 | 7.6 | — | — | — | — | Author SQL Injection in FluentCRM Pro <= 3.1.12 versions. | 66d ago |
| CVE-2026-74011 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Infi | 70d ago |
| CVE-2026-77077 | 7.6 | — | — | — | n8n / n8n | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. | 70d ago |
| CVE-2026-77072 | 7.6 | — | — | — | n8n / n8n | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's co | 70d ago |
| CVE-2026-66677 | 7.6 | — | — | — | — | Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | 70d ago |
| CVE-2026-76357 | 7.6 | — | — | — | splunk / soar | In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path | 71d ago |
| CVE-2026-68900 | 7.6 | — | — | — | — | Wekan is open source kanban built with Meteor. | 71d ago |
| CVE-2026-16828 | 7.6 | — | — | — | ibm / power system e1080 \(9080-hex\) firmware | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 throu | 71d ago |
| CVE-2024-13942 | 7.6 | — | — | — | — | Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from exter | 71d ago |
