| CVE-2026-66422 | 8.1 | — | — | — | apache / tomcat | Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly use | 64d ago |
| CVE-2026-65183 | 8.1 | — | — | — | apache / tomcat | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets | 64d ago |
| CVE-2026-79263 | 8.1 | — | — | — | google / chrome | Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrar | 64d ago |
| CVE-2026-79194 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to ex | 64d ago |
| CVE-2026-79072 | 8.1 | — | — | — | google / chrome | Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to pote | 64d ago |
| CVE-2026-79057 | 8.1 | — | — | — | google / chrome | Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging | 64d ago |
| CVE-2026-79039 | 8.1 | — | — | — | google / chrome | Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute ar | 64d ago |
| CVE-2026-79027 | 8.1 | — | — | — | google / chrome | Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary co | 64d ago |
| CVE-2026-79020 | 8.1 | — | — | — | google / chrome | Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read m | 64d ago |
| CVE-2026-79011 | 8.1 | — | — | — | google / chrome | UI misrepresentation in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging socia | 64d ago |
| CVE-2026-78913 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially exec | 64d ago |
| CVE-2026-65105 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may acce | 64d ago |
| CVE-2026-65098 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could c | 64d ago |
| CVE-2026-65084 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improp | 64d ago |
| CVE-2026-65081 | 8.1 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause exec | 64d ago |
| CVE-2026-78379 | 8.1 | — | — | — | — | Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools bef | 64d ago |
| CVE-2026-16231 | 8.1 | — | — | — | hbs project / hbs | hbs is an Express view engine that wraps Handlebars. | 64d ago |
| CVE-2026-78478 | 8.1 | — | — | — | — | The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. | 64d ago |
| CVE-2026-72695 | 8.1 | — | — | — | — | Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authentic | 64d ago |
| CVE-2026-34968 | 8.1 | — | — | — | — | Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop | 64d ago |
| CVE-2026-77567 | 8.1 | — | — | — | — | Filament is a collection of full-stack components for accelerated Laravel development. | 65d ago |
| CVE-2026-75464 | 8.1 | — | — | — | — | OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link(). | 65d ago |
| CVE-2026-71506 | 8.1 | — | — | — | — | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint t | 65d ago |
| CVE-2026-71504 | 8.1 | — | — | — | — | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attack | 65d ago |
| CVE-2025-26238 | 8.1 | — | — | — | — | In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code. | 65d ago |
| CVE-2025-26237 | 8.1 | — | — | — | — | D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which | 65d ago |
| CVE-2026-39915 | 8.1 | — | — | — | — | TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HT | 65d ago |
| CVE-2026-66671 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions. | 65d ago |
| CVE-2026-66670 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Måne <= 1.7 versions. | 65d ago |
| CVE-2026-28152 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | 65d ago |
| CVE-2026-28151 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | 65d ago |
| CVE-2026-74651 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_get_wp | 67d ago |
| CVE-2026-74592 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_trunca | 67d ago |
| CVE-2026-76793 | 8.1 | — | — | — | — | The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication | 67d ago |
| CVE-2026-18052 | 8.1 | — | — | — | — | The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature whic | 67d ago |
| CVE-2026-64679 | 8.1 | — | — | — | — | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. | 68d ago |
| CVE-2026-68745 | 8.1 | — | — | — | apache / cloudstack | Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms | 68d ago |
| CVE-2026-18781exploited | 8.1 | 0.54% | 1/3 | +3d | — | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the fi | 68d ago |
| CVE-2026-19437 | 8.1 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buf | 69d ago |
| CVE-2026-17138 | 8.1 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a sta | 69d ago |
| CVE-2026-17060 | 8.1 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and ca | 69d ago |
| CVE-2026-17000 | 8.1 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to impro | 69d ago |
| CVE-2026-76019 | 8.1 | — | — | — | google / chrome | Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had comp | 69d ago |
| CVE-2026-77176 | 8.1 | — | — | — | — | A flaw was found in Kata Containers. | 69d ago |
| CVE-2026-63042 | 8.1 | — | — | — | apache / inlong | Files or Directories Accessible to External Parties vulnerability in Apache InLong. | 69d ago |
| CVE-2026-63040 | 8.1 | — | — | — | apache / inlong | Files or Directories Accessible to External Parties vulnerability in Apache InLong. | 69d ago |
| CVE-2026-76633 | 8.1 | — | — | — | — | WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any auth | 69d ago |
| CVE-2026-28150 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. | 69d ago |
| CVE-2025-15637 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. | 69d ago |
| CVE-2026-76886 | 8.1 | — | — | — | wireshark / wireshark | C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | 70d ago |
| CVE-2026-76399 | 8.1 | — | — | — | splunk / ai toolkit | In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided sche | 70d ago |
| CVE-2026-76397 | 8.1 | — | — | — | splunk / ai toolkit | In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all re | 70d ago |
| CVE-2026-76388 | 8.1 | — | — | — | splunk / enterprise security | In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst Splunk Enterprise Security ro | 70d ago |
| CVE-2026-76387 | 8.1 | — | — | — | splunk / enterprise security | In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contai | 70d ago |
| CVE-2026-76356 | 8.1 | — | — | — | splunk / soar | In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted reques | 70d ago |
| CVE-2026-76354 | 8.1 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "p | 70d ago |
| CVE-2026-76338 | 8.1 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to | 70d ago |
| CVE-2026-76331 | 8.1 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "p | 70d ago |
| CVE-2026-18544 | 8.1 | — | — | — | ibm / portieris | IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement | 70d ago |
| CVE-2026-12633 | 8.1 | — | — | — | — | The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) | 70d ago |
