| CVE-2026-19002 | 8.1 | — | — | — | — | A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver ca | 62d ago |
| CVE-2026-13267 | 8.1 | — | — | — | ibm / security verify access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify | 62d ago |
| CVE-2026-12359 | 8.1 | — | — | — | ibm / security verify access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify | 62d ago |
| CVE-2026-19311 | 8.1 | — | — | — | — | Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated | 62d ago |
| CVE-2026-18952 | 8.1 | — | — | — | — | Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might | 62d ago |
| CVE-2026-16904 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to impr | 62d ago |
| CVE-2026-18499 | 8.1 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when | 62d ago |
| CVE-2026-18098 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compr | 62d ago |
| CVE-2026-69105 | 8.1 | — | — | — | — | An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentiall | 62d ago |
| CVE-2026-73289 | 8.1 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 62d ago |
| CVE-2026-73286 | 8.1 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 62d ago |
| CVE-2026-66375 | 8.1 | — | — | — | jfrog / artifactory | A low-privilege authenticated user may permanently remove protected internal metadata across repositories under sp | 62d ago |
| CVE-2026-47231 | 8.1 | — | — | — | — | Admidio is an open-source user management solution. | 62d ago |
| CVE-2026-70468 | 8.1 | — | — | — | — | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiMana | 62d ago |
| CVE-2026-70465 | 8.1 | — | — | — | — | A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWind | 62d ago |
| CVE-2026-19594 | 8.1 | — | — | — | — | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confus | 63d ago |
| CVE-2026-18230 | 8.1 | — | — | — | — | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a S | 63d ago |
| CVE-2026-18057 | 8.1 | — | — | — | — | The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using | 63d ago |
| CVE-2026-16977 | 8.1 | — | — | — | — | The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value tha | 63d ago |
| CVE-2026-18961 | 8.1 | — | — | — | — | The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is v | 63d ago |
| CVE-2026-19091 | 8.1 | — | — | — | — | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerab | 63d ago |
| CVE-2026-18844 | 8.1 | — | — | — | — | The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low En | 63d ago |
| CVE-2026-73227 | 8.1 | — | — | — | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | 63d ago |
| CVE-2026-73225 | 8.1 | — | — | — | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | 63d ago |
| CVE-2026-73223 | 8.1 | — | — | — | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | 63d ago |
| CVE-2026-18712 | 8.1 | — | — | — | — | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with pr | 63d ago |
| CVE-2026-18690 | 8.1 | — | — | — | — | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an act | 63d ago |
| CVE-2026-71331 | 8.1 | — | — | — | microsoft / windows 10 1809 | Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execu | 63d ago |
| CVE-2026-70340 | 8.1 | — | — | — | microsoft / azure cyclecloud | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 63d ago |
| CVE-2026-66802 | 8.1 | — | — | — | microsoft / windows 10 1809 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Heal | 63d ago |
| CVE-2026-65796 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a | 63d ago |
| CVE-2026-65789 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 63d ago |
| CVE-2026-65679 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a | 63d ago |
| CVE-2026-63520exploited | 8.1 | 0.96% | 1/3 | +14d | microsoft / sharepoint server | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a ne | 63d ago |
| CVE-2026-62889 | 8.1 | — | — | — | microsoft / windows 10 1607 | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code ove | 63d ago |
| CVE-2026-62820 | 8.1 | — | — | — | microsoft / windows 10 1607 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows | 63d ago |
| CVE-2026-62819 | 8.1 | — | — | — | microsoft / windows 10 1607 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized | 63d ago |
| CVE-2026-62792 | 8.1 | — | — | — | microsoft / windows 10 1607 | Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | 63d ago |
| CVE-2026-62781 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network. | 63d ago |
| CVE-2026-62778 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network. | 63d ago |
| CVE-2026-48440 | 8.1 | — | — | — | adobe / coldfusion | ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution | 63d ago |
| CVE-2026-72921 | 8.1 | — | — | — | — | SeaweedFS is a distributed storage system. | 63d ago |
| CVE-2026-18129 | 8.1 | — | — | — | — | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 all | 63d ago |
| CVE-2026-72596 | 8.1 | — | — | — | — | A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to dele | 63d ago |
| CVE-2026-72595 | 8.1 | — | — | — | — | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to upda | 63d ago |
| CVE-2026-72563 | 8.1 | — | — | — | — | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to over | 63d ago |
| CVE-2026-72555 | 8.1 | — | — | — | — | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Confi | 63d ago |
| CVE-2026-15560 | 8.1 | — | — | — | — | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object | 64d ago |
| CVE-2026-15556 | 8.1 | — | — | — | — | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements match | 64d ago |
| CVE-2026-73030 | 8.1 | — | — | — | — | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_director | 64d ago |
| CVE-2026-72903 | 8.1 | — | — | — | — | Tabby (formerly Terminus) is a highly configurable terminal emulator. | 64d ago |
| CVE-2026-15467 | 8.1 | — | — | — | — | A flaw was found in the trustyai-service-operator's LMEvalJob controller. | 64d ago |
| CVE-2026-68376 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp | 64d ago |
| CVE-2026-68373 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in | 64d ago |
| CVE-2026-68353 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_m | 64d ago |
| CVE-2026-68100 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_subauth when copying ACE i | 64d ago |
| CVE-2026-66407 | 8.1 | — | — | — | — | DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. | 65d ago |
| CVE-2026-18469 | 8.1 | — | — | — | — | The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against | 65d ago |
| CVE-2026-18468 | 8.1 | — | — | — | — | The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to th | 65d ago |
| CVE-2026-18030 | 8.1 | — | — | — | — | The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a pa | 65d ago |
