| CVE-2026-44446 | 8.8 | — | — | — | frappe / erpnext | ERPNext is a free and open source Enterprise Resource Planning tool. | 166d ago |
| CVE-2026-45229 | 8.8 | — | — | — | — | Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authent | 166d ago |
| CVE-2026-42550 | 8.8 | — | — | — | — | Flight is an extensible micro-framework for PHP. | 167d ago |
| CVE-2026-0259 | 8.8 | — | — | — | paloaltonetworks / pan-os | An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enab | 167d ago |
| CVE-2026-6281 | 8.8 | — | — | — | — | A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote auth | 167d ago |
| CVE-2026-44293 | 8.8 | — | — | — | protobufjs project / protobufjs | protobufjs compiles protobuf definitions into JavaScript (JS) functions. | 167d ago |
| CVE-2026-42266 | 8.8 | — | — | — | jupyter / jupyterlab | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook | 167d ago |
| CVE-2026-41957 | 8.8 | — | — | — | f5 / big-ip access policy manager | An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ C | 167d ago |
| CVE-2026-3425 | 8.8 | — | — | — | — | The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, a | 167d ago |
| CVE-2026-8053 | 8.8 | — | — | — | mongodb / mongodb | An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write | 167d ago |
| CVE-2026-42289 | 8.8 | — | — | — | — | ChurchCRM is an open-source church management system. | 167d ago |
| CVE-2026-45227 | 8.8 | — | — | — | — | Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenti | 167d ago |
| CVE-2026-42844 | 8.8 | — | — | — | getgrav / grav | Grav is a file-based Web platform. | 167d ago |
| CVE-2026-44224 | 8.8 | — | — | — | requarks / wiki.js | Wiki.js is an open source wiki app built on Node.js. | 167d ago |
| CVE-2026-7474 | 8.8 | — | — | — | — | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a p | 168d ago |
| CVE-2026-8429 | 8.8 | — | — | — | — | SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the private space that allows attack | 168d ago |
| CVE-2026-23819 | 8.8 | — | — | — | arubanetworks / arubaos | A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allo | 168d ago |
| CVE-2026-43892 | 8.8 | — | — | — | — | AntSword is a cross-platform website management toolkit. | 168d ago |
| CVE-2026-41613 | 8.8 | — | — | — | microsoft / visual studio code | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | 168d ago |
| CVE-2026-41109 | 8.8 | — | — | — | microsoft / visual studio code | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copil | 168d ago |
| CVE-2026-41094 | 8.8 | — | — | — | microsoft / data formulator | Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized atta | 168d ago |
| CVE-2026-41086 | 8.8 | — | — | — | microsoft / windows admin center | Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network | 168d ago |
| CVE-2026-40420 | 8.8 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | 168d ago |
| CVE-2026-40403 | 8.8 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally. | 168d ago |
| CVE-2026-40370 | 8.8 | — | — | — | microsoft / sql server 2016 | External control of file name or path in SQL Server allows an authorized attacker to execute code over a network. | 168d ago |
| CVE-2026-40365 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 168d ago |
| CVE-2026-40357 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 168d ago |
| CVE-2026-35439 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 168d ago |
| CVE-2026-35436 | 8.8 | — | — | — | microsoft / 365 apps | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | 168d ago |
| CVE-2026-34329 | 8.8 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adja | 168d ago |
| CVE-2026-33112 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 168d ago |
| CVE-2026-33110 | 8.8 | — | — | — | microsoft / sharepoint server | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove | 168d ago |
| CVE-2026-31232 | 8.8 | — | — | — | — | The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deser | 168d ago |
| CVE-2025-53844 | 8.8 | — | — | — | fortinet / fortios | A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS | 168d ago |
| CVE-2025-43524 | 8.8 | — | — | — | apple / macos | An access issue was addressed with additional sandbox restrictions. | 168d ago |
| CVE-2025-35990 | 8.8 | — | — | — | intel / endpoint management assistant | Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within | 168d ago |
| CVE-2026-31225 | 8.8 | — | — | — | — | The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing c | 168d ago |
| CVE-2026-31224 | 8.8 | — | — | — | snorkel / snorkel | The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClas | 168d ago |
| CVE-2026-31223 | 8.8 | — | — | — | snorkel / snorkel | The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseL | 168d ago |
| CVE-2026-31222 | 8.8 | — | — | — | snorkel / snorkel | The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load( | 168d ago |
| CVE-2026-31219 | 8.8 | — | — | — | — | The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481 | 168d ago |
| CVE-2026-31218 | 8.8 | — | — | — | — | The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481 | 168d ago |
| CVE-2026-30810 | 8.8 | — | — | — | artica / pandora fms | Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. | 168d ago |
| CVE-2026-30807 | 8.8 | — | — | — | artica / pandora fms | Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. | 168d ago |
| CVE-2026-8111 | 8.8 | — | — | — | ivanti / endpoint manager | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated a | 168d ago |
| CVE-2026-43937 | 8.8 | — | — | — | — | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. | 168d ago |
| CVE-2026-8389 | 8.8 | — | — | — | mozilla / firefox | JIT miscompilation in the JavaScript Engine: JIT component. | 168d ago |
| CVE-2026-2465 | 8.8 | — | — | — | — | Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Indust | 168d ago |
| CVE-2026-6001 | 8.8 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. | 168d ago |
| CVE-2026-7256 | 8.8 | — | — | — | zyxel / wre6505 firmware | ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware v | 168d ago |
| CVE-2026-41489 | 8.8 | — | — | — | — | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. | 168d ago |
| CVE-2026-28995 | 8.8 | — | — | — | apple / ipados | A logic issue was addressed with improved restrictions. | 168d ago |
| CVE-2026-28978 | 8.8 | — | — | — | apple / macos | A permissions issue was addressed with additional restrictions. | 168d ago |
| CVE-2026-28955 | 8.8 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 168d ago |
| CVE-2026-28947 | 8.8 | — | — | — | apple / ipados | A use-after-free issue was addressed with improved memory management. | 168d ago |
| CVE-2026-28940 | 8.8 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 168d ago |
| CVE-2026-28923 | 8.8 | — | — | — | apple / macos | A logging issue was addressed with improved data redaction. | 168d ago |
| CVE-2026-28847 | 8.8 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 168d ago |
| CVE-2026-36734 | 8.8 | — | — | — | — | EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. | 169d ago |
| CVE-2026-45223 | 8.8 | — | — | — | — | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification pa | 169d ago |
