| CVE-2025-71359 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.load | 117d ago |
| CVE-2025-71356 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_ | 117d ago |
| CVE-2025-71353 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get | 117d ago |
| CVE-2025-71347 | 8.1 | — | — | — | — | picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function | 117d ago |
| CVE-2025-71345 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_au | 117d ago |
| CVE-2025-71343 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.ma | 117d ago |
| CVE-2025-71342 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce meth | 117d ago |
| CVE-2026-58293 | 8.1 | — | — | — | microsoft / edge chromium | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execut | 117d ago |
| CVE-2026-58286 | 8.1 | — | — | — | microsoft / edge chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing ove | 117d ago |
| CVE-2026-58283 | 8.1 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 117d ago |
| CVE-2026-58282 | 8.1 | — | — | — | microsoft / edge chromium | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing ove | 117d ago |
| CVE-2026-28744 | 8.1 | — | — | — | — | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass | 117d ago |
| CVE-2026-28699 | 8.1 | — | — | — | — | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP | 117d ago |
| CVE-2026-22555 | 8.1 | — | — | — | — | Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the C | 117d ago |
| CVE-2026-8286 | 8.1 | — | — | — | haxx / curl | A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing li | 117d ago |
| CVE-2026-13368 | 8.1 | — | — | — | watchguard / fireware | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication | 118d ago |
| CVE-2026-50722 | 8.1 | — | — | — | libreswan / libreswan | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER enco | 118d ago |
| CVE-2026-50721 | 8.1 | — | — | — | libreswan / libreswan | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the | 118d ago |
| CVE-2026-7311 | 8.1 | — | — | — | — | The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due | 118d ago |
| CVE-2026-9272 | 8.1 | — | — | — | progress / flowmon anomaly detection system | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is aut | 118d ago |
| CVE-2026-55119 | 8.1 | — | — | — | ui / unifi talk application | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerabi | 118d ago |
| CVE-2026-57751 | 8.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions. | 118d ago |
| CVE-2026-42382 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | 118d ago |
| CVE-2026-27412 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. | 118d ago |
| CVE-2025-58902 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. | 118d ago |
| CVE-2026-8147 | 8.1 | — | — | — | lfprojects / mlflow | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper a | 118d ago |
| CVE-2026-5821 | 8.1 | — | — | — | — | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1 | 118d ago |
| CVE-2026-5120 | 8.1 | — | — | — | — | A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user | 119d ago |
| CVE-2026-53903 | 8.1 | — | — | — | mycomplianceoffice / mycomplianceoffice | MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/ | 119d ago |
| CVE-2026-11794 | 8.1 | — | — | — | — | The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the Wor | 119d ago |
| CVE-2026-10750 | 8.1 | — | — | — | — | The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools a | 119d ago |
| CVE-2026-56286 | 8.1 | — | — | — | — | Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows | 120d ago |
| CVE-2026-56264 | 8.1 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.7 contains an arbitrary JavaScript execution vulnerability in the Docker API server's /execute | 120d ago |
| CVE-2026-14122 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 al | 120d ago |
| CVE-2026-14111 | 8.1 | — | — | — | google / chrome | Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to i | 120d ago |
| CVE-2026-14090 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 al | 120d ago |
| CVE-2026-14032 | 8.1 | — | — | — | google / chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a use | 120d ago |
| CVE-2026-14011 | 8.1 | — | — | — | google / chrome | Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform | 120d ago |
| CVE-2026-13974 | 8.1 | — | — | — | google / chrome | Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypa | 120d ago |
| CVE-2026-13864 | 8.1 | — | — | — | google / chrome | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convince | 120d ago |
| CVE-2026-13819 | 8.1 | — | — | — | google / chrome | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compr | 120d ago |
| CVE-2026-13806 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remo | 120d ago |
| CVE-2026-13799 | 8.1 | — | — | — | google / chrome | Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit he | 120d ago |
| CVE-2026-13791 | 8.1 | — | — | — | google / chrome | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacke | 120d ago |
| CVE-2026-13787 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execu | 120d ago |
| CVE-2026-13779 | 8.1 | — | — | — | google / chrome | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to exec | 120d ago |
| CVE-2026-13774 | 8.1 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to i | 120d ago |
| CVE-2025-71374 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle redu | 120d ago |
| CVE-2025-71371 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduc | 120d ago |
| CVE-2025-71368 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing a | 120d ago |
| CVE-2025-71363 | 8.1 | — | — | — | — | picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers | 120d ago |
| CVE-2025-71352 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file | 120d ago |
| CVE-2025-71350 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in redu | 120d ago |
| CVE-2025-71349 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowi | 120d ago |
| CVE-2025-36359 | 8.1 | — | — | — | ibm / devops automation | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could | 120d ago |
| CVE-2026-58377 | 8.1 | — | — | — | — | JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege use | 120d ago |
| CVE-2026-58372 | 8.1 | — | — | — | — | SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that | 120d ago |
| CVE-2026-58370 | 8.1 | — | — | — | — | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. | 120d ago |
| CVE-2026-49877 | 8.1 | — | — | — | apache / activemq | Improper Authorization vulnerability in Apache ActiveMQ. | 120d ago |
| CVE-2026-7656 | 8.1 | — | — | — | zephyrproject / zephyr | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input | 121d ago |
