| CVE-2026-57821 | 8.1 | — | — | — | apache / fineract | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up t | 91d ago |
| CVE-2026-56287 | 8.1 | — | — | — | apache / fineract | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in | 91d ago |
| CVE-2026-12281 | 8.1 | — | — | — | — | The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled wi | 91d ago |
| CVE-2026-46638 | 8.1 | — | — | — | symfony / twig | Twig is a template language for PHP. | 91d ago |
| CVE-2026-48349 | 8.1 | — | — | — | adobe / animate | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in t | 91d ago |
| CVE-2026-47995 | 8.1 | — | — | — | adobe / commerce | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-pri | 91d ago |
| CVE-2026-47304 | 8.1 | — | — | — | microsoft / .net framework | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feat | 91d ago |
| CVE-2026-58617 | 8.1 | — | — | — | microsoft / 365 copilot | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges ove | 91d ago |
| CVE-2026-56186 | 8.1 | — | — | — | microsoft / windows 10 1607 | Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network. | 91d ago |
| CVE-2026-50686 | 8.1 | — | — | — | microsoft / windows 10 1607 | Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to ex | 91d ago |
| CVE-2026-50487 | 8.1 | — | — | — | microsoft / windows 11 24h2 | Use after free in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network. | 91d ago |
| CVE-2026-50460 | 8.1 | — | — | — | microsoft / windows 10 1809 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all | 91d ago |
| CVE-2026-50439 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a n | 91d ago |
| CVE-2026-45074 | 8.1 | — | — | — | sensiolabs / symfony | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. | 91d ago |
| CVE-2026-58595 | 8.1 | — | — | — | microsoft / bing search | Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker | 91d ago |
| CVE-2026-56169 | 8.1 | — | — | — | microsoft / windows admin center | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network | 91d ago |
| CVE-2026-54995 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code ove | 91d ago |
| CVE-2026-50694 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code | 91d ago |
| CVE-2026-49164 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code ove | 91d ago |
| CVE-2026-42900 | 8.1 | — | — | — | microsoft / windows 10 1607 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store a | 91d ago |
| CVE-2026-15427 | 8.1 | — | — | — | tp-link / archer vx1800v firmware | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to | 91d ago |
| CVE-2026-58476 | 8.1 | — | — | — | dan-in-ca / sustainable irrigation platform | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability t | 91d ago |
| CVE-2026-12583 | 8.1 | — | — | — | — | The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored th | 92d ago |
| CVE-2026-12511 | 8.1 | — | — | — | — | The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a | 92d ago |
| CVE-2026-44745 | 8.1 | — | — | — | — | SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain confi | 92d ago |
| CVE-2026-62192 | 8.1 | — | — | — | openclaw / openclaw | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions | 92d ago |
| CVE-2026-62188 | 8.1 | — | — | — | openclaw / openclaw\/feishu | OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which | 92d ago |
| CVE-2026-62187 | 8.1 | — | — | — | openclaw / openclaw\/feishu | OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. | 92d ago |
| CVE-2026-59245 | 8.1 | — | — | — | apache / apache-airflow-providers-fab | In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permissio | 92d ago |
| CVE-2026-58065 | 8.1 | — | — | — | apache / apache-airflow-providers-git | The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disab | 92d ago |
| CVE-2026-57743 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 93d ago |
| CVE-2026-11963 | 8.1 | — | — | — | — | The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a memb | 93d ago |
| CVE-2026-10666 | 8.1 | — | — | — | zephyrproject / zephyr | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copi | 93d ago |
| CVE-2026-56313 | 8.1 | — | — | — | — | Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint t | 93d ago |
| CVE-2026-7655 | 8.1 | — | — | — | — | The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and | 95d ago |
| CVE-2026-55810 | 8.1 | — | — | — | plotly / plotly.js graphing | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js G | 95d ago |
| CVE-2026-55809 | 8.1 | — | — | — | flag attendance field project / flag attendance field | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attend | 95d ago |
| CVE-2026-49213 | 8.1 | — | — | — | — | TypeBot is a chatbot builder tool. | 95d ago |
| CVE-2026-13244 | 8.1 | — | — | — | dakku / tealium iq tag management | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ | 95d ago |
| CVE-2026-55377 | 8.1 | — | — | — | — | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. | 95d ago |
| CVE-2026-56668 | 8.1 | — | — | — | — | ZITADEL is an open source identity management platform. | 95d ago |
| CVE-2026-59796 | 8.1 | — | — | — | jetbrains / teamcity | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks | 95d ago |
| CVE-2026-59795 | 8.1 | — | — | — | jetbrains / teamcity | In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | 95d ago |
| CVE-2026-38057 | 8.1 | — | — | — | — | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. | 95d ago |
| CVE-2026-22659 | 8.1 | — | — | — | — | FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authent | 95d ago |
| CVE-2026-54771 | 8.1 | — | — | — | — | Langroid is a framework for building large-language-model-powered applications. | 96d ago |
| CVE-2026-12598 | 8.1 | — | — | — | — | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2 | 96d ago |
| CVE-2026-12597 | 8.1 | — | — | — | — | The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in ve | 96d ago |
| CVE-2026-12595 | 8.1 | — | — | — | — | The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all v | 96d ago |
| CVE-2026-51925 | 8.1 | — | — | — | — | A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker t | 96d ago |
| CVE-2026-51924 | 8.1 | — | — | — | — | An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload a | 96d ago |
| CVE-2026-51923 | 8.1 | — | — | — | — | An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote | 96d ago |
| CVE-2025-45422 | 8.1 | — | — | — | — | Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions a | 96d ago |
| CVE-2026-33390 | 8.1 | — | — | — | nozominetworks / cmc | An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sen | 97d ago |
| CVE-2026-31985 | 8.1 | — | — | — | — | When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration | 97d ago |
| CVE-2026-35552 | 8.1 | — | — | — | — | In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated | 97d ago |
| CVE-2026-54591 | 8.1 | — | — | — | — | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol | 97d ago |
| CVE-2026-3144 | 8.1 | — | — | — | ibm / api connect | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthoriz | 97d ago |
| CVE-2026-54652 | 8.1 | — | — | — | — | Frigate is an open source network video recorder. | 97d ago |
| CVE-2026-56246 | 8.1 | — | — | — | — | Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a sc | 97d ago |
