2026 CVEs¶
3755 entries from 2026. 45 ship detection & prevention rules.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2025-71389 — Cal.com Unauthenticated RCE via Next.js RSC Deserialization | Critical (10.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-0881 — Sandbox escape in the Messaging System component. | Critical (10.0) | — | ✅ |
| CVE-2026-102255 — A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place… | Critical (10.0) | — | ✅ |
| CVE-2026-103956 — Missing authentication for critical function in the authentication dependency in Loom for… | Critical (10.0) | — | ✅ |
| CVE-2026-104610 — A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. | Critical (10.0) | — | ✅ |
| CVE-2026-105857 — Payload is a free and open source headless content management system. | Critical (10.0) | — | ✅ |
| CVE-2026-105899 — ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type… | Critical (10.0) | — | ✅ |
| CVE-2026-106102 — Quasar Framework is a framework for building high-performance Vue.js user interfaces. | Critical (10.0) | — | ✅ |
| CVE-2026-106622 — ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could… | Critical (10.0) | — | ✅ |
| CVE-2026-106624 — ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')… | Critical (10.0) | — | ✅ |
| CVE-2026-110536 — A vulnerability was determined in D-Link DIR-868L 2.01b05. | Critical (10.0) | — | ✅ |
| CVE-2026-110957 — A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. | Critical (10.0) | — | ✅ |
| CVE-2026-110958 — A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. | Critical (10.0) | — | ✅ |
| CVE-2026-11756 — A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in… | Critical (10.0) | — | ✅ |
| CVE-2026-11976 — The official MonsterInsights Pro update distribution bucket… | Critical (10.0) | — | ✅ |
| CVE-2026-14812 — The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that… | Critical (10.0) | — | ✅ |
| CVE-2026-15409 — A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000… | Critical (10.0) | — | ✅ |
| CVE-2026-16326 — In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state… | Critical (10.0) | — | ✅ |
| CVE-2026-16498 — The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential… | Critical (10.0) | — | ✅ |
| CVE-2026-16812 — VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a… | Critical (10.0) | — | ✅ |
| CVE-2026-17061 — A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from… | Critical (10.0) | — | ✅ |
| CVE-2026-18452 — DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials… | Critical (10.0) | — | ✅ |
| CVE-2026-19188 — A critical OS command injection vulnerability has been identified in the | Critical (10.0) | — | ✅ |
| CVE-2026-20030 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (10.0) | — | ✅ |
| CVE-2026-20223 — Cisco Secure Workload (formerly Tetration) | Critical (10.0) | Snort | ✅ |
| CVE-2026-20315 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (10.0) | — | ✅ |
| CVE-2026-20317 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (10.0) | — | ✅ |
| CVE-2026-20357 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (10.0) | — | ✅ |
| CVE-2026-20358 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (10.0) | — | ✅ |
| CVE-2026-21962 — Oracle HTTP Server and WebLogic Server Proxy Plugin Authentication Bypass vulnerability. | Critical (10.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-22306 — Download of code without integrity check, inclusion of functionality from untrusted… | Critical (10.0) | — | ✅ |
| CVE-2026-23652 — Microsoft Power Pages | Critical (10.0) | Snort | ✅ |
| CVE-2026-27544 — Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | Critical (10.0) | — | ✅ |
| CVE-2026-33267 — Improper Input Validation vulnerability in Apache Traffic Server. | Critical (10.0) | — | ✅ |
| CVE-2026-33712 — Typebot | Critical (10.0) | Snort | ✅ |
| CVE-2026-39821 — Go standard library (golang.org/x/net/idna) | Critical (10.0) | Snort | ✅ |
| CVE-2026-42901 — Microsoft Entra ID | Critical (10.0) | Snort | ✅ |
| CVE-2026-42933 — Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary… | Critical (10.0) | — | ✅ |
| CVE-2026-4357 — The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can… | Critical (10.0) | — | ✅ |
| CVE-2026-45336 — HireFlow is a web-based interview management system for managing candidates, scheduling… | Critical (10.0) | — | ✅ |
| CVE-2026-45618 — LiquidJS is a Shopify/GitHub Pages compatible template engine. | Critical (10.0) | — | ✅ |
| CVE-2026-46339 — 9Router is an AI router & token saver. | Critical (10.0) | — | ✅ |
CVE-2026-47668 — DbGate /runners/start Code Injection (Unauthenticated RCE) |
Critical (10.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-48056 — Streambert is a cross-platform Electron Desktop App to stream and download video content. | Critical (10.0) | — | ✅ |
| CVE-2026-48168 — PraisonAI is a multi-agent teams system. | Critical (10.0) | — | ✅ |
| CVE-2026-48323 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | Critical (10.0) | — | ✅ |
| CVE-2026-48330 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | Critical (10.0) | — | ✅ |
| CVE-2026-48331 — Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)… | Critical (10.0) | — | ✅ |
| CVE-2026-48449 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that… | Critical (10.0) | — | ✅ |
| CVE-2026-50148 — Metabase is an open-source business intelligence and embedded analytics tool. | Critical (10.0) | — | ✅ |
| CVE-2026-54159 — PrestaShop ps_facetedsearch is a module that adds layered navigation filters. | Critical (10.0) | — | ✅ |
| CVE-2026-5430 — The JWT authentication mechanism accepts tokens signed with algorithms other than those… | Critical (10.0) | — | ✅ |
| CVE-2026-54734 — Prebid Server Java is the Java version of Prebid Server. | Critical (10.0) | — | ✅ |
| CVE-2026-54735 — Prebid Server is an open-source solution for running real-time advertising auctions in… | Critical (10.0) | — | ✅ |
| CVE-2026-54745 — Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… | Critical (10.0) | — | ✅ |
| CVE-2026-55107 — Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications,… | Critical (10.0) | — | ✅ |
| CVE-2026-55572 — e107 is a content management system (CMS). | Critical (10.0) | — | ✅ |
| CVE-2026-56162 — Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate… | Critical (10.0) | — | ✅ |
| CVE-2026-56163 — Missing authentication for critical function in Microsoft Azure Kubernetes Service allows… | Critical (10.0) | — | ✅ |
| CVE-2026-56191 — Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to… | Critical (10.0) | — | ✅ |
| CVE-2026-57106 — Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to… | Critical (10.0) | — | ✅ |
| CVE-2026-57834 — Apache Traffic Server allows request smuggling if chunked messages are malformed. | Critical (10.0) | — | ✅ |
| CVE-2026-58115 — A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All… | Critical (10.0) | — | ✅ |
| CVE-2026-58150 — Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing… | Critical (10.0) | — | ✅ |
| CVE-2026-58162 — The Apache Traffic Server certifier plugin generates certificates based on… | Critical (10.0) | — | ✅ |
| CVE-2026-58231 — SAP Commerce Cloud allows an unauthenticated | Critical (10.0) | — | ✅ |
| CVE-2026-58275 — Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges… | Critical (10.0) | — | ✅ |
| CVE-2026-58630 — Improper access control in Azure App Service allows an unauthorized attacker to elevate… | Critical (10.0) | — | ✅ |
| CVE-2026-59500 — CWE-287: Improper Authentication | Critical (10.0) | — | ✅ |
| CVE-2026-59555 — Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. | Critical (10.0) | — | ✅ |
| CVE-2026-60366 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | Critical (10.0) | — | ✅ |
| CVE-2026-61241 — Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware… | Critical (10.0) | — | ✅ |
| CVE-2026-61539 — Xinference is an inference API for running open-source, speech, and multimodal models. | Critical (10.0) | — | ✅ |
| CVE-2026-61732 — Decepticon is an autonomous hacking agent for red teams. | Critical (10.0) | — | ✅ |
| CVE-2026-61962 — Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | Critical (10.0) | — | ✅ |
| CVE-2026-62104 — Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. | Critical (10.0) | — | ✅ |
| CVE-2026-62825 — Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate… | Critical (10.0) | — | ✅ |
| CVE-2026-62874 — Insufficient verification of data authenticity in Azure Billing allows an unauthorized… | Critical (10.0) | — | ✅ |
| CVE-2026-63508 — Missing authentication for critical function in Microsoft Planetary Computer Pro allows… | Critical (10.0) | — | ✅ |
| CVE-2026-63688 — Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing… | Critical (10.0) | — | ✅ |
| CVE-2026-63692 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing… | Critical (10.0) | — | ✅ |
| CVE-2026-64812 — In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a… | Critical (10.0) | — | ✅ |
| CVE-2026-64813 — In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible… | Critical (10.0) | — | ✅ |
| CVE-2026-6516 — ManageEngine ADAudit Plus Agent API OS Command Injection (Unauthenticated RCE) | Critical (10.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-65553 — Unauthenticated Remote Code Execution (RCE) in Spider Analyser –… | Critical (10.0) | — | ✅ |
| CVE-2026-65667 — Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate… | Critical (10.0) | — | ✅ |
| CVE-2026-65770 — Improper neutralization of argument delimiters in a command ('argument injection') in… | Critical (10.0) | — | ✅ |
| CVE-2026-65801 — Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized… | Critical (10.0) | — | ✅ |
| CVE-2026-65816 — Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized… | Critical (10.0) | — | ✅ |
CVE-2026-66012 — SiYuan /mcp Missing Authorization (Unauthenticated Workspace RCE) |
Critical (10.0) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-66665 — Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | Critical (10.0) | — | ✅ |
| CVE-2026-66803 — Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute… | Critical (10.0) | — | ✅ |
| CVE-2026-67308 — Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions… | Critical (10.0) | — | ✅ |
| CVE-2026-67429 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | Critical (10.0) | — | ✅ |
| CVE-2026-69083 — SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the… | Critical (10.0) | — | ✅ |
| CVE-2026-69084 — SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes… | Critical (10.0) | — | ✅ |
| CVE-2026-69085 — SiYuan before v3.7.3 contains a SQL injection vulnerability in the… | Critical (10.0) | — | ✅ |
| CVE-2026-69399 — Azure Arc Elevation of Privilege Vulnerability | Critical (10.0) | — | ✅ |
| CVE-2026-69502 — Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker… | Critical (10.0) | — | ✅ |
| CVE-2026-69555 — Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate… | Critical (10.0) | — | ✅ |
| CVE-2026-69836 — Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker… | Critical (10.0) | — | ✅ |
| CVE-2026-69843 — Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to… | Critical (10.0) | — | ✅ |
| CVE-2026-69865 — Authorization bypass through user-controlled key in Microsoft Container Registry allows… | Critical (10.0) | — | ✅ |
| CVE-2026-70200 — Improper limitation of a pathname to a restricted directory ('path traversal') in Azure… | Critical (10.0) | — | ✅ |
| CVE-2026-70352 — Missing authentication for critical function in Azure AI Language allows an unauthorized… | Critical (10.0) | — | ✅ |
| CVE-2026-70880 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (10.0) | — | ✅ |
| CVE-2026-70921 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | Critical (10.0) | — | ✅ |
| CVE-2026-71398 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that… | Critical (10.0) | — | ✅ |
| CVE-2026-72811 — SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention… | Critical (10.0) | — | ✅ |
| CVE-2026-72851 — Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in… | Critical (10.0) | — | ✅ |
| CVE-2026-72898 — Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the… | Critical (10.0) | — | ✅ |
| CVE-2026-72899 — Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared… | Critical (10.0) | — | ✅ |
| CVE-2026-73678 — MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code… | Critical (10.0) | — | ✅ |
| CVE-2026-76008 — A flaw has been found in Comfast CF-N1-S 2.6.0.1. | Critical (10.0) | — | ✅ |
| CVE-2026-76193 — Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF)… | Critical (10.0) | — | ✅ |
| CVE-2026-76195 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | Critical (10.0) | — | ✅ |
| CVE-2026-76197 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | Critical (10.0) | — | ✅ |
| CVE-2026-76460 — A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an… | Critical (10.0) | — | ✅ |
| CVE-2026-76482 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (10.0) | — | ✅ |
| CVE-2026-76657 — Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that… | Critical (10.0) | — | ✅ |
| CVE-2026-76658 — A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer… | Critical (10.0) | — | ✅ |
| CVE-2026-77537 — A malicious actor with access to the network could exploit an Improper Input Validation… | Critical (10.0) | — | ✅ |
| CVE-2026-77550 — A malicious actor with access to the network could exploit an Improper Neutralization of… | Critical (10.0) | — | ✅ |
| CVE-2026-77554 — A malicious actor with access to the network could exploit an Improper Input Validation… | Critical (10.0) | — | ✅ |
| CVE-2026-77946 — A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. | Critical (10.0) | — | ✅ |
| CVE-2026-78167 — A weakness has been identified in EFM ipTIME T16000M 14.20.2. | Critical (10.0) | — | ✅ |
| CVE-2026-79911 — A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. | Critical (10.0) | — | ✅ |
| CVE-2026-81096 — ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a… | Critical (10.0) | — | ✅ |
| CVE-2026-81735 — startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen… | Critical (10.0) | — | ✅ |
| CVE-2026-81779 — Improper Validation of Specified Quantity in Input vulnerability in Silk Themes… | Critical (10.0) | — | ✅ |
| CVE-2026-81780 — Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. | Critical (10.0) | — | ✅ |
| CVE-2026-82222 — Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows… | Critical (10.0) | — | ✅ |
| CVE-2026-82456 — argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP… | Critical (10.0) | — | ✅ |
| CVE-2026-82542 — A weakness has been identified in Tenda HG10 300001138. | Critical (10.0) | — | ✅ |
| CVE-2026-82693 — A vulnerability was determined in Tenda AC1206 15.03.06.23. | Critical (10.0) | — | ✅ |
| CVE-2026-82694 — A vulnerability was identified in Tenda AC1206 15.03.06.23. | Critical (10.0) | — | ✅ |
| CVE-2026-82695 — A security flaw has been discovered in Tenda AC18 15.03.05.19. | Critical (10.0) | — | ✅ |
| CVE-2026-82970 — Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie… | Critical (10.0) | — | ✅ |
| CVE-2026-82971 — A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. | Critical (10.0) | — | ✅ |
| CVE-2026-83711 — Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C… | Critical (10.0) | — | ✅ |
| CVE-2026-83944 — Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate… | Critical (10.0) | — | ✅ |
| CVE-2026-85061 — MapLibre GL JS is an interactive vector tile map library for web browsers. | Critical (10.0) | — | ✅ |
| CVE-2026-85889 — Missing authentication for critical function in Azure AI Foundry allows an unauthorized… | Critical (10.0) | — | ✅ |
| CVE-2026-86152 — A flaw has been found in Tenda CP3 27.5.57.101. | Critical (10.0) | — | ✅ |
| CVE-2026-92937 — vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host… | Critical (10.0) | — | ✅ |
| CVE-2026-92940 — vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to… | Critical (10.0) | — | ✅ |
| CVE-2026-92941 — vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code,… | Critical (10.0) | — | ✅ |
| CVE-2026-92946 — vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is… | Critical (10.0) | — | ✅ |
| CVE-2026-92947 — vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing… | Critical (10.0) | — | ✅ |
| CVE-2026-92953 — vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer… | Critical (10.0) | — | ✅ |
| CVE-2026-92955 — vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers… | Critical (10.0) | — | ✅ |
| CVE-2026-92956 — vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new… | Critical (10.0) | — | ✅ |
| CVE-2026-92960 — vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin:… | Critical (10.0) | — | ✅ |
| CVE-2026-94169 — Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The… | Critical (10.0) | — | ✅ |
| CVE-2026-100706 — kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy… | Critical (9.9) | — | ✅ |
| CVE-2026-100716 — Froxlor is a server administration panel. | Critical (9.9) | — | ✅ |
| CVE-2026-100717 — froxlor is a server administration panel. | Critical (9.9) | — | ✅ |
| CVE-2026-100740 — A vulnerability was detected in D-Link DIR-895L A1_102b07. | Critical (9.9) | — | ✅ |
| CVE-2026-10090 — A flaw was found in the Application Subscription controller… | Critical (9.9) | — | ✅ |
| CVE-2026-105037 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any… | Critical (9.9) | — | ✅ |
| CVE-2026-105080 — In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead… | Critical (9.9) | — | ✅ |
| CVE-2026-105903 — ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')… | Critical (9.9) | — | ✅ |
| CVE-2026-106612 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | Critical (9.9) | — | ✅ |
| CVE-2026-108390 — Hestia Control Panel is a lightweight and powerful control panel for the modern web. | Critical (9.9) | — | ✅ |
| CVE-2026-110812 — Deserialization of untrusted data in the Gremlin graph data import component in Amazon… | Critical (9.9) | — | ✅ |
| CVE-2026-12946 — IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary… | Critical (9.9) | — | ✅ |
| CVE-2026-13435 — IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability… | Critical (9.9) | — | ✅ |
| CVE-2026-14450 — A flaw was found in the MaaS API. | Critical (9.9) | — | ✅ |
| CVE-2026-15068 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated… | Critical (9.9) | — | ✅ |
| CVE-2026-16816 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker… | Critical (9.9) | — | ✅ |
| CVE-2026-17186 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary… | Critical (9.9) | — | ✅ |
| CVE-2026-17566 — pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by… | Critical (9.9) | — | ✅ |
| CVE-2026-18527 — IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i… | Critical (9.9) | — | ✅ |
| CVE-2026-18835 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker… | Critical (9.9) | — | ✅ |
| CVE-2026-18948 — A flaw was found in Feast. | Critical (9.9) | — | ✅ |
| CVE-2026-19295 — IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute… | Critical (9.9) | — | ✅ |
| CVE-2026-19626 — A remote code execution vulnerability exists in Tenable Security Center's report… | Critical (9.9) | — | ✅ |
| CVE-2026-19681 — An authenticated command injection vulnerability exists in Security Center related to… | Critical (9.9) | — | ✅ |
| CVE-2026-19682 — A command injection vulnerability exists in Security Center where a remote,… | Critical (9.9) | — | ✅ |
| CVE-2026-20231 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.9) | — | ✅ |
| CVE-2026-20303 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.9) | — | ✅ |
| CVE-2026-20304 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.9) | — | ✅ |
| CVE-2026-20359 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.9) | — | ✅ |
| CVE-2026-22172 — OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the… | Critical (9.9) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-28363 — In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed… | Critical (9.9) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-28466 — OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it… | Critical (9.9) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32559 — Subscriber Arbitrary File Upload in UltimateAI <= 3.1.0 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-32922 — OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in… | Critical (9.9) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-33579 — OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair… | Critical (9.9) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-46512 — Frogman provides headless PBX control through MCP and HTTP API. | Critical (9.9) | — | ✅ |
| CVE-2026-47724 — nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | Critical (9.9) | — | ✅ |
| CVE-2026-47752 — Tugtainer is a self-hosted app for automating updates of Docker containers. | Critical (9.9) | — | ✅ |
| CVE-2026-48030 — Pheditor is a single-file editor and file manager written in PHP. | Critical (9.9) | — | ✅ |
| CVE-2026-48086 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | Critical (9.9) | — | ✅ |
| CVE-2026-48318 — ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory… | Critical (9.9) | — | ✅ |
| CVE-2026-48326 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | Critical (9.9) | — | ✅ |
| CVE-2026-48749 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-48750 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-48751 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-48752 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-48753 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-48755 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-48765 — TypeBot is a chatbot builder tool. | Critical (9.9) | — | ✅ |
| CVE-2026-48769 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-50481 — Modification of assumed-immutable data (maid) in Azure Active Directory allows an… | Critical (9.9) | — | ✅ |
| CVE-2026-50515 — Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to… | Critical (9.9) | — | ✅ |
| CVE-2026-50517 — Deserialization of untrusted data in M365 Copilot allows an authorized attacker to… | Critical (9.9) | — | ✅ |
| CVE-2026-52855 — Wings is the server control plane for Pterodactyl, a free, open-source game server… | Critical (9.9) | — | ✅ |
| CVE-2026-52891 — Wekan is open source kanban built with Meteor. | Critical (9.9) | — | ✅ |
| CVE-2026-54052 — n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation,… | Critical (9.9) | — | ✅ |
| CVE-2026-54120 — Improper input validation in Microsoft Surface allows an authorized attacker to execute… | Critical (9.9) | — | ✅ |
| CVE-2026-54680 — Logging operator automates the deployment and configuration of Kubernetes logging… | Critical (9.9) | — | ✅ |
| CVE-2026-55089 — Etherpad is a real-time collaborative editor. | Critical (9.9) | — | ✅ |
| CVE-2026-55565 — Yamcs is a mission control framework. | Critical (9.9) | — | ✅ |
| CVE-2026-55634 — Pimcore is an Open Source Data & Experience Management Platform. | Critical (9.9) | — | ✅ |
| CVE-2026-57155 — OPNsense is a FreeBSD based firewall and routing platform. | Critical (9.9) | — | ✅ |
| CVE-2026-57401 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… | Critical (9.9) | — | ✅ |
| CVE-2026-57710 — Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro… | Critical (9.9) | — | ✅ |
| CVE-2026-58046 — Improper neutralization in the Plesk XML-RPC API allows a remote authenticated… | Critical (9.9) | — | ✅ |
| CVE-2026-59115 — '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized… | Critical (9.9) | — | ✅ |
| CVE-2026-59543 — Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-60369 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | Critical (9.9) | — | ✅ |
| CVE-2026-60702 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-60720 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-60730 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-60916 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.9) | — | ✅ |
| CVE-2026-60990 — Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion… | Critical (9.9) | — | ✅ |
