| CVE-2016-20068 | 8.2 | — | — | — | — | WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerabili | 119d ago |
| CVE-2026-54413 | 8.2 | — | — | — | — | driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0 | 120d ago |
| CVE-2026-54412 | 8.2 | — | — | — | — | LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt | 120d ago |
| CVE-2026-50088 | 8.2 | — | — | — | aqara / developer portal | The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test | 122d ago |
| CVE-2026-50087 | 8.2 | — | — | — | aqara / iam\/sso gateway | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is a | 122d ago |
| CVE-2026-53721 | 8.2 | — | — | — | nuxt / nuxt | Nuxt is an open-source web development framework for Vue.js. | 122d ago |
| CVE-2026-52859 | 8.2 | — | — | — | vim / vim | Vim is an open source, command line text editor. | 123d ago |
| CVE-2026-49982 | 8.2 | — | — | — | raszi / tmp | tmp is a temporary file and directory creator for node.js. | 123d ago |
| CVE-2026-44705 | 8.2 | — | — | — | raszi / tmp | tmp is a temporary file and directory creator for node.js. | 123d ago |
| CVE-2026-40998 | 8.2 | — | — | — | broadcom / spring web services | Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parse | 124d ago |
| CVE-2026-40994 | 8.2 | — | — | — | broadcom / spring web services | Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validat | 124d ago |
| CVE-2026-50637 | 8.2 | — | — | — | pevans / metrics\ | Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. | 124d ago |
| CVE-2026-49759 | 8.2 | — | — | — | erlang / erlang\/otp | Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker | 124d ago |
| CVE-2023-29146 | 8.2 | — | — | — | — | The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes | 125d ago |
| CVE-2026-47652 | 8.2 | — | — | — | microsoft / windows 11 23h2 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | 125d ago |
| CVE-2026-45476 | 8.2 | — | — | — | microsoft / azure network adapter | Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally. | 125d ago |
| CVE-2026-44822 | 8.2 | — | — | — | microsoft / 365 apps | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a networ | 125d ago |
| CVE-2017-20249 | 8.2 | — | — | — | — | Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute | 125d ago |
| CVE-2017-20247 | 8.2 | — | — | — | — | WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attack | 125d ago |
| CVE-2017-20246 | 8.2 | — | — | — | — | KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attacker | 125d ago |
| CVE-2017-20245 | 8.2 | — | — | — | — | Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attacke | 125d ago |
| CVE-2017-20244 | 8.2 | — | — | — | — | Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attacke | 125d ago |
| CVE-2017-20243 | 8.2 | — | — | — | — | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that all | 125d ago |
| CVE-2016-20065 | 8.2 | — | — | — | — | Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated att | 125d ago |
| CVE-2016-20062 | 8.2 | — | — | — | — | Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attacke | 125d ago |
| CVE-2026-46303 | 8.2 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation ext | 126d ago |
| CVE-2026-45327 | 8.2 | — | — | — | — | TinyIce is a streaming server for audio and video. | 129d ago |
| CVE-2026-41249 | 8.2 | — | — | — | — | CoreShop is a Pimcore enhanced eCommerce solution. | 130d ago |
| CVE-2025-69755 | 8.2 | — | — | — | — | An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive informatio | 130d ago |
| CVE-2019-25745 | 8.2 | — | — | — | — | WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unau | 130d ago |
| CVE-2019-25732 | 8.2 | — | — | — | — | PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi | 130d ago |
| CVE-2019-25730 | 8.2 | — | — | — | — | Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitr | 130d ago |
| CVE-2019-25728 | 8.2 | — | — | — | — | Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitra | 130d ago |
| CVE-2019-25726 | 8.2 | — | — | — | — | All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to e | 130d ago |
| CVE-2026-50205 | 8.2 | — | — | — | acer / connect m6e 5g firmware | System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate id | 131d ago |
| CVE-2026-41010 | 8.2 | — | — | — | — | ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jo | 131d ago |
| CVE-2026-41011 | 8.2 | — | — | — | — | PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name} | 131d ago |
| CVE-2021-4481 | 8.2 | — | — | — | — | Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecur | 132d ago |
| CVE-2021-4480 | 8.2 | — | — | — | — | Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecur | 132d ago |
| CVE-2026-28299 | 8.2 | — | — | — | solarwinds / web help desk | SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could | 132d ago |
| CVE-2021-4478 | 8.2 | — | — | — | — | Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-bounds write vulner | 132d ago |
| CVE-2026-10622 | 8.2 | — | — | — | — | Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileg | 132d ago |
| CVE-2026-24752 | 8.2 | — | — | — | accellion / kiteworks | Kiteworks is a private data network (PDN). | 133d ago |
| CVE-2026-24088 | 8.2 | — | — | — | qualcomm / ar9380 firmware | Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customi | 133d ago |
| CVE-2026-49491 | 8.2 | — | — | — | — | Pixa Bank 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract sensitive d | 133d ago |
| CVE-2018-25434 | 8.2 | — | — | — | — | WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit | 133d ago |
| CVE-2018-25433 | 8.2 | — | — | — | — | Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attacker | 133d ago |
| CVE-2018-25428 | 8.2 | — | — | — | — | Paroiciel 11.20 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary | 133d ago |
| CVE-2026-37234 | 8.2 | — | — | — | mosaic5g / flexric | FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. | 133d ago |
| CVE-2026-24751 | 8.2 | — | — | — | accellion / kiteworks | Kiteworks is a private data network (PDN). | 133d ago |
| CVE-2026-45545 | 8.2 | — | — | — | nextcloud / tables | Nextcloud is an open source content collaboration platform. | 133d ago |
| CVE-2026-45302 | 8.2 | — | — | — | — | parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. | 133d ago |
| CVE-2026-43624 | 8.2 | — | — | — | — | F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows | 133d ago |
| CVE-2018-25425 | 8.2 | — | — | — | — | Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary S | 135d ago |
| CVE-2018-25424 | 8.2 | — | — | — | — | Gate Pass Management System 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to b | 135d ago |
| CVE-2018-25422 | 8.2 | — | — | — | — | MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute | 135d ago |
| CVE-2018-25420 | 8.2 | — | — | — | — | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit | 135d ago |
| CVE-2018-25419 | 8.2 | — | — | — | — | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit | 135d ago |
| CVE-2018-25418 | 8.2 | — | — | — | — | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit | 135d ago |
| CVE-2018-25417 | 8.2 | — | — | — | — | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit | 135d ago |
