| CVE-2026-44552 | 8.7 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 165d ago |
| CVE-2026-7481 | 8.7 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, a | 166d ago |
| CVE-2026-7377 | 8.7 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, a | 166d ago |
| CVE-2026-6073 | 8.7 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, a | 166d ago |
| CVE-2026-33583 | 8.7 | — | — | — | — | Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys v | 167d ago |
| CVE-2026-0240 | 8.7 | — | — | — | paloaltonetworks / trust protection foundation | An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain | 167d ago |
| CVE-2026-44295 | 8.7 | — | — | — | protobufjs project / protobufjs-cli | protobufjs-cli is the command line add-on for protobuf.js. | 167d ago |
| CVE-2026-42930 | 8.7 | — | — | — | f5 / big-ip access policy manager | When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass | 167d ago |
| CVE-2026-42924 | 8.7 | — | — | — | f5 / big-ip access policy manager | An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration obje | 167d ago |
| CVE-2026-42406 | 8.7 | — | — | — | f5 / big-ip access policy manager | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at leas | 167d ago |
| CVE-2026-41953 | 8.7 | — | — | — | f5 / big-ip access policy manager | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resou | 167d ago |
| CVE-2026-40698 | 8.7 | — | — | — | f5 / big-ip access policy manager | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at leas | 167d ago |
| CVE-2026-40631 | 8.7 | — | — | — | f5 / big-ip access policy manager | An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects t | 167d ago |
| CVE-2026-40061 | 8.7 | — | — | — | f5 / big-ip domain name system | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh | 167d ago |
| CVE-2026-34176 | 8.7 | — | — | — | f5 / big-ip access policy manager | When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed i | 167d ago |
| CVE-2026-32673 | 8.7 | — | — | — | f5 / big-ip access policy manager | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Admi | 167d ago |
| CVE-2026-32643 | 8.7 | — | — | — | f5 / big-ip access policy manager | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at leas | 167d ago |
| CVE-2026-34686 | 8.7 | — | — | — | adobe / commerce | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected | 168d ago |
| CVE-2026-34653 | 8.7 | — | — | — | adobe / commerce | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected | 168d ago |
| CVE-2026-45392 | 8.7 | — | — | — | — | DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary J | 168d ago |
| CVE-2026-43912 | 8.7 | — | — | — | dani-garcia / vaultwarden | Vaultwarden is a Bitwarden-compatible server written in Rust. | 169d ago |
| CVE-2026-43888 | 8.7 | — | — | — | — | Outline is a service that allows for collaborative documentation. | 169d ago |
| CVE-2026-32277 | 8.7 | — | — | — | opensource-workshop / connect-cms | Connect-CMS is a content management system. | 218d ago |
| CVE-2026-4601 | 8.7 | — | — | — | kjur / jsrsasign | Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DS | 218d ago |
| CVE-2026-33226 | 8.7 | — | — | — | budibase / budibase | Budibase is a low code platform for creating internal tools, workflows, and admin panels. | 221d ago |
| CVE-2026-33172 | 8.7 | — | — | — | statamic / statamic | Statamic is a Laravel and Git powered content management system (CMS). | 221d ago |
| CVE-2026-33346 | 8.7 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 222d ago |
| CVE-2026-32627 | 8.7 | — | — | — | yhirose / cpp-httplib | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. | 225d ago |
| CVE-2026-1090 | 8.7 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, | 230d ago |
| CVE-2026-86119 | 8.6 | — | — | — | — | Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, | 52d ago |
| CVE-2026-19305 | 8.6 | — | — | — | — | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server- | 53d ago |
| CVE-2026-85620 | 8.6 | — | — | — | — | Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not appli | 53d ago |
| CVE-2026-85614 | 8.6 | — | — | — | — | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/sit | 53d ago |
| CVE-2026-63219zero day | 8.6 | 0.47% | 2/3 | 1d before | — | GeoNetwork is a catalog application to manage spatially referenced resources. | 54d ago |
| CVE-2026-20276 | 8.6 | — | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software enginee | 55d ago |
| CVE-2024-35585 | 8.6 | — | — | — | — | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. | 55d ago |
| CVE-2026-84700 | 8.6 | — | — | — | — | PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus | 56d ago |
| CVE-2026-73706 | 8.6 | — | — | — | arubanetworks / fabric composer | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to obt | 56d ago |
| CVE-2026-81889 | 8.6 | — | — | — | — | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. | 57d ago |
| CVE-2026-82645 | 8.6 | — | — | — | — | AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restrea | 58d ago |
| CVE-2026-82641 | 8.6 | — | — | — | — | Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces | 58d ago |
| CVE-2026-16061 | 8.6 | — | — | — | — | The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of | 59d ago |
| CVE-2026-55848 | 8.6 | — | — | — | — | mapfish-print is a component of MapFish for printing templated cartographic maps. | 60d ago |
| CVE-2026-82286 | 8.6 | — | — | — | — | gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing una | 60d ago |
| CVE-2026-80590 | 8.6 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments be | 60d ago |
| CVE-2026-81093 | 8.6 | — | — | — | — | The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. | 61d ago |
| CVE-2026-81091 | 8.6 | — | — | — | — | The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. | 61d ago |
| CVE-2026-81573 | 8.6 | — | — | — | — | If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not en | 61d ago |
| CVE-2026-27330 | 8.6 | — | — | — | — | Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. | 61d ago |
| CVE-2026-54511 | 8.6 | — | — | — | — | LogTape is an unobtrusive logging library. | 62d ago |
| CVE-2026-55539 | 8.6 | — | — | — | — | PraisonAI is a multi-agent teams system. | 63d ago |
| CVE-2022-50999 | 8.6 | — | — | — | nokogiri / nokogiri | Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling func | 63d ago |
| CVE-2026-55534 | 8.6 | — | — | — | — | PraisonAI is a multi-agent teams system. | 63d ago |
| CVE-2026-63587 | 8.6 | — | — | — | — | The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Passwo | 63d ago |
| CVE-2026-78284 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions. | 64d ago |
| CVE-2026-32477 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 version | 64d ago |
| CVE-2026-28171 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions. | 64d ago |
| CVE-2026-34741 | 8.6 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 67d ago |
| CVE-2026-75932 | 8.6 | — | — | — | — | Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the a | 67d ago |
| CVE-2026-77775 | 8.6 | — | — | — | — | Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. | 67d ago |