| CVE-2026-60995 — Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion… | Critical (9.9) | — | ✅ |
| CVE-2026-61003 — Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-61021 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-61066 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-61206 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | Critical (9.9) | — | ✅ |
| CVE-2026-61248 — Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-61317 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | Critical (9.9) | — | ✅ |
| CVE-2026-62283 — Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M… | Critical (9.9) | — | ✅ |
| CVE-2026-62452 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | Critical (9.9) | — | ✅ |
| CVE-2026-62512 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | Critical (9.9) | — | ✅ |
| CVE-2026-62588 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | Critical (9.9) | — | ✅ |
| CVE-2026-62608 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.9) | — | ✅ |
| CVE-2026-62830 — Missing authorization in Azure SRE Agent allows an authorized attacker to elevate… | Critical (9.9) | — | ✅ |
| CVE-2026-62867 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-62940 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-62941 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-63125 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-63227 — An unrestricted SCORM file upload vulnerability | Critical (9.9) | — | ✅ |
| CVE-2026-63232 — A SQL injection and unsafe deserialisation | Critical (9.9) | — | ✅ |
| CVE-2026-63233 — A SQL injection and unsafe deserialisation | Critical (9.9) | — | ✅ |
| CVE-2026-63234 — A SQL injection and unsafe deserialisation | Critical (9.9) | — | ✅ |
| CVE-2026-63343 — Incus is a system container and virtual machine manager. | Critical (9.9) | — | ✅ |
| CVE-2026-63509 — Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate… | Critical (9.9) | — | ✅ |
| CVE-2026-63732 — 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default… | Critical (9.9) | — | ✅ |
| CVE-2026-65083 — NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API,… | Critical (9.9) | — | ✅ |
| CVE-2026-65093 — NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a… | Critical (9.9) | — | ✅ |
| CVE-2026-65548 — Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-66785 — A flaw was found in Submariner. | Critical (9.9) | — | ✅ |
| CVE-2026-66788 — A flaw was found in Lighthouse. | Critical (9.9) | — | ✅ |
| CVE-2026-66897 — A path traversal vulnerability in LXD's instance template processing allows an attacker… | Critical (9.9) | — | ✅ |
| CVE-2026-66898 — A path traversal vulnerability in LXD allows an attacker to manipulate file system paths… | Critical (9.9) | — | ✅ |
| CVE-2026-67269 — Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an… | Critical (9.9) | — | ✅ |
| CVE-2026-67330 — @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and… | Critical (9.9) | — | ✅ |
| CVE-2026-67567 — A flaw was found in the multicloud-operators-subscription component. | Critical (9.9) | — | ✅ |
| CVE-2026-67622 — Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the… | Critical (9.9) | — | ✅ |
| CVE-2026-68782 — Improper neutralization of special elements used in an sql command ('sql injection') in… | Critical (9.9) | — | ✅ |
| CVE-2026-68789 — Improper neutralization of special elements used in an sql command ('sql injection') in… | Critical (9.9) | — | ✅ |
| CVE-2026-69851 — Server-side request forgery (ssrf) in Azure Active Directory allows an authorized… | Critical (9.9) | — | ✅ |
| CVE-2026-70496 — A flaw was found in search-v2-operator. | Critical (9.9) | — | ✅ |
| CVE-2026-70615 — boringproxy through 0.10.0 contains a newline injection vulnerability that allows… | Critical (9.9) | — | ✅ |
| CVE-2026-70920 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | Critical (9.9) | — | ✅ |
| CVE-2026-71059 — Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web… | Critical (9.9) | — | ✅ |
| CVE-2026-71268 — OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses… | Critical (9.9) | — | ✅ |
| CVE-2026-72603 — An OS command injection vulnerability in wg-easy 15.3.0 allows users with the… | Critical (9.9) | — | ✅ |
| CVE-2026-72733 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72735 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72736 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72738 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72841 — luci-app-openvpn fails to properly validate the instance_name2 parameter during file… | Critical (9.9) | — | ✅ |
| CVE-2026-72842 — luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged… | Critical (9.9) | — | ✅ |
| CVE-2026-72862 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72863 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72864 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72865 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72867 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72868 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72869 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72872 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72876 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72880 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72882 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72886 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72901 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72902 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.9) | — | ✅ |
| CVE-2026-72911 — ERPNext is a free and open source Enterprise Resource Planning tool. | Critical (9.9) | — | ✅ |
| CVE-2026-7329 — An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query… | Critical (9.9) | — | ✅ |
| CVE-2026-73656 — Trigger.dev is a platform for building and deploying fully managed AI agents and… | Critical (9.9) | — | ✅ |
| CVE-2026-73930 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.9) | — | ✅ |
| CVE-2026-73992 — Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-74014 — Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-74016 — Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-74018 — Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. | Critical (9.9) | — | ✅ |
| CVE-2026-75976 — A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. | Critical (9.9) | — | ✅ |
| CVE-2026-76003 — A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. | Critical (9.9) | — | ✅ |
| CVE-2026-76004 — A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. | Critical (9.9) | — | ✅ |
| CVE-2026-76584 — A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. | Critical (9.9) | — | ✅ |
| CVE-2026-76589 — A vulnerability was found in TRENDnet TEW-755AP up to 20260702. | Critical (9.9) | — | ✅ |
| CVE-2026-76590 — A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. | Critical (9.9) | — | ✅ |
| CVE-2026-77009 — The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its… | Critical (9.9) | — | ✅ |
| CVE-2026-77022 — A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. | Critical (9.9) | — | ✅ |
| CVE-2026-77148 — A vulnerability was found in Comfast CF-N1-S 2.6.0.1. | Critical (9.9) | — | ✅ |
| CVE-2026-77524 — KEDA is a Kubernetes-based Event Driven Autoscaling component. | Critical (9.9) | — | ✅ |
| CVE-2026-77533 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77534 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77536 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77543 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77546 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77547 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77548 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77553 — A malicious actor with access to the network and low privileges could exploit an Improper… | Critical (9.9) | — | ✅ |
| CVE-2026-77683 — A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. | Critical (9.9) | — | ✅ |
| CVE-2026-77810 — In the Neptune connector, a user with access to Neptune through Athena Federated Query… | Critical (9.9) | — | ✅ |
| CVE-2026-78050 — A vulnerability was found in Comfast CF-N1-S 2.6.0.1. | Critical (9.9) | — | ✅ |
| CVE-2026-78155 — privilege escalation in StackGres operator allows a low-privilege tenant who owns a… | Critical (9.9) | — | ✅ |
| CVE-2026-78169 — A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. | Critical (9.9) | — | ✅ |
| CVE-2026-79697 — A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB,… | Critical (9.9) | — | ✅ |
| CVE-2026-79698 — A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB,… | Critical (9.9) | — | ✅ |
| CVE-2026-79748 — MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP… | Critical (9.9) | — | ✅ |
| CVE-2026-79798 — SQL injection vulnerabilities in the web-based management interface of ClearPass Policy… | Critical (9.9) | — | ✅ |
| CVE-2026-79901 — In deployments using BoKS keytab management, affected versions of boks_keytabmd generate… | Critical (9.9) | — | ✅ |
| CVE-2026-82041 — UTMStack before 11.2.16 contains a missing authorization vulnerability in… | Critical (9.9) | — | ✅ |
| CVE-2026-82592 — A vulnerability was detected in D-Link DIR-825M 1.1.8. | Critical (9.9) | — | ✅ |
| CVE-2026-82593 — A flaw has been found in D-Link DIR-825M 1.1.8. | Critical (9.9) | — | ✅ |
| CVE-2026-82616 — A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. | Critical (9.9) | — | ✅ |
| CVE-2026-82689 — A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to… | Critical (9.9) | — | ✅ |
| CVE-2026-82692 — A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. | Critical (9.9) | — | ✅ |
| CVE-2026-82874 — ToolJet before v3.16.208 fails to validate that authenticated users belong to the… | Critical (9.9) | — | ✅ |
| CVE-2026-82954 — A vulnerability was detected in Dokploy up to 0.29.7. | Critical (9.9) | — | ✅ |
| CVE-2026-83524 — A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer… | Critical (9.9) | — | ✅ |
| CVE-2026-83772 — A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to… | Critical (9.9) | — | ✅ |
| CVE-2026-8476 — IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution… | Critical (9.9) | — | ✅ |
| CVE-2026-8481 — IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution… | Critical (9.9) | — | ✅ |
| CVE-2026-85031 — A vulnerability was found in TOTOLINK CP450 4.1.0. | Critical (9.9) | — | ✅ |
| CVE-2026-85223 — A vulnerability was found in D-Link DNS-340L 1.01B04. | Critical (9.9) | — | ✅ |
| CVE-2026-85878 — Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to… | Critical (9.9) | — | ✅ |
| CVE-2026-85885 — Improper neutralization of special elements used in a command ('command injection') in… | Critical (9.9) | — | ✅ |
| CVE-2026-86167 — A vulnerability was identified in Tenda HG10 300001138. | Critical (9.9) | — | ✅ |
| CVE-2026-8635 — IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges… | Critical (9.9) | — | ✅ |
| CVE-2026-8709 — An improper privilege management vulnerability in the REST API document patch operation… | Critical (9.9) | — | ✅ |
| CVE-2026-8859 — IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary… | Critical (9.9) | — | ✅ |
| CVE-2026-89310 — A parameter taken from the request body is inserted into | Critical (9.9) | — | ✅ |
| CVE-2026-90970 — GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all… | Critical (9.9) | — | ✅ |
| CVE-2026-9135 — IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit… | Critical (9.9) | — | ✅ |
| CVE-2026-9193 — An improper privilege management vulnerability in the Hadoop integration of Progress… | Critical (9.9) | — | ✅ |
| CVE-2026-92938 — vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code… | Critical (9.9) | — | ✅ |
| CVE-2026-92939 — vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when… | Critical (9.9) | — | ✅ |
| CVE-2026-92948 — vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass… | Critical (9.9) | — | ✅ |
| CVE-2026-92951 — vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external… | Critical (9.9) | — | ✅ |
CVE-2026-92957 — vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating… |
Critical (9.9) | — | ✅ |
| CVE-2026-96658 — A flaw was found in Foreman. | Critical (9.9) | — | ✅ |
| CVE-2026-97381 — Legacy Update is a tool for activating and installing updates on legacy Windows PCs. | Critical (9.9) | — | ✅ |
| CVE-2026-0755 — gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-0756 — github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-101950 — A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos… | Critical (9.8) | — | ✅ |
| CVE-2026-101954 — An Improper Authentication vulnerability in the J-Web management interface and its… | Critical (9.8) | — | ✅ |
| CVE-2026-10196 — The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin… | Critical (9.8) | — | ✅ |
| CVE-2026-101980 — An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with… | Critical (9.8) | — | ✅ |
| CVE-2026-101982 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of… | Critical (9.8) | — | ✅ |
| CVE-2026-101983 — A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks… | Critical (9.8) | — | ✅ |
| CVE-2026-101986 — An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos… | Critical (9.8) | — | ✅ |
| CVE-2026-101990 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of… | Critical (9.8) | — | ✅ |
| CVE-2026-102031 — An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved… | Critical (9.8) | — | ✅ |
| CVE-2026-102115 — Kiteworks Core did not correctly validate a parameter submitted to the password reset… | Critical (9.8) | — | ✅ |
| CVE-2026-102159 — An access-control flaw in the CV-CUE backend may allow an unauthenticated network… | Critical (9.8) | — | ✅ |
| CVE-2026-102175 — A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of… | Critical (9.8) | — | ✅ |
| CVE-2026-102178 — A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks… | Critical (9.8) | — | ✅ |
| CVE-2026-102182 — A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks… | Critical (9.8) | — | ✅ |
| CVE-2026-103244 — ground-station versions before 0.8.0 contain an authentication bypass vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-103752 — Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-103764 — Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in… | Critical (9.8) | — | ✅ |
| CVE-2026-103768 — The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is… | Critical (9.8) | — | ✅ |
| CVE-2026-104070 — The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2026-104286 — An improper limitation of a pathname to a restricted directory ('path traversal')… | Critical (9.8) | — | ✅ |
| CVE-2026-104334 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-104730 — The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin… | Critical (9.8) | — | ✅ |
| CVE-2026-104748 — The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications… | Critical (9.8) | — | ✅ |
| CVE-2026-104798 — The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-104800 — The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions… | Critical (9.8) | — | ✅ |
| CVE-2026-104846 — Seroval facilitates JS value stringification, including complex structures beyond… | Critical (9.8) | — | ✅ |
| CVE-2026-105038 — The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI… | Critical (9.8) | — | ✅ |
| CVE-2026-105105 — CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry… | Critical (9.8) | — | ✅ |
| CVE-2026-105110 — OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices… | Critical (9.8) | — | ✅ |
| CVE-2026-105192 — LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ… | Critical (9.8) | — | ✅ |
| CVE-2026-10579 — A flaw was found in Picketlink Federation SAML; the unsolcited response handler would… | Critical (9.8) | — | ✅ |
| CVE-2026-105845 — Payload is a free and open source headless content management system. | Critical (9.8) | — | ✅ |
| CVE-2026-105859 — Payload is a free and open source headless content management system. | Critical (9.8) | — | ✅ |
| CVE-2026-106446 — Handlebars provides the power necessary to let users build semantic templates. | Critical (9.8) | — | ✅ |
| CVE-2026-107204 — LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2026-107424 — Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashboard… | Critical (9.8) | — | ✅ |
| CVE-2026-107459 — The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. | Critical (9.8) | — | ✅ |
| CVE-2026-108065 — SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in… | Critical (9.8) | — | ✅ |
| CVE-2026-108291 — Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows… | Critical (9.8) | — | ✅ |
| CVE-2026-108587 — The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for… | Critical (9.8) | — | ✅ |
| CVE-2026-109219 — The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all… | Critical (9.8) | — | ✅ |
| CVE-2026-109439 — Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a… | Critical (9.8) | — | ✅ |
| CVE-2026-109515 — The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | Critical (9.8) | — | ✅ |
| CVE-2026-109686 — Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free… | Critical (9.8) | — | ✅ |
| CVE-2026-109694 — Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm… | Critical (9.8) | — | ✅ |
| CVE-2026-109892 — Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by… | Critical (9.8) | — | ✅ |
| CVE-2026-110002 — The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload… | Critical (9.8) | — | ✅ |
| CVE-2026-110392 — Improper neutralization of special elements used in an OS command ('OS command… | Critical (9.8) | — | ✅ |
| CVE-2026-110612 — vlife through 2.0.1 contains an authentication bypass vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110631 — Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery… | Critical (9.8) | — | ✅ |
| CVE-2026-110634 — git-diff before 2.0.7 contains an OS command injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110635 — webp-converter before 3.0.0 contains an OS command injection vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-110636 — pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(),… | Critical (9.8) | — | ✅ |
| CVE-2026-110638 — doc-recog through 1.1.6 contains an OS command injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110639 — @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110640 — Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110643 — transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110644 — nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-110645 — Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that… | Critical (9.8) | — | ✅ |
| CVE-2026-110649 — Stills before 25.24.2 contains an OS command injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-110650 — The thumbnail Python package through 1.5 contains an OS command injection vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2026-110911 — Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are… | Critical (9.8) | — | ✅ |
| CVE-2026-111281 — Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code… | Critical (9.8) | — | ✅ |
| CVE-2026-111322 — Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-111329 — JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456… | Critical (9.8) | — | ✅ |
| CVE-2026-111444 — Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping… | Critical (9.8) | — | ✅ |
| CVE-2026-11613 — The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all… | Critical (9.8) | — | ✅ |
| CVE-2026-12118 — IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote… | Critical (9.8) | — | ✅ |
| CVE-2026-12627 — Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow… | Critical (9.8) | — | ✅ |
| CVE-2026-12692 — Unverified password change vulnerability in Vimesoft Inc. | Critical (9.8) | — | ✅ |
| CVE-2026-12940 — IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code… | Critical (9.8) | — | ✅ |
| CVE-2026-12943 — IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0… | Critical (9.8) | — | ✅ |
| CVE-2026-12949 — The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via… | Critical (9.8) | — | ✅ |
| CVE-2026-13001 — The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file… | Critical (9.8) | — | ✅ |
| CVE-2026-13206 — Improper neutralization of special elements used in an OS command ('OS command… | Critical (9.8) | — | ✅ |
| CVE-2026-13214 — The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in… | Critical (9.8) | — | ✅ |
| CVE-2026-13249 — An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-13446 — IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password… | Critical (9.8) | — | ✅ |
| CVE-2026-13447 — The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT… | Critical (9.8) | — | ✅ |
| CVE-2026-13639 — An insufficient entropy vulnerability in login logic in Synology DiskStation Manager… | Critical (9.8) | — | ✅ |
| CVE-2026-13684 — An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation… | Critical (9.8) | — | ✅ |
| CVE-2026-14175 — Unrestricted upload of file with dangerous type vulnerability in Bilin Software and… | Critical (9.8) | — | ✅ |
| CVE-2026-14281 — The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country… | Critical (9.8) | — | ✅ |
| CVE-2026-14282 — The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for… | Critical (9.8) | — | ✅ |
| CVE-2026-14365 — The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is… | Critical (9.8) | — | ✅ |
| CVE-2026-14378 — The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to… | Critical (9.8) | — | ✅ |
| CVE-2026-14446 — IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access… | Critical (9.8) | — | ✅ |
| CVE-2026-14483 — The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-14494 — The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all… | Critical (9.8) | — | ✅ |
| CVE-2026-14512 — IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-14526 — The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization… | Critical (9.8) | — | ✅ |
| CVE-2026-14900 — The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code… | Critical (9.8) | — | ✅ |
| CVE-2026-14950 — An unauthenticated remote attacker in possession of a valid session identifier is able to… | Critical (9.8) | — | ✅ |
| CVE-2026-14956 — The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all… | Critical (9.8) | — | ✅ |
| CVE-2026-15011 — The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code… | Critical (9.8) | — | ✅ |
| CVE-2026-15013 — The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication… | Critical (9.8) | — | ✅ |
| CVE-2026-15014 — The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery… | Critical (9.8) | — | ✅ |
| CVE-2026-15015 — The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-15303 — The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in… | Critical (9.8) | — | ✅ |
| CVE-2026-15341 — The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass… | Critical (9.8) | — | ✅ |
| CVE-2026-15354 — The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all… | Critical (9.8) | — | ✅ |
| CVE-2026-15369 — The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-15435 — IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27… | Critical (9.8) | — | ✅ |
| CVE-2026-15511 — A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. | Critical (9.8) | — | ✅ |
| CVE-2026-15701 — A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. | Critical (9.8) | — | ✅ |
| CVE-2026-15704 — In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled… | Critical (9.8) | — | ✅ |
| CVE-2026-15706 — Missing authentication for critical function vulnerability in Baylan Measuring… | Critical (9.8) | — | ✅ |
| CVE-2026-15721 — Cleartext storage of sensitive information vulnerability in Bilin Software and… | Critical (9.8) | — | ✅ |
| CVE-2026-15826 — The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via… | Critical (9.8) | — | ✅ |
| CVE-2026-15964 — The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass… | Critical (9.8) | — | ✅ |
| CVE-2026-15980 — The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all… | Critical (9.8) | — | ✅ |
| CVE-2026-15981 — The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication… | Critical (9.8) | — | ✅ |
