| CVE-2026-47984 | 8.2 | — | — | — | adobe / commerce | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature byp | 90d ago |
| CVE-2026-47423 | 8.2 | — | — | — | cure53 / dompurify | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. | 90d ago |
| CVE-2026-45075 | 8.2 | — | — | — | sensiolabs / symfony | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. | 90d ago |
| CVE-2026-50680 | 8.2 | — | — | — | microsoft / windows 10 1809 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 90d ago |
| CVE-2026-50429 | 8.2 | — | — | — | microsoft / windows 10 1607 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network. | 90d ago |
| CVE-2026-59197 | 8.2 | — | — | — | python / pillow | Pillow is a Python imaging library. | 90d ago |
| CVE-2026-50338 | 8.2 | — | — | — | microsoft / azure spring cloud | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. | 90d ago |
| CVE-2026-58477 | 8.2 | — | — | — | dan-in-ca / sustainable irrigation platform | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows | 90d ago |
| CVE-2026-10672 | 8.2 | — | — | — | zephyrproject / zephyr | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (conte | 90d ago |
| CVE-2026-9561 | 8.2 | — | — | — | eclipse / kura | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative sou | 90d ago |
| CVE-2026-44752 | 8.2 | — | — | — | — | SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through cr | 91d ago |
| CVE-2026-58500 | 8.2 | — | — | — | appium / appium-mcp | MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and i | 91d ago |
| CVE-2026-48364 | 8.2 | — | — | — | adobe / coldfusion | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability | 91d ago |
| CVE-2026-48363 | 8.2 | — | — | — | adobe / coldfusion | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability | 91d ago |
| CVE-2026-57768 | 8.2 | — | — | — | — | Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Priv | 91d ago |
| CVE-2026-56259 | 8.2 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attacke | 92d ago |
| CVE-2026-58499 | 8.2 | — | — | — | — | EverOS is a memory runtime for agents. | 94d ago |
| CVE-2026-55641 | 8.2 | — | — | — | — | 9Router is an AI router & token saver. | 94d ago |
| CVE-2026-53657 | 8.2 | — | — | — | — | Lima launches Linux virtual machines, typically on macOS, for running containerd. | 94d ago |
| CVE-2026-29519 | 8.2 | — | — | — | — | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site | 94d ago |
| CVE-2026-54423 | 8.2 | — | — | — | — | In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management inter | 95d ago |
| CVE-2026-44787 | 8.2 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 95d ago |
| CVE-2026-4256 | 8.2 | — | — | — | — | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Techno | 95d ago |
| CVE-2026-58525 | 8.2 | — | — | — | microsoft / edge chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security fe | 96d ago |
| CVE-2026-59822zero day | 8.2 | 0.84% | 3/3 | same day | litellm / litellm | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. | 96d ago |
| CVE-2026-59802 | 8.2 | — | — | — | — | PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the va | 96d ago |
| CVE-2026-59731 | 8.2 | — | — | — | — | Astro is a web framework for content-driven websites. | 96d ago |
| CVE-2026-29009 | 8.2 | — | — | — | denx / u-boot | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when | 96d ago |
| CVE-2026-57239 | 8.2 | — | — | — | foxit / pdf editor | The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privile | 96d ago |
| CVE-2026-55428 | 8.2 | — | — | — | coder / coder | Coder allows organizations to provision remote development environments via Terraform. | 97d ago |
| CVE-2026-8377 | 8.2 | — | — | — | — | Missing Authorization vulnerability in Armiya Information Technologies Ltd. | 98d ago |
| CVE-2025-53831 | 8.2 | — | — | — | — | DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing applica | 98d ago |
| CVE-2026-59195 | 8.2 | — | — | — | pnpm / pnpm | pnpm is a package manager. | 98d ago |
| CVE-2026-44937 | 8.2 | — | — | — | suse / rancher fleet | Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15. | 98d ago |
| CVE-2026-46591 | 8.2 | — | — | — | apache / camel | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. | 98d ago |
| CVE-2026-14637 | 8.2 | — | — | — | — | A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab74 | 100d ago |
| CVE-2026-27771 | 8.2 | — | — | — | — | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, w | 101d ago |
| CVE-2026-57688 | 8.2 | — | — | — | — | Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions. | 102d ago |
| CVE-2026-14336 | 8.2 | — | — | — | — | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.ecl | 102d ago |
| CVE-2026-53906 | 8.2 | — | — | — | mycomplianceoffice / mycomplianceoffice | MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and | 103d ago |
| CVE-2026-52868 | 8.2 | — | — | — | — | An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storag | 104d ago |
| CVE-2026-10564 | 8.2 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). | 104d ago |
| CVE-2026-10560 | 8.2 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ | 104d ago |
| CVE-2026-54351 | 8.2 | — | — | — | budibase / budibase | Budibase is an open-source low-code platform. | 108d ago |
| CVE-2026-55188 | 8.2 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 108d ago |
| CVE-2026-52783 | 8.2 | — | — | — | — | OpenProject is open-source, web-based project management software. | 108d ago |
| CVE-2026-57655 | 8.2 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions. | 108d ago |
| CVE-2026-12473 | 8.2 | — | — | — | — | Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL paramet | 109d ago |
| CVE-2026-55667 | 8.2 | — | — | — | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within | 109d ago |
| CVE-2026-57236 | 8.2 | — | — | — | nokogiri / nokogiri | Nokogiri is an open source XML and HTML library for the Ruby programming language. | 109d ago |
| CVE-2026-57235 | 8.2 | — | — | — | nokogiri / nokogiri | Nokogiri is an open source XML and HTML library for the Ruby programming language. | 109d ago |
| CVE-2026-53268 | 8.2 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of- | 109d ago |
| CVE-2026-44016 | 8.2 | — | — | — | docling / docling | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative A | 110d ago |
| CVE-2026-56351 | 8.2 | — | — | — | n8n / n8n | n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that | 110d ago |
| CVE-2026-56245 | 8.2 | — | — | — | — | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build | 110d ago |
| CVE-2026-56785 | 8.2 | — | — | — | — | FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and e | 111d ago |
| CVE-2026-56324 | 8.2 | — | — | — | — | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attacker | 112d ago |
| CVE-2026-48109 | 8.2 | — | — | — | messagepack / messagepack | MessagePack for C# is a MessagePack serializer for C#. | 112d ago |
| CVE-2026-54271 | 8.2 | — | — | — | protobufjs project / protobufjs-cli | protobufjs-cli is the command line add-on for protobuf.js. | 112d ago |
| CVE-2026-50168 | 8.2 | — | — | — | angular / angular | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and | 112d ago |
