| CVE-2026-18712 | 8.1 | — | — | — | — | An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with pr | 78d ago |
| CVE-2026-18690 | 8.1 | — | — | — | — | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an act | 78d ago |
| CVE-2026-71331 | 8.1 | — | — | — | microsoft / windows 10 1809 | Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execu | 78d ago |
| CVE-2026-70340 | 8.1 | — | — | — | microsoft / azure cyclecloud | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 78d ago |
| CVE-2026-66802 | 8.1 | — | — | — | microsoft / windows 10 1809 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Heal | 78d ago |
| CVE-2026-65796 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a | 78d ago |
| CVE-2026-65789 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 78d ago |
| CVE-2026-65679 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a | 78d ago |
| CVE-2026-63520exploited | 8.1 | 0.96% | 1/3 | +14d | microsoft / sharepoint server | Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a ne | 78d ago |
| CVE-2026-62889 | 8.1 | — | — | — | microsoft / windows 10 1607 | Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code ove | 78d ago |
| CVE-2026-62820 | 8.1 | — | — | — | microsoft / windows 10 1607 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows | 78d ago |
| CVE-2026-62819 | 8.1 | — | — | — | microsoft / windows 10 1607 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized | 78d ago |
| CVE-2026-62792 | 8.1 | — | — | — | microsoft / windows 10 1607 | Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | 78d ago |
| CVE-2026-62781 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network. | 78d ago |
| CVE-2026-62778 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DNS allows an unauthorized attacker to elevate privileges over a network. | 78d ago |
| CVE-2026-48440 | 8.1 | — | — | — | adobe / coldfusion | ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution | 78d ago |
| CVE-2026-72921 | 8.1 | — | — | — | — | SeaweedFS is a distributed storage system. | 78d ago |
| CVE-2026-18129 | 8.1 | — | — | — | — | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 all | 78d ago |
| CVE-2026-72596 | 8.1 | — | — | — | — | A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to dele | 78d ago |
| CVE-2026-72595 | 8.1 | — | — | — | — | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to upda | 78d ago |
| CVE-2026-72563 | 8.1 | — | — | — | — | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to over | 78d ago |
| CVE-2026-72555 | 8.1 | — | — | — | — | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Confi | 78d ago |
| CVE-2026-15560 | 8.1 | — | — | — | — | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object | 78d ago |
| CVE-2026-15556 | 8.1 | — | — | — | — | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements match | 78d ago |
| CVE-2026-73030 | 8.1 | — | — | — | — | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_director | 79d ago |
| CVE-2026-72903 | 8.1 | — | — | — | — | Tabby (formerly Terminus) is a highly configurable terminal emulator. | 79d ago |
| CVE-2026-15467 | 8.1 | — | — | — | — | A flaw was found in the trustyai-service-operator's LMEvalJob controller. | 79d ago |
| CVE-2026-68376 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp | 79d ago |
| CVE-2026-68373 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: at76c50x-usb: avoid length underflow in | 79d ago |
| CVE-2026-68353 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware num_m | 79d ago |
| CVE-2026-68100 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate num_subauth when copying ACE i | 79d ago |
| CVE-2026-66407 | 8.1 | — | — | — | — | DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. | 79d ago |
| CVE-2026-18469 | 8.1 | — | — | — | — | The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against | 79d ago |
| CVE-2026-18468 | 8.1 | — | — | — | — | The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to th | 79d ago |
| CVE-2026-18030 | 8.1 | — | — | — | — | The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a pa | 79d ago |
| CVE-2026-13600 | 8.1 | — | — | — | — | The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before | 79d ago |
| CVE-2026-17017 | 8.1 | — | — | — | — | The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using | 80d ago |
| CVE-2026-16948 | 8.1 | — | — | — | — | The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions a | 81d ago |
| CVE-2026-16267 | 8.1 | — | — | — | — | The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value take | 81d ago |
| CVE-2026-16030 | 8.1 | — | — | — | — | The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token u | 82d ago |
| CVE-2026-15361 | 8.1 | — | — | — | — | The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and d | 82d ago |
| CVE-2026-70634 | 8.1 | — | — | — | timescale / timescaledb | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression | 83d ago |
| CVE-2026-64665 | 8.1 | — | — | — | — | Statamic is a Laravel and Git powered content management system (CMS). | 83d ago |
| CVE-2026-5857 | 8.1 | — | — | — | — | Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before chec | 83d ago |
| CVE-2026-48081 | 8.1 | — | — | — | — | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. | 83d ago |
| CVE-2026-43632 | 8.1 | — | — | — | — | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting | 83d ago |
| CVE-2026-43631 | 8.1 | — | — | — | — | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of ll | 83d ago |
| CVE-2026-43629 | 8.1 | — | — | — | — | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore pa | 83d ago |
| CVE-2026-19153 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote at | 83d ago |
| CVE-2026-19111 | 8.1 | — | — | — | — | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Stra | 83d ago |
| CVE-2026-66710 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. | 83d ago |
| CVE-2026-65570 | 8.1 | — | — | — | — | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | 83d ago |
| CVE-2026-57818 | 8.1 | — | — | — | apache / cxf | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times | 83d ago |
| CVE-2026-57817 | 8.1 | — | — | — | apache / cxf | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating | 83d ago |
| CVE-2026-15459zero day | 8.1 | 0.87% | 1/3 | same day | — | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and incl | 83d ago |
| CVE-2026-71320 | 8.1 | — | — | — | — | Nuxt is an open-source web development framework for Vue.js. | 84d ago |
| CVE-2025-63822 | 8.1 | — | — | — | — | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. | 84d ago |
| CVE-2026-18411 | 8.1 | — | — | — | — | The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentica | 84d ago |
| CVE-2026-70617 | 8.1 | — | — | — | — | Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated | 84d ago |
| CVE-2026-66881 | 8.1 | — | — | — | livebook / livebook | Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a fil | 84d ago |