| CVE-2026-15982 — The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit… | Critical (9.8) | — | ✅ |
| CVE-2026-15989 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-16019 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | Critical (9.8) | — | ✅ |
| CVE-2026-16098 — The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in… | Critical (9.8) | — | ✅ |
| CVE-2026-16142 — The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up… | Critical (9.8) | — | ✅ |
| CVE-2026-16230 — The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due… | Critical (9.8) | — | ✅ |
| CVE-2026-16286 — Unrestricted upload of file with dangerous type vulnerability in TRtek Technological… | Critical (9.8) | — | ✅ |
| CVE-2026-16310 — The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in… | Critical (9.8) | — | ✅ |
| CVE-2026-16462 — In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. | Critical (9.8) | — | ✅ |
| CVE-2026-16606 — A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris… | Critical (9.8) | — | ✅ |
| CVE-2026-16610 — The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote… | Critical (9.8) | — | ✅ |
| CVE-2026-16656 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root… | Critical (9.8) | — | ✅ |
| CVE-2026-16740 — Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. | Critical (9.8) | — | ✅ |
| CVE-2026-16741 — Improper neutralization of special elements used in an OS command ('OS command… | Critical (9.8) | — | ✅ |
| CVE-2026-16834 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a… | Critical (9.8) | — | ✅ |
| CVE-2026-16840 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16845 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16862 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16864 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16872 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16882 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16885 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16894 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16913 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16917 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-16919 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17032 — Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's… | Critical (9.8) | — | ✅ |
| CVE-2026-17040 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17118 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17122 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17136 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17141 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17142 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17145 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17152 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17157 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17160 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17182 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass… | Critical (9.8) | — | ✅ |
| CVE-2026-17184 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-1728 — Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to… | Critical (9.8) | — | ✅ |
| CVE-2026-17482 — IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-17561 — Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim… | Critical (9.8) | — | ✅ |
| CVE-2026-18072 — The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin… | Critical (9.8) | — | ✅ |
| CVE-2026-18080 — The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress… | Critical (9.8) | — | ✅ |
| CVE-2026-18143 — The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File… | Critical (9.8) | — | ✅ |
| CVE-2026-18191 — VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing… | Critical (9.8) | — | ✅ |
| CVE-2026-18315 — The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is… | Critical (9.8) | — | ✅ |
| CVE-2026-18431 — The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up… | Critical (9.8) | — | ✅ |
| CVE-2026-18432 — The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege… | Critical (9.8) | — | ✅ |
| CVE-2026-18550 — The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation… | Critical (9.8) | — | ✅ |
| CVE-2026-18588 — A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. | Critical (9.8) | — | ✅ |
| CVE-2026-18589 — A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. | Critical (9.8) | — | ✅ |
| CVE-2026-18601 — A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18602 — A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18612 — A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18614 — A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18615 — A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18616 — A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18658 — IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1,… | Critical (9.8) | — | ✅ |
| CVE-2026-18684 — A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18685 — A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18686 — A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. | Critical (9.8) | — | ✅ |
| CVE-2026-18765 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | Critical (9.8) | — | ✅ |
| CVE-2026-18808 — Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan… | Critical (9.8) | — | ✅ |
| CVE-2026-19092 — The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from… | Critical (9.8) | — | ✅ |
| CVE-2026-19117 — Under specific conditions, an attacker can register an attacker-controlled FIDO2… | Critical (9.8) | — | ✅ |
| CVE-2026-19264 — Postiz is an open-source social media scheduling tool. | Critical (9.8) | — | ✅ |
| CVE-2026-19286 — IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-19348 — A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. | Critical (9.8) | — | ✅ |
| CVE-2026-19425 — Travel Agency Management System developed by Win Men Intermational has a SQL Injection… | Critical (9.8) | — | ✅ |
| CVE-2026-19598 — The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-19632 — The TranslatePress – Translate Multilingual sites with AI Translation plugin for… | Critical (9.8) | — | ✅ |
| CVE-2026-19652 — The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in… | Critical (9.8) | — | ✅ |
| CVE-2026-19660 — The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all… | Critical (9.8) | — | ✅ |
| CVE-2026-19747 — A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C,… | Critical (9.8) | — | ✅ |
| CVE-2026-19924 — A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. | Critical (9.8) | — | ✅ |
| CVE-2026-20093 — This repository contains a proof-of-concept (PoC) exploit for CVE-2026-20093, a critical… | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-20160 — Cisco Smart Software Manager On-Prem | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-20212 — A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could… | Critical (9.8) | — | ✅ |
| CVE-2026-20272 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-20274 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-20279 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-2346 — Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. | Critical (9.8) | — | ✅ |
| CVE-2026-24254 — NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology,… | Critical (9.8) | — | ✅ |
| CVE-2026-28005 — Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19… | Critical (9.8) | — | ✅ |
| CVE-2026-28008 — Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <=… | Critical (9.8) | — | ✅ |
| CVE-2026-28139 — Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-28148 — Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-28149 — Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-28165 — Unauthenticated Privilege Escalation in Digits <= 9.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-28185 — Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-28323 — SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass… | Critical (9.8) | — | ✅ |
| CVE-2026-28391 — OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-28470 — OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-28474 — OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-30741 — A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-31020 — In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-32038 — OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32253 — Sunshine (self-hosted game streaming server) | Critical (9.8) | Snort | ✅ |
| CVE-2026-32558 — Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce… | Critical (9.8) | — | ✅ |
| CVE-2026-32563 — Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <=… | Critical (9.8) | — | ✅ |
| CVE-2026-32566 — Unauthenticated Privilege Escalation in ACPT (Pro) - Custom Post Types Plugin for… | Critical (9.8) | — | ✅ |
| CVE-2026-32917 — OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32924 — OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32973 — OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32975 — OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32987 — OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device… | Critical (9.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-33789 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of… | Critical (9.8) | — | ✅ |
| CVE-2026-33792 — A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Networks… | Critical (9.8) | — | ✅ |
| CVE-2026-33796 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of… | Critical (9.8) | — | ✅ |
| CVE-2026-34265 — SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit… | Critical (9.8) | — | ✅ |
| CVE-2026-38447 — osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. | Critical (9.8) | — | ✅ |
| CVE-2026-41452 — Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer… | Critical (9.8) | — | ✅ |
| CVE-2026-41939 — Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-42990 — Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-44090 — Due to missing authentication, an unauthenticated remote attacker may access the MQTT… | Critical (9.8) | — | ✅ |
| CVE-2026-44101 — Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated… | Critical (9.8) | — | ✅ |
| CVE-2026-44104 — The firmware update process for the basemodule of the charging controller only validates… | Critical (9.8) | — | ✅ |
| CVE-2026-44108 — Due to a flaw in the execution order of scripts during shutdown, the firewall is… | Critical (9.8) | — | ✅ |
| CVE-2026-44180 — Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed… | Critical (9.8) | — | ✅ |
| CVE-2026-44402 — Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution… | Critical (9.8) | — | ✅ |
| CVE-2026-44930 — Apache CXF | Critical (9.8) | Snort | ✅ |
| CVE-2026-45018 — Chainlit is a Python framework for building production-ready conversational AI… | Critical (9.8) | — | ✅ |
| CVE-2026-45140 — Chamilo LMS is an open-source learning management system. | Critical (9.8) | — | ✅ |
| CVE-2026-45538 — OpenSIPS is a Session Initiation Protocol (SIP) server implementation. | Critical (9.8) | — | ✅ |
| CVE-2026-45695 — Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental… | Critical (9.8) | — | ✅ |
| CVE-2026-46562 — Yamcs is a mission control framework. | Critical (9.8) | — | ✅ |
| CVE-2026-46670 — YesWiki is a wiki system written in PHP. | Critical (9.8) | — | ✅ |
| CVE-2026-4703 — The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-47429 — Vitest is a testing framework powered by Vite. | Critical (9.8) | — | ✅ |
| CVE-2026-4769 — Certain devices in the WAGO System I/O Field series activate an internal diagnostic… | Critical (9.8) | — | ✅ |
| CVE-2026-48062 — CodeIgniter is a PHP full-stack web framework. | Critical (9.8) | — | ✅ |
| CVE-2026-48085 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | Critical (9.8) | — | ✅ |
| CVE-2026-48087 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | Critical (9.8) | — | ✅ |
| CVE-2026-48333 — Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that… | Critical (9.8) | — | ✅ |
| CVE-2026-48528 — Metacat is data repository software that helps researchers preserve, share, and discover… | Critical (9.8) | — | ✅ |
| CVE-2026-49172 — Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-49352 — 9Router is an AI router & token saver. | Critical (9.8) | — | ✅ |
| CVE-2026-49435 — Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. | Critical (9.8) | — | ✅ |
| CVE-2026-4978 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | Critical (9.8) | — | ✅ |
| CVE-2026-49819 — UpSnap is a wake on lan web app. | Critical (9.8) | — | ✅ |
| CVE-2026-49827 — WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. | Critical (9.8) | — | ✅ |
| CVE-2026-49950 — Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2026-50027 — mcp-memory-service is a semantic memory layer for AI applications. | Critical (9.8) | — | ✅ |
| CVE-2026-50447 — Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-50518 — Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-50522 — Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized… | Critical (9.8) | — | ✅ |
| CVE-2026-5134 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | Critical (9.8) | — | ✅ |
| CVE-2026-52889 — Formie is a Craft CMS plugin for creating forms. | Critical (9.8) | — | ✅ |
| CVE-2026-53412 — Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for… | Critical (9.8) | — | ✅ |
| CVE-2026-53451 — Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware… | Critical (9.8) | — | ✅ |
| CVE-2026-53545 — Termix is a web-based server management platform with SSH terminal, tunneling, and file… | Critical (9.8) | — | ✅ |
| CVE-2026-53611 — Looking Glass is a modern, stateless network-diagnostic platform — a single… | Critical (9.8) | — | ✅ |
| CVE-2026-53633 — Vitest is a testing framework powered by Vite. | Critical (9.8) | — | ✅ |
| CVE-2026-5388 — justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers… | Critical (9.8) | — | ✅ |
| CVE-2026-53975 — OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that… | Critical (9.8) | — | ✅ |
| CVE-2026-54460 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | Critical (9.8) | — | ✅ |
| CVE-2026-54472 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded… | Critical (9.8) | — | ✅ |
| CVE-2026-54569 — SENAITE.CORE is the core framework for the SENAITE laboratory information management… | Critical (9.8) | — | ✅ |
| CVE-2026-54617 — GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. | Critical (9.8) | — | ✅ |
| CVE-2026-54658 — Hypequery is a TypeScript semantic layer for ClickHouse. | Critical (9.8) | — | ✅ |
| CVE-2026-54990 — Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-55010 — Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized… | Critical (9.8) | — | ✅ |
| CVE-2026-55546 — QWED-MCP is a deterministic verification gateway for MCP. | Critical (9.8) | — | ✅ |
| CVE-2026-55559 — Yamcs is a mission control framework. | Critical (9.8) | — | ✅ |
| CVE-2026-55573 — e107 is a content management system (CMS). | Critical (9.8) | — | ✅ |
| CVE-2026-55579 — Pheditor is a single-file editor and file manager written in PHP. | Critical (9.8) | — | ✅ |
| CVE-2026-55642 — dbx is a cross-platform database client for databases. | Critical (9.8) | — | ✅ |
| CVE-2026-55652 — Wekan is open source kanban built with Meteor. | Critical (9.8) | — | ✅ |
| CVE-2026-55680 — WeGIA is a web manager for charitable institutions. | Critical (9.8) | — | ✅ |
| CVE-2026-55683 — WeGIA is a web manager for charitable institutions. | Critical (9.8) | — | ✅ |
| CVE-2026-55684 — WeGIA is a web manager for charitable institutions. | Critical (9.8) | — | ✅ |
| CVE-2026-55944 — Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized… | Critical (9.8) | — | ✅ |
| CVE-2026-56159 — Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-56165 — Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to… | Critical (9.8) | — | ✅ |
| CVE-2026-56188 — Concurrent execution using shared resource with improper synchronization ('race… | Critical (9.8) | — | ✅ |
| CVE-2026-56190 — Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute… | Critical (9.8) | — | ✅ |
| CVE-2026-56271 — Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default… | Critical (9.8) | — | ✅ |
| CVE-2026-56705 — Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN… | Critical (9.8) | — | ✅ |
| CVE-2026-56710 — Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege… | Critical (9.8) | — | ✅ |
| CVE-2026-57724 — Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object… | Critical (9.8) | — | ✅ |
| CVE-2026-57738 — Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows… | Critical (9.8) | — | ✅ |
| CVE-2026-57744 — Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions… | Critical (9.8) | — |
| CVE-2026-57770 — Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography… | Critical (9.8) | — | ✅ |
| CVE-2026-57813 — Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows… | Critical (9.8) | — | ✅ |
| CVE-2026-58479 — Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-58574 — Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. | Critical (9.8) | — | ✅ |
| CVE-2026-58644 — Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized… | Critical (9.8) | — | ✅ |
| CVE-2026-59309 — VMware vCenter contains an authentication bypass vulnerability in the VMware Directory… | Critical (9.8) | — | ✅ |
| CVE-2026-59310 — VMware vCenter contains a directory traversal vulnerability in the Syslog server. | Critical (9.8) | — | ✅ |
| CVE-2026-59518 — Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows… | Critical (9.8) | — | ✅ |
| CVE-2026-59540 — Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-59544 — Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-59683 — The OpenRGB network protocol allows to write attacker controlled strings into arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-60004 — Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook… | Critical (9.8) | — | ✅ |
| CVE-2026-60112 — AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication… | Critical (9.8) | — | ✅ |
| CVE-2026-60113 — AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a… | Critical (9.8) | — | ✅ |
| CVE-2026-60121 — Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-60367 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60372 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60721 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-60727 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-60782 — Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File… | Critical (9.8) | — | ✅ |
| CVE-2026-60821 — Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… | Critical (9.8) | — | ✅ |
| CVE-2026-60858 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-60921 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60946 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60947 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60958 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60970 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60971 — Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion… | Critical (9.8) | — | ✅ |
| CVE-2026-60977 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-61018 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-61258 — Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-61272 — Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards… | Critical (9.8) | — | ✅ |
| CVE-2026-61318 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | Critical (9.8) | — | ✅ |
| CVE-2026-61421 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded… | Critical (9.8) | — | ✅ |
| CVE-2026-61498 — Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-61511 — vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection… | Critical (9.8) | — | ✅ |
| CVE-2026-61514 — Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass… | Critical (9.8) | — | ✅ |
| CVE-2026-61515 — Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command… | Critical (9.8) | — | ✅ |
| CVE-2026-61808 — LightRAG provides simple and fast retrieval-augmented generation. | Critical (9.8) | — | ✅ |
| CVE-2026-61884 — The web management interface of Tycon Systems TPDIN-Monitor-WEB2 | Critical (9.8) | — | ✅ |
| CVE-2026-61951 — Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-61967 — Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-62101 — Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-62108 — Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-62252 — Homer is open source telecom observability software. | Critical (9.8) | — | ✅ |
| CVE-2026-62253 — Homer is open source telecom observability software. | Critical (9.8) | — | ✅ |
| CVE-2026-62457 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-62539 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-62541 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-62543 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-62544 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-62585 — Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component:… | Critical (9.8) | — | ✅ |
| CVE-2026-62592 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | Critical (9.8) | — | ✅ |
| CVE-2026-62609 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62611 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62614 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62617 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62621 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62622 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62624 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62626 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62630 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62632 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62633 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62634 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62635 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62639 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62640 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-62873 — Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an… | Critical (9.8) | — | ✅ |
| CVE-2026-63077 — In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution… | Critical (9.8) | — | ✅ |
| CVE-2026-63087 — Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that… | Critical (9.8) | — | ✅ |
| CVE-2026-63106 — ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-63223 — CodeIgniter is a PHP full-stack web framework. | Critical (9.8) | — | ✅ |
| CVE-2026-63359 — The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE)… | Critical (9.8) | — | ✅ |
| CVE-2026-63455 — Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator… | Critical (9.8) | — | ✅ |
| CVE-2026-63456 — Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator… | Critical (9.8) | — | ✅ |
| CVE-2026-63586 — The web-based management interface uses a modified uhttpd server with CGI shell scripts. | Critical (9.8) | — | ✅ |
| CVE-2026-63722 — ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-64827 — Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x… | Critical (9.8) | — | ✅ |
| CVE-2026-65321 — PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-65507 — Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65552 — Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65556 — Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43… | Critical (9.8) | — | ✅ |
| CVE-2026-65571 — Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65572 — Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65573 — Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65574 — Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65575 — Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65576 — Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65577 — Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65578 — Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65579 — Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65581 — Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-65687 — Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath… | Critical (9.8) | — | ✅ |
| CVE-2026-65688 — Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath… | Critical (9.8) | — | ✅ |
| CVE-2026-65689 — Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath… | Critical (9.8) | — | ✅ |
