| CVE-2026-8533 | 8.3 | — | — | — | google / chrome | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromi | 166d ago |
| CVE-2026-8530 | 8.3 | — | — | — | google / chrome | Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had com | 166d ago |
| CVE-2026-8525 | 8.3 | — | — | — | google / chrome | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker to potentia | 166d ago |
| CVE-2026-8523 | 8.3 | — | — | — | google / chrome | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the r | 166d ago |
| CVE-2026-8520 | 8.3 | — | — | — | google / chrome | Race in Payments in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbo | 166d ago |
| CVE-2026-8515 | 8.3 | — | — | — | google / chrome | Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to en | 166d ago |
| CVE-2026-8514 | 8.3 | — | — | — | google / chrome | Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the r | 166d ago |
| CVE-2026-8513 | 8.3 | — | — | — | google / chrome | Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compr | 166d ago |
| CVE-2026-8512 | 8.3 | — | — | — | google / chrome | Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a use | 166d ago |
| CVE-2026-43907 | 8.3 | — | — | — | openimageio / openimageio | OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to V | 166d ago |
| CVE-2026-44586 | 8.3 | — | — | — | — | SiYuan is an open-source personal knowledge management system. | 166d ago |
| CVE-2026-32993 | 8.3 | — | — | — | — | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthentic | 167d ago |
| CVE-2026-21821 | 8.3 | — | — | — | — | The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. | 167d ago |
| CVE-2026-35438 | 8.3 | — | — | — | microsoft / windows admin center | Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 169d ago |
| CVE-2025-40946 | 8.3 | — | — | — | — | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions | 169d ago |
| CVE-2026-42313 | 8.3 | — | — | — | pyload-ng project / pyload-ng | pyLoad is a free and open-source download manager written in Python. | 170d ago |
| CVE-2026-1313 | 8.3 | — | — | — | — | The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a | 221d ago |
| CVE-2026-4064 | 8.3 | — | — | — | ironmansoftware / powershell universal | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an a | 224d ago |
| CVE-2026-0708 | 8.3 | — | — | — | vstakhov / libucl | A flaw was found in libucl. | 225d ago |
| CVE-2026-25083 | 8.3 | — | — | — | — | GROWI OpenAI thread/message API endpoints do not perform authorization. | 226d ago |
| CVE-2025-13779 | 8.3 | — | — | — | — | Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affe | 228d ago |
| CVE-2025-13777 | 8.3 | — | — | — | — | Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects A | 228d ago |
| CVE-2026-32110 | 8.3 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 230d ago |
| CVE-2026-86145 | 8.2 | — | — | — | — | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a re | 53d ago |
| CVE-2026-52767 | 8.2 | — | — | — | — | YesWiki is a wiki system written in PHP. | 53d ago |
| CVE-2026-77822 | 8.2 | — | — | — | — | IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to se | 54d ago |
| CVE-2026-85613 | 8.2 | — | — | — | — | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint | 54d ago |
| CVE-2026-85455 | 8.2 | — | — | — | — | MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet t | 54d ago |
| CVE-2026-85432 | 8.2 | — | — | — | — | MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticat | 54d ago |
| CVE-2026-63376 | 8.2 | — | — | — | — | toml-node is a TOML parser for Node.js and the browser. | 54d ago |
| CVE-2026-44506 | 8.2 | — | — | — | — | Medplum is a developer platform that enables development of healthcare apps. | 54d ago |
| CVE-2026-84757 | 8.2 | — | — | — | — | Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. | 55d ago |
| CVE-2021-38489 | 8.2 | — | — | — | — | HDD password plaintext is stored in a UEFI variable. | 55d ago |
| CVE-2026-20277 | 8.2 | — | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software enginee | 56d ago |
| CVE-2026-18329 | 8.2 | — | — | — | — | Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler perform | 56d ago |
| CVE-2025-15485 | 8.2 | — | — | — | — | The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, a | 56d ago |
| CVE-2026-84696 | 8.2 | — | — | — | — | Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the | 56d ago |
| CVE-2026-84370 | 8.2 | — | — | — | — | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. | 56d ago |
| CVE-2026-73779 | 8.2 | — | — | — | hpe / arubaos-cx | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an un | 56d ago |
| CVE-2026-73710 | 8.2 | — | — | — | arubanetworks / fabric composer | Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacke | 56d ago |
| CVE-2026-84187 | 8.2 | — | — | — | — | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated a | 57d ago |
| CVE-2026-77348 | 8.2 | — | — | — | — | Wallos is an open-source, self-hostable personal subscription tracker. | 57d ago |
| CVE-2026-82876 | 8.2 | — | — | — | — | Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware | 58d ago |
| CVE-2026-82473 | 8.2 | — | — | — | — | KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication veri | 60d ago |
| CVE-2026-76548 | 8.2 | — | — | — | — | The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload featur | 60d ago |
| CVE-2026-18904 | 8.2 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject una | 60d ago |
| CVE-2026-18891 | 8.2 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitiv | 60d ago |
| CVE-2026-82285 | 8.2 | — | — | — | — | bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/repor | 60d ago |
| CVE-2026-82234 | 8.2 | — | — | — | — | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetc | 61d ago |
| CVE-2026-80615 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy o | 61d ago |
| CVE-2026-81730 | 8.2 | — | — | — | dolibarr / dolibarr erp\/crm | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME header | 61d ago |
| CVE-2026-59324 | 8.2 | — | — | — | vmware / spring integration | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads | 61d ago |
| CVE-2026-59316 | 8.2 | — | — | — | broadcom / spring authorization server | Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. | 61d ago |
| CVE-2026-80208 | 8.2 | — | — | — | — | APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserControlle | 62d ago |
| CVE-2026-75871 | 8.2 | — | — | — | gitlab / gitlab | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway | 62d ago |
| CVE-2026-19889 | 8.2 | — | — | — | — | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway | 62d ago |
| CVE-2026-81574 | 8.2 | — | — | — | — | In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, | 62d ago |
| CVE-2026-47877 | 8.2 | — | — | — | vmware / spring security | Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity enc | 62d ago |
| CVE-2026-80549 | 8.2 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not oper | 63d ago |
| CVE-2026-77538 | 8.2 | — | — | — | — | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi | 63d ago |
