| CVE-2026-39555 | 8.1 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. | 148d ago |
| CVE-2026-39553 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2026-39552 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2025-69369 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2025-68886 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2025-58897 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2025-58707 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2026-39551 | 8.1 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. | 148d ago |
| CVE-2026-39550 | 8.1 | — | — | — | — | Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. | 148d ago |
| CVE-2025-58705 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2025-53440 | 8.1 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 148d ago |
| CVE-2026-5422 | 8.1 | — | — | — | jupyter / jupyter server | A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary | 148d ago |
| CVE-2026-49121 | 8.1 | — | — | — | amd / aiter | AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability i | 149d ago |
| CVE-2026-45281 | 8.1 | — | — | — | nextcloud / nextcloud server | Nextcloud is an open source content collaboration platform. | 149d ago |
| CVE-2026-41013 | 8.1 | — | — | — | — | Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release allows low-privilege | 149d ago |
| CVE-2026-45156 | 8.1 | — | — | — | — | Nextcloud is an open source content collaboration platform. | 149d ago |
| CVE-2026-44825exploited | 8.1 | 3.9% | 1/3 | +51d | apache / solr | Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 | 149d ago |
| CVE-2026-42588 | 8.1 | — | — | — | apache / activemq | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Activ | 149d ago |
| CVE-2026-8796 | 8.1 | — | — | — | — | Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. | 150d ago |
| CVE-2026-49490 | 8.1 | — | — | — | — | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authe | 150d ago |
| CVE-2026-47740 | 8.1 | — | — | — | — | Shopper is a Headless e-commerce Admin Panel. | 152d ago |
| CVE-2026-45707 | 8.1 | — | — | — | n8n-mcp / n8n-mcp | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. | 152d ago |
| CVE-2026-44237 | 8.1 | — | — | — | sangoma / freepbx | FreePBX is an open source IP PBX. | 152d ago |
| CVE-2026-6075 | 8.1 | — | — | — | — | The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and | 152d ago |
| CVE-2026-9964 | 8.1 | — | — | — | google / chrome | Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a use | 153d ago |
| CVE-2026-45344 | 8.1 | — | — | — | — | LinkAce is a self-hosted archive to collect website links. | 153d ago |
| CVE-2026-44973 | 8.1 | — | — | — | — | Billy is an interface filesystem abstraction for Go. | 153d ago |
| CVE-2026-44882 | 8.1 | — | — | — | portainer / portainer | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be | 153d ago |
| CVE-2026-46828 | 8.1 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). | 153d ago |
| CVE-2026-35277 | 8.1 | — | — | — | oracle / rest data services | Vulnerability in Oracle REST Data Services (component: Core). | 153d ago |
| CVE-2026-9095 | 8.1 | — | — | — | — | Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. | 153d ago |
| CVE-2026-46232 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A de | 153d ago |
| CVE-2026-46138 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix OOB read and infinit | 153d ago |
| CVE-2026-6455 | 8.1 | — | — | — | — | The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitr | 153d ago |
| CVE-2026-46402 | 8.1 | — | — | — | — | Microsoft UFO open-source framework for intelligent automation across devices and platforms. | 154d ago |
| CVE-2026-48064 | 8.1 | — | — | — | — | pam_usb provides hardware authentication for Linux using ordinary removable media. | 154d ago |
| CVE-2026-48152 | 8.1 | — | — | — | — | Budibase is an open-source low-code platform. | 154d ago |
| CVE-2026-48149 | 8.1 | — | — | — | — | Budibase is an open-source low-code platform. | 154d ago |
| CVE-2026-42790 | 8.1 | — | — | — | erlang / erlang\/otp | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows | 154d ago |
| CVE-2026-44838 | 8.1 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 154d ago |
| CVE-2026-46099 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl l | 154d ago |
| CVE-2026-46010 | 8.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix error handling in rxgk_extract_toke | 154d ago |
| CVE-2026-48906 | 8.1 | — | — | — | tassos / advanced custom fields | The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites. | 154d ago |
| CVE-2025-13392 | 8.1 | — | — | — | synology / diskstation manager | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) be | 154d ago |
| CVE-2026-8994 | 8.1 | — | — | — | — | The Login with NEAR plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin | 154d ago |
| CVE-2026-45574 | 8.1 | — | — | — | — | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. | 155d ago |
| CVE-2026-44900 | 8.1 | — | — | — | — | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. | 155d ago |
| CVE-2026-8855 | 8.1 | — | — | — | ibm / http server | IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TL | 155d ago |
| CVE-2026-48695 | 8.1 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router i | 155d ago |
| CVE-2026-48694 | 8.1 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router | 155d ago |
| CVE-2026-48692 | 8.1 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanis | 155d ago |
| CVE-2026-43935 | 8.1 | — | — | — | — | e107 is a content management system (CMS). | 155d ago |
| CVE-2026-48132 | 8.1 | — | — | — | — | The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UD | 155d ago |
| CVE-2026-48131 | 8.1 | — | — | — | — | The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early s | 155d ago |
| CVE-2026-8046 | 8.1 | — | — | — | — | The affected products insufficiently verify authorization when deleting user accounts. | 155d ago |
| CVE-2026-48842exploited | 8.1 | 1.7% | 1/3 | +119d | — | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_ | 156d ago |
| CVE-2026-45361 | 8.1 | — | — | — | apache / apache-airflow-providers-google | Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing S | 156d ago |
| CVE-2026-25193 | 8.1 | — | — | — | gallagher / active directory sync | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to | 156d ago |
| CVE-2026-9397 | 8.1 | — | — | — | — | A weakness has been identified in Besen BS20 EV Charging Station up to 20260426. | 157d ago |
| CVE-2026-41076 | 8.1 | — | — | — | — | RT is an open source, enterprise-grade issue and ticket tracking system. | 159d ago |