| CVE-2026-65700 — h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible… | Critical (9.8) | — | ✅ |
| CVE-2026-66402 — FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate… | Critical (9.8) | — | ✅ |
| CVE-2026-66424 — Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66453 — Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66465 — Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66583 — Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66587 — Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66613 — Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66648 — Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66650 — Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66662 — Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66672 — Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66682 — Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0… | Critical (9.8) | — | ✅ |
| CVE-2026-66691 — Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-66738 — SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. | Critical (9.8) | — | ✅ |
| CVE-2026-66747 — Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present… | Critical (9.8) | — | ✅ |
| CVE-2026-67100 — HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data… | Critical (9.8) | — | ✅ |
| CVE-2026-67191 — Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow… | Critical (9.8) | — | ✅ |
| CVE-2026-67208 — Juggle through 1.6.0 contains a remote code execution vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-67261 — Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0,… | Critical (9.8) | — | ✅ |
| CVE-2026-67289 — FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control… | Critical (9.8) | — | ✅ |
| CVE-2026-67324 — GitPython 3.1.50 fails to recognize joined short-option forms such as -u |
Critical (9.8) | — | ✅ |
| CVE-2026-67340 — ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes… | Critical (9.8) | — | ✅ |
| CVE-2026-67341 — ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL… | Critical (9.8) | — | ✅ |
| CVE-2026-67342 — ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP… | Critical (9.8) | — | ✅ |
| CVE-2026-67594 — Spikster through commit e1cdf8c contains a missing authentication vulnerability that… | Critical (9.8) | — | ✅ |
| CVE-2026-67614 — CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal… | Critical (9.8) | — | ✅ |
| CVE-2026-68502 — LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. | Critical (9.8) | — | ✅ |
| CVE-2026-68503 — LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. | Critical (9.8) | — | ✅ |
| CVE-2026-68770 — sentence-transformers contains a security control bypass vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-68771 — ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-69098 — kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-69102 — MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing… | Critical (9.8) | — | ✅ |
| CVE-2026-69240 — Sequelize is a Node.js ORM tool. | Critical (9.8) | — | ✅ |
| CVE-2026-69658 — MQTT credentials and control traffic are transmitted in cleartext, | Critical (9.8) | — | ✅ |
| CVE-2026-69703 — Atlas-Livre contains an improper access control vulnerability in the admin controllers… | Critical (9.8) | — | ✅ |
| CVE-2026-70552 — MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX… | Critical (9.8) | — | ✅ |
| CVE-2026-70553 — MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated… | Critical (9.8) | — | ✅ |
| CVE-2026-70554 — MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated… | Critical (9.8) | — | ✅ |
| CVE-2026-70558 — Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path… | Critical (9.8) | — | ✅ |
| CVE-2026-70669 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-70689 — Vulnerability in Oracle Essbase (component: Infrastructure). | Critical (9.8) | — | ✅ |
| CVE-2026-70739 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-70740 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-70745 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-70817 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | Critical (9.8) | — | ✅ |
| CVE-2026-70871 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (9.8) | — | ✅ |
| CVE-2026-70873 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (9.8) | — | ✅ |
| CVE-2026-70905 — Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-70926 — Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component:… | Critical (9.8) | — | ✅ |
| CVE-2026-70953 — Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component:… | Critical (9.8) | — | ✅ |
| CVE-2026-70954 — Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component:… | Critical (9.8) | — | ✅ |
| CVE-2026-70970 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-70995 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.8) | — | ✅ |
| CVE-2026-71040 — Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:… | Critical (9.8) | — | ✅ |
| CVE-2026-71074 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.8) | — | ✅ |
| CVE-2026-71152 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.8) | — | ✅ |
| CVE-2026-71164 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.8) | — | ✅ |
| CVE-2026-71187 — The Ebyte device relies on client side authentication logic that can be | Critical (9.8) | — | ✅ |
| CVE-2026-71207 — The Stock-Inventory-Management-System application's login.php assigns raw $_POST… | Critical (9.8) | — | ✅ |
| CVE-2026-71214 — The Aerie/PlanDev sequencing-server's authorization middleware… | Critical (9.8) | — | ✅ |
| CVE-2026-71231 — IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as… | Critical (9.8) | — | ✅ |
| CVE-2026-71237 — Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password… | Critical (9.8) | — | ✅ |
| CVE-2026-71248 — Inventory-Management-System-PHP's login.php constructs its authentication query via… | Critical (9.8) | — | ✅ |
| CVE-2026-71254 — nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side… | Critical (9.8) | — | ✅ |
| CVE-2026-71256 — nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer… | Critical (9.8) | — | ✅ |
| CVE-2026-71262 — IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other… | Critical (9.8) | — | ✅ |
| CVE-2026-71267 — microtar's mtar_write_file_header() and mtar_write_dir_header() functions… | Critical (9.8) | — | ✅ |
| CVE-2026-71278 — rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create… | Critical (9.8) | — | ✅ |
| CVE-2026-71289 — The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's… | Critical (9.8) | — | ✅ |
| CVE-2026-71914 — Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm… | Critical (9.8) | — | ✅ |
| CVE-2026-71921 — Multiple DrayTek VigorSwitch models contain a pre-authentication command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71944 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71945 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71946 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71947 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71948 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71949 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71950 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71951 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71952 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71953 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71954 — D-Link DWR-M961 devices with hardware version C1 and firmware version before… | Critical (9.8) | — | ✅ |
| CVE-2026-71955 — D-Link DWR-M961 devices with hardware version C1 and software version… | Critical (9.8) | — | ✅ |
| CVE-2026-71956 — D-Link DWR-M961 devices with hardware version C1 and software version… | Critical (9.8) | — | ✅ |
| CVE-2026-71957 — D-Link DWR-M961 devices with hardware version C1 and software version… | Critical (9.8) | — | ✅ |
| CVE-2026-71958 — D-Link DWR-M961 devices with hardware version C1 and software version… | Critical (9.8) | — | ✅ |
| CVE-2026-71983 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71984 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71985 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71986 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71987 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71988 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71989 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71990 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71991 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-71992 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Critical (9.8) | — | ✅ |
| CVE-2026-72529 — A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf… | Critical (9.8) | — | ✅ |
| CVE-2026-72565 — A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated… | Critical (9.8) | — | ✅ |
| CVE-2026-72567 — An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit… | Critical (9.8) | — | ✅ |
| CVE-2026-72577 — Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote… | Critical (9.8) | — | ✅ |
| CVE-2026-72580 — An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows… | Critical (9.8) | — | ✅ |
| CVE-2026-72589 — An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an… | Critical (9.8) | — | ✅ |
| CVE-2026-72590 — An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an… | Critical (9.8) | — | ✅ |
| CVE-2026-72592 — An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an… | Critical (9.8) | — | ✅ |
| CVE-2026-72593 — A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an… | Critical (9.8) | — | ✅ |
| CVE-2026-72599 — An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to… | Critical (9.8) | — | ✅ |
| CVE-2026-72776 — AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution… | Critical (9.8) | — | ✅ |
| CVE-2026-72822 — The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to… | Critical (9.8) | — | ✅ |
| CVE-2026-72824 — The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap… | Critical (9.8) | — | ✅ |
| CVE-2026-72826 — The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a… | Critical (9.8) | — | ✅ |
| CVE-2026-72829 — The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap… | Critical (9.8) | — | ✅ |
| CVE-2026-72830 — Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in… | Critical (9.8) | — | ✅ |
| CVE-2026-72839 — filebrowser through 2.63.16 fails to properly restrict scope and permissions when… | Critical (9.8) | — | ✅ |
| CVE-2026-72843 — The customer update route in EverShop is declared with "access": "public" in… | Critical (9.8) | — | ✅ |
| CVE-2026-72920 — SeaweedFS is a distributed storage system. | Critical (9.8) | — | ✅ |
| CVE-2026-73046 — SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the… | Critical (9.8) | — | ✅ |
| CVE-2026-73056 — SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive… | Critical (9.8) | — | ✅ |
| CVE-2026-73061 — Scriban before 7.2.2 contains an access-modifier bypass vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-73125 — Ebyte device web management interface does not consistently enforce | Critical (9.8) | — | ✅ |
| CVE-2026-73211 — PeerTube is an ActivityPub-federated video streaming platform. | Critical (9.8) | — | ✅ |
| CVE-2026-73347 — Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-73364 — Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-73389 — Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-73390 — Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-73519 — WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into… | Critical (9.8) | — | ✅ |
| CVE-2026-73532 — Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a… | Critical (9.8) | — | ✅ |
| CVE-2026-73533 — Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via… | Critical (9.8) | — | ✅ |
| CVE-2026-73649 — Velocity.js is a JavaScript implementation of the Apache Velocity template engine. | Critical (9.8) | — | ✅ |
| CVE-2026-73749 — Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper… | Critical (9.8) | — | ✅ |
| CVE-2026-73819 — The affected Ebyte | Critical (9.8) | — | ✅ |
| CVE-2026-73849 — Emlog is an open source website building system. | Critical (9.8) | — | ✅ |
| CVE-2026-73905 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.8) | — | ✅ |
| CVE-2026-73912 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.8) | — | ✅ |
| CVE-2026-73921 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.8) | — | ✅ |
| CVE-2026-73993 — Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-74001 — Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5… | Critical (9.8) | — | ✅ |
| CVE-2026-74232 — Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628… | Critical (9.8) | — | ✅ |
| CVE-2026-74233 — Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526… | Critical (9.8) | — | ✅ |
| CVE-2026-75143 — FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader… | Critical (9.8) | — | ✅ |
| CVE-2026-75430 — PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the… | Critical (9.8) | — | ✅ |
| CVE-2026-75816 — The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication… | Critical (9.8) | — | ✅ |
| CVE-2026-75865 — The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google… | Critical (9.8) | — | ✅ |
| CVE-2026-75957 — The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is… | Critical (9.8) | — | ✅ |
| CVE-2026-76070 — Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow… | Critical (9.8) | — | ✅ |
| CVE-2026-76071 — Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow… | Critical (9.8) | — | ✅ |
| CVE-2026-76133 — The affected Ebyte | Critical (9.8) | — | ✅ |
| CVE-2026-76179 — An improper protection of authentication tokens vulnerability exists in | Critical (9.8) | — | ✅ |
| CVE-2026-76268 — In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with… | Critical (9.8) | — | ✅ |
| CVE-2026-76455 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-76465 — A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of… | Critical (9.8) | — | ✅ |
| CVE-2026-76471 — A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an… | Critical (9.8) | — | ✅ |
| CVE-2026-76480 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-76485 — A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of… | Critical (9.8) | — | ✅ |
| CVE-2026-76486 — A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of… | Critical (9.8) | — | ✅ |
| CVE-2026-76498 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-76499 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-76500 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.8) | — | ✅ |
| CVE-2026-76501 — A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and… | Critical (9.8) | — | ✅ |
| CVE-2026-76519 — A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email… | Critical (9.8) | — | ✅ |
| CVE-2026-76581 — The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all… | Critical (9.8) | — | ✅ |
| CVE-2026-76742 — Authentication bypass vulnerabilities exist in the web management interface of AOS-S. | Critical (9.8) | — | ✅ |
| CVE-2026-76743 — A vulnerability have been identified in the management interface of AOS-S that could… | Critical (9.8) | — | ✅ |
| CVE-2026-76744 — Buffer overflow vulnerabilities exist in the affected interface of AOS-S. | Critical (9.8) | — | ✅ |
| CVE-2026-76750 — Deserialization of untrusted data vulnerabilities exist in the web interface of HPE… | Critical (9.8) | — | ✅ |
| CVE-2026-76751 — A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass… | Critical (9.8) | — | ✅ |
| CVE-2026-76752 — Authentication bypass vulnerabilities exist in the web-based management and API… | Critical (9.8) | — | ✅ |
| CVE-2026-76753 — A format string vulnerability in an affected service interface of HPE Networking… | Critical (9.8) | — | ✅ |
| CVE-2026-76754 — A vulnerability in an affected interface of ClearPass Policy Manager could allow an… | Critical (9.8) | — | ✅ |
| CVE-2026-76850 — LMDeploy deserializes disaggregated-serving peer messages with pickle. | Critical (9.8) | — | ✅ |
| CVE-2026-76904 — GeoTools is an open source Java library that provides tools for geospatial data. | Critical (9.8) | — | ✅ |
| CVE-2026-76943 — Xiiaozet LK100Wt contains an authentication weakness within an | Critical (9.8) | — | ✅ |
| CVE-2026-77264 — The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country… | Critical (9.8) | — | ✅ |
| CVE-2026-77552 — A malicious actor with access to the network could exploit an Improper Input Validation… | Critical (9.8) | — | ✅ |
| CVE-2026-77557 — A malicious actor with access to the network could exploit an Improper Access Control… | Critical (9.8) | — | ✅ |
| CVE-2026-77647 — SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as… | Critical (9.8) | — | ✅ |
| CVE-2026-77649 — The internment crate 0.8.7 for Rust can trigger execution of malicious code when… | Critical (9.8) | — | ✅ |
| CVE-2026-77650 — The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when… | Critical (9.8) | — | ✅ |
| CVE-2026-77651 — The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling… | Critical (9.8) | — | ✅ |
| CVE-2026-77806 — SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as… | Critical (9.8) | — | ✅ |
| CVE-2026-77915 — rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-78003 — The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request… | Critical (9.8) | — | ✅ |
| CVE-2026-78012 — An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3… | Critical (9.8) | — | ✅ |
| CVE-2026-7808 — justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow… | Critical (9.8) | — | ✅ |
| CVE-2026-78168 — A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. | Critical (9.8) | — | ✅ |
| CVE-2026-78211 — 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection… | Critical (9.8) | — | ✅ |
| CVE-2026-78239 — Xiiaozet LK100W exposes a critical management function that can be | Critical (9.8) | — | ✅ |
| CVE-2026-78262 — Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-78265 — Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-78267 — Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-78286 — Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-78292 — Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-78477 — The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to,… | Critical (9.8) | — | ✅ |
| CVE-2026-7849 — Due to improper neutralization of special elements, an unauthenticated remote attacker is… | Critical (9.8) | — | ✅ |
| CVE-2026-78568 — The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions… | Critical (9.8) | — | ✅ |
| CVE-2026-78570 — The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all… | Critical (9.8) | — | ✅ |
| CVE-2026-78657 — The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-78676 — GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during… | Critical (9.8) | — | ✅ |
| CVE-2026-79657 — NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted… | Critical (9.8) | — | ✅ |
| CVE-2026-79675 — NLTK before 3.10.3 fails to validate JVM options passed through the per-call options… | Critical (9.8) | — | ✅ |
| CVE-2026-79787 — Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default… | Critical (9.8) | — | ✅ |
| CVE-2026-79796 — Vulnerabilities have been identified in the affected interface of ClearPass Policy… | Critical (9.8) | — | ✅ |
| CVE-2026-79801 — A missing integrity verification vulnerability in the client agent software of HPE… | Critical (9.8) | — | ✅ |
| CVE-2026-79805 — An authenticated path traversal vulnerability exists in ClearPass Policy Manager. | Critical (9.8) | — | ✅ |
| CVE-2026-80104 — DB-GPT builds the destination path for an uploaded skill from the multipart filename… | Critical (9.8) | — | ✅ |
| CVE-2026-80138 — ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath… | Critical (9.8) | — | ✅ |
| CVE-2026-80203 — The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the… | Critical (9.8) | — | ✅ |
| CVE-2026-80235 — EFence developed by Thinking Software Technology has an Arbitrary File Upload… | Critical (9.8) | — | ✅ |
| CVE-2026-80349 — TarsWeb decides whether a request comes from a trusted local caller using a… | Critical (9.8) | — | ✅ |
| CVE-2026-80428 — ILIAS deserialises stored session data for an unauthenticated caller. | Critical (9.8) | — | ✅ |
| CVE-2026-81032 — NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. | Critical (9.8) | — | ✅ |
| CVE-2026-81294 — Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-81700 — openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in… | Critical (9.8) | — | ✅ |
| CVE-2026-81701 — openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in… | Critical (9.8) | — | ✅ |
| CVE-2026-81702 — openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading… | Critical (9.8) | — | ✅ |
| CVE-2026-81707 — openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity… | Critical (9.8) | — | ✅ |
| CVE-2026-81934 — Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function,… | Critical (9.8) | — | ✅ |
| CVE-2026-82042 — UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-82082 — NUMail developed by Green-Computing has an OS Command Injection vulnerability. | Critical (9.8) | — | ✅ |
| CVE-2026-82226 — Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-82266 — Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth… | Critical (9.8) | — | ✅ |
| CVE-2026-82277 — Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating… | Critical (9.8) | — | ✅ |
| CVE-2026-82329 — JFrog Artifactory contains an authentication weakness that, under default configuration,… | Critical (9.8) | — | ✅ |
| CVE-2026-82448 — Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node… | Critical (9.8) | — | ✅ |
| CVE-2026-82452 — rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2026-82460 — Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST… | Critical (9.8) | — | ✅ |
| CVE-2026-82526 — R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-82824 — Hitachi Coding Software Suite contains a vulnerability related to Path Traversal… | Critical (9.8) | — | ✅ |
| CVE-2026-82825 — Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication… | Critical (9.8) | — | ✅ |
| CVE-2026-82827 — Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded… | Critical (9.8) | — | ✅ |
| CVE-2026-82829 — Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality… | Critical (9.8) | — | ✅ |
| CVE-2026-82854 — Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized… | Critical (9.8) | — | ✅ |
| CVE-2026-82855 — @hulumi/policies versions before 1.3.2 contain an evidence validation bypass… | Critical (9.8) | — | ✅ |
| CVE-2026-82856 — @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM… | Critical (9.8) | — | ✅ |
| CVE-2026-82857 — hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly… | Critical (9.8) | — | ✅ |
| CVE-2026-82858 — @hulumi/drift versions before 1.3.2 accept externally supplied execute plans without… | Critical (9.8) | — | ✅ |
| CVE-2026-82859 — hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create… | Critical (9.8) | — | ✅ |
| CVE-2026-82860 — @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM… | Critical (9.8) | — | ✅ |
| CVE-2026-82923 — The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any… | Critical (9.8) | — | ✅ |
| CVE-2026-8297 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | Critical (9.8) | — | ✅ |
| CVE-2026-83627 — The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for… | Critical (9.8) | — | ✅ |
| CVE-2026-84238 — Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium <… | Critical (9.8) | — | ✅ |
| CVE-2026-84372 — Predis is a flexible and feature-complete Redis and Valkey client for PHP. | Critical (9.8) | — | ✅ |
| CVE-2026-84411 — The web management service in affected RouterOS versions contains an integer underflow in… | Critical (9.8) | — | ✅ |
| CVE-2026-8445 — justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant… | Critical (9.8) | — | ✅ |
| CVE-2026-84480 — WWBN AVideo fails to validate password recovery token expiration in… | Critical (9.8) | — | ✅ |
| CVE-2026-8457 — The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication… | Critical (9.8) | — | ✅ |
| CVE-2026-84731 — An unauthenticated remote attacker can bypass authentication and gain full access to… | Critical (9.8) | — | ✅ |
