| CVE-2026-74960 | 8.1 | — | — | — | mozilla / firefox | Site isolation issue in the WebExtensions component. | 56d ago |
| CVE-2026-74957 | 8.1 | — | — | — | mozilla / firefox | Mitigation bypass in the Safe Browsing component. | 56d ago |
| CVE-2026-75829 | 8.1 | — | — | — | — | grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attacke | 56d ago |
| CVE-2026-15371 | 8.1 | — | — | — | — | Velociraptor's web GUI allows specifying a custom type for columns in tables. | 56d ago |
| CVE-2026-57233 | 8.1 | — | — | — | — | Notepad++ is a free and open-source source code editor. | 57d ago |
| CVE-2026-33437 | 8.1 | — | — | — | — | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. | 57d ago |
| CVE-2026-75051 | 8.1 | — | — | — | — | In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible | 57d ago |
| CVE-2026-75044 | 8.1 | — | — | — | — | In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authentica | 57d ago |
| CVE-2026-19693 | 8.1 | — | — | — | — | extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's | 57d ago |
| CVE-2026-19901 | 8.1 | — | — | — | — | A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. | 59d ago |
| CVE-2026-19900 | 8.1 | — | — | — | — | A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. | 59d ago |
| CVE-2026-18500 | 8.1 | — | — | — | fastify / fastify\/jwt | @fastify/jwt is a JSON Web Token plugin for Fastify. | 59d ago |
| CVE-2026-74410 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX des | 59d ago |
| CVE-2026-74340 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware coun | 59d ago |
| CVE-2026-72310 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl | 59d ago |
| CVE-2026-72227 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of num_dests | 59d ago |
| CVE-2026-72115 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for | 59d ago |
| CVE-2026-68472 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID | 59d ago |
| CVE-2026-73683 | 8.1 | — | — | — | — | Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated | 60d ago |
| CVE-2026-19629 | 8.1 | — | — | — | tenable / security center | A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" | 60d ago |
| CVE-2026-16772 | 8.1 | — | — | — | — | In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themsel | 60d ago |
| CVE-2026-19768 | 8.1 | — | — | — | — | Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Univer | 60d ago |
| CVE-2026-72836 | 8.1 | — | — | — | — | FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownershi | 60d ago |
| CVE-2026-18039 | 8.1 | — | — | — | — | The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration field | 60d ago |
| CVE-2026-73659 | 8.1 | — | — | — | — | Trigger.dev is the open-source platform for building AI workflows in TypeScript. | 61d ago |
| CVE-2026-72856 | 8.1 | — | — | — | — | Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant | 61d ago |
| CVE-2026-19750 | 8.1 | — | — | — | — | A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. | 61d ago |
| CVE-2026-72665 | 8.1 | — | — | — | elastic / kibana | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend respons | 61d ago |
| CVE-2026-18164 | 8.1 | — | — | — | — | An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. | 61d ago |
| CVE-2026-17206 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | 61d ago |
| CVE-2026-17069 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to im | 61d ago |
| CVE-2026-17045 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and ac | 61d ago |
| CVE-2026-16868 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitia | 61d ago |
| CVE-2026-16867 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an au | 61d ago |
| CVE-2026-73482 | 8.1 | — | — | — | — | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. | 61d ago |
| CVE-2026-17197 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validat | 61d ago |
| CVE-2026-72741 | 8.1 | — | — | — | — | Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authe | 61d ago |
| CVE-2026-58439 | 8.1 | — | — | — | — | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | 61d ago |
| CVE-2026-55987 | 8.1 | — | — | — | — | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete | 61d ago |
| CVE-2026-24791 | 8.1 | — | — | — | — | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 61d ago |
| CVE-2026-73515 | 8.1 | — | — | — | — | PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory discl | 61d ago |
| CVE-2026-70463 | 8.1 | — | — | — | samba / rsync | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. | 61d ago |
| CVE-2026-70460 | 8.1 | — | — | — | — | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the modu | 61d ago |
| CVE-2026-53795 | 8.1 | — | — | — | samba / rsync | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the | 61d ago |
| CVE-2026-53790 | 8.1 | — | — | — | — | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execut | 61d ago |
| CVE-2026-53783 | 8.1 | — | — | — | — | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync res | 61d ago |
| CVE-2026-66657 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | 61d ago |
| CVE-2026-66656 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | 61d ago |
| CVE-2026-66653 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | 61d ago |
| CVE-2026-66450 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions. | 61d ago |
| CVE-2026-61979exploited | 8.1 | 0.37% | 1/3 | +8d | — | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. | 61d ago |
| CVE-2026-28186 | 8.1 | — | — | — | — | Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | 61d ago |
| CVE-2026-27543 | 8.1 | — | — | — | — | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | 61d ago |
| CVE-2026-6464 | 8.1 | — | — | — | postgresql / postgresql | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines | 61d ago |
| CVE-2026-14668 | 8.1 | — | — | — | postgresql / postgresql | Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view | 61d ago |
| CVE-2026-73624 | 8.1 | — | — | — | — | GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method tha | 61d ago |
| CVE-2026-73620 | 8.1 | — | — | — | gitpython project / gitpython | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), al | 61d ago |
| CVE-2026-73612 | 8.1 | — | — | — | — | File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and del | 61d ago |
| CVE-2026-73484 | 8.1 | — | — | — | flowiseai / flowise | Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native | 61d ago |
| CVE-2026-19004 | 8.1 | — | — | — | — | An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing out | 62d ago |
