| CVE-2026-6428 | 7.6 | — | — | — | — | SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.0 | 138d ago |
| CVE-2026-54056 | 7.6 | — | — | — | kovidgoyal / kitty | Kitty is a cross-platform GPU based terminal. | 139d ago |
| CVE-2026-45012 | 7.6 | — | — | — | — | ApostropheCMS is an open-source Node.js content management system. | 139d ago |
| CVE-2026-6961 | 7.6 | — | — | — | mattermost / mattermost server | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails t | 139d ago |
| CVE-2026-53981 | 7.6 | — | — | — | — | Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an a | 139d ago |
| CVE-2026-11774 | 7.6 | — | — | — | — | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). | 140d ago |
| CVE-2026-42558 | 7.6 | — | — | — | — | Xibo is an open source digital signage platform with a web content management system and Windows display player so | 140d ago |
| CVE-2026-20252 | 7.6 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 1 | 141d ago |
| CVE-2026-41003 | 7.6 | — | — | — | vmware / spring security | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms g | 141d ago |
| CVE-2026-5068 | 7.6 | — | — | — | zephyrproject / zephyr | A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE C | 142d ago |
| CVE-2026-41518 | 7.6 | — | — | — | — | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to cr | 147d ago |
| CVE-2026-41234 | 7.6 | — | — | — | — | Froxlor is open source server administration software. | 147d ago |
| CVE-2026-49771 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo | 147d ago |
| CVE-2025-15655 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla Sch | 148d ago |
| CVE-2019-25722 | 7.6 | — | — | — | — | Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext cre | 149d ago |
| CVE-2026-24782 | 7.6 | — | — | — | accellion / kiteworks | Kiteworks is a private data network (PDN). | 149d ago |
| CVE-2026-49374 | 7.6 | — | — | — | jetbrains / teamcity | In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters | 153d ago |
| CVE-2026-9809 | 7.6 | — | — | — | — | A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. | 153d ago |
| CVE-2026-46426 | 7.6 | — | — | — | — | Budibase is an open-source low-code platform. | 155d ago |
| CVE-2026-44680 | 7.6 | — | — | — | — | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. | 156d ago |
| CVE-2026-45082 | 7.6 | — | — | — | — | Karakeep is a elf-hostable bookmark-everything app. | 156d ago |
| CVE-2026-34207 | 7.6 | — | — | — | — | TypeBot is a chatbot builder tool. | 160d ago |
| CVE-2026-9047 | 7.6 | — | — | — | devolutions / devolutions server | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server a | 160d ago |
| CVE-2026-44068 | 7.6 | — | — | — | — | Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote | 161d ago |
| CVE-2026-9144 | 7.6 | — | — | — | — | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the em | 162d ago |
| CVE-2026-5783 | 7.6 | — | — | — | — | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Compute | 162d ago |
| CVE-2026-42383 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH Wo | 162d ago |
| CVE-2026-33233 | 7.6 | — | — | — | — | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence | 163d ago |
| CVE-2026-6347 | 7.6 | — | — | — | mattermost / mattermost server | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuratio | 164d ago |
| CVE-2026-44555 | 7.6 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 167d ago |
| CVE-2026-46408 | 7.6 | — | — | — | — | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. | 167d ago |
| CVE-2026-46367 | 7.6 | — | — | — | — | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authen | 167d ago |
| CVE-2026-44516 | 7.6 | — | — | — | — | Valtimo is an open-source business process automation platform. | 168d ago |
| CVE-2026-45225 | 7.6 | — | — | — | — | Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated u | 169d ago |
| CVE-2026-44166 | 7.6 | — | — | — | pocketbase / pocketbase | Pocketbase is an open source web backend written in go. | 170d ago |
| CVE-2026-45213 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 B | 170d ago |
| CVE-2026-33650 | 7.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 220d ago |
| CVE-2026-33354 | 7.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 220d ago |
| CVE-2026-32055 | 7.6 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that | 222d ago |
| CVE-2026-32318 | 7.6 | — | — | — | cryptomator / cryptomator | Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. | 223d ago |
| CVE-2026-32317 | 7.6 | — | — | — | cryptomator / cryptomator | Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. | 223d ago |
| CVE-2026-32303 | 7.6 | — | — | — | cryptomator / cryptomator | Cryptomator encrypts data being stored on cloud infrastructure. | 223d ago |
| CVE-2026-33321 | 7.6 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 224d ago |
| CVE-2026-32749 | 7.6 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 224d ago |
| CVE-2024-42210 | 7.6 | — | — | — | hcltech / unica | A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. | 224d ago |
| CVE-2026-32728 | 7.6 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 224d ago |
| CVE-2026-32692 | 7.6 | — | — | — | canonical / juju | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through | 225d ago |
| CVE-2026-32606 | 7.6 | — | — | — | — | IncusOS is an immutable OS image dedicated to running Incus. | 225d ago |
| CVE-2026-22181 | 7.6 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allo | 225d ago |
| CVE-2026-2476 | 7.6 | — | — | — | mattermost / ms teams | Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker | 227d ago |
| CVE-2026-32459 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart Upse | 230d ago |
| CVE-2026-32458 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 W | 230d ago |
| CVE-2026-32418 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow M | 230d ago |
| CVE-2026-32358 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Bo | 230d ago |
| CVE-2026-32308 | 7.6 | — | — | — | hackerbay / oneuptime | OneUptime is a solution for monitoring and managing online services. | 230d ago |
| CVE-2026-31944 | 7.6 | — | — | — | librechat / librechat | LibreChat is a ChatGPT clone with additional features. | 230d ago |
| CVE-2026-32117 | 7.6 | — | — | — | ekacnet / grafanacubism-panel | The grafanacubism-panel plugin allows use of cubism.js in Grafana. | 231d ago |
| CVE-2026-32101 | 7.6 | — | — | — | studiocms / studiocms | StudioCMS is a server-side-rendered, Astro native, headless content management system. | 232d ago |
| CVE-2026-86173 | 7.5 | — | — | — | — | MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows | 54d ago |
| CVE-2026-52770 | 7.5 | — | — | — | — | YesWiki is a wiki system written in PHP. | 54d ago |
