| CVE-2026-13600 | 8.1 | — | — | — | — | The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before | 64d ago |
| CVE-2026-17017 | 8.1 | — | — | — | — | The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using | 65d ago |
| CVE-2026-16948 | 8.1 | — | — | — | — | The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions a | 66d ago |
| CVE-2026-16267 | 8.1 | — | — | — | — | The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value take | 66d ago |
| CVE-2026-16030 | 8.1 | — | — | — | — | The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token u | 67d ago |
| CVE-2026-15361 | 8.1 | — | — | — | — | The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and d | 67d ago |
| CVE-2026-70634 | 8.1 | — | — | — | timescale / timescaledb | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression | 68d ago |
| CVE-2026-64665 | 8.1 | — | — | — | — | Statamic is a Laravel and Git powered content management system (CMS). | 68d ago |
| CVE-2026-5857 | 8.1 | — | — | — | — | Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before chec | 68d ago |
| CVE-2026-48081 | 8.1 | — | — | — | — | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. | 68d ago |
| CVE-2026-43632 | 8.1 | — | — | — | — | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting | 68d ago |
| CVE-2026-43631 | 8.1 | — | — | — | — | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of ll | 68d ago |
| CVE-2026-43629 | 8.1 | — | — | — | — | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore pa | 68d ago |
| CVE-2026-19153 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote at | 68d ago |
| CVE-2026-19111 | 8.1 | — | — | — | — | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Stra | 68d ago |
| CVE-2026-66710 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. | 68d ago |
| CVE-2026-65570 | 8.1 | — | — | — | — | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | 68d ago |
| CVE-2026-57818 | 8.1 | — | — | — | apache / cxf | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times | 68d ago |
| CVE-2026-57817 | 8.1 | — | — | — | apache / cxf | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating | 68d ago |
| CVE-2026-15459zero day | 8.1 | 0.87% | 1/3 | same day | — | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and incl | 68d ago |
| CVE-2026-71320 | 8.1 | — | — | — | — | Nuxt is an open-source web development framework for Vue.js. | 69d ago |
| CVE-2025-63822 | 8.1 | — | — | — | — | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. | 69d ago |
| CVE-2026-18411 | 8.1 | — | — | — | — | The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentica | 69d ago |
| CVE-2026-70617 | 8.1 | — | — | — | — | Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated | 69d ago |
| CVE-2026-66881 | 8.1 | — | — | — | livebook / livebook | Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a fil | 69d ago |
| CVE-2026-9196 | 8.1 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agent | 69d ago |
| CVE-2026-70429 | 8.1 | — | — | — | — | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names incons | 69d ago |
| CVE-2026-8400 | 8.1 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery ha | 69d ago |
| CVE-2026-7327 | 8.1 | — | — | — | progress / marklogic server | An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic S | 69d ago |
| CVE-2026-39923 | 8.1 | — | — | — | — | Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attac | 69d ago |
| CVE-2026-16102 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management | 69d ago |
| CVE-2026-15573 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak's Authorization Services. | 69d ago |
| CVE-2026-15979 | 8.1 | — | — | — | — | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary Fi | 69d ago |
| CVE-2026-71285 | 8.1 | — | — | — | — | Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable M | 69d ago |
| CVE-2026-71239 | 8.1 | — | — | — | — | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template | 69d ago |
| CVE-2026-7520 | 8.1 | — | — | — | — | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a m | 69d ago |
| CVE-2026-7444 | 8.1 | — | — | — | — | The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, | 69d ago |
| CVE-2026-54418 | 8.1 | — | — | — | — | Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEn | 69d ago |
| CVE-2026-15230 | 8.1 | — | — | — | — | The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, | 69d ago |
| CVE-2026-14553 | 8.1 | — | — | — | — | The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied | 69d ago |
| CVE-2026-70494 | 8.1 | — | — | — | — | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 70d ago |
| CVE-2026-70482 | 8.1 | — | — | — | — | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 70d ago |
| CVE-2026-18830 | 8.1 | — | — | — | — | Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to exec | 70d ago |
| CVE-2026-24079 | 8.1 | — | — | — | qualcomm / ar8035 firmware | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | 70d ago |
| CVE-2026-66318 | 8.1 | — | — | — | microsoft / edge chromium | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information | 71d ago |
| CVE-2026-52521 | 8.1 | — | — | — | — | A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands | 71d ago |
| CVE-2026-67611 | 8.1 | — | — | — | open-emr / openemr | OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials | 71d ago |
| CVE-2026-67610 | 8.1 | — | — | — | — | OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration | 71d ago |
| CVE-2026-69088 | 8.1 | — | — | — | — | Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blu | 71d ago |
| CVE-2026-18092 | 8.1 | — | — | — | timlegge / net\ | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_f | 71d ago |
| CVE-2026-16539 | 8.1 | — | — | — | — | The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it | 71d ago |
| CVE-2025-15672 | 8.1 | — | — | — | — | The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deseri | 71d ago |
| CVE-2026-20465 | 8.1 | — | — | — | — | In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. | 72d ago |
| CVE-2026-18577zero day | 8.1 | 14.6% | 3/3 | same day | n-able / n-central | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions | 72d ago |
| CVE-2026-68581 | 8.1 | — | — | — | — | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. | 72d ago |
| CVE-2026-12586 | 8.1 | — | — | — | — | The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password | 72d ago |
| CVE-2026-67328 | 8.1 | — | — | — | — | @better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider han | 73d ago |
| CVE-2026-16144exploited | 8.1 | 1.2% | 1/3 | +4d | — | The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution | 73d ago |
| CVE-2026-15450 | 8.1 | — | — | — | — | The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via pat | 73d ago |
| CVE-2026-15368 | 8.1 | — | — | — | — | The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed afte | 73d ago |
