| CVE-2026-1463 | 8.8 | — | — | — | — | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File | 223d ago |
| CVE-2026-33001 | 8.8 | — | — | — | jenkins / jenkins | Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of | 223d ago |
| CVE-2025-55044 | 8.8 | — | — | — | murasoftware / mura cms | The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from t | 223d ago |
| CVE-2025-55040 | 8.8 | — | — | — | murasoftware / mura cms | The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious for | 223d ago |
| CVE-2026-32693 | 8.8 | — | — | — | canonical / juju | In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, | 223d ago |
| CVE-2026-23246 | 8.8 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80 | 223d ago |
| CVE-2026-22730 | 8.8 | — | — | — | vmware / spring ai | A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass | 223d ago |
| CVE-2026-29056 | 8.8 | — | — | — | kanboard / kanboard | Kanboard is project management software focused on Kanban methodology. | 223d ago |
| CVE-2026-27894 | 8.8 | — | — | — | ldap-account-manager / ldap account manager | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. | 223d ago |
| CVE-2026-27811 | 8.8 | — | — | — | roxy-wi / roxy-wi | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. | 223d ago |
| CVE-2026-4148 | 8.8 | — | — | — | mongodb / mongodb | A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who | 224d ago |
| CVE-2026-4318 | 8.8 | — | — | — | — | A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. | 224d ago |
| CVE-2026-4208 | 8.8 | — | — | — | mrsilaz / mfa mail | The extension fails to properly reset the generated MFA code after successful authentication. | 224d ago |
| CVE-2026-1323 | 8.8 | — | — | — | cps-it / mailqueue | The extension fails to properly define allowed classes used when deserializing transport failure metadata. | 224d ago |
| CVE-2025-50881 | 8.8 | — | — | — | — | The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote C | 225d ago |
| CVE-2026-30881 | 8.8 | — | — | — | chamilo / chamilo lms | Chamilo LMS is a learning management system. | 225d ago |
| CVE-2026-30875 | 8.8 | — | — | — | chamilo / chamilo lms | Chamilo LMS is a learning management system. | 225d ago |
| CVE-2025-69784 | 8.8 | — | — | — | xcitium / openedr | A local, non-privileged attacker can abuse a vulnerable IOCTL interface exposed by the OpenEDR 2.5.1.0 kernel driv | 225d ago |
| CVE-2026-4227 | 8.8 | — | — | — | lb-link / bl-wr9000 firmware | A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. | 225d ago |
| CVE-2026-4226 | 8.8 | — | — | — | lb-link / bl-wr9000 firmware | A weakness has been identified in LB-LINK BL-WR9000 2.4.9. | 225d ago |
| CVE-2026-4214 | 8.8 | — | — | — | dlink / dnr-202l firmware | A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-3 | 225d ago |
| CVE-2026-4213 | 8.8 | — | — | — | dlink / dnr-202l firmware | A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L | 225d ago |
| CVE-2026-4212 | 8.8 | — | — | — | dlink / dnr-202l firmware | A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS | 225d ago |
| CVE-2026-4211 | 8.8 | — | — | — | dlink / dnr-202l firmware | A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-32 | 225d ago |
| CVE-2026-4188 | 8.8 | — | — | — | — | A security flaw has been discovered in D-Link DIR-619L 2.06B01. | 225d ago |
| CVE-2026-4167 | 8.8 | — | — | — | — | A vulnerability was determined in Belkin F9K1122 1.00.33. | 225d ago |
| CVE-2026-3838 | 8.8 | — | — | — | unraid / unraid | Unraid Update Request Path Traversal Remote Code Execution Vulnerability. | 225d ago |
| CVE-2026-3562 | 8.8 | — | — | — | philips / hue bridge v2 firmware | Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability. | 225d ago |
| CVE-2026-3560 | 8.8 | — | — | — | philips / hue bridge v2 firmware | Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability. | 225d ago |
| CVE-2026-3556 | 8.8 | — | — | — | philips / hue bridge v2 firmware | Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability. | 225d ago |
