| CVE-2026-41071 | 8.1 | — | — | — | struktur / libheif | libheif is a HEIF and AVIF file format decoder and encoder. | 159d ago |
| CVE-2026-40172 | 8.1 | — | — | — | — | authentik is an open-source identity provider. | 159d ago |
| CVE-2026-46727 | 8.1 | — | — | — | ruby-lang / ruby | An issue was discovered in Ruby 4 before 4.0.5. | 159d ago |
| CVE-2026-9256 | 8.1 | — | — | — | f5 / nginx open source | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. | 159d ago |
| CVE-2026-9277 | 8.1 | — | — | — | — | shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. | 159d ago |
| CVE-2026-48242 | 8.1 | — | — | — | — | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password | 160d ago |
| CVE-2026-48241 | 8.1 | — | — | — | — | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing datab | 160d ago |
| CVE-2026-45760 | 8.1 | — | — | — | — | (Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled K | 160d ago |
| CVE-2026-44051 | 8.1 | — | — | — | — | An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker t | 160d ago |
| CVE-2026-24218 | 8.1 | — | — | — | nvidia / dgx os | NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image caus | 161d ago |
| CVE-2026-45584 | 8.1 | — | — | — | microsoft / malware protection engine | Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. | 161d ago |
| CVE-2026-47784 | 8.1 | — | — | — | memcached / memcached | In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel beca | 161d ago |
| CVE-2026-47783 | 8.1 | — | — | — | memcached / memcached | In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel beca | 161d ago |
| CVE-2026-43618 | 8.1 | — | — | — | samba / rsync | Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32 | 162d ago |
| CVE-2026-34358 | 8.1 | — | — | — | — | CtrlPanel is open-source billing software for hosting providers. | 162d ago |
| CVE-2026-47107 | 8.1 | — | — | — | — | Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration | 162d ago |
| CVE-2026-8711 | 8.1 | — | — | — | f5 / njs | NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-contr | 162d ago |
| CVE-2026-8969 | 8.1 | — | — | — | mozilla / firefox | Mitigation bypass in the DOM: Security component. | 162d ago |
| CVE-2026-8962 | 8.1 | — | — | — | mozilla / firefox | Mitigation bypass in the DOM: Security component. | 162d ago |
| CVE-2026-7504 | 8.1 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak's URL validation logic during redirect operations. | 162d ago |
| CVE-2026-24792 | 8.1 | — | — | — | — | in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps. | 163d ago |
| CVE-2026-8851 | 8.1 | — | — | — | — | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functio | 163d ago |
| CVE-2026-45665 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-45301 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-44565 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-45402 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-45675 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-44554 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-44553 | 8.1 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-46407 | 8.1 | — | — | — | — | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. | 166d ago |
| CVE-2026-35194 | 8.1 | — | — | — | apache / flink | Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authentic | 166d ago |
| CVE-2026-4094 | 8.1 | — | — | — | — | The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data lo | 166d ago |
| CVE-2026-28761 | 8.1 | — | — | — | — | Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev22 | 166d ago |
| CVE-2026-8629 | 8.1 | — | — | — | — | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared visibility-onl | 167d ago |
| CVE-2026-44633 | 8.1 | — | — | — | — | Live Helper Chat is an open-source application that enables live support websites. | 167d ago |
| CVE-2026-42897zero day | 8.1 | 70.7% | 3/3 | same day | microsoft / exchange server | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server | 167d ago |
| CVE-2026-4030 | 8.1 | — | — | — | — | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deleti | 167d ago |
| CVE-2026-3892 | 8.1 | — | — | — | — | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file delet | 167d ago |
| CVE-2026-29206 | 8.1 | — | — | — | — | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of t | 168d ago |
| CVE-2026-42463 | 8.1 | — | — | — | fit2cloud / sqlbot | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. | 168d ago |
| CVE-2026-45055 | 8.1 | — | — | — | — | CubeCart is an ecommerce software solution. | 168d ago |
| CVE-2026-42602 | 8.1 | — | — | — | opentelemetry / opentelemetry collector contrib | azureauthextension is the Azure Authenticator Extension. | 168d ago |
| CVE-2026-0250 | 8.1 | — | — | — | paloaltonetworks / globalprotect | A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middl | 168d ago |
| CVE-2026-0244 | 8.1 | — | — | — | paloaltonetworks / prisma sd-wan | An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-mid | 168d ago |
| CVE-2026-0265 | 8.1 | — | — | — | paloaltonetworks / pan-os | An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker w | 168d ago |
| CVE-2026-44574 | 8.1 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 168d ago |
| CVE-2026-6282 | 8.1 | — | — | — | — | A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices | 168d ago |
| CVE-2026-44291 | 8.1 | — | — | — | protobufjs project / protobufjs | protobufjs compiles protobuf definitions into JavaScript (JS) functions. | 168d ago |
| CVE-2026-42945exploited | 8.1 | 68.0% | 1/3 | +3d | f5 / dos | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. | 168d ago |
| CVE-2026-20916 | 8.1 | — | — | — | f5 / big-iq centralized management | An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclose | 168d ago |
| CVE-2026-7635 | 8.1 | — | — | — | — | The coreActivity: Activity Logging for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all | 169d ago |
| CVE-2026-44548 | 8.1 | — | — | — | — | ChurchCRM is an open-source church management system. | 169d ago |
| CVE-2026-44304 | 8.1 | — | — | — | — | Lemur manages TLS certificate creation. | 169d ago |
| CVE-2026-44301 | 8.1 | — | — | — | gohugo / hugo | Hugo is a static site generator. | 169d ago |
| CVE-2026-44260 | 8.1 | — | — | — | — | efw4.X is an Enterprise Framework for Web. | 169d ago |
| CVE-2026-8430 | 8.1 | — | — | — | — | SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to | 169d ago |
| CVE-2026-40415 | 8.1 | — | — | — | microsoft / windows 10 1809 | Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network. | 169d ago |
| CVE-2026-30808 | 8.1 | — | — | — | artica / pandora fms | Session Fixation vulnerability allows Session Hijacking via crafted session ID. | 169d ago |
| CVE-2026-43983 | 8.1 | — | — | — | pocket-id / pocket id | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. | 169d ago |
| CVE-2026-43938 | 8.1 | — | — | — | — | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. | 169d ago |
