| CVE-2026-19049 | 8.6 | — | — | — | — | The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL qu | 78d ago |
| CVE-2026-17044 | 8.6 | — | — | — | — | The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before usi | 79d ago |
| CVE-2026-48120 | 8.6 | — | — | — | — | Kakoune is a code editor. | 81d ago |
| CVE-2026-63637 | 8.6 | — | — | — | — | Dgraph is an open source distributed GraphQL database. | 82d ago |
| CVE-2026-53983 | 8.6 | — | — | — | — | Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the o | 82d ago |
| CVE-2026-19143 | 8.6 | — | — | — | google / chrome | Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed | 82d ago |
| CVE-2026-3430 | 8.6 | — | — | — | — | The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an | 82d ago |
| CVE-2026-18953 | 8.6 | — | — | — | amazon / aws transform mcp server | Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transfo | 83d ago |
| CVE-2026-20301 | 8.6 | — | — | — | — | A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protoc | 83d ago |
| CVE-2026-20273 | 8.6 | — | — | — | cisco / ios xe | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software enginee | 83d ago |
| CVE-2026-20271 | 8.6 | — | — | — | cisco / ios xe | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software enginee | 83d ago |
| CVE-2026-20270 | 8.6 | — | — | — | cisco / ios xe | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software enginee | 83d ago |
| CVE-2026-20269 | 8.6 | — | — | — | cisco / ios xe | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software enginee | 83d ago |
| CVE-2026-20268 | 8.6 | — | — | — | cisco / ios xe | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software enginee | 83d ago |
| CVE-2026-20263 | 8.6 | — | — | — | — | A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE Software could allow an | 83d ago |
| CVE-2026-71270 | 8.6 | — | — | — | — | Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtm | 83d ago |
| CVE-2026-71259 | 8.6 | — | — | — | — | ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validat | 83d ago |
| CVE-2026-71255 | 8.6 | — | — | — | — | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identificati | 83d ago |
| CVE-2026-68587 | 8.6 | — | — | — | — | SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, | 85d ago |
| CVE-2026-68586 | 8.6 | — | — | — | — | SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content end | 85d ago |
| CVE-2026-68584 | 8.6 | — | — | — | — | SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returni | 85d ago |
| CVE-2026-16572 | 8.6 | — | — | — | — | The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using i | 85d ago |
| CVE-2026-12817 | 8.6 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. | 85d ago |
| CVE-2026-12185 | 8.6 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. | 86d ago |
| CVE-2025-71399 | 8.6 | — | — | — | — | Better Auth relies on better-call, which uses the rou3 router library. | 86d ago |
| CVE-2026-12721 | 8.6 | — | — | — | — | The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request befo | 88d ago |
| CVE-2026-67346 | 8.6 | — | — | — | — | Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_saf | 89d ago |
| CVE-2026-54367 | 8.6 | — | — | — | — | CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to r | 89d ago |
| CVE-2026-22620 | 8.6 | — | — | — | — | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow a | 89d ago |
| CVE-2026-44098 | 8.6 | — | — | — | — | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypas | 89d ago |
| CVE-2026-44094 | 8.6 | — | — | — | — | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure co | 89d ago |
| CVE-2026-13395 | 8.6 | — | — | — | — | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly ca | 89d ago |
| CVE-2026-48448 | 8.6 | — | — | — | adobe / campaign | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command | 89d ago |
| CVE-2026-17699 | 8.6 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a | 90d ago |
| CVE-2026-67427 | 8.6 | — | — | — | — | Flyto2 Core is an execution kernel for automation and AI-agent workflows. | 90d ago |
| CVE-2026-67425 | 8.6 | — | — | — | — | Flyto2 Core is an execution kernel for automation and AI-agent workflows. | 90d ago |
| CVE-2026-67201 | 8.6 | — | — | — | — | V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that | 90d ago |
| CVE-2026-16328 | 8.6 | — | — | — | — | In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, all | 90d ago |
| CVE-2026-56389 | 8.6 | — | — | — | gnu / bison | GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling o | 90d ago |
| CVE-2026-58182 | 8.6 | — | — | — | apache / traffic server | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. | 90d ago |
| CVE-2026-11974 | 8.6 | — | — | — | — | The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using i | 90d ago |
| CVE-2026-54650 | 8.6 | — | — | — | — | openhole exposes localhost to the internet in one command. | 91d ago |
| CVE-2026-48396 | 8.6 | — | — | — | adobe / bridge | Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in th | 91d ago |
| CVE-2026-48395 | 8.6 | — | — | — | adobe / bridge | Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the | 91d ago |
| CVE-2026-14869 | 8.6 | — | — | — | — | The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamab | 91d ago |
| CVE-2026-48388 | 8.6 | — | — | — | adobe / photoshop installer | Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have result | 91d ago |
| CVE-2026-54609 | 8.6 | — | — | — | — | QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. | 91d ago |
| CVE-2026-54603 | 8.6 | — | — | — | — | OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). | 91d ago |
| CVE-2026-45293 | 8.6 | — | — | — | — | WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. | 91d ago |
| CVE-2026-43760 | 8.6 | — | — | — | apple / macos | An access issue was addressed with improved access restrictions. | 92d ago |
| CVE-2026-28973 | 8.6 | — | — | — | apple / ipados | An integer overflow was addressed with improved input validation. | 92d ago |
| CVE-2025-15662 | 8.6 | — | — | — | — | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user | 92d ago |
| CVE-2026-64400 | 8.6 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restri | 94d ago |
| CVE-2026-28698 | 8.6 | — | — | — | — | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized | 96d ago |
| CVE-2026-65702 | 8.6 | — | — | — | — | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integra | 96d ago |
| CVE-2026-65908 | 8.6 | — | — | — | jetbrains / pycharm | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible | 96d ago |
| CVE-2026-64814 | 8.6 | — | — | — | jetbrains / intellij idea | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | 96d ago |
| CVE-2026-13321 | 8.6 | — | — | — | — | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer | 97d ago |
| CVE-2026-65318 | 8.6 | — | — | — | — | Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that all | 98d ago |
| CVE-2026-65317 | 8.6 | — | — | — | — | Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-orig | 98d ago |