| CVE-2026-84753 — Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-84795 — Craft CMS before 5.10.11 fails to validate the admin flag during user registration,… | Critical (9.8) | — | ✅ |
| CVE-2026-84814 — Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-84834 — Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions. | Critical (9.8) | — | ✅ |
| CVE-2026-8505 — IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook… | Critical (9.8) | — | ✅ |
| CVE-2026-85097 — The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file… | Critical (9.8) | — | ✅ |
| CVE-2026-85109 — A vulnerability was determined in Tenda HG10 300001138. | Critical (9.8) | — | ✅ |
| CVE-2026-85146 — SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials… | Critical (9.8) | — | ✅ |
| CVE-2026-85148 — SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials… | Critical (9.8) | — | ✅ |
| CVE-2026-85154 — WWBN AVideo contains an authentication failure vulnerability where the video_id_hash… | Critical (9.8) | — | ✅ |
| CVE-2026-85181 — CAT uses Java String.hashCode as the sole integrity check for session cookies without… | Critical (9.8) | — | ✅ |
| CVE-2026-85391 — Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml… | Critical (9.8) | — | ✅ |
| CVE-2026-85424 — MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing… | Critical (9.8) | — | ✅ |
| CVE-2026-85425 — MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-85426 — MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS… | Critical (9.8) | — | ✅ |
| CVE-2026-85428 — MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-85433 — MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD… | Critical (9.8) | — | ✅ |
| CVE-2026-85437 — MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function… | Critical (9.8) | — | ✅ |
| CVE-2026-85438 — MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction()… | Critical (9.8) | — | ✅ |
| CVE-2026-85440 — MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2026-85504 — FreeIPMI before 1.6.19 has a stack-based buffer overflow in… | Critical (9.8) | — | ✅ |
| CVE-2026-85506 — ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in… | Critical (9.8) | — | ✅ |
| CVE-2026-85507 — ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in… | Critical (9.8) | — | ✅ |
| CVE-2026-85508 — ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in… | Critical (9.8) | — | ✅ |
| CVE-2026-85509 — FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in… | Critical (9.8) | — | ✅ |
| CVE-2026-85661 — excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when… | Critical (9.8) | — | ✅ |
| CVE-2026-85663 — Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-85672 — zerox 1.1.20 contains an OS command injection vulnerability in the file download… | Critical (9.8) | — | ✅ |
| CVE-2026-85688 — TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write… | Critical (9.8) | — | ✅ |
| CVE-2026-85696 — SadTalker contains an OS command injection vulnerability in the video muxing process… | Critical (9.8) | — | ✅ |
| CVE-2026-85984 — The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is… | Critical (9.8) | — | ✅ |
| CVE-2026-86121 — Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME… | Critical (9.8) | — | ✅ |
| CVE-2026-86124 — AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP… | Critical (9.8) | — | ✅ |
| CVE-2026-86165 — A vulnerability was found in Tenda HG10 300001138. | Critical (9.8) | — | ✅ |
| CVE-2026-86184 — Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the… | Critical (9.8) | — | ✅ |
| CVE-2026-86189 — WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows… | Critical (9.8) | — | ✅ |
| CVE-2026-86863 — pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by… | Critical (9.8) | — | ✅ |
| CVE-2026-87796 — The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File… | Critical (9.8) | — | ✅ |
| CVE-2026-87855 — The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File… | Critical (9.8) | — | ✅ |
| CVE-2026-89079 — The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account… | Critical (9.8) | — | ✅ |
| CVE-2026-9055 — The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress… | Critical (9.8) | — | ✅ |
| CVE-2026-90822 — FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version… | Critical (9.8) | — | ✅ |
| CVE-2026-90823 — FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version… | Critical (9.8) | — | ✅ |
| CVE-2026-9103 — IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized… | Critical (9.8) | — | ✅ |
| CVE-2026-9192 — An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic… | Critical (9.8) | — | ✅ |
| CVE-2026-9198 — IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain… | Critical (9.8) | — | ✅ |
| CVE-2026-9202 — IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create… | Critical (9.8) | — | ✅ |
| CVE-2026-92161 — FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook,… | Critical (9.8) | — | ✅ |
| CVE-2026-92787 — Feast through 0.66.0 fails to verify JWT token signatures before establishing user… | Critical (9.8) | — | ✅ |
| CVE-2026-92805 — UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation… | Critical (9.8) | — | ✅ |
| CVE-2026-92944 — vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26… | Critical (9.8) | — | ✅ |
| CVE-2026-93388 — The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-93467 — The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. | Critical (9.8) | — | ✅ |
| CVE-2026-93643 — When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with… | Critical (9.8) | — | ✅ |
| CVE-2026-93674 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2026-9384 — Totolink A8000RU Router | Critical (9.8) | Snort | ✅ |
| CVE-2026-94541 — The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-95606 — Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events… | Critical (9.8) | — | ✅ |
| CVE-2026-97637 — The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached… | Critical (9.8) | — | ✅ |
| CVE-2026-97657 — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to… | Critical (9.8) | — | ✅ |
| CVE-2026-97668 — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL… | Critical (9.8) | — | ✅ |
| CVE-2026-100715 — Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in… | Critical (9.6) | — | ✅ |
| CVE-2026-105039 — EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check… | Critical (9.6) | — | ✅ |
| CVE-2026-106501 — Backstage is an open framework for building developer portals. | Critical (9.6) | — | ✅ |
| CVE-2026-106620 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a… | Critical (9.6) | — | ✅ |
| CVE-2026-11861 — A flaw was found in FreeIPA. | Critical (9.6) | — | ✅ |
| CVE-2026-12605 — In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet… | Critical (9.6) | — | ✅ |
| CVE-2026-15773 — Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a… | Critical (9.6) | — | ✅ |
| CVE-2026-16687 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | Critical (9.6) | — | ✅ |
| CVE-2026-16835 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | Critical (9.6) | — | ✅ |
| CVE-2026-16903 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | Critical (9.6) | — | ✅ |
| CVE-2026-17349 — /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in… | Critical (9.6) | — | ✅ |
| CVE-2026-18667 — A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with… | Critical (9.6) | — | ✅ |
| CVE-2026-18972 — An authenticated attacker can spoof another GUI user's identity by sending their request… | Critical (9.6) | — | ✅ |
| CVE-2026-19274 — IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent… | Critical (9.6) | — | ✅ |
| CVE-2026-19766 — An authentication bypass vulnerability exists in the underlying operating system of HPE… | Critical (9.6) | — | ✅ |
| CVE-2026-20318 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.6) | — | ✅ |
| CVE-2026-22752 — Authentication bypass by primary weakness vulnerability in Spring Security Spring… | Critical (9.6) | — | ✅ |
| CVE-2026-25289 — Memory Corruption when processing Device Capability Extended attributes in certain NAN… | Critical (9.6) | — | ✅ |
| CVE-2026-28164 — Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons… | Critical (9.6) | — | ✅ |
| CVE-2026-46409 — OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop… | Critical (9.6) | — | ✅ |
| CVE-2026-47428 — Vitest is a testing framework powered by Vite. | Critical (9.6) | — | ✅ |
| CVE-2026-48259 — Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF)… | Critical (9.6) | — | ✅ |
| CVE-2026-48284 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in… | Critical (9.6) | — | ✅ |
| CVE-2026-48317 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in… | Critical (9.6) | — | ✅ |
| CVE-2026-48322 — ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')… | Critical (9.6) | — | ✅ |
| CVE-2026-48356 — Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type… | Critical (9.6) | — | ✅ |
| CVE-2026-48359 — Adobe Experience Manager is affected by an Improper Restriction of XML External Entity… | Critical (9.6) | — | ✅ |
| CVE-2026-48561 — Improper neutralization of special elements used in a command ('command injection') in… | Critical (9.6) | — | ✅ |
| CVE-2026-49003 — Attackers can exploit command injection vulnerabilities to delete core system runtime… | Critical (9.6) | — | ✅ |
| CVE-2026-49481 — UpSnap is a wake on lan web app. | Critical (9.6) | — | ✅ |
| CVE-2026-50380 — Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute… | Critical (9.6) | — | ✅ |
| CVE-2026-50540 — Kata Containers is an open source project focusing on a standard implementation of… | Critical (9.6) | — | ✅ |
| CVE-2026-53513 — Better Auth is an authentication and authorization library for TypeScript. | Critical (9.6) | — | ✅ |
| CVE-2026-53546 — Termix is a web-based server management platform with SSH terminal, tunneling, and file… | Critical (9.6) | — | ✅ |
| CVE-2026-53548 — Termix is a web-based server management platform with SSH terminal, tunneling, and file… | Critical (9.6) | — | ✅ |
| CVE-2026-53552 — Goploy is an open-source automation deployment system. | Critical (9.6) | — | ✅ |
| CVE-2026-53649 — Joro is a web exploitation framework. | Critical (9.6) | — | ✅ |
| CVE-2026-54053 — Many Notes is a Markdown note-taking web application designed for simplicity. | Critical (9.6) | — | ✅ |
| CVE-2026-54458 — WWBN AVideo is an open source video platform. | Critical (9.6) | — | ✅ |
| CVE-2026-54523 — Kyverno is a policy engine designed for cloud native platform engineering teams. | Critical (9.6) | — | ✅ |
| CVE-2026-54725 — vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection… | Critical (9.6) | — | ✅ |
| CVE-2026-54752 — NetBox Device Type Library is a collection of community-sourced device type definitions… | Critical (9.6) | — | ✅ |
| CVE-2026-54754 — Klever-Go is the Go implementation of the Klever blockchain protocol. | Critical (9.6) | — | ✅ |
| CVE-2026-54755 — Klever-Go is the Go implementation of the Klever blockchain protocol. | Critical (9.6) | — | ✅ |
| CVE-2026-55008 — Improper neutralization of input during web page generation ('cross-site scripting') in… | Critical (9.6) | — | ✅ |
| CVE-2026-55085 — Etherpad is a real-time collaborative editor. | Critical (9.6) | — | ✅ |
| CVE-2026-55518 — Avo is a framework to create admin panels for Ruby on Rails apps. | Critical (9.6) | — | ✅ |
| CVE-2026-56161 — Improper access control in Azure Logic Apps allows an authorized attacker to disclose… | Critical (9.6) | — | ✅ |
| CVE-2026-56662 — GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community… | Critical (9.6) | — | ✅ |
| CVE-2026-57496 — NetLicensing MCP Server is a natural-language interface that enables agentic applications… | Critical (9.6) | — | ✅ |
| CVE-2026-57784 — Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension… | Critical (9.6) | — | ✅ |
| CVE-2026-5917 — libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend… | Critical (9.6) | — | ✅ |
| CVE-2026-59354 — In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4,… | Critical (9.6) | — | ✅ |
| CVE-2026-59891 — sigstore-js provides JavaScript libraries for interacting with Sigstore services. | Critical (9.6) | — | ✅ |
| CVE-2026-60861 — Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware… | Critical (9.6) | — | ✅ |
| CVE-2026-60905 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | Critical (9.6) | — | ✅ |
| CVE-2026-61001 — Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware… | Critical (9.6) | — | ✅ |
| CVE-2026-61451 — The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the… | Critical (9.6) | — | ✅ |
| CVE-2026-62463 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.6) | — | ✅ |
| CVE-2026-62582 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | Critical (9.6) | — | ✅ |
| CVE-2026-62896 — Improper authentication in Microsoft Teams allows an authorized attacker to elevate… | Critical (9.6) | — | ✅ |
| CVE-2026-62948 — OpenWrt is a Linux operating system targeting embedded devices. | Critical (9.6) | — | ✅ |
| CVE-2026-65471 — Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. | Critical (9.6) | — | ✅ |
| CVE-2026-65605 — SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute… | Critical (9.6) | — | ✅ |
| CVE-2026-65606 — SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan://… | Critical (9.6) | — | ✅ |
| CVE-2026-66395 — SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in… | Critical (9.6) | — | ✅ |
| CVE-2026-67273 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper… | Critical (9.6) | — | ✅ |
| CVE-2026-68579 — FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows… | Critical (9.6) | — | ✅ |
| CVE-2026-69400 — Improper limitation of a pathname to a restricted directory ('path traversal') in Azure… | Critical (9.6) | — | ✅ |
| CVE-2026-70332 — Improper neutralization of input during web page generation ('cross-site scripting') in… | Critical (9.6) | — | ✅ |
| CVE-2026-70376 — Pluck CMS's admin panel relies solely on a Referer-header comparison… | Critical (9.6) | — | ✅ |
| CVE-2026-70670 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.6) | — | ✅ |
| CVE-2026-70958 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | Critical (9.6) | — | ✅ |
| CVE-2026-71063 — Vulnerability in the Portable Clusterware component of Oracle Database Server. | Critical (9.6) | — | ✅ |
| CVE-2026-71064 — Vulnerability in the Portable Clusterware component of Oracle Database Server. | Critical (9.6) | — | ✅ |
| CVE-2026-71193 — In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone,… | Critical (9.6) | — | ✅ |
| CVE-2026-71319 — Nuxt is an open-source web development framework for Vue.js. | Critical (9.6) | — | ✅ |
| CVE-2026-72564 — An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an… | Critical (9.6) | — | ✅ |
| CVE-2026-72737 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.6) | — | ✅ |
| CVE-2026-72877 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.6) | — | ✅ |
| CVE-2026-72878 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Critical (9.6) | — | ✅ |
| CVE-2026-73032 — PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows… | Critical (9.6) | — | ✅ |
| CVE-2026-73644 — OpenDJ is an LDAPv3 compliant directory service. | Critical (9.6) | — | ✅ |
| CVE-2026-75925 — Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows… | Critical (9.6) | — | ✅ |
| CVE-2026-75994 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | Critical (9.6) | — | ✅ |
| CVE-2026-76464 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.6) | — | ✅ |
| CVE-2026-76745 — Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated… | Critical (9.6) | — | ✅ |
| CVE-2026-76840 — RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size… | Critical (9.6) | — | ✅ |
| CVE-2026-77087 — Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers,… | Critical (9.6) | — | ✅ |
| CVE-2026-77532 — A malicious actor with access to an adjacent network could exploit a Buffer Overflow… | Critical (9.6) | — | ✅ |
| CVE-2026-78683 — NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization… | Critical (9.6) | — | ✅ |
| CVE-2026-82870 — ToolJet before v3.16.208 fails to validate organizationId ownership in database write and… | Critical (9.6) | — | ✅ |
| CVE-2026-84119 — Sandbox escape due to use-after-free in the DOM: Navigation component. | Critical (9.6) | — | ✅ |
| CVE-2026-84121 — Sandbox escape due to use-after-free in the DOM: Security component. | Critical (9.6) | — | ✅ |
| CVE-2026-85042 — Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote… | Critical (9.6) | — | ✅ |
| CVE-2026-85047 — Improper input validation in Transactions Platform in Google Chrome on on iOS prior to… | Critical (9.6) | — | ✅ |
| CVE-2026-85085 — The Canva Android App before 2.376.0 allowed an external origin to be loaded in a… | Critical (9.6) | — | ✅ |
| CVE-2026-86360 — Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a… | Critical (9.6) | — | ✅ |
| CVE-2026-8715 — Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and… | Critical (9.6) | — | ✅ |
| CVE-2026-87701 — Improper neutralization of special elements in output used by a downstream component… | Critical (9.6) | — | ✅ |
| CVE-2026-91140 — An OS command injection vulnerability in the shell-based temporary-file cleanup… | Critical (9.6) | — | ✅ |
| CVE-2026-95699 — Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated… | Critical (9.6) | — | ✅ |
| CVE-2026-102149 — Kiteworks Email Protection Gateway did not sufficiently restrict which account a… | Critical (9.4) | — | ✅ |
| CVE-2026-103765 — Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP… | Critical (9.4) | — | ✅ |
| CVE-2026-107206 — LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess… | Critical (9.4) | — | ✅ |
| CVE-2026-11841 — An attacker may perform unauthenticated read and write operations on sensitive filesystem… | Critical (9.4) | — | ✅ |
| CVE-2026-12693 — Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. | Critical (9.4) | — | ✅ |
| CVE-2026-14525 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere… | Critical (9.4) | — | ✅ |
| CVE-2026-14529 — IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server -… | Critical (9.4) | — | ✅ |
| CVE-2026-16839 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain… | Critical (9.4) | — | ✅ |
| CVE-2026-28446 — OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled… | Critical (9.4) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32916 — OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability… | Critical (9.4) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-44100 — The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure… | Critical (9.4) | — | ✅ |
| CVE-2026-48088 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | Critical (9.4) | — | ✅ |
| CVE-2026-54618 — Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. | Critical (9.4) | — | ✅ |
| CVE-2026-59270 — Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally… | Critical (9.4) | — | ✅ |
| CVE-2026-62629 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.4) | — | ✅ |
| CVE-2026-63221 — CodeIgniter is a PHP full-stack web framework. | Critical (9.4) | — | ✅ |
| CVE-2026-66147 — An unauthenticated command injection vulnerability was identified in the GMS Dispatcher… | Critical (9.4) | — | ✅ |
| CVE-2026-71166 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.4) | — | ✅ |
| CVE-2026-71167 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.4) | — | ✅ |
| CVE-2026-73653 — Vitest is a testing framework powered by Vite. | Critical (9.4) | — | ✅ |
| CVE-2026-73920 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.4) | — | ✅ |
| CVE-2026-76310 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an… | Critical (9.4) | — | ✅ |
| CVE-2026-76311 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an… | Critical (9.4) | — | ✅ |
| CVE-2026-76312 — In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an… | Critical (9.4) | — | ✅ |
| CVE-2026-78207 — exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the… | Critical (9.4) | — | ✅ |
| CVE-2026-85695 — FastChat contains an authentication bypass vulnerability in the /register_worker endpoint… | Critical (9.4) | — | ✅ |
| CVE-2026-93291 — Omni C20 lacks proper certificate validation which could allow an attacker to perform a… | Critical (9.4) | — | ✅ |
| CVE-2026-95102 — WebSocket endpoints lack proper authentication mechanisms, enabling attackers to… | Critical (9.4) | — | ✅ |
| CVE-2026-102147 — A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an… | Critical (9.3) | — | ✅ |
| CVE-2026-102628 — The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled… | Critical (9.3) | — | ✅ |
| CVE-2026-102795 — Improper Access Control vulnerability in Apache Traffic Server. | Critical (9.3) | — | ✅ |
| CVE-2026-103904 — The public consent endpoint of JTL-Shop accepts arbitrary | Critical (9.3) | — | ✅ |
| CVE-2026-103922 — Capacitor is a cross-platform native runtime for web applications. | Critical (9.3) | — | ✅ |
| CVE-2026-108497 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Critical (9.3) | — | ✅ |
| CVE-2026-109688 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Critical (9.3) | — | ✅ |
| CVE-2026-109698 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Critical (9.3) | — | ✅ |
| CVE-2026-11707 — IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server… | Critical (9.3) | — | ✅ |
| CVE-2026-14973 — IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be… | Critical (9.3) | — | ✅ |
| CVE-2026-15091 — IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute… | Critical (9.3) | — | ✅ |
| CVE-2026-16279 — An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release… | Critical (9.3) | — | ✅ |
| CVE-2026-16822 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to… | Critical (9.3) | — | ✅ |
| CVE-2026-17181 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to… | Critical (9.3) | — | ✅ |
| CVE-2026-17422 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute… | Critical (9.3) | — | ✅ |
| CVE-2026-18367 — A privilege escalation vulnerability allows local users to execute arbitrary code as root… | Critical (9.3) | — | ✅ |
| CVE-2026-28001 — Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-28142 — Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-32479 — Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17… | Critical (9.3) | — | ✅ |
| CVE-2026-32551 — Unauthenticated SQL Injection in Woo Essential <= 4.3.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-32554 — Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-32555 — Unauthenticated SQL Injection in Boost <= 2.0.4 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-32913 — OpenClaw before 2026.3.7 contains an improper header validation vulnerability in… | Critical (9.3) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-41920 — Improper Access Control vulnerability in Apache Traffic Server. | Critical (9.3) | — | ✅ |
| CVE-2026-47187 — SSHFS is a network filesystem client for connecting to SSH servers. | Critical (9.3) | — | ✅ |
| CVE-2026-47754 — Metacat is data repository software that helps researchers preserve, share, and discover… | Critical (9.3) | — | ✅ |
| CVE-2026-47876 — VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network… | Critical (9.3) | — | ✅ |
| CVE-2026-48321 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | Critical (9.3) | — | ✅ |
| CVE-2026-48325 — ColdFusion is affected by a Missing Authentication for Critical Function vulnerability… | Critical (9.3) | — | ✅ |
| CVE-2026-48334 — Illustrator is affected by an Improper Input Validation vulnerability that could result… | Critical (9.3) | — | ✅ |
| CVE-2026-49798 — Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges… | Critical (9.3) | — | ✅ |
| CVE-2026-52842 — Lightpanda is a headless browser designed for AI and automation. | Critical (9.3) | — | ✅ |
| CVE-2026-52843 — Lightpanda is a headless browser designed for AI and automation. | Critical (9.3) | — | ✅ |
| CVE-2026-54496 — ZEBRA is a Zcash node written entirely in Rust. | Critical (9.3) | — | ✅ |
| CVE-2026-58155 — Apache Traffic Server truncates over-long header names, allowing header aliasing, request… | Critical (9.3) | — | ✅ |
| CVE-2026-59111 — Improper neutralization of special elements used in an OS command ('OS command… | Critical (9.3) | — | ✅ |
