| CVE-2026-33245 | 8 | — | — | — | shopify / react-router | React Router is a router for React. | 134d ago |
| CVE-2026-0097 | 8 | — | — | — | google / android | In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic | 135d ago |
| CVE-2026-0095 | 8 | — | — | — | google / android | In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privil | 135d ago |
| CVE-2026-0059 | 8 | — | — | — | google / android | In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer o | 135d ago |
| CVE-2026-47294 | 8 | — | — | — | microsoft / sharepoint server | Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office Sha | 135d ago |
| CVE-2026-20452 | 8 | — | — | — | mediatek / mt6890 firmware | In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow. | 135d ago |
| CVE-2026-49367 | 8 | — | — | — | jetbrains / intellij idea | In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account | 138d ago |
| CVE-2026-35630 | 8 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fai | 138d ago |
| CVE-2026-37266 | 8 | — | — | — | — | An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbi | 139d ago |
| CVE-2026-6957 | 8 | — | — | — | mattermost / legal hold | Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to c | 140d ago |
| CVE-2026-3012 | 8 | — | — | — | redhat / openshift container platform | A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. | 140d ago |
| CVE-2026-8834 | 8 | — | — | — | ibm / http server | IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. | 141d ago |
| CVE-2026-4858 | 8 | — | — | — | mattermost / mattermost server | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integra | 146d ago |
| CVE-2025-11954 | 8 | — | — | — | — | Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd. | 147d ago |
| CVE-2026-24214 | 8 | — | — | — | nvidia / triton inference server | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integ | 147d ago |
| CVE-2026-24213 | 8 | — | — | — | nvidia / triton inference server | NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-o | 147d ago |
| CVE-2026-45671 | 8 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 152d ago |
| CVE-2026-44184 | 8 | — | — | — | — | Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported down | 155d ago |
| CVE-2026-40368 | 8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 155d ago |
| CVE-2026-34332 | 8 | — | — | — | microsoft / windows server 2025 | Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network. | 155d ago |
| CVE-2023-27753 | 8 | — | — | — | — | An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploadi | 155d ago |
| CVE-2026-43639 | 8 | — | — | — | bitwarden / server | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service | 156d ago |
| CVE-2026-41431 | 8 | — | — | — | — | Zen is a firefox-based browser. | 156d ago |
| CVE-2026-4802 | 8 | — | — | — | — | A flaw was found in Cockpit. | 156d ago |
| CVE-2026-32658 | 8 | — | — | — | dell / automation platform | Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. | 156d ago |
| CVE-2026-33335 | 8 | — | — | — | vikunja / vikunja | Vikunja is an open-source self-hosted task management platform. | 204d ago |
| CVE-2026-32813 | 8 | — | — | — | admidio / admidio | Admidio is an open-source user management solution. | 209d ago |
| CVE-2026-32014 | 8 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and device | 209d ago |
| CVE-2025-55041 | 8 | — | — | — | murasoftware / mura cms | MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUser | 210d ago |
| CVE-2025-41258 | 8 | — | — | — | librechat / librechat | LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises | 210d ago |
| CVE-2026-3561 | 8 | — | — | — | philips / hue bridge v2 firmware | Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. | 212d ago |
| CVE-2026-3557 | 8 | — | — | — | philips / hue bridge v2 firmware | Philips Hue Bridge hap_pair_verify_handler Sub-TLV Parsing Heap-based Buffer Overflow Remote Code Execution Vulnera | 212d ago |
| CVE-2026-3555 | 8 | — | — | — | philips / hue bridge v2 firmware | Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerabili | 212d ago |
| CVE-2026-22248 | 8 | — | — | — | teclib-edition / glpi | GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses | 217d ago |
| CVE-2026-85649 | 7.9 | — | — | — | — | (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in | 40d ago |
| CVE-2026-78408 | 7.9 | — | — | — | — | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open a | 42d ago |
| CVE-2026-73776 | 7.9 | — | — | — | hpe / arubaos-cx | A signature verification bypass vulnerability exists in the command line interface of AOS-CX. | 43d ago |
| CVE-2026-82636 | 7.9 | — | — | — | — | Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to | 45d ago |
| CVE-2026-44629 | 7.9 | — | — | — | — | Improper access control to the Synergis Softwire installation folder. | 48d ago |
| CVE-2026-80550 | 7.9 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW | 49d ago |
| CVE-2026-18716 | 7.9 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive info | 55d ago |
| CVE-2026-17063 | 7.9 | — | — | — | ibm / power system s1122 \(9824-22a\) firmware | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by | 56d ago |
| CVE-2026-70685 | 7.9 | — | — | — | oracle / hyperion calculation manager | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). | 57d ago |
| CVE-2026-54552 | 7.9 | — | — | — | — | sh provides Python process launching. | 57d ago |
| CVE-2026-15218 | 7.9 | — | — | — | — | A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. | 58d ago |
| CVE-2026-72312 | 7.9 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix VF bringup affecting PF prom | 60d ago |
| CVE-2026-20891 | 7.9 | — | — | — | intel / proset\/wireless wifi | Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers | 64d ago |
| CVE-2026-20737 | 7.9 | — | — | — | intel / proset\/wireless wifi | Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Win | 64d ago |
| CVE-2026-6726 | 7.9 | — | — | — | — | An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attack | 64d ago |
| CVE-2026-66763 | 7.9 | — | — | — | — | SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objec | 65d ago |
| CVE-2026-68116 | 7.9 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a fa | 65d ago |
| CVE-2026-48346 | 7.9 | — | — | — | adobe / animate | Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the | 92d ago |
| CVE-2026-12250 | 7.9 | — | — | — | — | Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Re | 101d ago |
| CVE-2026-42487 | 7.9 | — | — | — | — | HVM guest I/O port accesses are subject to either emulation or at least translation. | 118d ago |
| CVE-2026-46848 | 7.9 | — | — | — | oracle / weblogic server | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). | 119d ago |
| CVE-2026-48578 | 7.9 | — | — | — | microsoft / windows 10 1607 | Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally. | 127d ago |
| CVE-2026-48576 | 7.9 | — | — | — | microsoft / windows 10 1607 | No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | 127d ago |
| CVE-2026-48575 | 7.9 | — | — | — | microsoft / windows 10 1607 | Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature loc | 127d ago |
| CVE-2026-48573 | 7.9 | — | — | — | microsoft / windows 10 1607 | No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. | 127d ago |
| CVE-2026-48570 | 7.9 | — | — | — | microsoft / windows 10 1607 | Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature loc | 127d ago |
