| CVE-2026-45213 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 B | 154d ago |
| CVE-2026-33650 | 7.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 204d ago |
| CVE-2026-33354 | 7.6 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 204d ago |
| CVE-2026-32055 | 7.6 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that | 206d ago |
| CVE-2026-32318 | 7.6 | — | — | — | cryptomator / cryptomator | Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. | 207d ago |
| CVE-2026-32317 | 7.6 | — | — | — | cryptomator / cryptomator | Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. | 207d ago |
| CVE-2026-32303 | 7.6 | — | — | — | cryptomator / cryptomator | Cryptomator encrypts data being stored on cloud infrastructure. | 207d ago |
| CVE-2026-33321 | 7.6 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 208d ago |
| CVE-2026-32749 | 7.6 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 208d ago |
| CVE-2024-42210 | 7.6 | — | — | — | hcltech / unica | A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. | 208d ago |
| CVE-2026-32728 | 7.6 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 209d ago |
| CVE-2026-32692 | 7.6 | — | — | — | canonical / juju | An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through | 209d ago |
| CVE-2026-32606 | 7.6 | — | — | — | — | IncusOS is an immutable OS image dedicated to running Incus. | 209d ago |
| CVE-2026-22181 | 7.6 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allo | 209d ago |
| CVE-2026-2476 | 7.6 | — | — | — | mattermost / ms teams | Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker | 211d ago |
| CVE-2026-32459 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart Upse | 214d ago |
| CVE-2026-32458 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 W | 214d ago |
| CVE-2026-32418 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow M | 214d ago |
| CVE-2026-32358 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Bo | 214d ago |
| CVE-2026-32308 | 7.6 | — | — | — | hackerbay / oneuptime | OneUptime is a solution for monitoring and managing online services. | 214d ago |
| CVE-2026-31944 | 7.6 | — | — | — | librechat / librechat | LibreChat is a ChatGPT clone with additional features. | 214d ago |
| CVE-2026-32117 | 7.6 | — | — | — | ekacnet / grafanacubism-panel | The grafanacubism-panel plugin allows use of cubism.js in Grafana. | 216d ago |
| CVE-2026-32101 | 7.6 | — | — | — | studiocms / studiocms | StudioCMS is a server-side-rendered, Astro native, headless content management system. | 216d ago |
| CVE-2026-86173 | 7.5 | — | — | — | — | MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows | 38d ago |
| CVE-2026-52770 | 7.5 | — | — | — | — | YesWiki is a wiki system written in PHP. | 38d ago |
| CVE-2026-85786 | 7.5 | — | — | — | — | Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause | 39d ago |
| CVE-2026-61686 | 7.5 | — | — | — | — | SolidInvoice is an open-source invoicing platform. | 39d ago |
| CVE-2026-19534 | 7.5 | — | — | — | — | undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds wi | 39d ago |
| CVE-2021-44320 | 7.5 | — | — | — | — | Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. | 39d ago |
| CVE-2026-19300 | 7.5 | — | — | — | — | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incompl | 39d ago |
| CVE-2026-85699 | 7.5 | — | — | — | — | jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the | 39d ago |
| CVE-2026-85691 | 7.5 | — | — | — | — | MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoin | 39d ago |
| CVE-2026-85687 | 7.5 | — | — | — | — | surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, | 39d ago |
| CVE-2026-85686 | 7.5 | — | — | — | — | ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that | 39d ago |
| CVE-2026-85685 | 7.5 | — | — | — | — | AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arb | 39d ago |
| CVE-2026-85675 | 7.5 | — | — | — | — | OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_conte | 39d ago |
| CVE-2026-85673 | 7.5 | — | — | — | — | LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media U | 39d ago |
| CVE-2026-85671 | 7.5 | — | — | — | — | QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/ | 39d ago |
| CVE-2026-85668 | 7.5 | — | — | — | — | Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in t | 39d ago |
| CVE-2026-85666 | 7.5 | — | — | — | — | OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vul | 39d ago |
| CVE-2026-85664 | 7.5 | — | — | — | — | Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_sear | 39d ago |
| CVE-2026-85626 | 7.5 | — | — | — | — | git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, gi | 39d ago |
| CVE-2026-85619 | 7.5 | — | — | — | — | AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization check | 39d ago |
| CVE-2026-85608 | 7.5 | — | — | — | — | Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download | 39d ago |
| CVE-2026-85606 | 7.5 | — | — | — | — | firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that a | 39d ago |
| CVE-2026-19205 | 7.5 | — | — | — | — | Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. | 39d ago |
| CVE-2026-12483 | 7.5 | — | — | — | — | The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and includ | 39d ago |
| CVE-2026-85612 | 7.5 | — | — | — | — | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon | 39d ago |
| CVE-2026-85609 | 7.5 | — | — | — | — | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in t | 39d ago |
| CVE-2026-85585 | 7.5 | — | — | — | — | SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middlewar | 39d ago |
| CVE-2026-85584 | 7.5 | — | — | — | — | SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle | 39d ago |
| CVE-2026-85581 | 7.5 | — | — | — | — | SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint | 39d ago |
| CVE-2026-19080 | 7.5 | — | — | — | — | Observable response discrepancy vulnerability in Menulux Software Inc. | 39d ago |
| CVE-2026-84428 | 7.5 | — | — | — | — | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in | 39d ago |
| CVE-2026-84469 | 7.5 | — | — | — | — | fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON | 39d ago |
| CVE-2026-76169 | 7.5 | — | — | — | — | fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom n | 39d ago |
| CVE-2026-81665 | 7.5 | — | — | — | — | A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. | 39d ago |
| CVE-2026-81270 | 7.5 | — | — | — | — | Apache Allura: exposure of non-public information via search. | 39d ago |
| CVE-2026-66840 | 7.5 | — | — | — | — | XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) | 39d ago |
| CVE-2026-85505 | 7.5 | — | — | — | — | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text | 39d ago |
