| CVE-2026-56179 | 8.3 | — | — | — | microsoft / windows 11 24h2 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform sp | 77d ago |
| CVE-2026-53415 | 8.3 | — | — | — | — | Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code ex | 77d ago |
| CVE-2026-53413 | 8.3 | — | — | — | — | Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting | 77d ago |
| CVE-2026-72768 | 8.3 | — | — | — | n8n / n8n | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client | 77d ago |
| CVE-2026-68352 | 8.3 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE le | 78d ago |
| CVE-2026-68196 | 8.3 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length | 78d ago |
| CVE-2026-19177 | 8.3 | — | — | — | google / chrome | Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacke | 82d ago |
| CVE-2026-19173 | 8.3 | — | — | — | google / chrome | Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised | 82d ago |
| CVE-2026-19172 | 8.3 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the | 82d ago |
| CVE-2026-19163 | 8.3 | — | — | — | google / chrome | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had comp | 82d ago |
| CVE-2026-19155 | 8.3 | — | — | — | google / chrome | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised | 82d ago |
| CVE-2026-19154 | 8.3 | — | — | — | google / chrome | Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compr | 82d ago |
| CVE-2026-19152 | 8.3 | — | — | — | google / chrome | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker w | 82d ago |
| CVE-2026-19148 | 8.3 | — | — | — | google / chrome | Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had com | 82d ago |
| CVE-2026-19147 | 8.3 | — | — | — | google / chrome | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had comprom | 82d ago |
| CVE-2026-19141 | 8.3 | — | — | — | google / chrome | Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had | 82d ago |
| CVE-2026-19140 | 8.3 | — | — | — | google / chrome | Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the r | 82d ago |
| CVE-2026-19138 | 8.3 | — | — | — | google / chrome | Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had | 82d ago |
| CVE-2026-19137 | 8.3 | — | — | — | google / chrome | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had comp | 82d ago |
| CVE-2026-71242 | 8.3 | — | — | — | — | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-owne | 84d ago |
| CVE-2026-71206 | 8.3 | — | — | — | — | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the em | 84d ago |
| CVE-2026-55739 | 8.3 | — | — | — | — | Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer abil | 84d ago |
| CVE-2026-67331 | 8.3 | — | — | — | — | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their cre | 87d ago |
| CVE-2026-67327 | 8.3 | — | — | — | — | better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10) are vuln | 87d ago |
| CVE-2026-14980 | 8.3 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery w | 89d ago |
| CVE-2026-5219 | 8.3 | — | — | — | — | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. | 89d ago |
| CVE-2026-22621 | 8.3 | — | — | — | — | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware co | 90d ago |
| CVE-2026-47882 | 8.3 | — | — | — | — | When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Clou | 90d ago |
| CVE-2026-17723 | 8.3 | — | — | — | google / chrome | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compr | 90d ago |
| CVE-2026-17722 | 8.3 | — | — | — | google / chrome | Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who | 90d ago |
| CVE-2026-17663 | 8.3 | — | — | — | google / chrome | Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a rem | 90d ago |
| CVE-2026-17660 | 8.3 | — | — | — | google / chrome | Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote att | 90d ago |
| CVE-2026-17657 | 8.3 | — | — | — | google / chrome | Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised | 90d ago |
| CVE-2026-17653 | 8.3 | — | — | — | google / chrome | Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the r | 90d ago |
| CVE-2026-17650 | 8.3 | — | — | — | google / chrome | Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise | 90d ago |
| CVE-2026-54666 | 8.3 | — | — | — | — | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. | 90d ago |
| CVE-2026-54664 | 8.3 | — | — | — | — | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. | 90d ago |
| CVE-2026-54662 | 8.3 | — | — | — | — | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. | 90d ago |
| CVE-2026-54661 | 8.3 | — | — | — | — | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. | 90d ago |
| CVE-2026-58153 | 8.3 | — | — | — | apache / traffic server | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when conver | 91d ago |
| CVE-2026-17497 | 8.3 | — | — | — | notegen / notegen | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 w | 93d ago |
| CVE-2026-64515 | 8.3 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If eit | 95d ago |
| CVE-2026-65709 | 8.3 | — | — | — | — | sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API tha | 95d ago |
| CVE-2026-66027 | 8.3 | — | — | — | — | Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authentica | 95d ago |
| CVE-2026-16804 | 8.3 | — | — | — | google / chrome | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the | 96d ago |
| CVE-2026-16413 | 8.3 | — | — | — | google / chrome | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromise | 98d ago |
| CVE-2026-62473 | 8.3 | — | — | — | oracle / installed base | Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). | 98d ago |
| CVE-2026-60788 | 8.3 | — | — | — | oracle / sales offline | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). | 98d ago |
| CVE-2026-60640 | 8.3 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 98d ago |
| CVE-2026-60582 | 8.3 | — | — | — | oracle / enterprise command center framework | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor | 98d ago |
| CVE-2026-60471 | 8.3 | — | — | — | oracle / webcenter content | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). | 98d ago |
| CVE-2026-47419 | 8.3 | — | — | — | — | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. | 98d ago |
| CVE-2026-47415 | 8.3 | — | — | — | — | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. | 98d ago |
| CVE-2026-47866 | 8.3 | — | — | — | broadcom / vmware avi load balancer | VMware Avi Load Balancer contains an authorization bypass vulnerability. | 102d ago |
| CVE-2026-62349 | 8.3 | — | — | — | — | TDengine is an open source, time-series database optimized for Internet of Things devices. | 104d ago |
| CVE-2026-59258 | 8.3 | — | — | — | — | immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint th | 104d ago |
| CVE-2026-53516 | 8.3 | — | — | — | better-auth / better auth | Better Auth is an authentication and authorization library for TypeScript. | 104d ago |
| CVE-2026-20296 | 8.3 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 1 | 104d ago |
| CVE-2026-10673 | 8.3 | — | — | — | zephyrproject / zephyr | The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received | 104d ago |
| CVE-2026-47158 | 8.3 | — | — | — | — | Vaultwarden is a Bitwarden-compatible server written in Rust. | 104d ago |
