| CVE-2026-58049 | 8.6 | — | — | — | — | FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor | 121d ago |
| CVE-2026-49991 | 8.6 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 123d ago |
| CVE-2026-55441 | 8.6 | — | — | — | — | mise manages dev tools like node, python, cmake, and terraform. | 123d ago |
| CVE-2026-56035 | 8.6 | — | — | — | — | Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. | 123d ago |
| CVE-2026-57877 | 8.6 | — | — | — | — | An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and ea | 123d ago |
| CVE-2026-53217 | 8.6 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packe | 124d ago |
| CVE-2026-12053 | 8.6 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain cond | 124d ago |
| CVE-2026-47389 | 8.6 | — | — | — | — | Mastodon is a free, open-source social network server based on ActivityPub. | 125d ago |
| CVE-2026-48721 | 8.6 | — | — | — | — | Warp is an agentic development environment. | 125d ago |
| CVE-2026-49269 | 8.6 | — | — | — | — | Apple M1 GPUs retain register file data between compute shader dispatches from different processes. | 125d ago |
| CVE-2026-54762 | 8.6 | — | — | — | traefik / traefik | Traefik is an HTTP reverse proxy and load balancer. | 126d ago |
| CVE-2026-53755 | 8.6 | — | — | — | kidocode / crawl4ai | Crawl4AI is an open-source LLM friendly web crawler & scraper. | 126d ago |
| CVE-2026-56266 | 8.6 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and | 127d ago |
| CVE-2026-55602 | 8.6 | — | — | — | chimurai / http-proxy-middleware | http-proxy-middleware is node.js http-proxy middleware. | 127d ago |
| CVE-2025-7737 | 8.6 | — | — | — | — | DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. | 130d ago |
| CVE-2025-69128 | 8.6 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allo | 132d ago |
| CVE-2026-27400 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. | 132d ago |
| CVE-2026-22343 | 8.6 | — | — | — | — | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. | 132d ago |
| CVE-2025-69139 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions. | 132d ago |
| CVE-2026-46776 | 8.6 | — | — | — | oracle / unified directory | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). | 132d ago |
| CVE-2026-22312 | 8.6 | — | — | — | — | The device has a webserver that exposes a REST API authenticated with a constant token. | 133d ago |
| CVE-2026-42089 | 8.6 | — | — | — | — | Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a gener | 133d ago |
| CVE-2026-10649 | 8.6 | — | — | — | — | A flaw was found in Pacemaker. | 133d ago |
| CVE-2025-71261 | 8.6 | — | — | — | — | An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before | 133d ago |
| CVE-2026-47825 | 8.6 | — | — | — | — | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain c | 134d ago |
| CVE-2026-40769 | 8.6 | — | — | — | — | Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File Upload & | 134d ago |
| CVE-2026-47835 | 8.6 | — | — | — | vmware / spring ai | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasti | 134d ago |
| CVE-2026-12057 | 8.6 | — | — | — | foxit / ai | When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept | 134d ago |
| CVE-2026-54410 | 8.6 | — | — | — | — | nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TC | 135d ago |
| CVE-2026-11527 | 8.6 | — | — | — | — | Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open( | 135d ago |
| CVE-2026-50085 | 8.6 | — | — | — | aqara / board service | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the plat | 137d ago |
| CVE-2026-47209 | 8.6 | — | — | — | — | vm2 is an open source vm/sandbox for Node.js. | 137d ago |
| CVE-2026-47139 | 8.6 | — | — | — | — | vm2 is an open source vm/sandbox for Node.js. | 137d ago |
| CVE-2026-45169 | 8.6 | — | — | — | paloaltonetworks / idira privileged access manager vault | Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhib | 137d ago |
| CVE-2026-47368 | 8.6 | — | — | — | — | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices | 137d ago |
| CVE-2026-44492 | 8.6 | — | — | — | axios / axios | Axios is a promise based HTTP client for the browser and Node.js. | 138d ago |
| CVE-2026-40999 | 8.6 | — | — | — | broadcom / spring web services | When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connec | 138d ago |
| CVE-2026-50131 | 8.6 | — | — | — | — | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. | 139d ago |
| CVE-2026-3326exploited | 8.6 | 1.9% | 1/3 | +125d | — | The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL | 139d ago |
| CVE-2026-46491 | 8.6 | — | — | — | — | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. | 140d ago |
| CVE-2026-47907 | 8.6 | — | — | — | adobe / dreamweaver | Dreamweaver Desktop versions 21.7 and earlier are affected by an Improper Access Control vulnerability that could | 140d ago |
| CVE-2026-47906 | 8.6 | — | — | — | adobe / dreamweaver | Dreamweaver Desktop versions 21.7 and earlier are affected by a Dependency on Vulnerable Third-Party Component vul | 140d ago |
| CVE-2026-11158 | 8.6 | — | — | — | google / chrome | Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a l | 145d ago |
| CVE-2026-49202 | 8.6 | — | — | — | acer / connect m6e 5g firmware | Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Reso | 145d ago |
| CVE-2026-46273 | 8.6 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MS | 146d ago |
| CVE-2026-20230exploited | 8.6 | 88.2% | 3/3 | +19d | cisco / unified communications manager | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Sess | 146d ago |
| CVE-2022-4992 | 8.6 | — | — | — | — | Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lowe | 147d ago |
| CVE-2019-25719 | 8.6 | — | — | — | — | Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, | 147d ago |
| CVE-2026-37232 | 8.6 | — | — | — | openairinterface / openairinterface5g | An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization | 148d ago |
| CVE-2024-40646 | 8.6 | — | — | — | vertex-app / vertex | Vertex is a management tool for PT (Private Tracker) users to manage streaming and watching videos. | 148d ago |
| CVE-2026-44697 | 8.6 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 151d ago |
| CVE-2026-49127 | 8.6 | — | — | — | — | Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_ | 152d ago |
| CVE-2026-44466 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 152d ago |
| CVE-2026-44465 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 152d ago |
| CVE-2026-44463 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 152d ago |
| CVE-2026-44461 | 8.6 | — | — | — | zed / zed | Zed is a code editor. | 152d ago |
| CVE-2026-7862 | 8.6 | — | — | — | — | The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund re | 152d ago |
| CVE-2026-42737 | 8.6 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBookin | 153d ago |
| CVE-2025-30028 | 8.6 | — | — | — | synology / active backup for business | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. | 153d ago |
| CVE-2026-45298exploited | 8.6 | 1.5% | 1/3 | +80d | amirraminfar / dozzle | Dozzle is a realtime log viewer for docker containers. | 154d ago |
