| CVE-2026-63909 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_d | 101d ago |
| CVE-2026-63893 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_p | 101d ago |
| CVE-2026-63889 | 8.1 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walk | 101d ago |
| CVE-2026-53390 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_per | 101d ago |
| CVE-2026-9323 | 8.1 | — | — | — | — | The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() | 102d ago |
| CVE-2026-13445 | 8.1 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to r | 103d ago |
| CVE-2026-45260 | 8.1 | — | — | — | — | Pimcore is an Open Source Data & Experience Management Platform. | 103d ago |
| CVE-2026-13473 | 8.1 | — | — | — | ibm / storage protect | IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is | 103d ago |
| CVE-2026-13448 | 8.1 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability | 103d ago |
| CVE-2026-63094 | 8.1 | — | — | — | — | SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthent | 103d ago |
| CVE-2025-60357 | 8.1 | — | — | — | ahnlab / epp management | AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/a | 103d ago |
| CVE-2026-11961 | 8.1 | — | — | — | — | The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submit | 103d ago |
| CVE-2026-62234 | 8.1 | — | — | — | — | Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webh | 104d ago |
| CVE-2026-62231 | 8.1 | — | — | — | — | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be creat | 104d ago |
| CVE-2026-62209 | 8.1 | — | — | — | openclaw / openclaw | OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode di | 104d ago |
| CVE-2026-43978 | 8.1 | — | — | — | — | wger is a free, open-source workout and fitness manager. | 104d ago |
| CVE-2026-55173 | 8.1 | — | — | — | — | WWBN AVideo is an open source video platform. | 104d ago |
| CVE-2026-44019 | 8.1 | — | — | — | — | Docling Core defines core data types and transformations for the document processing application Docling. | 104d ago |
| CVE-2026-46353 | 8.1 | — | — | — | — | BigBlueButton is an open-source virtual classroom. | 104d ago |
| CVE-2026-46351 | 8.1 | — | — | — | — | BigBlueButton is an open-source virtual classroom. | 104d ago |
| CVE-2021-27137zero day | 8.1 | 4.0% | 3/3 | 43d before | dd-wrt / dd-wrt | An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. | 104d ago |
| CVE-2026-63305 | 8.1 | — | — | — | — | AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCod | 104d ago |
| CVE-2026-63304 | 8.1 | — | — | — | — | AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where th | 104d ago |
| CVE-2026-15008 | 8.1 | — | — | — | — | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is v | 104d ago |
| CVE-2026-12585 | 8.1 | — | — | — | — | The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-r | 104d ago |
| CVE-2026-1609 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 105d ago |
| CVE-2026-59950 | 8.1 | — | — | — | lfprojects / mcp python sdk | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). | 105d ago |
| CVE-2026-58660 | 8.1 | — | — | — | — | Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag | 105d ago |
| CVE-2026-53518 | 8.1 | — | — | — | better-auth / better-auth\/oauth-provider | Better Auth is an authentication and authorization library for TypeScript. | 105d ago |
| CVE-2026-53517 | 8.1 | — | — | — | better-auth / better-auth\/oauth-provider | Better Auth is an authentication and authorization library for TypeScript. | 105d ago |
| CVE-2026-20156 | 8.1 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 105d ago |
| CVE-2026-62685 | 8.1 | — | — | — | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within | 105d ago |
| CVE-2026-42533 | 8.1 | — | — | — | f5 / nginx gateway fabric | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string e | 105d ago |
| CVE-2026-61873 | 8.1 | — | — | — | — | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parame | 105d ago |
| CVE-2026-61443 | 8.1 | — | — | — | — | PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that execu | 105d ago |
| CVE-2026-57821 | 8.1 | — | — | — | apache / fineract | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up t | 105d ago |
| CVE-2026-56287 | 8.1 | — | — | — | apache / fineract | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in | 105d ago |
| CVE-2026-12281 | 8.1 | — | — | — | — | The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled wi | 105d ago |
| CVE-2026-46638 | 8.1 | — | — | — | symfony / twig | Twig is a template language for PHP. | 106d ago |
| CVE-2026-48349 | 8.1 | — | — | — | adobe / animate | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in t | 106d ago |
| CVE-2026-47995 | 8.1 | — | — | — | adobe / commerce | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-pri | 106d ago |
| CVE-2026-47304 | 8.1 | — | — | — | microsoft / .net framework | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feat | 106d ago |
| CVE-2026-58617 | 8.1 | — | — | — | microsoft / 365 copilot | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges ove | 106d ago |
| CVE-2026-56186 | 8.1 | — | — | — | microsoft / windows 10 1607 | Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network. | 106d ago |
| CVE-2026-50686 | 8.1 | — | — | — | microsoft / windows 10 1607 | Access of resource using incompatible type ('type confusion') in Windows OLE allows an unauthorized attacker to ex | 106d ago |
| CVE-2026-50487 | 8.1 | — | — | — | microsoft / windows 11 24h2 | Use after free in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network. | 106d ago |
| CVE-2026-50460 | 8.1 | — | — | — | microsoft / windows 10 1809 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime all | 106d ago |
| CVE-2026-50439 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a n | 106d ago |
| CVE-2026-45074 | 8.1 | — | — | — | sensiolabs / symfony | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. | 106d ago |
| CVE-2026-58595 | 8.1 | — | — | — | microsoft / bing search | Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker | 106d ago |
| CVE-2026-56169 | 8.1 | — | — | — | microsoft / windows admin center | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network | 106d ago |
| CVE-2026-54995 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code ove | 106d ago |
| CVE-2026-50694 | 8.1 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code | 106d ago |
| CVE-2026-49164 | 8.1 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code ove | 106d ago |
| CVE-2026-42900 | 8.1 | — | — | — | microsoft / windows 10 1607 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store a | 106d ago |
| CVE-2026-15427 | 8.1 | — | — | — | tp-link / archer vx1800v firmware | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to | 106d ago |
| CVE-2026-58476 | 8.1 | — | — | — | dan-in-ca / sustainable irrigation platform | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability t | 106d ago |
| CVE-2026-12583 | 8.1 | — | — | — | — | The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored th | 106d ago |
| CVE-2026-12511 | 8.1 | — | — | — | — | The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a | 106d ago |
| CVE-2026-44745 | 8.1 | — | — | — | — | SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain confi | 107d ago |
