| CVE-2026-45006 | 8.8 | — | — | — | openclaw / openclaw | OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and | 169d ago |
| CVE-2026-42843 | 8.8 | — | — | — | getgrav / grav-plugin-api | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, co | 169d ago |
| CVE-2026-42603 | 8.8 | — | — | — | — | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, | 169d ago |
| CVE-2026-7816 | 8.8 | — | — | — | pgadmin / pgadmin 4 | OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. | 169d ago |
| CVE-2026-7815 | 8.8 | — | — | — | pgadmin / pgadmin 4 | SQL injection vulnerability in pgAdmin 4 Maintenance Tool. | 169d ago |
| CVE-2026-8260 | 8.8 | — | — | — | dlink / dcs-935l firmware | A vulnerability was found in D-Link DCS-935L up to 1.10.01. | 169d ago |
| CVE-2022-50944 | 8.8 | — | — | — | — | Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrar | 170d ago |
| CVE-2021-47949 | 8.8 | — | — | — | — | CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary fi | 170d ago |
| CVE-2021-47943 | 8.8 | — | — | — | — | TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execut | 170d ago |
| CVE-2021-47939 | 8.8 | — | — | — | — | Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module cre | 170d ago |
| CVE-2021-47938 | 8.8 | — | — | — | — | ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that all | 170d ago |
| CVE-2021-47937 | 8.8 | — | — | — | — | e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installat | 170d ago |
| CVE-2021-47935 | 8.8 | — | — | — | sentry / sentry | Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitr | 170d ago |
| CVE-2026-8234 | 8.8 | — | — | — | — | A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. | 170d ago |
| CVE-2026-30932 | 8.8 | — | — | — | froxlor / froxlor | Froxlor is open source server administration software. | 217d ago |
| CVE-2026-33336 | 8.8 | — | — | — | vikunja / vikunja | Vikunja is an open-source self-hosted task management platform. | 217d ago |
| CVE-2026-29839 | 8.8 | — | — | — | dedecms / dedecms | DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php. | 217d ago |
| CVE-2026-33310 | 8.8 | — | — | — | intake / intake | Intake is a package for finding, investigating, loading and disseminating data. | 217d ago |
| CVE-2026-4722 | 8.8 | — | — | — | mozilla / firefox | Privilege escalation in the IPC component. | 217d ago |
| CVE-2019-25647 | 8.8 | — | — | — | phreesoft / phreebookserp | PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated | 217d ago |
| CVE-2019-25630 | 8.8 | — | — | — | phreesoft / phreebookserp | PhreeBooks ERP 5.2.3 contains an arbitrary file upload vulnerability in the Image Manager component that allows au | 217d ago |
| CVE-2025-41660 | 8.8 | — | — | — | — | A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system | 217d ago |
| CVE-2026-33854 | 8.8 | — | — | — | molotovcherry / android-imagemagick7 | Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: b | 217d ago |
| CVE-2026-33849 | 8.8 | — | — | — | linkingvision / rapidvms | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.Th | 217d ago |
| CVE-2026-33848 | 8.8 | — | — | — | linkingvision / rapidvms | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in linkingvision rapidvms.Th | 217d ago |
| CVE-2026-4639 | 8.8 | — | — | — | gss / vitalsesp | Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticate | 217d ago |
| CVE-2026-4680 | 8.8 | — | — | — | google / chrome | Use after free in FedCM in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary cod | 217d ago |
| CVE-2026-4679 | 8.8 | — | — | — | google / chrome | Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of b | 217d ago |
| CVE-2026-4678 | 8.8 | — | — | — | google / chrome | Use after free in WebGPU in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to execute arbitrary co | 217d ago |
