| CVE-2026-54083 | 8.1 | — | — | — | — | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud worklo | 46d ago |
| CVE-2026-81728 | 8.1 | — | — | — | dolibarr / dolibarr erp\/crm | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. | 47d ago |
| CVE-2026-81525 | 8.1 | — | — | — | — | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespa | 47d ago |
| CVE-2026-81522 | 8.1 | — | — | — | — | A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters | 47d ago |
| CVE-2026-59286 | 8.1 | — | — | — | vmware / spring for graphql | The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresourc | 47d ago |
| CVE-2026-59285 | 8.1 | — | — | — | vmware / spring for graphql | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries | 47d ago |
| CVE-2026-53580 | 8.1 | — | — | — | — | Trilium is an open-source hierarchical note-taking application. | 47d ago |
| CVE-2026-37068 | 8.1 | — | — | — | — | Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 | 47d ago |
| CVE-2026-81273 | 8.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | 47d ago |
| CVE-2026-75020 | 8.1 | — | — | — | apache / apisix | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISI | 47d ago |
| CVE-2026-77317 | 8.1 | — | — | — | — | SeaweedFS is a distributed storage system for files and blobs. | 47d ago |
| CVE-2026-43621 | 8.1 | — | — | — | — | Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vuln | 47d ago |
| CVE-2026-55228 | 8.1 | — | — | — | — | Weblate is a web-based continuous localization platform used to manage software translations. | 47d ago |
| CVE-2026-32258 | 8.1 | — | — | — | — | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. | 48d ago |
| CVE-2026-32257 | 8.1 | — | — | — | — | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. | 48d ago |
| CVE-2026-81036 | 8.1 | — | — | — | — | Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default c | 48d ago |
| CVE-2026-81035 | 8.1 | — | — | — | — | Midday allows any member of a team to delete it. | 48d ago |
| CVE-2026-81029 | 8.1 | — | — | — | — | OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. | 48d ago |
| CVE-2026-75960 | 8.1 | — | — | — | — | Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerabilit | 48d ago |
| CVE-2026-15985 | 8.1 | — | — | — | — | The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in | 48d ago |
| CVE-2026-19718 | 8.1 | — | — | — | — | The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin be | 48d ago |
| CVE-2026-80192 | 8.1 | — | — | — | — | @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease lin | 48d ago |
| CVE-2026-58092 | 8.1 | — | — | — | — | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID | 48d ago |
| CVE-2026-18985 | 8.1 | — | — | — | — | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. | 48d ago |
| CVE-2026-68569 | 8.1 | — | — | — | apache / tomcat | Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. | 48d ago |
| CVE-2026-66422 | 8.1 | — | — | — | apache / tomcat | Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly use | 48d ago |
| CVE-2026-65183 | 8.1 | — | — | — | apache / tomcat | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets | 48d ago |
| CVE-2026-79263 | 8.1 | — | — | — | google / chrome | Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrar | 48d ago |
| CVE-2026-79194 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to ex | 48d ago |
| CVE-2026-79072 | 8.1 | — | — | — | google / chrome | Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to pote | 48d ago |
| CVE-2026-79057 | 8.1 | — | — | — | google / chrome | Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging | 48d ago |
| CVE-2026-79039 | 8.1 | — | — | — | google / chrome | Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute ar | 48d ago |
| CVE-2026-79027 | 8.1 | — | — | — | google / chrome | Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary co | 48d ago |
| CVE-2026-79020 | 8.1 | — | — | — | google / chrome | Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read m | 48d ago |
| CVE-2026-79011 | 8.1 | — | — | — | google / chrome | UI misrepresentation in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging socia | 48d ago |
| CVE-2026-78913 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exec | 48d ago |
| CVE-2026-65105 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may acce | 48d ago |
| CVE-2026-65098 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could c | 48d ago |
| CVE-2026-65084 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improp | 48d ago |
| CVE-2026-65081 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause exec | 48d ago |
| CVE-2026-78379 | 8.1 | — | — | — | — | Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools bef | 49d ago |
| CVE-2026-16231 | 8.1 | — | — | — | hbs project / hbs | hbs is an Express view engine that wraps Handlebars. | 49d ago |
| CVE-2026-78478 | 8.1 | — | — | — | — | The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. | 49d ago |
| CVE-2026-72695 | 8.1 | — | — | — | — | Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authentic | 49d ago |
| CVE-2026-34968 | 8.1 | — | — | — | — | Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop | 49d ago |
| CVE-2026-77567 | 8.1 | — | — | — | — | Filament is a collection of full-stack components for accelerated Laravel development. | 49d ago |
| CVE-2026-75464 | 8.1 | — | — | — | — | OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link(). | 49d ago |
| CVE-2026-71506 | 8.1 | — | — | — | — | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint t | 50d ago |
| CVE-2026-71504 | 8.1 | — | — | — | — | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attack | 50d ago |
| CVE-2025-26238 | 8.1 | — | — | — | — | In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code. | 50d ago |
| CVE-2025-26237 | 8.1 | — | — | — | — | D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which | 50d ago |
| CVE-2026-39915 | 8.1 | — | — | — | — | TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HT | 50d ago |
| CVE-2026-66671 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions. | 50d ago |
| CVE-2026-66670 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Måne <= 1.7 versions. | 50d ago |
| CVE-2026-28152 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | 50d ago |
| CVE-2026-28151 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | 50d ago |
| CVE-2026-74651 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_get_wp | 52d ago |
| CVE-2026-74592 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_trunca | 52d ago |
| CVE-2026-76793 | 8.1 | — | — | — | — | The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication | 52d ago |
| CVE-2026-18052 | 8.1 | — | — | — | — | The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature whic | 52d ago |
