| CVE-2026-43735 | 8.1 | — | — | — | apple / safari | The issue was addressed with improved checks. | 121d ago |
| CVE-2026-57950 | 8.1 | — | — | — | — | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOr | 121d ago |
| CVE-2026-40524 | 8.1 | — | — | — | — | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where t | 121d ago |
| CVE-2026-40523 | 8.1 | — | — | — | — | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows | 121d ago |
| CVE-2026-8095 | 8.1 | — | — | — | — | The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in ver | 123d ago |
| CVE-2026-10820 | 8.1 | — | — | — | — | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPre | 123d ago |
| CVE-2026-31928 | 8.1 | — | — | — | daktronics / dmp-5000 firmware | The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, whic | 124d ago |
| CVE-2026-56876 | 8.1 | — | — | — | max-mapper / extract-zip | extract-zip does not validate symlink targets when extracting zip archives. | 124d ago |
| CVE-2026-57645 | 8.1 | — | — | — | — | newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. | 124d ago |
| CVE-2026-56031 | 8.1 | — | — | — | — | Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. | 124d ago |
| CVE-2026-9222 | 8.1 | — | — | — | — | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when | 125d ago |
| CVE-2026-22879 | 8.1 | — | — | — | — | vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability | 125d ago |
| CVE-2026-11800 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 125d ago |
| CVE-2025-71340 | 8.1 | — | — | — | — | picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.r | 125d ago |
| CVE-2025-71335 | 8.1 | — | — | — | flowiseai / flowise | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session toke | 125d ago |
| CVE-2026-9800 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak Policy Enforcer. | 125d ago |
| CVE-2026-56123 | 8.1 | — | — | — | dest-unreach / socat | socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious | 125d ago |
| CVE-2026-45233 | 8.1 | — | — | — | — | HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers | 125d ago |
| CVE-2026-54845 | 8.1 | — | — | — | — | Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions. | 125d ago |
| CVE-2026-54842 | 8.1 | — | — | — | — | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Con | 125d ago |
| CVE-2026-53254 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC | 125d ago |
| CVE-2026-53178 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtw_mlme: add bounds check | 125d ago |
| CVE-2026-53147 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet s | 125d ago |
| CVE-2026-12246 | 8.1 | — | — | — | nlnetlabs / nsd | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for | 125d ago |
| CVE-2026-55762 | 8.1 | — | — | — | — | Rocket.Chat is an open-source, secure, fully customizable communications platform. | 126d ago |
| CVE-2026-52801 | 8.1 | — | — | — | — | Gogs is an open source self-hosted Git service. | 126d ago |
| CVE-2026-48725 | 8.1 | — | — | — | — | Warp is an agentic development environment. | 126d ago |
| CVE-2026-52967 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob | 126d ago |
| CVE-2026-35025 | 8.1 | — | — | — | proftpd / proftpd | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP | 126d ago |
| CVE-2025-71361 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowi | 126d ago |
| CVE-2025-71354 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetTe | 126d ago |
| CVE-2026-54513 | 8.1 | — | — | — | fasterxml / jackson-databind | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 127d ago |
| CVE-2026-54512 | 8.1 | — | — | — | fasterxml / jackson-databind | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 127d ago |
| CVE-2026-39253 | 8.1 | — | — | — | — | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common | 127d ago |
| CVE-2026-52845 | 8.1 | — | — | — | caddyserver / caddy | Caddy is an extensible server platform that uses TLS by default. | 127d ago |
| CVE-2026-49402 | 8.1 | — | — | — | deno / deno | Deno is a JavaScript, TypeScript, and WebAssembly runtime. | 127d ago |
| CVE-2026-45135 | 8.1 | — | — | — | caddyserver / caddy | Caddy is an extensible server platform that uses TLS by default. | 127d ago |
| CVE-2026-45732 | 8.1 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 127d ago |
| CVE-2026-35019 | 8.1 | — | — | — | — | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that a | 127d ago |
| CVE-2026-56784 | 8.1 | — | — | — | — | OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm delet | 127d ago |
| CVE-2026-56379 | 8.1 | — | — | — | imagemagick / imagemagick | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allow | 127d ago |
| CVE-2026-56258 | 8.1 | — | — | — | kidocode / crawl4ai | Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allo | 127d ago |
| CVE-2026-56243 | 8.1 | — | — | — | — | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plain | 127d ago |
| CVE-2025-71376 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_comp | 127d ago |
| CVE-2025-71370 | 8.1 | — | — | — | — | picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls emb | 127d ago |
| CVE-2025-71365 | 8.1 | — | — | — | — | picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval functio | 127d ago |
| CVE-2025-71341 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing | 127d ago |
| CVE-2025-71358 | 8.1 | — | — | — | — | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get | 128d ago |
| CVE-2025-71344 | 8.1 | — | — | — | — | picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in fu | 128d ago |
| CVE-2025-71339 | 8.1 | — | — | — | — | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ meth | 128d ago |
| CVE-2026-44271 | 8.1 | — | — | — | dell / wyse management suite | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elemen | 128d ago |
| CVE-2026-55388 | 8.1 | — | — | — | — | piscina is a node.js worker pool implementation. | 128d ago |
| CVE-2026-9072 | 8.1 | — | — | — | ibm / i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management w | 128d ago |
| CVE-2026-41045 | 8.1 | — | — | — | presire / qsnapper | A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to | 128d ago |
| CVE-2023-45796 | 8.1 | — | — | — | — | A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up | 128d ago |
| CVE-2025-66336 | 8.1 | — | — | — | apache / doris mcp server | Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. | 128d ago |
| CVE-2025-71378 | 8.1 | — | — | — | mmaitre314 / picklescan | picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing at | 129d ago |
| CVE-2025-71357 | 8.1 | — | — | — | mmaitre314 / picklescan | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcomma | 129d ago |
| CVE-2025-71348 | 8.1 | — | — | — | mmaitre314 / picklescan | picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config | 129d ago |
| CVE-2026-56345 | 8.1 | — | — | — | — | AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.p | 130d ago |