| CVE-2026-4677 | 8.8 | — | — | — | google / chrome | Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perf | 217d ago |
| CVE-2026-4676 | 8.8 | — | — | — | google / chrome | Use after free in Dawn in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to potentially perform a | 217d ago |
| CVE-2026-4675 | 8.8 | — | — | — | google / chrome | Heap buffer overflow in WebGL in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out | 217d ago |
| CVE-2026-4674 | 8.8 | — | — | — | google / chrome | Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of boun | 217d ago |
| CVE-2026-4673 | 8.8 | — | — | — | google / chrome | Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an o | 217d ago |
| CVE-2026-3533 | 8.8 | — | — | — | — | The Jupiter X Core plugin for WordPress is vulnerable to limited file uploads due to missing authorization on impor | 217d ago |
| CVE-2026-33046 | 8.8 | — | — | — | cern / indico | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. | 217d ago |
| CVE-2026-33634zero day | 8.8 | 59.7% | 3/3 | same day | aquasec / setup-trivy | Trivy is a security scanner. | 217d ago |
| CVE-2026-32276 | 8.8 | — | — | — | opensource-workshop / connect-cms | Connect-CMS is a content management system. | 217d ago |
| CVE-2025-60947 | 8.8 | — | — | — | csprousers / csweb | Census CSWeb 8.0.1 allows arbitrary file upload. | 217d ago |
| CVE-2025-60946 | 8.8 | — | — | — | csprousers / csweb | Census CSWeb 8.0.1 allows arbitrary file path input. | 217d ago |
| CVE-2026-23480 | 8.8 | — | — | — | blinko / blinko | Blinko is an AI-powered card note-taking project. | 218d ago |
| CVE-2026-33717 | 8.8 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 218d ago |
| CVE-2026-33648 | 8.8 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 218d ago |
| CVE-2026-33647 | 8.8 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 218d ago |
| CVE-2026-33507 | 8.8 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 218d ago |
| CVE-2026-24516 | 8.8 | — | — | — | — | A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. | 218d ago |
| CVE-2026-33479 | 8.8 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 218d ago |
| CVE-2026-31847 | 8.8 | — | — | — | nexxtsolutions / nebula300plus firmware | Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 1 | 218d ago |
| CVE-2026-4566 | 8.8 | — | — | — | belkin / f9k1122 firmware | A flaw has been found in Belkin F9K1122 1.00.33. | 218d ago |
| CVE-2026-4565 | 8.8 | — | — | — | tenda / ac21 firmware | A vulnerability was detected in Tenda AC21 16.03.08.16. | 218d ago |
| CVE-2026-4558 | 8.8 | — | — | — | linksys / mr9600 firmware | A flaw has been found in Linksys MR9600 2.0.6.206937. | 219d ago |
| CVE-2026-4555 | 8.8 | — | — | — | dlink / dir-513 firmware | A weakness has been identified in D-Link DIR-513 1.10. | 219d ago |
| CVE-2026-4553 | 8.8 | — | — | — | tenda / f453 firmware | A vulnerability was identified in Tenda F453 1.0.0.3. | 219d ago |
| CVE-2026-4552 | 8.8 | — | — | — | tenda / f453 firmware | A vulnerability was determined in Tenda F453 1.0.0.3. | 219d ago |
| CVE-2026-4551 | 8.8 | — | — | — | tenda / f453 firmware | A vulnerability was found in Tenda F453 1.0.0.3. | 219d ago |
| CVE-2026-4535 | 8.8 | — | — | — | tenda / fh451 firmware | A vulnerability has been found in Tenda FH451 1.0.0.9. | 219d ago |
| CVE-2026-4534 | 8.8 | — | — | — | tenda / fh451 firmware | A flaw has been found in Tenda FH451 1.0.0.9. | 219d ago |
| CVE-2026-4314 | 8.8 | — | — | — | — | The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in al | 219d ago |
| CVE-2026-4529 | 8.8 | — | — | — | dlink / dhp-1320 firmware | A vulnerability was identified in D-Link DHP-1320 1.00WWB04. | 219d ago |
| CVE-2026-4261 | 8.8 | — | — | — | — | The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1 | 220d ago |
