| CVE-2026-18175 | 8.1 | — | — | — | — | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper aut | 39d ago |
| CVE-2026-19303 | 8.1 | — | — | — | — | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files | 39d ago |
| CVE-2026-85694 | 8.1 | — | — | — | — | LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object tha | 39d ago |
| CVE-2026-85660 | 8.1 | — | — | — | — | cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with_operators fun | 39d ago |
| CVE-2026-85625 | 8.1 | — | — | — | — | sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches | 39d ago |
| CVE-2026-84504 | 8.1 | — | — | — | — | fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result p | 39d ago |
| CVE-2026-85427 | 8.1 | — | — | — | — | MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthentica | 39d ago |
| CVE-2026-85388 | 8.1 | — | — | — | — | Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, a | 39d ago |
| CVE-2026-82302 | 8.1 | — | — | — | — | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Inc | 39d ago |
| CVE-2026-78583 | 8.1 | — | — | — | — | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-15 | 39d ago |
| CVE-2026-84779 | 8.1 | — | — | — | — | Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | 40d ago |
| CVE-2026-85214 | 8.1 | — | — | — | — | vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbi | 40d ago |
| CVE-2026-85160 | 8.1 | — | — | — | — | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive | 40d ago |
| CVE-2026-84381 | 8.1 | — | — | — | — | HTTPX2 is a next generation HTTP client for Python. | 40d ago |
| CVE-2026-78689 | 8.1 | — | — | — | — | Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable | 41d ago |
| CVE-2026-66362 | 8.1 | — | — | — | — | Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability | 41d ago |
| CVE-2026-19219 | 8.1 | — | — | — | — | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parame | 41d ago |
| CVE-2026-82183 | 8.1 | — | — | — | — | The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Stea | 41d ago |
| CVE-2026-80467 | 8.1 | — | — | — | — | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through | 41d ago |
| CVE-2026-12526 | 8.1 | — | — | — | — | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authori | 41d ago |
| CVE-2026-14982 | 8.1 | — | — | — | — | The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path v | 41d ago |
| CVE-2026-84334 | 8.1 | — | — | — | google / chrome | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attack | 41d ago |
| CVE-2026-73778 | 8.1 | — | — | — | — | A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. | 41d ago |
| CVE-2026-73777 | 8.1 | — | — | — | hpe / arubaos-cx | Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauth | 41d ago |
| CVE-2026-73712 | 8.1 | — | — | — | arubanetworks / fabric composer | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to run | 41d ago |
| CVE-2026-73711 | 8.1 | — | — | — | arubanetworks / fabric composer | A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. | 41d ago |
| CVE-2026-51956 | 8.1 | — | — | — | — | A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. | 42d ago |
| CVE-2026-84203 | 8.1 | — | — | — | — | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing at | 42d ago |
| CVE-2026-84218 | 8.1 | — | — | — | — | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX s | 42d ago |
| CVE-2026-19513 | 8.1 | — | — | — | — | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including | 42d ago |
| CVE-2026-84189 | 8.1 | — | — | — | — | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-config | 42d ago |
| CVE-2026-83595 | 8.1 | — | — | — | — | AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to per | 42d ago |
| CVE-2026-82228 | 8.1 | — | — | — | — | Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. | 42d ago |
| CVE-2026-81892 | 8.1 | — | — | — | — | EasyAdmin is a fast and modern admin generator for Symfony applications. | 42d ago |
| CVE-2026-81891 | 8.1 | — | — | — | — | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. | 42d ago |
| CVE-2026-75458 | 8.1 | — | — | — | — | The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains | 42d ago |
| CVE-2026-61641 | 8.1 | — | — | — | — | Wallos is an open-source, self-hostable personal subscription tracker. | 42d ago |
| CVE-2026-72001 | 8.1 | — | — | — | — | Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to ac | 42d ago |
| CVE-2026-79746 | 8.1 | — | — | — | — | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separa | 43d ago |
| CVE-2026-66047exploited | 8.1 | 0.92% | 1/3 | +16d | — | ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vul | 43d ago |
| CVE-2026-82475 | 8.1 | — | — | — | — | iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fa | 45d ago |
| CVE-2026-82463 | 8.1 | — | — | — | — | pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverse | 45d ago |
| CVE-2026-82461 | 8.1 | — | — | — | — | pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Key | 45d ago |
| CVE-2026-82291 | 8.1 | — | — | — | — | HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enablin | 45d ago |
| CVE-2026-82287 | 8.1 | — | — | — | — | Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrict | 45d ago |
| CVE-2026-82284 | 8.1 | — | — | — | — | Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{c | 45d ago |
| CVE-2026-82283 | 8.1 | — | — | — | — | VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated u | 45d ago |
| CVE-2026-82279 | 8.1 | — | — | — | — | HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team | 45d ago |
| CVE-2026-82269 | 8.1 | — | — | — | — | Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication | 45d ago |
| CVE-2026-56100 | 8.1 | — | — | — | — | SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that al | 45d ago |
| CVE-2026-55065 | 8.1 | — | — | — | — | Vikunja is an open-source self-hosted task management platform. | 45d ago |
| CVE-2026-50979 | 8.1 | — | — | — | — | A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier | 46d ago |
| CVE-2026-82245 | 8.1 | — | — | — | — | Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any aut | 46d ago |
| CVE-2026-82240 | 8.1 | — | — | — | — | Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update | 46d ago |
| CVE-2026-82239 | 8.1 | — | — | — | — | Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, a | 46d ago |
| CVE-2026-80645 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in t | 46d ago |
| CVE-2026-80599 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr pro | 46d ago |
| CVE-2026-19423 | 8.1 | — | — | — | — | The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot res | 46d ago |
| CVE-2026-77977 | 8.1 | — | — | — | — | Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disru | 46d ago |
| CVE-2026-54330 | 8.1 | — | — | — | — | Ceph is an open-source distributed storage platform providing object, block, and file storage. | 46d ago |