| CVE-2026-59118 — Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate… | Critical (9.3) | — | ✅ |
| CVE-2026-59346 — VMware Workstation and Fusion contain an integer-overflow vulnerability. | Critical (9.3) | — | ✅ |
| CVE-2026-59506 — CWE-306: Missing Authentication for Critical Function | Critical (9.3) | — | ✅ |
| CVE-2026-59507 — CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an… | Critical (9.3) | — | ✅ |
| CVE-2026-59514 — Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-59515 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Critical (9.3) | — | ✅ |
| CVE-2026-59525 — Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-59526 — Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-59527 — Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-59533 — Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-59538 — Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-59549 — Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10… | Critical (9.3) | — | ✅ |
| CVE-2026-59550 — Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-61736 — LightRAG provides simple and fast retrieval-augmented generation. | Critical (9.3) | — | ✅ |
CVE-2026-61741 — http4s-scala-xml provides EntityDecoder[F, scala.xml.Elem] instances that parse XML… |
Critical (9.3) | — | ✅ |
| CVE-2026-61948 — Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-61949 — Unauthenticated SQL Injection in Bookly <= 27.7 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-61950 — Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-61966 — Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-61969 — Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-62071 — Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-62613 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.3) | — | ✅ |
| CVE-2026-62618 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.3) | — | ✅ |
| CVE-2026-62637 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.3) | — | ✅ |
| CVE-2026-62834 — Improper verification of cryptographic signature in Azure Data Factory allows an… | Critical (9.3) | — | ✅ |
| CVE-2026-62835 — Improper authorization in Azure Portal allows an unauthorized attacker to disclose… | Critical (9.3) | — | ✅ |
| CVE-2026-63089 — WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak… | Critical (9.3) | — | ✅ |
| CVE-2026-65508 — Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-65520 — Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-65546 — Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66418 — OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that… | Critical (9.3) | — | ✅ |
| CVE-2026-66421 — OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows… | Critical (9.3) | — | ✅ |
| CVE-2026-66436 — Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66446 — Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66447 — Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66458 — Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66472 — Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66478 — Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66592 — Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11… | Critical (9.3) | — | ✅ |
| CVE-2026-66593 — Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66609 — Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66649 — Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-66680 — Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. | Critical (9.3) | — | ✅ |
CVE-2026-66794 — A flaw was found in the cluster-proxy-addon component of Multicluster Engine for… |
Critical (9.3) | — | ✅ |
| CVE-2026-67101 — HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF)… | Critical (9.3) | — | ✅ |
| CVE-2026-67426 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | Critical (9.3) | — | ✅ |
| CVE-2026-68566 — Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-70009 — Improper limitation of a pathname to a restricted directory ('path traversal') in Azure… | Critical (9.3) | — | ✅ |
| CVE-2026-70673 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.3) | — | ✅ |
| CVE-2026-70855 — Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component:… | Critical (9.3) | — | ✅ |
| CVE-2026-70998 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.3) | — | ✅ |
| CVE-2026-71037 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.3) | — | ✅ |
| CVE-2026-71065 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.3) | — | ✅ |
| CVE-2026-71428 — The unstructured library provides open-source components for ingesting and pre-processing… | Critical (9.3) | — | ✅ |
| CVE-2026-73090 — PeerTube is an ActivityPub-federated video streaming platform. | Critical (9.3) | — | ✅ |
| CVE-2026-73183 — Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-73185 — Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-73388 — Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-73391 — Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-76746 — An unauthenticated buffer overflow vulnerability exists in AOS-S. | Critical (9.3) | — | ✅ |
| CVE-2026-78260 — Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-78288 — Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-80098 — Improper verification of cryptographic signature in Copilot Studio allows an unauthorized… | Critical (9.3) | — | ✅ |
| CVE-2026-81286 — Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-81293 — Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-81756 — Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24… | Critical (9.3) | — | ✅ |
| CVE-2026-81763 — Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-84768 — Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20… | Critical (9.3) | — | ✅ |
| CVE-2026-84813 — Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. | Critical (9.3) | — | ✅ |
| CVE-2026-85183 — Taipy configures its socket.io server with wildcard CORS origin and credential flag… | Critical (9.3) | — | ✅ |
| CVE-2026-90530 — ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted… | Critical (9.3) | — | ✅ |
| CVE-2026-9195 — A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server… | Critical (9.3) | — | ✅ |
| CVE-2026-9273 — The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict… | Critical (9.3) | — | ✅ |
| CVE-2026-93641 — An unauthenticated sender can forge a share notification that triggers stored XSS when a… | Critical (9.3) | — | ✅ |
| CVE-2026-93642 — An unauthenticated sender can forge a share notification that triggers stored XSS when a… | Critical (9.3) | — | ✅ |
| CVE-2026-93647 — An unauthenticated calendar sender can place active markup in a COUNTER message's RFC… | Critical (9.3) | — | ✅ |
| CVE-2026-94388 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Critical (9.3) | — | ✅ |
| CVE-2026-95605 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Critical (9.3) | — | ✅ |
| CVE-2026-99999 — In the Linux kernel, the following vulnerability has been resolved: | Critical (9.3) | — | ✅ |
| CVE-2026-49445 — Cilium is a networking, observability, and security solution. | Critical (9.2) | — | ✅ |
| CVE-2026-10059 — A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. | Critical (9.1) | — | ✅ |
| CVE-2026-100714 — Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath… | Critical (9.1) | — | ✅ |
| CVE-2026-101155 — An authenticated remote attacker with specific permissions can read or write files on the… | Critical (9.1) | — | ✅ |
| CVE-2026-102102 — Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side… | Critical (9.1) | — | ✅ |
| CVE-2026-102103 — Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side… | Critical (9.1) | — | ✅ |
| CVE-2026-102104 — Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side… | Critical (9.1) | — | ✅ |
| CVE-2026-102105 — Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side… | Critical (9.1) | — | ✅ |
| CVE-2026-102106 — Improper authentication in a Kiteworks Email Protection Gateway administrative service. | Critical (9.1) | — | ✅ |
| CVE-2026-102946 — joserfc is a Python library that provides an implementation of several JSON Object… | Critical (9.1) | — | ✅ |
| CVE-2026-103264 — Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device… | Critical (9.1) | — | ✅ |
| CVE-2026-103475 — yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses… | Critical (9.1) | — | ✅ |
| CVE-2026-103648 — Path traversal in image-downloader 4.3.0 allows an attacker who can control the download… | Critical (9.1) | — | ✅ |
| CVE-2026-104611 — A vulnerability was detected in Tenda AC9 15.03.02.13. | Critical (9.1) | — | ✅ |
| CVE-2026-105032 — The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI… | Critical (9.1) | — | ✅ |
| CVE-2026-105793 — Microsoft UFO is an open-source framework for intelligent automation across devices and… | Critical (9.1) | — | ✅ |
| CVE-2026-106621 — ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection')… | Critical (9.1) | — | ✅ |
| CVE-2026-107202 — A command injection vulnerability exists in the h-ui (version v0.0.25 and below)… | Critical (9.1) | — | ✅ |
| CVE-2026-107510 — An authenticated high privilege user can inject arguments in troubleshooting commands… | Critical (9.1) | — | ✅ |
| CVE-2026-110862 — Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass… | Critical (9.1) | — | ✅ |
| CVE-2026-111235 — An authorization bypass vulnerability exists in the REST API of multiple versions of… | Critical (9.1) | — | ✅ |
| CVE-2026-12694 — Missing Authorization vulnerability in Vimesoft Inc. | Critical (9.1) | — | ✅ |
| CVE-2026-13097 — A privilege escalation flaw was found in FreeIPA. | Critical (9.1) | — | ✅ |
| CVE-2026-13716 — Path traversal in server import and admin file upload in Crafty Controller. | Critical (9.1) | — | ✅ |
| CVE-2026-14484 — The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is… | Critical (9.1) | — | ✅ |
| CVE-2026-14488 — The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the… | Critical (9.1) | — | ✅ |
| CVE-2026-14524 — The ProSolution WP Client plugin for WordPress is vulnerable to arbitrary file deletion… | Critical (9.1) | — | ✅ |
| CVE-2026-14804 — Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics… | Critical (9.1) | — | ✅ |
| CVE-2026-14958 — IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to… | Critical (9.1) | — | ✅ |
| CVE-2026-14959 — IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to… | Critical (9.1) | — | ✅ |
| CVE-2026-15065 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass… | Critical (9.1) | — | ✅ |
| CVE-2026-15896 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to… | Critical (9.1) | — | ✅ |
| CVE-2026-16926 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite… | Critical (9.1) | — | ✅ |
| CVE-2026-17191 — An input validation vulnerability exists in an API component of the orchestrator. | Critical (9.1) | — | ✅ |
| CVE-2026-17609 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to… | Critical (9.1) | — | ✅ |
| CVE-2026-18248 — @fastify/aws-lambda version 6.4.0 decorates each Fastify request with… | Critical (9.1) | — | ✅ |
| CVE-2026-18316 — The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss… | Critical (9.1) | — | ✅ |
| CVE-2026-18753 — The | Critical (9.1) | — | ✅ |
| CVE-2026-18754 — The | Critical (9.1) | — | ✅ |
| CVE-2026-18855 — The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to… | Critical (9.1) | — | ✅ |
| CVE-2026-18931 — Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. | Critical (9.1) | — | ✅ |
| CVE-2026-19297 — IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized… | Critical (9.1) | — | ✅ |
| CVE-2026-19516 — A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's… | Critical (9.1) | — | ✅ |
| CVE-2026-20310 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.1) | — | ✅ |
| CVE-2026-20328 — A vulnerability in the web-based management interface of Cisco License On-Prem, formerly… | Critical (9.1) | — | ✅ |
| CVE-2026-27064 — Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. | Critical (9.1) | — | ✅ |
| CVE-2026-3141 — The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion… | Critical (9.1) | — | ✅ |
| CVE-2026-33557 — Apache Kafka JWT Validation Bypass | Critical (9.1) | Snort, YARA, Nginx, Sigma | ✅ |
| CVE-2026-3418 — The System REST API accepts user-supplied file uploads without enforcing sufficient… | Critical (9.1) | — | ✅ |
| CVE-2026-3627 — IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. | Critical (9.1) | — | ✅ |
| CVE-2026-39353 — InvoicePlane is a self-hosted open source application for managing invoices, clients, and… | Critical (9.1) | — | ✅ |
| CVE-2026-39932 — OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document… | Critical (9.1) | — | ✅ |
| CVE-2026-40712 — Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input… | Critical (9.1) | — | ✅ |
| CVE-2026-42007 — An attacker that has valid credentials can use a Sieve script with the editheader… | Critical (9.1) | — | ✅ |
| CVE-2026-42322 — Piwigo is a full featured open source photo gallery application for the web. | Critical (9.1) | — | ✅ |
| CVE-2026-44091 — An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in… | Critical (9.1) | — | ✅ |
| CVE-2026-44092 — An unauthenticated remote attacker can inject malicious input into the ModbusServer… | Critical (9.1) | — | ✅ |
| CVE-2026-4431 — The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification… | Critical (9.1) | — | ✅ |
| CVE-2026-44632 — Yamcs is a mission control framework. | Critical (9.1) | — | ✅ |
| CVE-2026-44758 — SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high… | Critical (9.1) | — | ✅ |
| CVE-2026-44945 — A privilege escalation vulnerability exists in Rancher's impersonation middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-45100 — OpenSIPS is a Session Initiation Protocol (SIP) server implementation. | Critical (9.1) | — | ✅ |
| CVE-2026-45363 — ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. | Critical (9.1) | — | ✅ |
| CVE-2026-45537 — OpenSIPS is a Session Initiation Protocol (SIP) server implementation. | Critical (9.1) | — | ✅ |
| CVE-2026-46621 — Yamcs is a mission control framework. | Critical (9.1) | — | ✅ |
| CVE-2026-46738 — Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input… | Critical (9.1) | — | ✅ |
| CVE-2026-47168 — EspoCRM is an open source customer relationship management application. | Critical (9.1) | — | ✅ |
| CVE-2026-48021 — In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection… | Critical (9.1) | — | ✅ |
| CVE-2026-48024 — Wazuh is a free and open source platform used for threat prevention, detection, and… | Critical (9.1) | — | ✅ |
| CVE-2026-48031 — go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by… | Critical (9.1) | — | ✅ |
| CVE-2026-48039 — Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta… | Critical (9.1) | — | ✅ |
| CVE-2026-48162 — Wazuh is a free and open source platform used for threat prevention, detection, and… | Critical (9.1) | — | ✅ |
CVE-2026-48170 — scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype… |
Critical (9.1) | — | ✅ |
| CVE-2026-48319 — ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory… | Critical (9.1) | — | ✅ |
| CVE-2026-48324 — ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL… | Critical (9.1) | — | ✅ |
| CVE-2026-48358 — Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability… | Critical (9.1) | — | ✅ |
| CVE-2026-49441 — Wazuh is a free and open source platform used for threat prevention, detection, and… | Critical (9.1) | — | ✅ |
| CVE-2026-49457 — erlang_quic is a pure Erlang QUIC implementation. | Critical (9.1) | — | ✅ |
| CVE-2026-49849 — xShop is an open-source shop developed in Laravel. | Critical (9.1) | — | ✅ |
| CVE-2026-50152 — Ceph is an open-source distributed storage platform providing object, block, and file… | Critical (9.1) | — | ✅ |
| CVE-2026-52766 — YesWiki is a wiki system written in PHP. | Critical (9.1) | — | ✅ |
| CVE-2026-53486 — The decompress package for Node.js extracts archives. | Critical (9.1) | — | ✅ |
| CVE-2026-53791 — rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows… | Critical (9.1) | — | ✅ |
| CVE-2026-53939 — OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… | Critical (9.1) | — | ✅ |
| CVE-2026-53953 — GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community… | Critical (9.1) | — | ✅ |
| CVE-2026-53976 — OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints… | Critical (9.1) | — | ✅ |
| CVE-2026-53984 — Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and… | Critical (9.1) | — | ✅ |
| CVE-2026-54363 — CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows… | Critical (9.1) | — | ✅ |
| CVE-2026-54489 — Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0,… | Critical (9.1) | — | ✅ |
| CVE-2026-54670 — WeGIA is a web manager for charitable institutions. | Critical (9.1) | — | ✅ |
| CVE-2026-54767 — WeGIA is a web manager for charitable institutions. | Critical (9.1) | — | ✅ |
| CVE-2026-55040 — Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to… | Critical (9.1) | — | ✅ |
| CVE-2026-55083 — DHIS2 is a flexible information system for data capture, management, validation,… | Critical (9.1) | — | ✅ |
| CVE-2026-55240 — Tianji is an open source analytics, uptime monitoring, and server status platform. | Critical (9.1) | — | ✅ |
| CVE-2026-55247 — plone.app.event provides the event content type for Plone. | Critical (9.1) | — | ✅ |
| CVE-2026-55248 — plone.app.portlets provides portlets and a Plone-specific user interface for… | Critical (9.1) | — | ✅ |
| CVE-2026-55511 — Yamcs is a mission control framework. | Critical (9.1) | — | ✅ |
| CVE-2026-55536 — PraisonAI is a multi-agent teams system. | Critical (9.1) | — | ✅ |
| CVE-2026-55640 — Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a… | Critical (9.1) | — | ✅ |
| CVE-2026-5581 — The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized… | Critical (9.1) | — | ✅ |
| CVE-2026-56160 — Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to… | Critical (9.1) | — | ✅ |
| CVE-2026-56260 — Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API… | Critical (9.1) | — | ✅ |
| CVE-2026-56660 — GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community… | Critical (9.1) | — | ✅ |
| CVE-2026-57499 — Liman is open source server management software. | Critical (9.1) | — | ✅ |
| CVE-2026-58400 — GeoNetwork is a catalog application to manage spatially referenced resources. | Critical (9.1) | — | ✅ |
| CVE-2026-58409 — ChurchCRM is an open-source church management system. | Critical (9.1) | — | ✅ |
| CVE-2026-59503 — CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of… | Critical (9.1) | — | ✅ |
| CVE-2026-59504 — CWE-602: Client-Side Enforcement of Server-Side Security | Critical (9.1) | — | ✅ |
| CVE-2026-59564 — An authentication bypass issue exists in communications between affected versions of the… | Critical (9.1) | — | ✅ |
| CVE-2026-59568 — Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote… | Critical (9.1) | — | ✅ |
| CVE-2026-59682 — Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. | Critical (9.1) | — | ✅ |
| CVE-2026-59769 — FA-50 all versions contain hard-coded credentials. | Critical (9.1) | — | ✅ |
| CVE-2026-60137 — WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not… | Critical (9.1) | — | ✅ |
| CVE-2026-60728 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-60737 — Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-60754 — Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component:… | Critical (9.1) | — | ✅ |
| CVE-2026-61008 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-61034 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-61594 — djust provides Phoenix LiveView-style reactive server-side rendering for Django with… | Critical (9.1) | — | ✅ |
| CVE-2026-61800 — Wazuh is an open-source security platform providing unified XDR and SIEM protection for… | Critical (9.1) | — | ✅ |
| CVE-2026-62176 — PraisonAI is a multi-agent teams system. | Critical (9.1) | — | ✅ |
| CVE-2026-62241 — clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret… | Critical (9.1) | — | ✅ |
| CVE-2026-62262 — Piwigo is a full featured open source photo gallery application for the web. | Critical (9.1) | — | ✅ |
| CVE-2026-62325 — goshs is a feature-rich single-binary file server for red teamers and developers. | Critical (9.1) | — | ✅ |
| CVE-2026-62610 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-62638 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-62916 — Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an… | Critical (9.1) | — | ✅ |
| CVE-2026-63229 — A pre-authentication blind SQL injection | Critical (9.1) | — | ✅ |
| CVE-2026-63230 — A pre-authentication error-based SQL injection | Critical (9.1) | — | ✅ |
| CVE-2026-63472 — Vendure is an open-source headless commerce platform. | Critical (9.1) | — | ✅ |
| CVE-2026-64863 — goshs is a feature-rich single-binary file server for red teamers and developers. | Critical (9.1) | — | ✅ |
| CVE-2026-65455 — Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions. | Critical (9.1) | — | ✅ |
| CVE-2026-65461 — Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. | Critical (9.1) | — | ✅ |
| CVE-2026-65701 — SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal… | Critical (9.1) | — | ✅ |
| CVE-2026-65907 — In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was… | Critical (9.1) | — | ✅ |
| CVE-2026-66309 — Improper access control in Azure SQL Database allows an authorized attacker to elevate… | Critical (9.1) | — | ✅ |
| CVE-2026-66600 — Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions. | Critical (9.1) | — | ✅ |
| CVE-2026-66709 — Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. | Critical (9.1) | — | ✅ |
| CVE-2026-66786 — A flaw was found in submariner. | Critical (9.1) | — | ✅ |
| CVE-2026-67568 — The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to… | Critical (9.1) | — | ✅ |
| CVE-2026-67602 — phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that… | Critical (9.1) | — | ✅ |
| CVE-2026-68823 — Exposed dangerous method or function in Azure Confidential Ledger allows an authorized… | Critical (9.1) | — | ✅ |
| CVE-2026-69110 — OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows… | Critical (9.1) | — | ✅ |
| CVE-2026-70419 — Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization… | Critical (9.1) | — | ✅ |
| CVE-2026-70668 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | Critical (9.1) | — | ✅ |
| CVE-2026-70730 — Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle… | Critical (9.1) | — | ✅ |
| CVE-2026-70741 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | Critical (9.1) | — | ✅ |
| CVE-2026-70854 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | Critical (9.1) | — | ✅ |
| CVE-2026-70862 — Vulnerability in Oracle Application Testing Suite. | Critical (9.1) | — | ✅ |
| CVE-2026-70872 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (9.1) | — | ✅ |
| CVE-2026-70876 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (9.1) | — | ✅ |
| CVE-2026-70883 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (9.1) | — | ✅ |
| CVE-2026-70884 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | Critical (9.1) | — | ✅ |
| CVE-2026-70976 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70977 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70978 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70979 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70981 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70984 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70994 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-70997 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-71014 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-71015 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-71026 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-71036 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.1) | — | ✅ |
| CVE-2026-71102 — Vulnerability in the Portable Clusterware component of Oracle Database Server. | Critical (9.1) | — | ✅ |
| CVE-2026-71213 — Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no… | Critical (9.1) | — | ✅ |
