| CVE-2026-49402 | 8.1 | — | — | — | deno / deno | Deno is a JavaScript, TypeScript, and WebAssembly runtime. | 112d ago |
| CVE-2026-45135 | 8.1 | — | — | — | caddyserver / caddy | Caddy is an extensible server platform that uses TLS by default. | 112d ago |
| CVE-2026-45732 | 8.1 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 112d ago |
| CVE-2026-35019 | 8.1 | — | — | — | — | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that a | 112d ago |
| CVE-2026-56784 | 8.1 | — | — | — | — | OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm delet | 112d ago |
| CVE-2026-56379 | 8.1 | — | — | — | imagemagick / imagemagick | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allow | 112d ago |
| CVE-2026-56258 | 8.1 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allo | 112d ago |
| CVE-2026-56243 | 8.1 | — | — | — | — | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plain | 112d ago |
| CVE-2025-71376 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_comp | 112d ago |
| CVE-2025-71370 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls emb | 112d ago |
| CVE-2025-71365 | 8.1 | — | — | — | — | picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval functio | 112d ago |
| CVE-2025-71341 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing | 112d ago |
| CVE-2025-71358 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get | 113d ago |
| CVE-2025-71344 | 8.1 | — | — | — | — | picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in fu | 113d ago |
| CVE-2025-71339 | 8.1 | — | — | — | — | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ meth | 113d ago |
| CVE-2026-44271 | 8.1 | — | — | — | dell / wyse management suite | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elemen | 113d ago |
| CVE-2026-55388 | 8.1 | — | — | — | — | piscina is a node.js worker pool implementation. | 113d ago |
| CVE-2026-9072 | 8.1 | — | — | — | ibm / i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management w | 113d ago |
| CVE-2026-41045 | 8.1 | — | — | — | presire / qsnapper | A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to | 113d ago |
| CVE-2023-45796 | 8.1 | — | — | — | — | A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up | 114d ago |
| CVE-2025-66336 | 8.1 | — | — | — | apache / doris mcp server | Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. | 114d ago |
| CVE-2025-71378 | 8.1 | — | — | — | mmaitre314 / picklescan | picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing at | 114d ago |
| CVE-2025-71357 | 8.1 | — | — | — | mmaitre314 / picklescan | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcomma | 114d ago |
| CVE-2025-71348 | 8.1 | — | — | — | mmaitre314 / picklescan | picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config | 114d ago |
| CVE-2026-56345 | 8.1 | — | — | — | — | AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.p | 115d ago |
| CVE-2026-9843 | 8.1 | — | — | — | — | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file dele | 116d ago |
| CVE-2026-49340 | 8.1 | — | — | — | — | gonic is a music streaming server / free-software subsonic server API implementation. | 116d ago |
| CVE-2026-49291 | 8.1 | — | — | — | — | mcp-memory-service is a semantic memory layer for AI applications. | 116d ago |
| CVE-2026-49286 | 8.1 | — | — | — | — | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. | 116d ago |
| CVE-2026-49872 | 8.1 | — | — | — | apache / apisix | Improper Authentication vulnerability in Apache APISIX. | 116d ago |
| CVE-2026-47339 | 8.1 | — | — | — | apache / apisix | Incorrect Authorization vulnerability in Apache APISIX. | 116d ago |
| CVE-2026-56076 | 8.1 | — | — | — | — | PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows re | 117d ago |
| CVE-2026-43994 | 8.1 | — | — | — | coturn project / coturn | Coturn is a free open source implementation of TURN and STUN Server. | 117d ago |
| CVE-2026-56020 | 8.1 | — | — | — | — | The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SS | 117d ago |
| CVE-2026-42488 | 8.1 | — | — | — | — | Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. | 117d ago |
| CVE-2026-11719 | 8.1 | — | — | — | google / mcp toolbox for databases | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enfor | 117d ago |
| CVE-2026-55744 | 8.1 | — | — | — | — | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File St | 118d ago |
| CVE-2026-55200 | 8.1 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_re | 118d ago |
| CVE-2026-50107 | 8.1 | — | — | — | f5 / nginx gateway fabric | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulner | 118d ago |
| CVE-2026-53871 | 8.1 | — | — | — | — | Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function t | 118d ago |
| CVE-2026-30799 | 8.1 | — | — | — | rti / connext professional | Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows I | 118d ago |
| CVE-2026-2674 | 8.1 | — | — | — | rti / connext professional | Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing S | 118d ago |
| CVE-2026-2467 | 8.1 | — | — | — | rti / connext professional | Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and | 118d ago |
| CVE-2026-54415 | 8.1 | — | — | — | — | Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on a | 118d ago |
| CVE-2026-42530 | 8.1 | — | — | — | f5 / nginx gateway fabric | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. | 118d ago |
| CVE-2026-42055 | 8.1 | — | — | — | f5 / dos | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module mod | 118d ago |
| CVE-2026-32804 | 8.1 | — | — | — | dell / powerflex manager | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. | 118d ago |
| CVE-2026-11311 | 8.1 | — | — | — | f5 / nginx gateway fabric | When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the | 118d ago |
| CVE-2026-54814 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 118d ago |
| CVE-2026-52707 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | 118d ago |
| CVE-2026-40757 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. | 118d ago |
| CVE-2026-40756 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. | 118d ago |
| CVE-2026-40752 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. | 118d ago |
| CVE-2026-40738 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. | 118d ago |
| CVE-2026-40733 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions. | 118d ago |
| CVE-2026-39590 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. | 118d ago |
| CVE-2026-39576 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. | 118d ago |
| CVE-2026-39560 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. | 118d ago |
| CVE-2026-39559 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. | 118d ago |
| CVE-2026-39556 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. | 118d ago |
