| CVE-2026-42863 | 8.1 | — | — | — | flowiseai / flowise | Flowise is a drag & drop user interface to build a customized large language model flow. | 127d ago |
| CVE-2026-11416 | 8.1 | — | — | — | — | MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers | 130d ago |
| CVE-2026-45749 | 8.1 | — | — | — | termix / termix | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. | 130d ago |
| CVE-2026-45743 | 8.1 | — | — | — | termix / termix | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. | 130d ago |
| CVE-2026-11231 | 8.1 | — | — | — | google / chrome | Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote atta | 131d ago |
| CVE-2026-11224 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute | 131d ago |
| CVE-2026-11185 | 8.1 | — | — | — | google / chrome | Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a | 131d ago |
| CVE-2026-11170 | 8.1 | — | — | — | google / chrome | Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attac | 131d ago |
| CVE-2026-11169 | 8.1 | — | — | — | google / chrome | Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject ar | 131d ago |
| CVE-2026-11111 | 8.1 | — | — | — | google / chrome | Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of | 131d ago |
| CVE-2026-11015 | 8.1 | — | — | — | google / chrome | Out of bounds read in WebGPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out o | 131d ago |
| CVE-2026-11011 | 8.1 | — | — | — | google / chrome | Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attac | 131d ago |
| CVE-2026-10930 | 8.1 | — | — | — | google / chrome | Out of bounds read in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to perform an | 131d ago |
| CVE-2026-10887 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute a | 131d ago |
| CVE-2026-10863 | 8.1 | — | — | — | misp-project / misp | A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accep | 132d ago |
| CVE-2025-59874 | 8.1 | — | — | — | — | HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keyclo | 132d ago |
| CVE-2026-36603 | 8.1 | — | — | — | — | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authenti | 132d ago |
| CVE-2026-35081 | 8.1 | — | — | — | mbs-solutions / universal gateway firmware | The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insuf | 133d ago |
| CVE-2026-35080 | 8.1 | — | — | — | mbs-solutions / universal gateway firmware | The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to in | 133d ago |
| CVE-2026-35079 | 8.1 | — | — | — | mbs-solutions / universal gateway firmware | The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insuff | 133d ago |
| CVE-2026-35078 | 8.1 | — | — | — | mbs-solutions / universal gateway firmware | The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insuff | 133d ago |
| CVE-2026-35077 | 8.1 | — | — | — | mbs-solutions / universal gateway firmware | The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to in | 133d ago |
| CVE-2026-35076 | 8.1 | — | — | — | mbs-solutions / universal gateway firmware | The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to ins | 133d ago |
| CVE-2026-44654 | 8.1 | — | — | — | librechat / librechat | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. | 133d ago |
| CVE-2026-42211 | 8.1 | — | — | — | shopify / react-router | React Router is a router for React. | 133d ago |
| CVE-2026-39555 | 8.1 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. | 134d ago |
| CVE-2026-39553 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2026-39552 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2025-69369 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2025-68886 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2025-58897 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2025-58707 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2026-39551 | 8.1 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. | 134d ago |
| CVE-2026-39550 | 8.1 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. | 134d ago |
| CVE-2025-58705 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2025-53440 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 134d ago |
| CVE-2026-5422 | 8.1 | — | — | — | jupyter / jupyter server | A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary | 134d ago |
| CVE-2026-49121 | 8.1 | — | — | — | amd / aiter | AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability i | 134d ago |
| CVE-2026-45281 | 8.1 | — | — | — | nextcloud / nextcloud server | Nextcloud is an open source content collaboration platform. | 134d ago |
| CVE-2026-41013 | 8.1 | — | — | — | — | Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privilege | 134d ago |
| CVE-2026-45156 | 8.1 | — | — | — | — | Nextcloud is an open source content collaboration platform. | 134d ago |
| CVE-2026-44825exploited | 8.1 | 2.8% | 1/3 | +51d | apache / solr | Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 | 135d ago |
| CVE-2026-42588 | 8.1 | — | — | — | apache / activemq | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Activ | 135d ago |
| CVE-2026-8796 | 8.1 | — | — | — | — | Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. | 135d ago |
| CVE-2026-49490 | 8.1 | — | — | — | — | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authe | 136d ago |
| CVE-2026-47740 | 8.1 | — | — | — | — | Shopper is a Headless e-commerce Admin Panel. | 137d ago |
| CVE-2026-45707 | 8.1 | — | — | — | n8n-mcp / n8n-mcp | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. | 138d ago |
| CVE-2026-44237 | 8.1 | — | — | — | sangoma / freepbx | FreePBX is an open source IP PBX. | 138d ago |
| CVE-2026-6075 | 8.1 | — | — | — | — | The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and | 138d ago |
| CVE-2026-9964 | 8.1 | — | — | — | google / chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a use | 138d ago |
| CVE-2026-45344 | 8.1 | — | — | — | — | LinkAce is a self-hosted archive to collect website links. | 138d ago |
| CVE-2026-44973 | 8.1 | — | — | — | — | Billy is an interface filesystem abstraction for Go. | 138d ago |
| CVE-2026-44882 | 8.1 | — | — | — | portainer / portainer | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be | 138d ago |
| CVE-2026-46828 | 8.1 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). | 138d ago |
| CVE-2026-35277 | 8.1 | — | — | — | oracle / rest data services | Vulnerability in Oracle REST Data Services (component: Core). | 138d ago |
| CVE-2026-9095 | 8.1 | — | — | — | — | Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. | 138d ago |
| CVE-2026-46232 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A de | 139d ago |
| CVE-2026-46138 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix OOB read and infinit | 139d ago |
| CVE-2026-6455 | 8.1 | — | — | — | — | The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitr | 139d ago |
| CVE-2026-46402 | 8.1 | — | — | — | — | Microsoft UFO open-source framework for intelligent automation across devices and platforms. | 139d ago |