| CVE-2026-71238 — DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed… | Critical (9.1) | — | ✅ |
| CVE-2026-71263 — The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool()… | Critical (9.1) | — | ✅ |
| CVE-2026-71277 — rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks… | Critical (9.1) | — | ✅ |
| CVE-2026-71362 — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result… | Critical (9.1) | — | ✅ |
| CVE-2026-71470 — A flaw was found in the search-v2-operator. | Critical (9.1) | — | ✅ |
| CVE-2026-71485 — Centrifugo is an open-source scalable real-time messaging server. | Critical (9.1) | — | ✅ |
| CVE-2026-71933 — Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in… | Critical (9.1) | — | ✅ |
| CVE-2026-71960 — Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing… | Critical (9.1) | — | ✅ |
| CVE-2026-72569 — A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an… | Critical (9.1) | — | ✅ |
| CVE-2026-72575 — An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated… | Critical (9.1) | — | ✅ |
| CVE-2026-72748 — AVideo contains an unauthenticated arbitrary file write vulnerability in the… | Critical (9.1) | — | ✅ |
| CVE-2026-72850 — Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated… | Critical (9.1) | — | ✅ |
| CVE-2026-73256 — Mongoose is an embedded web server and network library. | Critical (9.1) | — | ✅ |
| CVE-2026-73257 — Mongoose is an embedded web server and network library. | Critical (9.1) | — | ✅ |
| CVE-2026-73501 — kin-openapi is a Go project for handling OpenAPI files. | Critical (9.1) | — | ✅ |
| CVE-2026-73567 — sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms… | Critical (9.1) | — | ✅ |
| CVE-2026-73865 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.1) | — | ✅ |
| CVE-2026-73866 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.1) | — | ✅ |
| CVE-2026-73916 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.1) | — | ✅ |
| CVE-2026-73917 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.1) | — | ✅ |
| CVE-2026-73922 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.1) | — | ✅ |
| CVE-2026-73924 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | Critical (9.1) | — | ✅ |
| CVE-2026-74790 — Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering… | Critical (9.1) | — | ✅ |
| CVE-2026-7482 — Bleeding Llama: Ollama Heap OOB Read Memory Leak | Critical (9.1) | Snort, Nginx | ✅ |
| CVE-2026-75431 — PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for… | Critical (9.1) | — | ✅ |
| CVE-2026-75513 — Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. | Critical (9.1) | — | ✅ |
| CVE-2026-7557 — An improper verification of cryptographic signature vulnerability in the SAML… | Critical (9.1) | — | ✅ |
| CVE-2026-75896 — Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies… | Critical (9.1) | — | ✅ |
| CVE-2026-76404 — In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role… | Critical (9.1) | — | ✅ |
| CVE-2026-76454 — A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem,… | Critical (9.1) | — | ✅ |
| CVE-2026-76483 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.1) | — | ✅ |
| CVE-2026-76747 — Buffer overflow vulnerabilities exist in the affected interface of AOS-S. | Critical (9.1) | — | ✅ |
| CVE-2026-76835 — OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a… | Critical (9.1) | — | ✅ |
| CVE-2026-77086 — SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and… | Critical (9.1) | — | ✅ |
| CVE-2026-77535 — A malicious actor with access to the network and high privileges could exploit an… | Critical (9.1) | — | ✅ |
| CVE-2026-77539 — A malicious actor with access to the network and high privileges could exploit an… | Critical (9.1) | — | ✅ |
| CVE-2026-77540 — A malicious actor with access to the network and high privileges could exploit an… | Critical (9.1) | — | ✅ |
| CVE-2026-77541 — A malicious actor with access to the network and high privileges could exploit an… | Critical (9.1) | — | ✅ |
| CVE-2026-77542 — A malicious actor with access to the network and high privileges could exploit an… | Critical (9.1) | — | ✅ |
| CVE-2026-77776 — Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. | Critical (9.1) | — | ✅ |
| CVE-2026-78274 — Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. | Critical (9.1) | — | ✅ |
| CVE-2026-78327 — An Improper Neutralization of Special Elements used in an OS Command ('OS Command… | Critical (9.1) | — | ✅ |
| CVE-2026-78328 — A missing authorization vulnerability in the SonicWall Network Security Manager (NSM)… | Critical (9.1) | — | ✅ |
| CVE-2026-79794 — A SQL injection vulnerability in the web-based management interface of ClearPass Policy… | Critical (9.1) | — | ✅ |
| CVE-2026-79898 — Fortra BoKS Manager contains a command injection vulnerability in crlserver. | Critical (9.1) | — | ✅ |
| CVE-2026-81094 — The mcp-router CLI served its MCP aggregator on every interface and enforced… | Critical (9.1) | — | ✅ |
| CVE-2026-81098 — The Telnyx MCP server exposed its HTTP transport on every interface and did not require a… | Critical (9.1) | — | ✅ |
| CVE-2026-81939 — A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file… | Critical (9.1) | — | ✅ |
| CVE-2026-82244 — Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin… | Critical (9.1) | — | ✅ |
| CVE-2026-82454 — The Omnivore API (packages/api) before the fix in commit abf53d6 contains an… | Critical (9.1) | — | ✅ |
| CVE-2026-82539 — A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. | Critical (9.1) | — | ✅ |
| CVE-2026-82688 — A security vulnerability has been detected in D-Link DNS-340L and DNS-345… | Critical (9.1) | — | ✅ |
| CVE-2026-82690 — A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. | Critical (9.1) | — | ✅ |
| CVE-2026-82691 — A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to… | Critical (9.1) | — | ✅ |
| CVE-2026-82872 — ToolJet before v3.16.208 fails to validate that the path organizationId matches the… | Critical (9.1) | — | ✅ |
| CVE-2026-84479 — WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls… | Critical (9.1) | — | ✅ |
| CVE-2026-84699 — Team Password Manager before 14.184.308 fails to enforce authentication requirements in… | Critical (9.1) | — | ✅ |
| CVE-2026-85184 — @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped… | Critical (9.1) | — | ✅ |
| CVE-2026-85222 — A vulnerability has been found in D-Link DNS-340L 1.01B04. | Critical (9.1) | — | ✅ |
| CVE-2026-85224 — A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. | Critical (9.1) | — | ✅ |
| CVE-2026-85394 — python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC… | Critical (9.1) | — | ✅ |
| CVE-2026-85430 — MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in… | Critical (9.1) | — | ✅ |
| CVE-2026-85434 — MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before… | Critical (9.1) | — | ✅ |
| CVE-2026-85435 — MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST… | Critical (9.1) | — | ✅ |
| CVE-2026-85667 — xiaobei through 5.5.2 fails to implement authentication or signature validation on… | Critical (9.1) | — | ✅ |
| CVE-2026-85684 — marker through 2.0.0 contains a path traversal vulnerability in the FastAPI… | Critical (9.1) | — | ✅ |
| CVE-2026-85714 — Stirling-PDF is a locally hosted web application that facilitates various operations on… | Critical (9.1) | — | ✅ |
| CVE-2026-86148 — A security flaw has been discovered in Tenda CP3 27.5.57.101. | Critical (9.1) | — | ✅ |
| CVE-2026-86149 — A weakness has been identified in Tenda CP3 27.5.57.101. | Critical (9.1) | — | ✅ |
| CVE-2026-86151 — A vulnerability was detected in Tenda CP3 27.5.57.101. | Critical (9.1) | — | ✅ |
| CVE-2026-86153 — A vulnerability has been found in Tenda CP3 27.5.57.101. | Critical (9.1) | — | ✅ |
| CVE-2026-86190 — WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints… | Critical (9.1) | — | ✅ |
| CVE-2026-87115 — The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to… | Critical (9.1) | — | ✅ |
| CVE-2026-89055 — The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization… | Critical (9.1) | — | ✅ |
| CVE-2026-9190 — An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic… | Critical (9.1) | — | ✅ |
| CVE-2026-92084 — The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress… | Critical (9.1) | — | ✅ |
| CVE-2026-92097 — The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode… | Critical (9.1) | — | ✅ |
| CVE-2026-92860 — A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. | Critical (9.1) | — | ✅ |
| CVE-2026-92966 — The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress… | Critical (9.1) | — |
| CVE-2026-93399 — The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in… | Critical (9.1) | — | ✅ |
| CVE-2026-93895 — IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an… | Critical (9.1) | — | ✅ |
| CVE-2026-93909 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an… | Critical (9.1) | — | ✅ |
| CVE-2026-96659 — A flaw was found in Foreman. | Critical (9.1) | — | ✅ |
| CVE-2026-97063 — X-SpringBoot through 6.0 returns login verification codes in HTTP responses from… | Critical (9.1) | — | ✅ |
| CVE-2026-97064 — X-SpringBoot through 6.0 ships with a hardcoded static master login verification code… | Critical (9.1) | — | ✅ |
| CVE-2026-97720 — Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala… | Critical (9.1) | — | ✅ |
| CVE-2026-103248 — n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1… | Critical (9.0) | — | ✅ |
| CVE-2026-103255 — n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1… | Critical (9.0) | — | ✅ |
| CVE-2026-104019 — OS command injection in the Studio Space startup validation script in Amazon SageMaker… | Critical (9.0) | — | ✅ |
| CVE-2026-105812 — Improper control of code generation in the agent import functionality of Amazon Bedrock… | Critical (9.0) | — | ✅ |
| CVE-2026-106619 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in… | Critical (9.0) | — | ✅ |
| CVE-2026-111283 — BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass… | Critical (9.0) | — | ✅ |
| CVE-2026-11386 — An input validation and injection vulnerability exists in Canonical ubuntu-pro-client… | Critical (9.0) | — | ✅ |
| CVE-2026-16723 — A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. | Critical (9.0) | — | ✅ |
| CVE-2026-17351 — The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to… | Critical (9.0) | — | ✅ |
| CVE-2026-18245 — Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6… | Critical (9.0) | — | ✅ |
| CVE-2026-20267 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | Critical (9.0) | — | ✅ |
| CVE-2026-32475 — Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro… | Critical (9.0) | — | ✅ |
| CVE-2026-40541 — An improper neutralization of input during web page generation ('Cross-site Scripting')… | Critical (9.0) | — | ✅ |
| CVE-2026-45143 — Chamilo LMS is an open-source learning management system. | Critical (9.0) | — | ✅ |
| CVE-2026-47252 — Anyquery is an SQL query engine built on top of SQLite. | Critical (9.0) | — | ✅ |
| CVE-2026-48327 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | Critical (9.0) | — | ✅ |
| CVE-2026-48381 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | Critical (9.0) | — | ✅ |
| CVE-2026-61029 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | Critical (9.0) | — | ✅ |
| CVE-2026-62378 — RustFS Console is a web management console for the RustFS distributed file system. | Critical (9.0) | — | ✅ |
| CVE-2026-62674 — Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding… | Critical (9.0) | — | ✅ |
| CVE-2026-62988 — Froxlor is open source server administration software. | Critical (9.0) | — | ✅ |
| CVE-2026-70980 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | Critical (9.0) | — | ✅ |
| CVE-2026-71471 — A flaw was found in acm-search-v2-rhel9. | Critical (9.0) | — | ✅ |
| CVE-2026-71851 — crypto-js is a JavaScript library of crypto standards. | Critical (9.0) | — | ✅ |
| CVE-2026-72530 — A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf… | Critical (9.0) | — | ✅ |
| CVE-2026-73041 — SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to… | Critical (9.0) | — | ✅ |
| CVE-2026-73042 — SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML… | Critical (9.0) | — | ✅ |
| CVE-2026-73043 — SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the… | Critical (9.0) | — | ✅ |
| CVE-2026-73044 — SiYuan versions before v3.7.4 fail to validate or escape table column width values,… | Critical (9.0) | — | ✅ |
| CVE-2026-73050 — SiYuan versions before v3.7.4 fail to validate or escape the color field in… | Critical (9.0) | — | ✅ |
| CVE-2026-73052 — SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and… | Critical (9.0) | — | ✅ |
| CVE-2026-73053 — SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the… | Critical (9.0) | — | ✅ |
| CVE-2026-73700 — A vulnerability in the web-based management interface of HPE Networking Fabric Composer… | Critical (9.0) | — | ✅ |
| CVE-2026-73701 — An unauthenticated remote code execution vulnerability exists in the underlying operating… | Critical (9.0) | — | ✅ |
| CVE-2026-73842 — OpenChoreo is a complete, open-source developer platform for Kubernetes. | Critical (9.0) | — | ✅ |
| CVE-2026-75604 — Next.js is a React framework for building full-stack web applications. | Critical (9.0) | — | ✅ |
| CVE-2026-77545 — A malicious actor with access to the network, low privileges and under certain conditions… | Critical (9.0) | — | ✅ |
| CVE-2026-77549 — A malicious actor with access to the network and under certain conditions could exploit… | Critical (9.0) | — | ✅ |
| CVE-2026-77551 — A malicious actor with access to the network and under certain conditions could exploit… | Critical (9.0) | — | ✅ |
| CVE-2026-77903 — Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker… | Critical (9.0) | — | ✅ |
| CVE-2026-79687 — Dell PowerStore SDNAS contains a Missing Authentication for Critical Function… | Critical (9.0) | — | ✅ |
| CVE-2026-84200 — Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. | Critical (9.0) | — | ✅ |
| CVE-2026-84803 — SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset… | Critical (9.0) | — | ✅ |
| CVE-2026-85982 — The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due… | Critical (9.0) | — | ✅ |
| CVE-2026-86002 — Dokku is a docker-powered platform as a service. | Critical (9.0) | — | ✅ |
| CVE-2026-86345 — A flaw was found in 389-ds-base. | Critical (9.0) | — | ✅ |
| CVE-2026-91881 — Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper… | Critical (9.0) | — | ✅ |
| CVE-2026-92934 — vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows… | Critical (9.0) | — | ✅ |
| CVE-2026-92935 — vm2 is a sandbox for running untrusted Node.js code. | Critical (9.0) | — | ✅ |
| CVE-2026-16496 — The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in… | High (8.9) | — | ✅ |
| CVE-2026-18193 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security… | High (8.9) | — | ✅ |
| CVE-2026-19200 — The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic… | High (8.9) | — | ✅ |
| CVE-2026-30864 — Combodo iTop is a web-based IT service management tool. | High (8.9) | — | ✅ |
| CVE-2026-48019 — Laravel is a web application framework. | High (8.9) | — | ✅ |
| CVE-2026-58154 — Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and… | High (8.9) | — | ✅ |
| CVE-2026-73570 — A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20… | High (8.9) | — | ✅ |
| CVE-2026-77638 — Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a… | High (8.9) | — | ✅ |
| CVE-2026-82653 — SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in… | High (8.9) | — | ✅ |
| CVE-2026-82654 — SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint,… | High (8.9) | — | ✅ |
| CVE-2026-94606 — authentik is an open-source identity provider. | High (8.9) | — | ✅ |
| CVE-2026-0551 — The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object… | High (8.8) | — | ✅ |
| CVE-2026-10036 — SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-100520 — Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST… | High (8.8) | — | ✅ |
| CVE-2026-100544 — openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for… | High (8.8) | — | ✅ |
| CVE-2026-100552 — OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat… | High (8.8) | — | ✅ |
| CVE-2026-100575 — OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in… | High (8.8) | — | ✅ |
| CVE-2026-100580 — OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in… | High (8.8) | — | ✅ |
| CVE-2026-100586 — OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when… | High (8.8) | — | ✅ |
| CVE-2026-100587 — OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the… | High (8.8) | — | ✅ |
| CVE-2026-100596 — OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing… | High (8.8) | — | ✅ |
| CVE-2026-100599 — OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval… | High (8.8) | — | ✅ |
| CVE-2026-100614 — Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-100615 — Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during… | High (8.8) | — | ✅ |
| CVE-2026-100617 — Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong… | High (8.8) | — | ✅ |
| CVE-2026-100619 — Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a… | High (8.8) | — | ✅ |
| CVE-2026-100623 — Capgo (capgo.app) exposes the legacy membership table public.org_users directly through… | High (8.8) | — | ✅ |
| CVE-2026-100639 — SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating… | High (8.8) | — | ✅ |
| CVE-2026-100670 — Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group… | High (8.8) | — | ✅ |
| CVE-2026-100679 — stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated… | High (8.8) | — | ✅ |
| CVE-2026-100864 — heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's… | High (8.8) | — | ✅ |
| CVE-2026-100865 — Heym before 0.0.53 contains multiple independent vulnerabilities. | High (8.8) | — | ✅ |
| CVE-2026-101207 — Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0,… | High (8.8) | — | ✅ |
| CVE-2026-101880 — OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability… | High (8.8) | — | ✅ |
| CVE-2026-101882 — OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-10195 — The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up… | High (8.8) | — | ✅ |
| CVE-2026-101965 — An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper… | High (8.8) | — | ✅ |
| CVE-2026-101967 — An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of… | High (8.8) | — | ✅ |
| CVE-2026-101978 — An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of… | High (8.8) | — | ✅ |
| CVE-2026-101979 — A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and… | High (8.8) | — | ✅ |
| CVE-2026-101981 — A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of… | High (8.8) | — | ✅ |
| CVE-2026-102014 — A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks… | High (8.8) | — | ✅ |
| CVE-2026-102015 — A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper… | High (8.8) | — | ✅ |
| CVE-2026-102049 — A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Networks… | High (8.8) | — | ✅ |
| CVE-2026-102050 — A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Networks Junos… | High (8.8) | — | ✅ |
| CVE-2026-102052 — A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Networks… | High (8.8) | — | ✅ |
| CVE-2026-102055 — A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos… | High (8.8) | — | ✅ |
| CVE-2026-102059 — An Improper Neutralization of Special Elements used in an OS Command ('OS Command… | High (8.8) | — | ✅ |
| CVE-2026-102061 — A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper… | High (8.8) | — | ✅ |
| CVE-2026-102069 — A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos… | High (8.8) | — | ✅ |
| CVE-2026-102120 — A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had… | High (8.8) | — | ✅ |
| CVE-2026-102125 — The sandbox that isolates document conversion on a Kiteworks appliance did not fully… | High (8.8) | — | ✅ |
| CVE-2026-102161 — An unauthenticated attacker located on an adjacent private network (or any attacker… | High (8.8) | — | ✅ |
| CVE-2026-102162 — On affected Arista Wi-Fi access points with captive portal, or application firewall… | High (8.8) | — | ✅ |
| CVE-2026-102163 — On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active,… | High (8.8) | — | ✅ |
| CVE-2026-102174 — A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemon of… | High (8.8) | — | ✅ |
| CVE-2026-102176 — A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-102377 — Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. | High (8.8) | — | ✅ |
| CVE-2026-102406 — Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to… | High (8.8) | — | ✅ |
| CVE-2026-103068 — Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <=… | High (8.8) | — | ✅ |
| CVE-2026-103268 — Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-103474 — yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload… | High (8.8) | — | ✅ |
| CVE-2026-103484 — IVFFlat index build in pgvector before 0.8.7 allows a database user to write data… | High (8.8) | — | ✅ |
| CVE-2026-103994 — A Heap-based Buffer Overflow vulnerability in the VXLAN Gateway Daemon (vgd) of Juniper… | High (8.8) | — | ✅ |
| CVE-2026-104018 — An improper privilege management vulnerability (CWE-269) exists in the command shell of… | High (8.8) | — | ✅ |
| CVE-2026-104335 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
CVE-2026-104795 — The insights-runtime-extractor runs as a privileged DaemonSet (hostPID: true) |
High (8.8) | — | ✅ |
| CVE-2026-104851 — fsspec is a specification and Python implementation framework for filesystem interfaces. | High (8.8) | — | ✅ |
| CVE-2026-105033 — The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials… | High (8.8) | — | ✅ |
| CVE-2026-105040 — The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account… | High (8.8) | — | ✅ |
| CVE-2026-105106 — Koha is vulnerable to OS command injection in the Task Scheduler deletion path. | High (8.8) | — | ✅ |
| CVE-2026-105123 — W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability… | High (8.8) | — | ✅ |
| CVE-2026-105796 — Kiota is an OpenAPI based HTTP Client code generator. | High (8.8) | — | ✅ |
| CVE-2026-105797 — SimpleChat is a secure AI conversation application with personal and group workspaces for… | High (8.8) | — | ✅ |
| CVE-2026-105901 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106059 — GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-106089 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106090 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106218 — In JetBrains TeamCity before 2026.1.3 | High (8.8) | — | ✅ |
| CVE-2026-106443 — WeasyPrint helps web developers to create PDF documents. | High (8.8) | — | ✅ |
| CVE-2026-106558 — Backstage is an open framework for building developer portals. | High (8.8) | — | ✅ |
| CVE-2026-106599 — Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart… | High (8.8) | — | ✅ |
| CVE-2026-106613 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106615 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106617 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106618 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.8) | — | ✅ |
| CVE-2026-106700 — ELADMIN v2.7 and earlier contains an improper access control vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-106708 — XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF)… | High (8.8) | — | ✅ |
| CVE-2026-107350 — Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who… | High (8.8) | — | ✅ |
| CVE-2026-108426 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108427 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108428 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108429 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108430 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108431 — Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108432 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108437 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108439 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108440 — Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108441 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108442 — Use after free in Microsoft Office Word allows an unauthorized attacker to execute code… | High (8.8) | — | ✅ |
