| CVE-2026-3688 | 8.1 | — | — | — | — | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Ins | 97d ago |
| CVE-2026-12378 | 8.1 | — | — | — | — | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate da | 98d ago |
| CVE-2026-44454 | 8.1 | — | — | — | coder / coder | Coder allows organizations to provision remote development environments via Terraform. | 98d ago |
| CVE-2026-13020 | 8.1 | — | — | — | esri / portal for arcgis | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earli | 98d ago |
| CVE-2026-11348 | 8.1 | — | — | — | — | Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. | 98d ago |
| CVE-2026-59713 | 8.1 | — | — | — | — | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true w | 99d ago |
| CVE-2026-59712 | 8.1 | — | — | — | — | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated use | 99d ago |
| CVE-2026-14471 | 8.1 | — | — | — | — | Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon | 99d ago |
| CVE-2026-40138 | 8.1 | — | — | — | beyondtrust / privileged remote access | A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support a | 99d ago |
| CVE-2026-49297 | 8.1 | — | — | — | apache / apache-airflow-providers-google | Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS o | 99d ago |
| CVE-2026-43865 | 8.1 | — | — | — | apache / camel | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. | 100d ago |
| CVE-2026-42527 | 8.1 | — | — | — | apache / camel | Deserialization of Untrusted Data vulnerability in Apache Camel. | 100d ago |
| CVE-2026-40859 | 8.1 | — | — | — | apache / camel | Deserialization of Untrusted Data vulnerability in Apache Camel. | 100d ago |
| CVE-2026-12083 | 8.1 | — | — | — | — | The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin | 100d ago |
| CVE-2026-12746 | 8.1 | — | — | — | — | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. | 101d ago |
| CVE-2026-12740 | 8.1 | — | — | — | — | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. | 101d ago |
| CVE-2025-71375 | 8.1 | — | — | — | — | picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files f | 102d ago |
| CVE-2025-71373 | 8.1 | — | — | — | — | picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers | 102d ago |
| CVE-2025-71372 | 8.1 | — | — | — | — | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ method | 102d ago |
| CVE-2025-71369 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder. | 102d ago |
| CVE-2025-71367 | 8.1 | — | — | — | — | picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attacker | 102d ago |
| CVE-2025-71366 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in | 102d ago |
| CVE-2025-71364 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickl | 102d ago |
| CVE-2025-71362 | 8.1 | — | — | — | — | picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval o | 102d ago |
| CVE-2025-71360 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduc | 102d ago |
| CVE-2025-71359 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.load | 102d ago |
| CVE-2025-71356 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_ | 102d ago |
| CVE-2025-71353 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get | 102d ago |
| CVE-2025-71347 | 8.1 | — | — | — | — | picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function | 102d ago |
| CVE-2025-71345 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_au | 102d ago |
| CVE-2025-71343 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.ma | 102d ago |
| CVE-2025-71342 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce meth | 102d ago |
| CVE-2026-58293 | 8.1 | — | — | — | microsoft / edge chromium | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execut | 102d ago |
| CVE-2026-58286 | 8.1 | — | — | — | microsoft / edge chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing ove | 102d ago |
| CVE-2026-58283 | 8.1 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 102d ago |
| CVE-2026-58282 | 8.1 | — | — | — | microsoft / edge chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing ove | 102d ago |
| CVE-2026-28744 | 8.1 | — | — | — | — | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass | 102d ago |
| CVE-2026-28699 | 8.1 | — | — | — | — | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP | 102d ago |
| CVE-2026-22555 | 8.1 | — | — | — | — | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the C | 102d ago |
| CVE-2026-8286 | 8.1 | — | — | — | haxx / curl | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing li | 103d ago |
| CVE-2026-13368 | 8.1 | — | — | — | watchguard / fireware | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication | 103d ago |
| CVE-2026-50722 | 8.1 | — | — | — | libreswan / libreswan | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER enco | 103d ago |
| CVE-2026-50721 | 8.1 | — | — | — | libreswan / libreswan | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the | 103d ago |
| CVE-2026-7311 | 8.1 | — | — | — | — | The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due | 103d ago |
| CVE-2026-9272 | 8.1 | — | — | — | progress / flowmon anomaly detection system | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is aut | 103d ago |
| CVE-2026-55119 | 8.1 | — | — | — | ui / unifi talk application | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerabi | 103d ago |
| CVE-2026-57751 | 8.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions. | 103d ago |
| CVE-2026-42382 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | 103d ago |
| CVE-2026-27412 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. | 103d ago |
| CVE-2025-58902 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. | 103d ago |
| CVE-2026-8147 | 8.1 | — | — | — | lfprojects / mlflow | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper a | 104d ago |
| CVE-2026-5821 | 8.1 | — | — | — | — | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1 | 104d ago |
| CVE-2026-5120 | 8.1 | — | — | — | — | A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user | 104d ago |
| CVE-2026-53903 | 8.1 | — | — | — | mycomplianceoffice / mycomplianceoffice | MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/ | 104d ago |
| CVE-2026-11794 | 8.1 | — | — | — | — | The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the Wor | 105d ago |
| CVE-2026-10750 | 8.1 | — | — | — | — | The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools a | 105d ago |
| CVE-2026-56286 | 8.1 | — | — | — | — | Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows | 105d ago |
| CVE-2026-56264 | 8.1 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute | 105d ago |
| CVE-2026-14122 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 al | 105d ago |
| CVE-2026-14111 | 8.1 | — | — | — | google / chrome | Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to i | 105d ago |
