| CVE-2026-5817 | 8.2 | — | — | — | docker / docker desktop | The vllm-metal inference backend in Docker Model Runner on macOS unconditionally sets trust_remote_code=True when l | 143d ago |
| CVE-2026-48235 | 8.2 | — | — | — | — | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, lon | 144d ago |
| CVE-2026-24188 | 8.2 | — | — | — | nvidia / tensorrt | NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. | 145d ago |
| CVE-2026-9057 | 8.2 | — | — | — | — | A broken access control issue has been identified in the Talend Administration Center, that allows a user with “Vie | 146d ago |
| CVE-2026-22810 | 8.2 | — | — | — | joplinapp / joplin | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. | 147d ago |
| CVE-2026-46720 | 8.2 | — | — | — | — | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. | 148d ago |
| CVE-2018-25339 | 8.2 | — | — | — | — | Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extr | 149d ago |
| CVE-2018-25338 | 8.2 | — | — | — | — | Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers t | 149d ago |
| CVE-2018-25333 | 8.2 | — | — | — | — | Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticate | 149d ago |
| CVE-2018-25330 | 8.2 | — | — | — | — | Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that al | 149d ago |
| CVE-2026-46728 | 8.2 | — | — | — | denx / u-boot | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitt | 149d ago |
| CVE-2021-47956 | 8.2 | — | — | — | — | EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipul | 149d ago |
| CVE-2021-47954 | 8.2 | — | — | — | — | LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database | 149d ago |
| CVE-2020-37244 | 8.2 | — | — | — | — | Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execut | 149d ago |
| CVE-2020-37243 | 8.2 | — | — | — | — | Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unau | 149d ago |
| CVE-2020-37242 | 8.2 | — | — | — | — | Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to ex | 149d ago |
| CVE-2026-8657 | 8.2 | — | — | — | — | Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patc | 150d ago |
| CVE-2021-47966 | 8.2 | — | — | — | — | PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid p | 150d ago |
| CVE-2026-34253 | 8.2 | — | — | — | — | A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in | 151d ago |
| CVE-2026-42591 | 8.2 | — | — | — | thecodingmachine / gotenberg | Gotenberg is a Docker-powered stateless API for PDF files. | 151d ago |
| CVE-2026-42590 | 8.2 | — | — | — | thecodingmachine / gotenberg | Gotenberg is a Docker-powered stateless API for PDF files. | 151d ago |
| CVE-2026-40893 | 8.2 | — | — | — | thecodingmachine / gotenberg | Gotenberg is a Docker-powered stateless API for PDF files. | 151d ago |
| CVE-2026-5395 | 8.2 | — | — | — | — | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is | 152d ago |
| CVE-2026-5396 | 8.2 | — | — | — | — | The Fluent Forms plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all vers | 152d ago |
| CVE-2026-32992 | 8.2 | — | — | — | cpanel / cpanel | SSL verification is disabled in the DNS Cluster system. | 152d ago |
| CVE-2020-37218 | 8.2 | — | — | — | — | Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticate | 152d ago |
| CVE-2026-26289 | 8.2 | — | — | — | — | PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissio | 153d ago |
| CVE-2026-43929 | 8.2 | — | — | — | — | ssrfcheck is a library that checks if a string contains a potential SSRF attack. | 153d ago |
| CVE-2026-33833 | 8.2 | — | — | — | microsoft / azure machine learning | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machin | 153d ago |
| CVE-2026-43993 | 8.2 | — | — | — | — | JunoClaw is an agentic AI platform built on Juno Network. | 153d ago |
| CVE-2026-42260 | 8.2 | — | — | — | — | Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. | 154d ago |
| CVE-2026-35071 | 8.2 | — | — | — | dell / insightiq | Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements u | 154d ago |
| CVE-2026-41713 | 8.2 | — | — | — | vmware / spring ai | A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an | 154d ago |
| CVE-2026-39432 | 8.2 | — | — | — | — | Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control | 154d ago |
| CVE-2026-34259 | 8.2 | — | — | — | — | Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with ad | 154d ago |
| CVE-2026-43893 | 8.2 | — | — | — | — | exiftool-vendored provides cross-platform Node.js access to ExifTool. | 154d ago |
| CVE-2026-43886 | 8.2 | — | — | — | — | Outline is a service that allows for collaborative documentation. | 154d ago |
| CVE-2026-42564 | 8.2 | — | — | — | — | jotty·page is a self-hosted app for your checklists and notes. | 154d ago |
| CVE-2026-44413 | 8.2 | — | — | — | jetbrains / teamcity | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access | 154d ago |
| CVE-2021-47941 | 8.2 | — | — | — | — | WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attacke | 156d ago |
| CVE-2021-47930 | 8.2 | — | — | — | — | Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission | 156d ago |
| CVE-2021-47928 | 8.2 | — | — | — | — | Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers | 156d ago |
| CVE-2026-27654 | 8.2 | — | — | — | f5 / nginx plus | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attack | 203d ago |
| CVE-2019-25643 | 8.2 | — | — | — | — | eNdonesia Portal v8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to exec | 203d ago |
| CVE-2019-25642 | 8.2 | — | — | — | — | Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arb | 203d ago |
| CVE-2019-25641 | 8.2 | — | — | — | — | Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulat | 203d ago |
| CVE-2019-25640 | 8.2 | — | — | — | — | Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate d | 203d ago |
| CVE-2019-25639 | 8.2 | — | — | — | — | Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attacke | 203d ago |
| CVE-2019-25636 | 8.2 | — | — | — | zeeways / jobsite cms | Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate da | 203d ago |
| CVE-2019-25635 | 8.2 | — | — | — | zeeways / matrimony cms | Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to mani | 203d ago |
| CVE-2026-32278 | 8.2 | — | — | — | opensource-workshop / connect-cms | Connect-CMS is a content management system. | 203d ago |
| CVE-2019-25581 | 8.2 | — | — | — | i-doit / i-doit | i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrar | 205d ago |
| CVE-2019-25580 | 8.2 | — | — | — | owndms / owndms | ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL | 205d ago |
| CVE-2019-25578 | 8.2 | — | — | — | codnloc / phptransformer | phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQ | 205d ago |
| CVE-2019-25576 | 8.2 | — | — | — | keplerwallpapers / kepler wallpaper script | Kepler Wallpaper Script 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execu | 205d ago |
| CVE-2019-25575 | 8.2 | — | — | — | simplepresscms / simplepress cms | SimplePress CMS 1.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arb | 205d ago |
| CVE-2026-33243 | 8.2 | — | — | — | denx / u-boot | barebox is a bootloader. | 206d ago |
| CVE-2026-33072 | 8.2 | — | — | — | filerise / filerise | FileRise is a self-hosted web file manager / WebDAV server. | 207d ago |
| CVE-2026-32811 | 8.2 | — | — | — | dadrus / heimdall | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. | 207d ago |
| CVE-2026-32763 | 8.2 | — | — | — | kysely / kysely | Kysely is a type-safe TypeScript SQL query builder. | 207d ago |
