| CVE-2026-48064 | 8.1 | — | — | — | — | pam_usb provides hardware authentication for Linux using ordinary removable media. | 139d ago |
| CVE-2026-48152 | 8.1 | — | — | — | — | Budibase is an open-source low-code platform. | 139d ago |
| CVE-2026-48149 | 8.1 | — | — | — | — | Budibase is an open-source low-code platform. | 139d ago |
| CVE-2026-42790 | 8.1 | — | — | — | erlang / erlang\/otp | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows | 139d ago |
| CVE-2026-44838 | 8.1 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 140d ago |
| CVE-2026-46099 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl l | 140d ago |
| CVE-2026-46010 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix error handling in rxgk_extract_toke | 140d ago |
| CVE-2026-48906 | 8.1 | — | — | — | tassos / advanced custom fields | The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites. | 140d ago |
| CVE-2025-13392 | 8.1 | — | — | — | synology / diskstation manager | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) be | 140d ago |
| CVE-2026-8994 | 8.1 | — | — | — | — | The Login with NEAR plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin | 140d ago |
| CVE-2026-45574 | 8.1 | — | — | — | — | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. | 140d ago |
| CVE-2026-44900 | 8.1 | — | — | — | — | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. | 140d ago |
| CVE-2026-8855 | 8.1 | — | — | — | ibm / http server | IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TL | 140d ago |
| CVE-2026-48695 | 8.1 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router i | 140d ago |
| CVE-2026-48694 | 8.1 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router | 140d ago |
| CVE-2026-48692 | 8.1 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanis | 140d ago |
| CVE-2026-43935 | 8.1 | — | — | — | — | e107 is a content management system (CMS). | 140d ago |
| CVE-2026-48132 | 8.1 | — | — | — | — | The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UD | 141d ago |
| CVE-2026-48131 | 8.1 | — | — | — | — | The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early s | 141d ago |
| CVE-2026-8046 | 8.1 | — | — | — | — | The affected products insufficiently verify authorization when deleting user accounts. | 141d ago |
| CVE-2026-48842exploited | 8.1 | 0.89% | 1/3 | +119d | — | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_ | 141d ago |
| CVE-2026-45361 | 8.1 | — | — | — | apache / apache-airflow-providers-google | Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing S | 142d ago |
| CVE-2026-25193 | 8.1 | — | — | — | gallagher / active directory sync | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to | 142d ago |
| CVE-2026-9397 | 8.1 | — | — | — | — | A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. | 142d ago |
| CVE-2026-41076 | 8.1 | — | — | — | — | RT is an open source, enterprise-grade issue and ticket tracking system. | 144d ago |
| CVE-2026-41071 | 8.1 | — | — | — | struktur / libheif | libheif is a HEIF and AVIF file format decoder and encoder. | 144d ago |
| CVE-2026-40172 | 8.1 | — | — | — | — | authentik is an open-source identity provider. | 144d ago |
| CVE-2026-46727 | 8.1 | — | — | — | ruby-lang / ruby | An issue was discovered in Ruby 4 before 4.0.5. | 144d ago |
| CVE-2026-9256 | 8.1 | — | — | — | f5 / nginx open source | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. | 145d ago |
| CVE-2026-9277 | 8.1 | — | — | — | — | shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. | 145d ago |
| CVE-2026-48242 | 8.1 | — | — | — | — | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password | 145d ago |
| CVE-2026-48241 | 8.1 | — | — | — | — | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing datab | 145d ago |
| CVE-2026-45760 | 8.1 | — | — | — | — | (Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled K | 146d ago |
| CVE-2026-44051 | 8.1 | — | — | — | — | An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker t | 146d ago |
| CVE-2026-24218 | 8.1 | — | — | — | nvidia / dgx os | NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image caus | 146d ago |
| CVE-2026-45584 | 8.1 | — | — | — | microsoft / malware protection engine | Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. | 147d ago |
| CVE-2026-47784 | 8.1 | — | — | — | memcached / memcached | In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel beca | 147d ago |
| CVE-2026-47783 | 8.1 | — | — | — | memcached / memcached | In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel beca | 147d ago |
| CVE-2026-43618 | 8.1 | — | — | — | samba / rsync | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32 | 147d ago |
| CVE-2026-34358 | 8.1 | — | — | — | — | CtrlPanel is open-source billing software for hosting providers. | 147d ago |
| CVE-2026-47107 | 8.1 | — | — | — | — | Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration | 147d ago |
| CVE-2026-8711 | 8.1 | — | — | — | f5 / njs | NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-contr | 148d ago |
| CVE-2026-8969 | 8.1 | — | — | — | mozilla / firefox | Mitigation bypass in the DOM: Security component. | 148d ago |
| CVE-2026-8962 | 8.1 | — | — | — | mozilla / firefox | Mitigation bypass in the DOM: Security component. | 148d ago |
| CVE-2026-7504 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak's URL validation logic during redirect operations. | 148d ago |
| CVE-2026-24792 | 8.1 | — | — | — | — | in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. | 148d ago |
| CVE-2026-8851 | 8.1 | — | — | — | — | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functio | 148d ago |
| CVE-2026-45665 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-45301 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-44565 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-45402 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-45675 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-44554 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-44553 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-46407 | 8.1 | — | — | — | — | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. | 151d ago |
| CVE-2026-35194 | 8.1 | — | — | — | apache / flink | Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authentic | 151d ago |
| CVE-2026-4094 | 8.1 | — | — | — | — | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data lo | 152d ago |
| CVE-2026-28761 | 8.1 | — | — | — | — | Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev22 | 152d ago |
| CVE-2026-8629 | 8.1 | — | — | — | — | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-onl | 152d ago |
| CVE-2026-44633 | 8.1 | — | — | — | — | Live Helper Chat is an open-source application that enables live support websites. | 152d ago |
