| CVE-2026-7831 | 7.6 | — | — | — | uvnc / ultravnc | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. | 104d ago |
| CVE-2026-56249 | 7.6 | — | — | — | — | Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows | 105d ago |
| CVE-2026-13449 | 7.6 | — | — | — | ibm / business automation manager | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injectio | 105d ago |
| CVE-2026-58376 | 7.6 | — | — | — | — | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated | 105d ago |
| CVE-2026-58056 | 7.6 | — | — | — | — | RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connectio | 107d ago |
| CVE-2026-57631 | 7.6 | — | — | — | — | Administrator SQL Injection in Popup box <= 6.0.1 versions. | 109d ago |
| CVE-2026-57628 | 7.6 | — | — | — | — | Administrator SQL Injection in WP All Import <= 4.0.1 versions. | 109d ago |
| CVE-2026-54826 | 7.6 | — | — | — | — | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. | 109d ago |
| CVE-2026-39951 | 7.6 | — | — | — | cacti / cacti | Cacti is an open source performance and fault management framework. | 110d ago |
| CVE-2026-11998 | 7.6 | — | — | — | — | A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URL | 111d ago |
| CVE-2026-55583 | 7.6 | — | — | — | — | Twenty is an open-source CRM (customer relationship management) platform. | 111d ago |
| CVE-2026-56231 | 7.6 | — | — | — | — | Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/: | 111d ago |
| CVE-2026-56052 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Fu | 111d ago |
| CVE-2026-54317 | 7.6 | — | — | — | home-assistant / home-assistant | Home Assistant is open source home automation software that puts local control and privacy first. | 112d ago |
| CVE-2026-54013 | 7.6 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 112d ago |
| CVE-2026-55409 | 7.6 | — | — | — | — | Filament is a collection of full-stack components for accelerated Laravel development. | 113d ago |
| CVE-2026-56239 | 7.6 | — | — | — | — | Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SE | 114d ago |
| CVE-2026-56208 | 7.6 | — | — | — | — | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. | 116d ago |
| CVE-2026-46699 | 7.6 | — | — | — | — | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services i | 117d ago |
| CVE-2026-55746 | 7.6 | — | — | — | — | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File S | 117d ago |
| CVE-2026-54804 | 7.6 | — | — | — | — | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | 118d ago |
| CVE-2026-39546 | 7.6 | — | — | — | — | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. | 118d ago |
| CVE-2026-35327 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 118d ago |
| CVE-2026-52712 | 7.6 | — | — | — | — | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. | 119d ago |
| CVE-2026-53705 | 7.6 | — | — | — | — | A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. | 120d ago |
| CVE-2026-6428 | 7.6 | — | — | — | — | SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.0 | 122d ago |
| CVE-2026-54056 | 7.6 | — | — | — | kovidgoyal / kitty | Kitty is a cross-platform GPU based terminal. | 123d ago |
| CVE-2026-45012 | 7.6 | — | — | — | — | ApostropheCMS is an open-source Node.js content management system. | 123d ago |
| CVE-2026-6961 | 7.6 | — | — | — | mattermost / mattermost server | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails t | 123d ago |
| CVE-2026-53981 | 7.6 | — | — | — | — | Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an a | 123d ago |
| CVE-2026-11774 | 7.6 | — | — | — | — | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). | 124d ago |
| CVE-2026-42558 | 7.6 | — | — | — | — | Xibo is an open source digital signage platform with a web content management system and Windows display player so | 125d ago |
| CVE-2026-20252 | 7.6 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 1 | 125d ago |
| CVE-2026-41003 | 7.6 | — | — | — | vmware / spring security | An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms g | 125d ago |
| CVE-2026-5068 | 7.6 | — | — | — | zephyrproject / zephyr | A remote, unauthenticated BLE peer can trigger a 2-byte out-of-bounds write in the Bluetooth host during L2CAP LE C | 126d ago |
| CVE-2026-41518 | 7.6 | — | — | — | — | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to cr | 131d ago |
| CVE-2026-41234 | 7.6 | — | — | — | — | Froxlor is open source server administration software. | 131d ago |
| CVE-2026-49771 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo | 131d ago |
| CVE-2025-15655 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla Sch | 132d ago |
| CVE-2019-25722 | 7.6 | — | — | — | — | Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext cre | 133d ago |
| CVE-2026-24782 | 7.6 | — | — | — | accellion / kiteworks | Kiteworks is a private data network (PDN). | 134d ago |
| CVE-2026-49374 | 7.6 | — | — | — | jetbrains / teamcity | In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters | 137d ago |
| CVE-2026-9809 | 7.6 | — | — | — | — | A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. | 137d ago |
| CVE-2026-46426 | 7.6 | — | — | — | — | Budibase is an open-source low-code platform. | 139d ago |
| CVE-2026-44680 | 7.6 | — | — | — | — | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. | 140d ago |
| CVE-2026-45082 | 7.6 | — | — | — | — | Karakeep is a elf-hostable bookmark-everything app. | 140d ago |
| CVE-2026-34207 | 7.6 | — | — | — | — | TypeBot is a chatbot builder tool. | 144d ago |
| CVE-2026-9047 | 7.6 | — | — | — | devolutions / devolutions server | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server a | 144d ago |
| CVE-2026-44068 | 7.6 | — | — | — | — | Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote | 145d ago |
| CVE-2026-9144 | 7.6 | — | — | — | — | Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the em | 146d ago |
| CVE-2026-5783 | 7.6 | — | — | — | — | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Compute | 146d ago |
| CVE-2026-42383 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH Wo | 146d ago |
| CVE-2026-33233 | 7.6 | — | — | — | — | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence | 147d ago |
| CVE-2026-6347 | 7.6 | — | — | — | mattermost / mattermost server | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuratio | 148d ago |
| CVE-2026-44555 | 7.6 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 151d ago |
| CVE-2026-46408 | 7.6 | — | — | — | — | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. | 151d ago |
| CVE-2026-46367 | 7.6 | — | — | — | — | phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authen | 151d ago |
| CVE-2026-44516 | 7.6 | — | — | — | — | Valtimo is an open-source business process automation platform. | 152d ago |
| CVE-2026-45225 | 7.6 | — | — | — | — | Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated u | 154d ago |
| CVE-2026-44166 | 7.6 | — | — | — | pocketbase / pocketbase | Pocketbase is an open source web backend written in go. | 154d ago |
