| CVE-2026-55431 | 7.7 | — | — | — | coder / coder | Coder allows organizations to provision remote development environments via Terraform. | 98d ago |
| CVE-2026-54607 | 7.7 | — | — | — | — | FastGPT is a knowledge-based AI application platform. | 98d ago |
| CVE-2026-34044 | 7.7 | — | — | — | — | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | 99d ago |
| CVE-2026-14468 | 7.7 | — | — | — | — | HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry module | 99d ago |
| CVE-2026-6901 | 7.7 | — | — | — | — | Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. | 99d ago |
| CVE-2026-9165 | 7.7 | — | — | — | — | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). | 99d ago |
| CVE-2026-58423 | 7.7 | — | — | — | — | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories | 102d ago |
| CVE-2026-58460 | 7.7 | — | — | — | — | react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious ap | 103d ago |
| CVE-2026-59095 | 7.7 | — | — | — | — | LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated at | 103d ago |
| CVE-2026-59092 | 7.7 | — | — | — | juicedata / juicefs | JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauth | 103d ago |
| CVE-2026-54401 | 7.7 | — | — | — | ui / unifi os server | A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) | 103d ago |
| CVE-2026-34592 | 7.7 | — | — | — | — | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | 106d ago |
| CVE-2023-37524 | 7.7 | — | — | — | hcltech / traveler for microsoft outlook | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of | 109d ago |
| CVE-2026-49984 | 7.7 | — | — | — | kestra / kestra | Kestra is an open-source, event-driven orchestration platform. | 109d ago |
| CVE-2026-45807 | 7.7 | — | — | — | kestra / kestra | Kestra is an open-source, event-driven orchestration platform. | 109d ago |
| CVE-2026-55189 | 7.7 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 109d ago |
| CVE-2026-21734 | 7.7 | — | — | — | imaginationtech / ddk | A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write o | 109d ago |
| CVE-2026-57920 | 7.7 | — | — | — | peplink / intcontrol 2 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for | 109d ago |
| CVE-2026-10835 | 7.7 | — | — | — | — | The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed t | 109d ago |
| CVE-2026-37149 | 7.7 | — | — | — | — | GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vuln | 110d ago |
| CVE-2026-9099 | 7.7 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 110d ago |
| CVE-2026-54033 | 7.7 | — | — | — | librechat / librechat | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. | 110d ago |
| CVE-2026-56054 | 7.7 | — | — | — | — | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | 110d ago |
| CVE-2026-8666 | 7.7 | — | — | — | rapid7 / insightconnect traceroute | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux all | 111d ago |
| CVE-2026-8665 | 7.7 | — | — | — | rapid7 / insightconnect translate | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remot | 111d ago |
| CVE-2026-8660 | 7.7 | — | — | — | rapid7 / insightconnect ping | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote a | 111d ago |
| CVE-2026-8592 | 7.7 | — | — | — | rapid7 / insightconnect awk | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows | 111d ago |
| CVE-2026-33235 | 7.7 | — | — | — | — | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence | 111d ago |
| CVE-2026-54699 | 7.7 | — | — | — | — | Warp is an agentic development environment. | 111d ago |
| CVE-2026-9710 | 7.7 | — | — | — | — | The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request | 111d ago |
| CVE-2026-9709 | 7.7 | — | — | — | — | The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, all | 111d ago |
| CVE-2026-54322 | 7.7 | — | — | — | — | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. | 112d ago |
| CVE-2026-54018 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 112d ago |
| CVE-2026-54304 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 112d ago |
| CVE-2026-49465 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 112d ago |
| CVE-2026-54313 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 112d ago |
| CVE-2026-54311 | 7.7 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 112d ago |
| CVE-2026-56268 | 7.7 | — | — | — | flowiseai / flowise | Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endp | 113d ago |
| CVE-2026-42129 | 7.7 | — | — | — | grafana / loki datasource | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Lok | 113d ago |
| CVE-2026-41156 | 7.7 | — | — | — | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement o | 116d ago |
| CVE-2026-34192 | 7.7 | — | — | — | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path l | 116d ago |
| CVE-2026-54017 | 7.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 117d ago |
| CVE-2026-32174 | 7.7 | — | — | — | microsoft / azure ai bot service | Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network. | 117d ago |
| CVE-2026-54193 | 7.7 | — | — | — | — | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. | 118d ago |
| CVE-2025-60223 | 7.7 | — | — | — | — | Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions. | 118d ago |
| CVE-2026-47684 | 7.7 | — | — | — | — | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. | 119d ago |
| CVE-2026-40779 | 7.7 | — | — | — | — | Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions. | 120d ago |
| CVE-2026-40727 | 7.7 | — | — | — | — | Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions. | 120d ago |
| CVE-2026-53833 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allow | 123d ago |
| CVE-2026-53832 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to | 123d ago |
| CVE-2026-46717 | 7.7 | — | — | — | — | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. | 123d ago |
| CVE-2026-47260 | 7.7 | — | — | — | — | Koel is a free, open-source music streaming solution. | 123d ago |
| CVE-2026-53812 | 7.7 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows auth | 124d ago |
| CVE-2026-50245 | 7.7 | — | — | — | — | Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authenticatio | 124d ago |
| CVE-2026-50005 | 7.7 | — | — | — | — | Brickcom cameras ship with default credentials that allows any unauthenticated remote attacker to silently access | 124d ago |
| CVE-2026-47170 | 7.7 | — | — | — | — | Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface | 124d ago |
| CVE-2026-44692 | 7.7 | — | — | — | — | Sharp is a content management framework built for Laravel as a package. | 125d ago |
| CVE-2026-50567 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 125d ago |
| CVE-2026-49823 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 125d ago |
| CVE-2026-49822 | 7.7 | — | — | — | — | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and | 125d ago |
