| CVE-2026-39587 | 8.1 | — | — | — | — | Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions. | 120d ago |
| CVE-2026-27333 | 8.1 | — | — | — | — | Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions. | 120d ago |
| CVE-2026-50891 | 8.1 | — | — | — | — | Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privi | 120d ago |
| CVE-2026-50888 | 8.1 | — | — | — | — | An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard K | 120d ago |
| CVE-2026-50881 | 8.1 | — | — | — | — | Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to esca | 120d ago |
| CVE-2026-50875 | 8.1 | — | — | — | — | Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated att | 120d ago |
| CVE-2026-50874 | 8.1 | — | — | — | — | An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3. | 120d ago |
| CVE-2026-53823 | 8.1 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to muta | 123d ago |
| CVE-2026-45013 | 8.1 | — | — | — | — | ApostropheCMS is an open-source Node.js content management system. | 123d ago |
| CVE-2026-53408 | 8.1 | — | — | — | zoom / meeting software development kit | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and bef | 123d ago |
| CVE-2026-53407 | 8.1 | — | — | — | zoom / workplace | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and bef | 123d ago |
| CVE-2026-50101 | 8.1 | — | — | — | — | Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device o | 123d ago |
| CVE-2026-7368 | 8.1 | — | — | — | — | The Yarbo cloud does not enforce per-device or per-user authorization. | 123d ago |
| CVE-2026-50633 | 8.1 | — | — | — | apache / cxf | A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for cod | 124d ago |
| CVE-2026-50632 | 8.1 | — | — | — | apache / cxf | A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for | 124d ago |
| CVE-2026-11846 | 8.1 | — | — | — | — | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnera | 124d ago |
| CVE-2026-48610 | 8.1 | — | — | — | — | Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Co | 124d ago |
| CVE-2026-6250 | 8.1 | — | — | — | tp-link / tapo c110 firmware | An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling o | 124d ago |
| CVE-2026-44249 | 8.1 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 124d ago |
| CVE-2026-12012 | 8.1 | — | — | — | google / chrome | Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network pos | 124d ago |
| CVE-2026-46622 | 8.1 | — | — | — | — | SolidInvoice is an open-source invoicing platform. | 124d ago |
| CVE-2026-46489 | 8.1 | — | — | — | — | SolidInvoice is an open-source invoicing platform. | 124d ago |
| CVE-2026-45178 | 8.1 | — | — | — | paloaltonetworks / idira secrets manager | Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluste | 124d ago |
| CVE-2026-53777 | 8.1 | — | — | — | — | Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitr | 124d ago |
| CVE-2026-11816 | 8.1 | — | — | — | keras / keras | Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities locate | 124d ago |
| CVE-2026-41700 | 8.1 | — | — | — | vmware / spring for graphql | Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket H | 125d ago |
| CVE-2026-41699 | 8.1 | — | — | — | vmware / spring for graphql | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries | 125d ago |
| CVE-2026-10795zero day | 8.1 | 3.6% | 1/3 | 1d before | — | The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all v | 125d ago |
| CVE-2026-53738 | 8.1 | — | — | — | — | Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_ | 125d ago |
| CVE-2026-45062 | 8.1 | — | — | — | — | FrankenPHP is a modern application server for PHP. | 125d ago |
| CVE-2026-45569 | 8.1 | — | — | — | — | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. | 125d ago |
| CVE-2026-45565 | 8.1 | — | — | — | — | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. | 125d ago |
| CVE-2026-26239 | 8.1 | — | — | — | qnap / file station | A buffer overflow vulnerability has been reported to affect File Station 5. | 126d ago |
| CVE-2026-24724 | 8.1 | — | — | — | qnap / file station | An incorrect authorization vulnerability has been reported to affect File Station 6. | 126d ago |
| CVE-2026-53673 | 8.1 | — | — | — | — | BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows | 126d ago |
| CVE-2026-41732 | 8.1 | — | — | — | vmware / spring for apache pulsar | JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting a | 126d ago |
| CVE-2026-41731 | 8.1 | — | — | — | vmware / spring for apache kafka | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages us | 126d ago |
| CVE-2026-41729 | 8.1 | — | — | — | vmware / spring data rest | Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patc | 126d ago |
| CVE-2026-41717 | 8.1 | — | — | — | vmware / spring data mongodb | Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. | 126d ago |
| CVE-2026-9753 | 8.1 | — | — | — | mongodb / mongodb | The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malfo | 126d ago |
| CVE-2026-47930 | 8.1 | — | — | — | adobe / coldfusion | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that co | 126d ago |
| CVE-2026-36720 | 8.1 | — | — | — | — | Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via | 126d ago |
| CVE-2026-9213 | 8.1 | — | — | — | netgear / mr70 firmware | A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper wi | 126d ago |
| CVE-2026-7383 | 8.1 | — | — | — | openssl / openssl | Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_nco | 126d ago |
| CVE-2026-47631 | 8.1 | — | — | — | microsoft / exchange server | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server | 126d ago |
| CVE-2026-45635 | 8.1 | — | — | — | microsoft / windows 10 1607 | Access of resource using incompatible type ('type confusion') in Universal Plug and Play (upnp.dll) allows an unau | 126d ago |
| CVE-2026-45599 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a networ | 126d ago |
| CVE-2026-45503 | 8.1 | — | — | — | microsoft / exchange server | Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a n | 126d ago |
| CVE-2026-42987 | 8.1 | — | — | — | microsoft / windows server 2012 | Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network. | 126d ago |
| CVE-2026-42981 | 8.1 | — | — | — | microsoft / windows 11 23h2 | Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute c | 126d ago |
| CVE-2026-42974 | 8.1 | — | — | — | microsoft / windows 11 23h2 | Integer overflow or wraparound in Windows Performance Monitor allows an unauthorized attacker to execute code over | 126d ago |
| CVE-2026-42835 | 8.1 | — | — | — | microsoft / teams | Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Te | 126d ago |
| CVE-2026-49948 | 8.1 | — | — | — | — | Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-ho | 126d ago |
| CVE-2026-24065 | 8.1 | — | — | — | — | Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the p | 126d ago |
| CVE-2026-9662 | 8.1 | — | — | — | — | The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to a | 127d ago |
| CVE-2026-41855 | 8.1 | — | — | — | vmware / spring framework | In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org | 127d ago |
| CVE-2026-11693 | 8.1 | — | — | — | google / chrome | Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had | 127d ago |
| CVE-2026-11689 | 8.1 | — | — | — | google / chrome | Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker wh | 127d ago |
| CVE-2026-11643 | 8.1 | — | — | — | google / chrome | Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary co | 127d ago |
| CVE-2026-46484 | 8.1 | — | — | — | — | Headplane is a feature-complete Web UI for Headscale. | 127d ago |
