| CVE-2026-8970 | 8.8 | — | — | — | mozilla / firefox | Privilege escalation in the Security component. | 161d ago |
| CVE-2026-8957 | 8.8 | — | — | — | mozilla / firefox | Privilege escalation in the Enterprise Policies component. | 161d ago |
| CVE-2026-8955 | 8.8 | — | — | — | mozilla / firefox | Privilege escalation in the DOM: Workers component. | 161d ago |
| CVE-2026-8952 | 8.8 | — | — | — | mozilla / firefox | Privilege escalation in the Application Update component. | 161d ago |
| CVE-2026-42097 | 8.8 | — | — | — | sparxsystems / pro cloud server | Sparx Pro Cloud Server requires authentication based on requested URL. | 161d ago |
| CVE-2026-42096 | 8.8 | — | — | — | sparxsystems / pro cloud server | Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. | 161d ago |
| CVE-2026-46586 | 8.8 | — | — | — | apache / ofbiz | Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Ev | 161d ago |
| CVE-2026-27648 | 8.8 | — | — | — | — | in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. | 161d ago |
| CVE-2026-45495 | 8.8 | — | — | — | microsoft / edge chromium | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 162d ago |
| CVE-2026-41085 | 8.8 | — | — | — | — | Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow a | 162d ago |
| CVE-2025-57282 | 8.8 | — | — | — | — | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. | 162d ago |
| CVE-2026-7498 | 8.8 | — | — | — | — | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Basamak Infor | 162d ago |
| CVE-2026-3220 | 8.8 | — | — | — | — | The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPr | 162d ago |
| CVE-2026-8776 | 8.8 | — | — | — | — | A vulnerability has been found in Edimax BR-6428NS 1.10. | 162d ago |
| CVE-2026-8775 | 8.8 | — | — | — | — | A flaw has been found in Edimax BR-6428NS 1.10. | 162d ago |
| CVE-2026-8719 | 8.8 | — | — | — | — | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escal | 163d ago |
| CVE-2021-47979 | 8.8 | — | — | — | — | WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authentica | 164d ago |
| CVE-2021-47976 | 8.8 | — | — | — | — | TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to up | 164d ago |
| CVE-2020-37227 | 8.8 | — | — | — | — | HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to byp | 164d ago |
| CVE-2026-45672 | 8.8 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 164d ago |
| CVE-2021-47964 | 8.8 | — | — | — | — | Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute a | 165d ago |
| CVE-2026-45035 | 8.8 | — | — | — | tabby / tabby | Tabby (formerly Terminus) is a highly configurable terminal emulator. | 165d ago |
| CVE-2026-6228exploited | 8.8 | 0.44% | 1/3 | +151d | — | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and i | 165d ago |
| CVE-2026-43490 | 8.8 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate inherited ACE SID length smb_i | 165d ago |
| CVE-2026-8587 | 8.8 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a us | 166d ago |
| CVE-2026-8581 | 8.8 | — | — | — | google / chrome | Use after free in GPU in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code | 166d ago |
| CVE-2026-8577 | 8.8 | — | — | — | google / chrome | Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary c | 166d ago |
| CVE-2026-8558 | 8.8 | — | — | — | google / chrome | Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrar | 166d ago |
| CVE-2026-8555 | 8.8 | — | — | — | google / chrome | Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbi | 166d ago |
| CVE-2026-8551 | 8.8 | — | — | — | google / chrome | Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user | 166d ago |
| CVE-2026-8549 | 8.8 | — | — | — | google / chrome | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary cod | 166d ago |
| CVE-2026-8544 | 8.8 | — | — | — | google / chrome | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary cod | 166d ago |
| CVE-2026-8540 | 8.8 | — | — | — | google / chrome | Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code i | 166d ago |
| CVE-2026-8532 | 8.8 | — | — | — | google / chrome | Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary cod | 166d ago |
| CVE-2026-8531 | 8.8 | — | — | — | google / chrome | Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to pote | 166d ago |
| CVE-2026-8529 | 8.8 | — | — | — | google / chrome | Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitr | 166d ago |
| CVE-2026-8527 | 8.8 | — | — | — | google / chrome | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 148.0.7778.168 allowed a remote a | 166d ago |
| CVE-2026-8526 | 8.8 | — | — | — | google / chrome | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitra | 166d ago |
| CVE-2026-8524 | 8.8 | — | — | — | google / chrome | Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbit | 166d ago |
| CVE-2026-8522 | 8.8 | — | — | — | google / chrome | Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to execute ar | 166d ago |
| CVE-2026-8519 | 8.8 | — | — | — | google / chrome | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform | 166d ago |
| CVE-2026-8518 | 8.8 | — | — | — | google / chrome | Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary cod | 166d ago |
| CVE-2026-8517 | 8.8 | — | — | — | google / chrome | Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who co | 166d ago |
| CVE-2026-8509 | 8.8 | — | — | — | google / chrome | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitra | 166d ago |
| CVE-2026-43909 | 8.8 | — | — | — | openimageio / openimageio | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to V | 166d ago |
| CVE-2026-43908 | 8.8 | — | — | — | openimageio / openimageio | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to V | 166d ago |
| CVE-2026-8621 | 8.8 | — | — | — | — | Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that allows non-admin shared-token callers | 166d ago |
| CVE-2025-15024 | 8.8 | — | — | — | — | Improper Control of Generation of Code ('Code Injection') vulnerability in Yordam Information Technology Consultin | 166d ago |
| CVE-2025-15023 | 8.8 | — | — | — | — | Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems | 166d ago |
| CVE-2026-44827 | 8.8 | — | — | — | huggingface / diffusers | Diffusers is the a library for pretrained diffusion models. | 166d ago |
| CVE-2026-44513 | 8.8 | — | — | — | huggingface / diffusers | Diffusers is the a library for pretrained diffusion models. | 166d ago |
| CVE-2026-42559 | 8.8 | — | — | — | — | RMCP is an official Rust SDK for the Model Context Protocol. | 166d ago |
| CVE-2026-6637 | 8.8 | — | — | — | postgresql / postgresql | Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code | 166d ago |
| CVE-2026-6477 | 8.8 | — | — | — | postgresql / postgresql | Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo | 166d ago |
| CVE-2026-6475 | 8.8 | — | — | — | postgresql / postgresql | Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite | 166d ago |
| CVE-2026-6473 | 8.8 | — | — | — | postgresql / postgresql | Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server | 166d ago |
| CVE-2025-15025 | 8.8 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Traini | 166d ago |
| CVE-2025-12008 | 8.8 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc. | 166d ago |
| CVE-2026-6506 | 8.8 | — | — | — | — | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, | 166d ago |
| CVE-2026-44447 | 8.8 | — | — | — | frappe / erpnext | ERPNext is a free and open source Enterprise Resource Planning tool. | 166d ago |
