| CVE-2026-72856 | 8.1 | — | — | — | — | Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant | 76d ago |
| CVE-2026-19750 | 8.1 | — | — | — | — | A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. | 76d ago |
| CVE-2026-72665 | 8.1 | — | — | — | elastic / kibana | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend respons | 76d ago |
| CVE-2026-18164 | 8.1 | — | — | — | — | An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. | 76d ago |
| CVE-2026-17206 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | 76d ago |
| CVE-2026-17069 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to im | 76d ago |
| CVE-2026-17045 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and ac | 76d ago |
| CVE-2026-16868 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitia | 76d ago |
| CVE-2026-16867 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an au | 76d ago |
| CVE-2026-73482 | 8.1 | — | — | — | — | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. | 76d ago |
| CVE-2026-17197 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validat | 76d ago |
| CVE-2026-72741 | 8.1 | — | — | — | — | Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authe | 76d ago |
| CVE-2026-58439 | 8.1 | — | — | — | — | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | 76d ago |
| CVE-2026-55987 | 8.1 | — | — | — | — | OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete | 76d ago |
| CVE-2026-24791 | 8.1 | — | — | — | — | Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes | 76d ago |
| CVE-2026-73515 | 8.1 | — | — | — | — | PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory discl | 76d ago |
| CVE-2026-70463 | 8.1 | — | — | — | samba / rsync | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. | 76d ago |
| CVE-2026-70460 | 8.1 | — | — | — | — | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the modu | 76d ago |
| CVE-2026-53795 | 8.1 | — | — | — | samba / rsync | rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the | 76d ago |
| CVE-2026-53790 | 8.1 | — | — | — | — | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execut | 76d ago |
| CVE-2026-53783 | 8.1 | — | — | — | — | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync res | 76d ago |
| CVE-2026-66657 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | 76d ago |
| CVE-2026-66656 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | 76d ago |
| CVE-2026-66653 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | 76d ago |
| CVE-2026-66450 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions. | 76d ago |
| CVE-2026-61979exploited | 8.1 | 0.42% | 1/3 | +8d | — | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. | 76d ago |
| CVE-2026-28186 | 8.1 | — | — | — | — | Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | 76d ago |
| CVE-2026-27543 | 8.1 | — | — | — | — | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | 76d ago |
| CVE-2026-6464 | 8.1 | — | — | — | postgresql / postgresql | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines | 76d ago |
| CVE-2026-14668 | 8.1 | — | — | — | postgresql / postgresql | Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view | 76d ago |
| CVE-2026-73624 | 8.1 | — | — | — | — | GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method tha | 76d ago |
| CVE-2026-73620 | 8.1 | — | — | — | gitpython project / gitpython | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), al | 76d ago |
| CVE-2026-73612 | 8.1 | — | — | — | — | File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and del | 76d ago |
| CVE-2026-73484 | 8.1 | — | — | — | flowiseai / flowise | Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native | 76d ago |
| CVE-2026-19004 | 8.1 | — | — | — | — | An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing out | 77d ago |
| CVE-2026-19002 | 8.1 | — | — | — | — | A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver ca | 77d ago |
| CVE-2026-13267 | 8.1 | — | — | — | ibm / security verify access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify | 77d ago |
| CVE-2026-12359 | 8.1 | — | — | — | ibm / security verify access | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify | 77d ago |
| CVE-2026-19311 | 8.1 | — | — | — | — | Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated | 77d ago |
| CVE-2026-18952 | 8.1 | — | — | — | — | Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might | 77d ago |
| CVE-2026-16904 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to impr | 77d ago |
| CVE-2026-18499 | 8.1 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when | 77d ago |
| CVE-2026-18098 | 8.1 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compr | 77d ago |
| CVE-2026-69105 | 8.1 | — | — | — | — | An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentiall | 77d ago |
| CVE-2026-73289 | 8.1 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 77d ago |
| CVE-2026-73286 | 8.1 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 77d ago |
| CVE-2026-66375 | 8.1 | — | — | — | jfrog / artifactory | A low-privilege authenticated user may permanently remove protected internal metadata across repositories under sp | 77d ago |
| CVE-2026-47231 | 8.1 | — | — | — | — | Admidio is an open-source user management solution. | 77d ago |
| CVE-2026-70468 | 8.1 | — | — | — | — | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiMana | 77d ago |
| CVE-2026-70465 | 8.1 | — | — | — | — | A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWind | 77d ago |
| CVE-2026-19594 | 8.1 | — | — | — | — | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confus | 77d ago |
| CVE-2026-18230 | 8.1 | — | — | — | — | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a S | 77d ago |
| CVE-2026-18057 | 8.1 | — | — | — | — | The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using | 77d ago |
| CVE-2026-16977 | 8.1 | — | — | — | — | The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value tha | 77d ago |
| CVE-2026-18961 | 8.1 | — | — | — | — | The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is v | 77d ago |
| CVE-2026-19091 | 8.1 | — | — | — | — | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerab | 78d ago |
| CVE-2026-18844 | 8.1 | — | — | — | — | The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low En | 78d ago |
| CVE-2026-73227 | 8.1 | — | — | — | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | 78d ago |
| CVE-2026-73225 | 8.1 | — | — | — | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | 78d ago |
| CVE-2026-73223 | 8.1 | — | — | — | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | 78d ago |
