| CVE-2026-73711 | 8.1 | — | — | — | arubanetworks / fabric composer | A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. | 57d ago |
| CVE-2026-51956 | 8.1 | — | — | — | — | A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. | 57d ago |
| CVE-2026-84203 | 8.1 | — | — | — | — | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing at | 57d ago |
| CVE-2026-84218 | 8.1 | — | — | — | — | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX s | 57d ago |
| CVE-2026-19513 | 8.1 | — | — | — | — | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including | 57d ago |
| CVE-2026-84189 | 8.1 | — | — | — | — | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-config | 57d ago |
| CVE-2026-83595 | 8.1 | — | — | — | — | AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to per | 57d ago |
| CVE-2026-82228 | 8.1 | — | — | — | — | Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. | 58d ago |
| CVE-2026-81892 | 8.1 | — | — | — | — | EasyAdmin is a fast and modern admin generator for Symfony applications. | 58d ago |
| CVE-2026-81891 | 8.1 | — | — | — | — | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. | 58d ago |
| CVE-2026-75458 | 8.1 | — | — | — | — | The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains | 58d ago |
| CVE-2026-61641 | 8.1 | — | — | — | — | Wallos is an open-source, self-hostable personal subscription tracker. | 58d ago |
| CVE-2026-72001 | 8.1 | — | — | — | — | Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to ac | 58d ago |
| CVE-2026-79746 | 8.1 | — | — | — | — | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separa | 58d ago |
| CVE-2026-66047exploited | 8.1 | 0.92% | 1/3 | +16d | — | ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vul | 58d ago |
| CVE-2026-82475 | 8.1 | — | — | — | — | iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fa | 60d ago |
| CVE-2026-82463 | 8.1 | — | — | — | — | pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverse | 60d ago |
| CVE-2026-82461 | 8.1 | — | — | — | — | pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Key | 60d ago |
| CVE-2026-82291 | 8.1 | — | — | — | — | HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enablin | 61d ago |
| CVE-2026-82287 | 8.1 | — | — | — | — | Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrict | 61d ago |
| CVE-2026-82284 | 8.1 | — | — | — | — | Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{c | 61d ago |
| CVE-2026-82283 | 8.1 | — | — | — | — | VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated u | 61d ago |
| CVE-2026-82279 | 8.1 | — | — | — | — | HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team | 61d ago |
| CVE-2026-82269 | 8.1 | — | — | — | — | Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication | 61d ago |
| CVE-2026-56100 | 8.1 | — | — | — | — | SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that al | 61d ago |
| CVE-2026-55065 | 8.1 | — | — | — | — | Vikunja is an open-source self-hosted task management platform. | 61d ago |
| CVE-2026-50979 | 8.1 | — | — | — | — | A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier | 61d ago |
| CVE-2026-82245 | 8.1 | — | — | — | — | Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any aut | 61d ago |
| CVE-2026-82240 | 8.1 | — | — | — | — | Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update | 61d ago |
| CVE-2026-82239 | 8.1 | — | — | — | — | Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, a | 61d ago |
| CVE-2026-80645 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in t | 61d ago |
| CVE-2026-80599 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: ensure accessible eth_hdr pro | 61d ago |
| CVE-2026-19423 | 8.1 | — | — | — | — | The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot res | 61d ago |
| CVE-2026-77977 | 8.1 | — | — | — | — | Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disru | 61d ago |
| CVE-2026-54330 | 8.1 | — | — | — | — | Ceph is an open-source distributed storage platform providing object, block, and file storage. | 61d ago |
| CVE-2026-54083 | 8.1 | — | — | — | — | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud worklo | 61d ago |
| CVE-2026-81728 | 8.1 | — | — | — | dolibarr / dolibarr erp\/crm | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. | 62d ago |
| CVE-2026-81525 | 8.1 | — | — | — | — | The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespa | 62d ago |
| CVE-2026-81522 | 8.1 | — | — | — | — | A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters | 62d ago |
| CVE-2026-59286 | 8.1 | — | — | — | vmware / spring for graphql | The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresourc | 62d ago |
| CVE-2026-59285 | 8.1 | — | — | — | vmware / spring for graphql | Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries | 62d ago |
| CVE-2026-53580 | 8.1 | — | — | — | — | Trilium is an open-source hierarchical note-taking application. | 62d ago |
| CVE-2026-37068 | 8.1 | — | — | — | — | Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 | 62d ago |
| CVE-2026-81273 | 8.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | 62d ago |
| CVE-2026-75020 | 8.1 | — | — | — | apache / apisix | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISI | 62d ago |
| CVE-2026-77317 | 8.1 | — | — | — | — | SeaweedFS is a distributed storage system for files and blobs. | 63d ago |
| CVE-2026-43621 | 8.1 | — | — | — | — | Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vuln | 63d ago |
| CVE-2026-55228 | 8.1 | — | — | — | — | Weblate is a web-based continuous localization platform used to manage software translations. | 63d ago |
| CVE-2026-32258 | 8.1 | — | — | — | — | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. | 63d ago |
| CVE-2026-32257 | 8.1 | — | — | — | — | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. | 63d ago |
| CVE-2026-81036 | 8.1 | — | — | — | — | Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default c | 63d ago |
| CVE-2026-81035 | 8.1 | — | — | — | — | Midday allows any member of a team to delete it. | 63d ago |
| CVE-2026-81029 | 8.1 | — | — | — | — | OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. | 63d ago |
| CVE-2026-75960 | 8.1 | — | — | — | — | Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerabilit | 63d ago |
| CVE-2026-15985 | 8.1 | — | — | — | — | The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in | 63d ago |
| CVE-2026-19718 | 8.1 | — | — | — | — | The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin be | 63d ago |
| CVE-2026-80192 | 8.1 | — | — | — | — | @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease lin | 63d ago |
| CVE-2026-58092 | 8.1 | — | — | — | — | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID | 63d ago |
| CVE-2026-18985 | 8.1 | — | — | — | — | Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. | 63d ago |
| CVE-2026-68569 | 8.1 | — | — | — | apache / tomcat | Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. | 64d ago |