| CVE-2026-3085 | 8.8 | — | — | — | gstreamer / gstreamer | GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. | 225d ago |
| CVE-2026-3083 | 8.8 | — | — | — | gstreamer / gstreamer | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability. | 225d ago |
| CVE-2026-3023 | 8.8 | — | — | — | wakyma / wakyma | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 've | 225d ago |
| CVE-2026-32628 | 8.8 | — | — | — | mintplexlabs / anythingllm | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during | 225d ago |
| CVE-2026-28519 | 8.8 | — | — | — | tuya / arduino-tuyaopen | arduino-TuyaOpen before version 1.2.1 contains a heap-based buffer overflow vulnerability in the DnsServer compone | 225d ago |
| CVE-2025-69240 | 8.8 | — | — | — | raytha / raytha | Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. | 225d ago |
| CVE-2025-54920 | 8.8 | — | — | — | apache / spark | This issue affects Apache Spark: before 3.5.7 and 4.0.1. | 225d ago |
| CVE-2025-15540 | 8.8 | — | — | — | raytha / raytha | "Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. | 225d ago |
| CVE-2025-14287 | 8.8 | — | — | — | lfprojects / mlflow | A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sage | 225d ago |
| CVE-2016-20034 | 8.8 | — | — | — | wowza / streaming engine | Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only use | 225d ago |
| CVE-2016-20025 | 8.8 | — | — | — | — | ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated u | 225d ago |
| CVE-2026-4092 | 8.8 | — | — | — | google / clasp | Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a | 228d ago |
| CVE-2026-3999 | 8.8 | — | — | — | pointsharp / id server | A broken access control may allow an authenticated user to perform a horizontal privilege escalation. | 228d ago |
| CVE-2026-3910zero day | 8.8 | 2.7% | 3/3 | 1d before | google / chrome | Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arb | 228d ago |
| CVE-2026-3909zero day | 8.8 | 2.3% | 3/3 | 1d before | google / chrome | Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bou | 228d ago |
| CVE-2026-32355 | 8.8 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Object Injection.This is | 228d ago |
| CVE-2026-25817 | 8.8 | — | — | — | — | HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmw | 228d ago |
| CVE-2026-3841 | 8.8 | — | — | — | tp-link / tl-mr6400 firmware | A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR64 | 229d ago |
| CVE-2026-32140 | 8.8 | — | — | — | dataease / dataease | Dataease is an open source data visualization analysis tool. | 229d ago |
| CVE-2026-32137 | 8.8 | — | — | — | dataease / dataease | Dataease is an open source data visualization analysis tool. | 229d ago |
| CVE-2026-26794 | 8.8 | — | — | — | gl-inet / ar300m16 firmware | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. | 229d ago |
| CVE-2026-21672 | 8.8 | — | — | — | — | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. | 229d ago |
| CVE-2026-4043 | 8.8 | — | — | — | tenda / i12 firmware | A security vulnerability has been detected in Tenda i12 1.0.0.6(2204). | 229d ago |
| CVE-2026-4042 | 8.8 | — | — | — | tenda / i12 firmware | A weakness has been identified in Tenda i12 1.0.0.6(2204). | 229d ago |
| CVE-2026-4041 | 8.8 | — | — | — | tenda / i12 firmware | A security flaw has been discovered in Tenda i12 1.0.0.6(2204). | 229d ago |
| CVE-2026-21668 | 8.8 | — | — | — | veeam / veeam backup \& replication | A vulnerability allowing an authenticated domain user to bypass restrictions and manipulate arbitrary files on a B | 229d ago |
| CVE-2026-4008 | 8.8 | — | — | — | tenda / w3 firmware | A flaw has been found in Tenda W3 1.0.0.3(2204). | 229d ago |
| CVE-2026-4007 | 8.8 | — | — | — | tenda / w3 firmware | A vulnerability was detected in Tenda W3 1.0.0.3(2204). | 229d ago |
| CVE-2026-3978 | 8.8 | — | — | — | dlink / dir-513 firmware | A vulnerability was detected in D-Link DIR-513 1.10. | 229d ago |
| CVE-2026-3976 | 8.8 | — | — | — | tenda / w3 firmware | A weakness has been identified in Tenda W3 1.0.0.3(2204). | 229d ago |
