| CVE-2026-14090 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 al | 105d ago |
| CVE-2026-14032 | 8.1 | — | — | — | google / chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a use | 105d ago |
| CVE-2026-14011 | 8.1 | — | — | — | google / chrome | Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform | 105d ago |
| CVE-2026-13974 | 8.1 | — | — | — | google / chrome | Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypa | 105d ago |
| CVE-2026-13864 | 8.1 | — | — | — | google / chrome | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convince | 105d ago |
| CVE-2026-13819 | 8.1 | — | — | — | google / chrome | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compr | 105d ago |
| CVE-2026-13806 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remo | 105d ago |
| CVE-2026-13799 | 8.1 | — | — | — | google / chrome | Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit he | 105d ago |
| CVE-2026-13791 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacke | 105d ago |
| CVE-2026-13787 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execu | 105d ago |
| CVE-2026-13779 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to exec | 105d ago |
| CVE-2026-13774 | 8.1 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to i | 105d ago |
| CVE-2025-71374 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle redu | 105d ago |
| CVE-2025-71371 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduc | 105d ago |
| CVE-2025-71368 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing a | 105d ago |
| CVE-2025-71363 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers | 105d ago |
| CVE-2025-71352 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file | 105d ago |
| CVE-2025-71350 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in redu | 105d ago |
| CVE-2025-71349 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowi | 105d ago |
| CVE-2025-36359 | 8.1 | — | — | — | ibm / devops automation | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could | 105d ago |
| CVE-2026-58377 | 8.1 | — | — | — | — | JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege use | 105d ago |
| CVE-2026-58372 | 8.1 | — | — | — | — | SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that | 105d ago |
| CVE-2026-58370 | 8.1 | — | — | — | — | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. | 105d ago |
| CVE-2026-49877 | 8.1 | — | — | — | apache / activemq | Improper Authorization vulnerability in Apache ActiveMQ. | 106d ago |
| CVE-2026-7656 | 8.1 | — | — | — | zephyrproject / zephyr | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input | 106d ago |
| CVE-2026-43735 | 8.1 | — | — | — | apple / safari | The issue was addressed with improved checks. | 106d ago |
| CVE-2026-57950 | 8.1 | — | — | — | — | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOr | 106d ago |
| CVE-2026-40524 | 8.1 | — | — | — | — | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where t | 106d ago |
| CVE-2026-40523 | 8.1 | — | — | — | — | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows | 106d ago |
| CVE-2026-8095 | 8.1 | — | — | — | — | The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in ver | 108d ago |
| CVE-2026-10820 | 8.1 | — | — | — | — | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPre | 109d ago |
| CVE-2026-31928 | 8.1 | — | — | — | daktronics / dmp-5000 firmware | The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, whic | 109d ago |
| CVE-2026-56876 | 8.1 | — | — | — | max-mapper / extract-zip | extract-zip does not validate symlink targets when extracting zip archives. | 109d ago |
| CVE-2026-57645 | 8.1 | — | — | — | — | newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. | 109d ago |
| CVE-2026-56031 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. | 109d ago |
| CVE-2026-9222 | 8.1 | — | — | — | — | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when | 110d ago |
| CVE-2026-22879 | 8.1 | — | — | — | — | vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability | 110d ago |
| CVE-2026-11800 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 110d ago |
| CVE-2025-71340 | 8.1 | — | — | — | — | picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.r | 110d ago |
| CVE-2025-71335 | 8.1 | — | — | — | flowiseai / flowise | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session toke | 110d ago |
| CVE-2026-9800 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak Policy Enforcer. | 110d ago |
| CVE-2026-56123 | 8.1 | — | — | — | dest-unreach / socat | socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious | 110d ago |
| CVE-2026-45233 | 8.1 | — | — | — | — | HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers | 110d ago |
| CVE-2026-54845 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions. | 110d ago |
| CVE-2026-54842 | 8.1 | — | — | — | — | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Con | 110d ago |
| CVE-2026-53254 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC | 111d ago |
| CVE-2026-53178 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds check | 111d ago |
| CVE-2026-53147 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet s | 111d ago |
| CVE-2026-12246 | 8.1 | — | — | — | nlnetlabs / nsd | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for | 111d ago |
| CVE-2026-55762 | 8.1 | — | — | — | — | Rocket.Chat is an open-source, secure, fully customizable communications platform. | 111d ago |
| CVE-2026-52801 | 8.1 | — | — | — | — | Gogs is an open source self-hosted Git service. | 111d ago |
| CVE-2026-48725 | 8.1 | — | — | — | — | Warp is an agentic development environment. | 111d ago |
| CVE-2026-52967 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob | 111d ago |
| CVE-2026-35025 | 8.1 | — | — | — | proftpd / proftpd | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP | 111d ago |
| CVE-2025-71361 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowi | 111d ago |
| CVE-2025-71354 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetTe | 111d ago |
| CVE-2026-54513 | 8.1 | — | — | — | fasterxml / jackson-databind | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 112d ago |
| CVE-2026-54512 | 8.1 | — | — | — | fasterxml / jackson-databind | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 112d ago |
| CVE-2026-39253 | 8.1 | — | — | — | — | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common | 112d ago |
| CVE-2026-52845 | 8.1 | — | — | — | caddyserver / caddy | Caddy is an extensible server platform that uses TLS by default. | 112d ago |
