| CVE-2026-42897zero day | 8.1 | 0.52% | 3/3 | same day | microsoft / exchange server | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server | 152d ago |
| CVE-2026-4030 | 8.1 | — | — | — | — | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deleti | 153d ago |
| CVE-2026-3892 | 8.1 | — | — | — | — | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file delet | 153d ago |
| CVE-2026-29206 | 8.1 | — | — | — | — | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of t | 153d ago |
| CVE-2026-42463 | 8.1 | — | — | — | fit2cloud / sqlbot | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. | 153d ago |
| CVE-2026-45055 | 8.1 | — | — | — | — | CubeCart is an ecommerce software solution. | 153d ago |
| CVE-2026-42602 | 8.1 | — | — | — | opentelemetry / opentelemetry collector contrib | azureauthextension is the Azure Authenticator Extension. | 153d ago |
| CVE-2026-0250 | 8.1 | — | — | — | paloaltonetworks / globalprotect | A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middl | 153d ago |
| CVE-2026-0244 | 8.1 | — | — | — | paloaltonetworks / prisma sd-wan | An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-mid | 153d ago |
| CVE-2026-0265 | 8.1 | — | — | — | paloaltonetworks / pan-os | An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker w | 153d ago |
| CVE-2026-44574 | 8.1 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 154d ago |
| CVE-2026-6282 | 8.1 | — | — | — | — | A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices | 154d ago |
| CVE-2026-44291 | 8.1 | — | — | — | protobufjs project / protobufjs | protobufjs compiles protobuf definitions into JavaScript (JS) functions. | 154d ago |
| CVE-2026-42945exploited | 8.1 | 3.4% | 1/3 | +3d | f5 / dos | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. | 154d ago |
| CVE-2026-20916 | 8.1 | — | — | — | f5 / big-iq centralized management | An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclose | 154d ago |
| CVE-2026-7635 | 8.1 | — | — | — | — | The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all | 154d ago |
| CVE-2026-44548 | 8.1 | — | — | — | — | ChurchCRM is an open-source church management system. | 154d ago |
| CVE-2026-44304 | 8.1 | — | — | — | — | Lemur manages TLS certificate creation. | 154d ago |
| CVE-2026-44301 | 8.1 | — | — | — | gohugo / hugo | Hugo is a static site generator. | 154d ago |
| CVE-2026-44260 | 8.1 | — | — | — | — | efw4.X is an Enterprise Framework for Web. | 154d ago |
| CVE-2026-8430 | 8.1 | — | — | — | — | SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to | 154d ago |
| CVE-2026-40415 | 8.1 | — | — | — | microsoft / windows 10 1809 | Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | 154d ago |
| CVE-2026-30808 | 8.1 | — | — | — | artica / pandora fms | Session Fixation vulnerability allows Session Hijacking via crafted session ID. | 155d ago |
| CVE-2026-43983 | 8.1 | — | — | — | pocket-id / pocket id | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. | 155d ago |
| CVE-2026-43938 | 8.1 | — | — | — | — | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. | 155d ago |
| CVE-2026-43913 | 8.1 | — | — | — | dani-garcia / vaultwarden | Vaultwarden is a Bitwarden-compatible server written in Rust. | 155d ago |
| CVE-2026-28907 | 8.1 | — | — | — | apple / ipados | The issue was addressed with improved input validation. | 155d ago |
| CVE-2026-43640 | 8.1 | — | — | — | bitwarden / server | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating | 155d ago |
| CVE-2026-42315 | 8.1 | — | — | — | pyload-ng project / pyload-ng | pyLoad is a free and open-source download manager written in Python. | 155d ago |
| CVE-2026-38568 | 8.1 | — | — | — | — | HireFlow v1.2 is vulnerable to Incorrect Access Control. | 155d ago |
| CVE-2026-38566 | 8.1 | — | — | — | — | HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. | 155d ago |
| CVE-2026-30635 | 8.1 | — | — | — | — | Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary command | 155d ago |
| CVE-2026-42349 | 8.1 | — | — | — | clerk / clerk\/astro | Clerk JavaScript is the official JavaScript repository for Clerk authentication. | 156d ago |
| CVE-2026-7819 | 8.1 | — | — | — | pgadmin / pgadmin 4 | Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. | 156d ago |
| CVE-2026-42609 | 8.1 | — | — | — | getgrav / grav | Grav is a file-based Web platform. | 156d ago |
| CVE-2026-32853 | 8.1 | — | — | — | libvncserver project / libvncserver | LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability i | 203d ago |
| CVE-2026-33678 | 8.1 | — | — | — | vikunja / vikunja | Vikunja is an open-source self-hosted task management platform. | 204d ago |
| CVE-2026-33668 | 8.1 | — | — | — | vikunja / vikunja | Vikunja is an open-source self-hosted task management platform. | 204d ago |
| CVE-2026-33316 | 8.1 | — | — | — | vikunja / vikunja | Vikunja is an open-source self-hosted task management platform. | 204d ago |
| CVE-2026-4718 | 8.1 | — | — | — | mozilla / firefox | Undefined behavior in the WebRTC: Signaling component. | 204d ago |
| CVE-2026-4021 | 8.1 | — | — | — | — | The Contest Gallery plugin for WordPress is vulnerable to an authentication bypass leading to admin account takeove | 204d ago |
| CVE-2026-32300 | 8.1 | — | — | — | opensource-workshop / connect-cms | Connect-CMS is a content management system. | 204d ago |
| CVE-2026-33651 | 8.1 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 204d ago |
| CVE-2026-33649 | 8.1 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 204d ago |
| CVE-2025-15517 | 8.1 | — | — | — | tp-link / archer nx600 firmware | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi e | 204d ago |
| CVE-2026-33482 | 8.1 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 205d ago |
| CVE-2026-33293 | 8.1 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 206d ago |
| CVE-2026-3629 | 8.1 | — | — | — | — | The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all version | 206d ago |
| CVE-2025-14037 | 8.1 | — | — | — | — | The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all | 207d ago |
| CVE-2026-33236 | 8.1 | — | — | — | nltk / nltk | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting rese | 207d ago |
| CVE-2026-33142 | 8.1 | — | — | — | hackerbay / oneuptime | OneUptime is a solution for monitoring and managing online services. | 207d ago |
| CVE-2026-33010 | 8.1 | — | — | — | doobidoo / mcp-memory-service | mcp-memory-service is an open-source memory backend for multi-agent systems. | 207d ago |
| CVE-2026-31836 | 8.1 | — | — | — | bluewavelabs / checkmate | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response time | 207d ago |
| CVE-2026-4434 | 8.1 | — | — | — | devolutions / devolutions server | Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man | 208d ago |
| CVE-2026-22324 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 208d ago |
| CVE-2026-27625 | 8.1 | — | — | — | stirling / stirling pdf | Stirling-PDF is a locally hosted web application that performs various operations on PDF files. | 208d ago |
| CVE-2026-4478 | 8.1 | — | — | — | — | A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_20171024151200. | 208d ago |
| CVE-2026-33055 | 8.1 | — | — | — | alexcrichton / tar-rs | tar-rs is a tar archive reading/writing library for Rust. | 208d ago |
| CVE-2026-33043 | 8.1 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 208d ago |
| CVE-2026-33038 | 8.1 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 208d ago |