| CVE-2026-108443 — Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code… | High (8.8) | — | ✅ |
| CVE-2026-108444 — Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-108445 — Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108446 — Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code… | High (8.8) | — | ✅ |
| CVE-2026-108447 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108449 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108450 — Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108451 — Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-108452 — Improper limitation of a pathname to a restricted directory ('path traversal') in… | High (8.8) | — | ✅ |
| CVE-2026-109693 — Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm… | High (8.8) | — | ✅ |
| CVE-2026-110444 — TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-110445 — TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-110621 — Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-110641 — @runnerty/executor-decompress through 3.1.1 contains an OS command injection… | High (8.8) | — | ✅ |
| CVE-2026-110761 — ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that… | High (8.8) | — | ✅ |
| CVE-2026-110908 — Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain… | High (8.8) | — | ✅ |
| CVE-2026-111311 — The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking,… | High (8.8) | — |
| CVE-2026-111352 — ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-111380 — FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin… | High (8.8) | — | ✅ |
| CVE-2026-111382 — FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-12144 — The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation… | High (8.8) | — | ✅ |
| CVE-2026-12263 — Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions… | High (8.8) | — | ✅ |
| CVE-2026-12366 — Zephyr's dynamic kernel-object disposal path unref_check() in… | High (8.8) | — | ✅ |
| CVE-2026-12384 — Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B… | High (8.8) | — | ✅ |
| CVE-2026-12405 — A flaw was found in rubygem-foreman_remote_execution. | High (8.8) | — | ✅ |
| CVE-2026-12522 — The HL7800 cellular modem driver's +CGCONTRDP: response handler on_cmd_atcmdinfo_ipaddr()… | High (8.8) | — | ✅ |
| CVE-2026-12562 — The RCU II+ and Multiload II+ are vulnerable to an unauthenticated | High (8.8) | — | ✅ |
| CVE-2026-12894 — A flaw was found in the Qute template engine, which is used by Quarkus to generate… | High (8.8) | — | ✅ |
| CVE-2026-12954 — The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in… | High (8.8) | — | ✅ |
| CVE-2026-13212 — The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio… | High (8.8) | — | ✅ |
| CVE-2026-13248 — An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec… | High (8.8) | — | ✅ |
| CVE-2026-13352 — The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile &… | High (8.8) | — | ✅ |
| CVE-2026-13673 — An incorrect permission assignment for critical resource vulnerability in LDAP API in… | High (8.8) | — | ✅ |
| CVE-2026-13717 — A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. | High (8.8) | — | ✅ |
| CVE-2026-13741 — The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable… | High (8.8) | — | ✅ |
| CVE-2026-14167 — A low privileged remote attacker can perform privileged configuration changes reserved… | High (8.8) | — | ✅ |
| CVE-2026-14168 — A low privileged remote attacker can gain administrator privileges due to missing… | High (8.8) | — | ✅ |
| CVE-2026-14270 — The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce)… | High (8.8) | — | ✅ |
| CVE-2026-14279 — The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in… | High (8.8) | — | ✅ |
| CVE-2026-14328 — The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for… | High (8.8) | — | ✅ |
| CVE-2026-14356 — The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all… | High (8.8) | — | ✅ |
| CVE-2026-14357 — The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up… | High (8.8) | — | ✅ |
| CVE-2026-14498 — The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all… | High (8.8) | — | ✅ |
| CVE-2026-14499 — IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to… | High (8.8) | — | ✅ |
| CVE-2026-14522 — IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27… | High (8.8) | — | ✅ |
| CVE-2026-14662 — Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an… | High (8.8) | — | ✅ |
| CVE-2026-14664 — Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-14669 — Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the… | High (8.8) | — | ✅ |
| CVE-2026-14670 — Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner… | High (8.8) | — | ✅ |
| CVE-2026-14671 — Type confusion in PostgreSQL module "refint" allows an object creator to execute… | High (8.8) | — | ✅ |
| CVE-2026-14676 — Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute… | High (8.8) | — | ✅ |
| CVE-2026-14677 — Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object… | High (8.8) | — | ✅ |
| CVE-2026-14680 — Type confusion with PostgreSQL "internal" data type arguments allows any user to execute… | High (8.8) | — | ✅ |
| CVE-2026-14828 — Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before… | High (8.8) | — | ✅ |
| CVE-2026-14863 — FileRun up to and including version 2026.2.0 contains an OS command injection… | High (8.8) | — | ✅ |
| CVE-2026-14948 — A low privileged remote attacker can hijack an active administrative session without… | High (8.8) | — | ✅ |
| CVE-2026-15001 — The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-15017 — The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in… | High (8.8) | — | ✅ |
| CVE-2026-15103 — The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin… | High (8.8) | — | ✅ |
| CVE-2026-15212 — The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in… | High (8.8) | — |
| CVE-2026-15307 — An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. | High (8.8) | — | ✅ |
| CVE-2026-15312 — The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-15414 — The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege… | High (8.8) | — | ✅ |
| CVE-2026-15480 — A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. | High (8.8) | — | ✅ |
| CVE-2026-15481 — A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. | High (8.8) | — | ✅ |
| CVE-2026-15483 — A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. | High (8.8) | — | ✅ |
| CVE-2026-15555 — A flaw was found in JBoss marshalling. | High (8.8) | — | ✅ |
| CVE-2026-15572 — A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy… | High (8.8) | — | ✅ |
| CVE-2026-15606 — The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization… | High (8.8) | — | ✅ |
| CVE-2026-15741 — SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-15742 — Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge… | High (8.8) | — | ✅ |
| CVE-2026-15767 — Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125… | High (8.8) | — | ✅ |
| CVE-2026-15776 — Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a… | High (8.8) | — | ✅ |
| CVE-2026-15804 — The HCM developed by MetaGuru has a SQL Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-15815 — Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when | High (8.8) | — | ✅ |
| CVE-2026-15894 — The Bluetooth Mesh On-Demand Private Proxy solicitation handler in… | High (8.8) | — | ✅ |
| CVE-2026-15897 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-15962 — The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object… | High (8.8) | — | ✅ |
| CVE-2026-15965 — The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress… | High (8.8) | — | ✅ |
| CVE-2026-15988 — The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is… | High (8.8) | — | ✅ |
| CVE-2026-15991 — The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to… | High (8.8) | — | ✅ |
| CVE-2026-15992 — The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all… | High (8.8) | — | ✅ |
| CVE-2026-16099 — The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file… | High (8.8) | — | ✅ |
| CVE-2026-16101 — Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond… | High (8.8) | — | ✅ |
| CVE-2026-16149 — The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all… | High (8.8) | — | ✅ |
| CVE-2026-16236 — The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in… | High (8.8) | — | ✅ |
| CVE-2026-16238 — Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to… | High (8.8) | — | ✅ |
| CVE-2026-16239 — Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-16347 — MikroTik RouterOS contains a weakness in its API authentication handling that lacks… | High (8.8) | — | ✅ |
| CVE-2026-16526 — A flaw in the PCP linux_sockets module exposes an unsecured internal connection. | High (8.8) | — | ✅ |
| CVE-2026-16601 — The CM Map Locations – Visualize and share your locations in a few clicks plugin for… | High (8.8) | — | ✅ |
| CVE-2026-16635 — The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all… | High (8.8) | — | ✅ |
| CVE-2026-16674 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16722 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain… | High (8.8) | — | ✅ |
| CVE-2026-16745 — A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI… | High (8.8) | — | ✅ |
| CVE-2026-16771 — In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any… | High (8.8) | — | ✅ |
| CVE-2026-16793 — An improper neutralization of special elements used in an operating system command… | High (8.8) | — | ✅ |
| CVE-2026-16814 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16841 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16842 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16844 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16847 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16848 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16850 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16865 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16877 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker… | High (8.8) | — | ✅ |
| CVE-2026-16879 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-16901 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16909 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16911 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker… | High (8.8) | — | ✅ |
| CVE-2026-16932 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16934 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain… | High (8.8) | — | ✅ |
| CVE-2026-16936 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16975 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-16987 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due… | High (8.8) | — | ✅ |
| CVE-2026-16996 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-17029 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code due… | High (8.8) | — | ✅ |
| CVE-2026-17070 — Missing Authorization vulnerability in HAVELSAN Inc. | High (8.8) | — | ✅ |
| CVE-2026-17086 — The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for… | High (8.8) | — | ✅ |
| CVE-2026-17123 — The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request… | High (8.8) | — | ✅ |
| CVE-2026-17196 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-17223 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-17346 — The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen… | High (8.8) | — | ✅ |
| CVE-2026-17436 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-17481 — IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-17623 — IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-17626 — IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-17632 — IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-18022 — Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user… | High (8.8) | — | ✅ |
| CVE-2026-18101 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due… | High (8.8) | — | ✅ |
| CVE-2026-18198 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | High (8.8) | — | ✅ |
| CVE-2026-18258 — Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process… | High (8.8) | — | ✅ |
| CVE-2026-18322 — The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation… | High (8.8) | — | ✅ |
| CVE-2026-18408 — Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the… | High (8.8) | — | ✅ |
| CVE-2026-18420 — Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch… | High (8.8) | — | ✅ |
| CVE-2026-18428 — A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL… | High (8.8) | — | ✅ |
| CVE-2026-18438 — The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates… | High (8.8) | — | ✅ |
| CVE-2026-18443 — The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for… | High (8.8) | — | ✅ |
| CVE-2026-18486 — IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote… | High (8.8) | — | ✅ |
| CVE-2026-18598 — A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. | High (8.8) | — | ✅ |
| CVE-2026-18600 — A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. | High (8.8) | — | ✅ |
| CVE-2026-18607 — A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530,… | High (8.8) | — | ✅ |
| CVE-2026-18617 — A flaw was found in the Data Science Pipelines Operator (DSPO). | High (8.8) | — | ✅ |
| CVE-2026-18630 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | High (8.8) | — | ✅ |
| CVE-2026-18650 — Missing Authorization vulnerability in HAVELSAN Inc. | High (8.8) | — | ✅ |
| CVE-2026-18692 — An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an… | High (8.8) | — | ✅ |
| CVE-2026-18729 — IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-18733 — A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before… | High (8.8) | — | ✅ |
| CVE-2026-18787 — A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. | High (8.8) | — | ✅ |
| CVE-2026-18832 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-18895 — A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. | High (8.8) | — | ✅ |
| CVE-2026-18897 — A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. | High (8.8) | — | ✅ |
| CVE-2026-18898 — A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. | High (8.8) | — | ✅ |
| CVE-2026-18949 — A flaw was found in odh-dashboard. | High (8.8) | — | ✅ |
| CVE-2026-18950 — A flaw was found in odh-dashboard. | High (8.8) | — | ✅ |
| CVE-2026-18951 — A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. | High (8.8) | — | ✅ |
| CVE-2026-18965 — PayRange API is missing proper authorization on management endpoints, which allows… | High (8.8) | — | ✅ |
| CVE-2026-18982 — A flaw was found in the RHOAI training-operator. | High (8.8) | — | ✅ |
| CVE-2026-19042 — A command injection vulnerability in TeamViewer Full | High (8.8) | — | ✅ |
| CVE-2026-19291 — Bluetooth re-pairing with an existing device can use a lower security level. | High (8.8) | — | ✅ |
| CVE-2026-19292 — Re-pairing with a legitimate device can use a lower security level than | High (8.8) | — | ✅ |
| CVE-2026-19293 — SMP security request (from peripheral) does not include the maximum | High (8.8) | — | ✅ |
| CVE-2026-19298 — IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-19341 — A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. | High (8.8) | — | ✅ |
| CVE-2026-19346 — A vulnerability was determined in Tenda CH22 1.0.0.1. | High (8.8) | — | ✅ |
| CVE-2026-19385 — Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an… | High (8.8) | — | ✅ |
| CVE-2026-19449 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may… | High (8.8) | — | ✅ |
| CVE-2026-19633 — PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to… | High (8.8) | — | ✅ |
| CVE-2026-19635 — A local privilege escalation vulnerability exists in Security Center. | High (8.8) | — | ✅ |
| CVE-2026-19679 — An input validation vulnerability exists in Security Center's file upload handling, where… | High (8.8) | — | ✅ |
| CVE-2026-19788 — A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. | High (8.8) | — | ✅ |
| CVE-2026-19790 — A vulnerability was identified in Tenda G0 up to 20260625. | High (8.8) | — | ✅ |
| CVE-2026-19791 — A weakness has been identified in Tenda G0 up to 20260625. | High (8.8) | — | ✅ |
| CVE-2026-19792 — A security flaw has been discovered in Tenda G0 up to 20260625. | High (8.8) | — | ✅ |
| CVE-2026-19804 — The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls &… | High (8.8) | — | ✅ |
| CVE-2026-19806 — The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing… | High (8.8) | — | ✅ |
| CVE-2026-19807 — The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-19811 — A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19812 — A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19813 — A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19814 — A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19815 — A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19821 — A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. | High (8.8) | — | ✅ |
| CVE-2026-19822 — A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. | High (8.8) | — | ✅ |
| CVE-2026-19823 — A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. | High (8.8) | — | ✅ |
| CVE-2026-19824 — A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. | High (8.8) | — | ✅ |
| CVE-2026-19844 — A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19845 — A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19846 — A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19847 — A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. | High (8.8) | — | ✅ |
| CVE-2026-19883 — The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized… | High (8.8) | — | ✅ |
| CVE-2026-19887 — The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all… | High (8.8) | — | ✅ |
| CVE-2026-19892 — The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account… | High (8.8) | — | ✅ |
| CVE-2026-19949 — The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL… | High (8.8) | — | ✅ |
| CVE-2026-20150 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-20200 — A vulnerability in the web-based management interface of Cisco IMC could allow an… | High (8.8) | — | ✅ |
| CVE-2026-20275 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-20278 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-20280 — As part of Cisco's ongoing commitment to proactive security and product quality,… | High (8.8) | — | ✅ |
| CVE-2026-20312 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-20340 — A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote… | High (8.8) | — | ✅ |
| CVE-2026-20344 — A vulnerability in the web-based management interface of Cisco Secure FMC Software could… | High (8.8) | — | ✅ |
| CVE-2026-20360 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-22622 — Improper input validation in one of the session management interface of Eaton's Tripp… | High (8.8) | — | ✅ |
| CVE-2026-24170 — NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization… | High (8.8) | — | ✅ |
| CVE-2026-25283 — Memory Corruption when copying unverified data from an external source exceeds the… | High (8.8) | — | ✅ |
| CVE-2026-28111 — Contributor Privilege Escalation in Forminator <= 1.56.0 versions. | High (8.8) | — | ✅ |
| CVE-2026-28161 — Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions. | High (8.8) | — | ✅ |
| CVE-2026-28176 — Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions. | High (8.8) | — | ✅ |
| CVE-2026-28326 — SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote… | High (8.8) | — | ✅ |
| CVE-2026-31936 — Combodo iTop is a web based IT service management tool. | High (8.8) | — | ✅ |
| CVE-2026-32560 — Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code,… | High (8.8) | — | ✅ |
| CVE-2026-32561 — Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. | High (8.8) | — | ✅ |
| CVE-2026-32915 — OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf… | High (8.8) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-33240 — Combodo iTop is a web based IT service management tool. | High (8.8) | — | ✅ |
| CVE-2026-33798 — A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS… | High (8.8) | — | ✅ |
| CVE-2026-3823 — EHG2408 series switch developed by Atop Technologies has a Stack-based Buffer Overflow… | High (8.8) | — | ✅ |
| CVE-2026-39718 — Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows… | High (8.8) | — | ✅ |
| CVE-2026-39944 — Ceph is an open-source distributed storage platform providing object, block, and file… | High (8.8) | — | ✅ |
| CVE-2026-40501 — Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote… | High (8.8) | — | ✅ |
| CVE-2026-41453 — Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads… | High (8.8) | — | ✅ |
| CVE-2026-42017 — An event-handling weakness in JFrog Artifactory could expose privileged authorization… | High (8.8) | — | ✅ |
| CVE-2026-44829 — Gotenberg is a Docker-powered stateless API for PDF files. | High (8.8) | — | ✅ |
| CVE-2026-45805 — Penpot is an open-source design tool for design and code collaboration. | High (8.8) | — | ✅ |
| CVE-2026-47295 — Improper neutralization of special elements used in an sql command ('sql injection') in… | High (8.8) | — | ✅ |
| CVE-2026-47300 — Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized… | High (8.8) | — | ✅ |
| CVE-2026-47301 — Improper access control in Microsoft Configuration Manager allows an authorized attacker… | High (8.8) | — | ✅ |
| CVE-2026-47303 — Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized… | High (8.8) | — | ✅ |
| CVE-2026-48054 — OpenZeppelin Contracts Wizardis a web application to interactively build a contract out… | High (8.8) | — | ✅ |
| CVE-2026-48169 — PraisonAI is a multi-agent teams system. | High (8.8) | — | ✅ |
| CVE-2026-49163 — Improper limitation of a pathname to a restricted directory ('path traversal') in… | High (8.8) | — | ✅ |
| CVE-2026-49255 — electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | High (8.8) | — | ✅ |
| CVE-2026-49258 — Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. | High (8.8) | — | ✅ |
| CVE-2026-49473 — @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that… | High (8.8) | — | ✅ |
| CVE-2026-49499 — Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of… | High (8.8) | — | ✅ |
| CVE-2026-50130 — Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… | High (8.8) | — | ✅ |
| CVE-2026-50186 — 4gaBoards is a boards system for realtime project management. | High (8.8) | — | ✅ |
| CVE-2026-50191 — 4gaBoards is a boards system for realtime project management. | High (8.8) | — | ✅ |
| CVE-2026-50369 — Use after free in Windows Remote Desktop Services allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-50382 — Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-50385 — Concurrent execution using shared resource with improper synchronization ('race… | High (8.8) | — | ✅ |
| CVE-2026-50398 — Concurrent execution using shared resource with improper synchronization ('race… | High (8.8) | — | ✅ |
| CVE-2026-50413 — Use after free in Windows Runtime allows an authorized attacker to elevate privileges… | High (8.8) | — | ✅ |
| CVE-2026-50438 — Improper link resolution before file access ('link following') in Microsoft PC Manager… | High (8.8) | — | ✅ |
| CVE-2026-50444 — Missing authentication for critical function in Windows Server Update Service allows an… | High (8.8) | — | ✅ |
| CVE-2026-50474 — Use after free in Remote Desktop Client allows an unauthorized attacker to execute code… | High (8.8) | — | ✅ |
| CVE-2026-50477 — Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate… | High (8.8) | — | ✅ |
| CVE-2026-50489 — Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate… | High (8.8) | — | ✅ |
| CVE-2026-50538 — LibVNCClient is a library for easy implementation of a VNC client. | High (8.8) | — | ✅ |
| CVE-2026-50666 — Use after free in Windows Remote Access Connection Manager allows an authorized attacker… | High (8.8) | — | ✅ |
| CVE-2026-50670 — Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges… | High (8.8) | — | ✅ |
| CVE-2026-50687 — Use after free in Windows Kernel allows an authorized attacker to elevate privileges… | High (8.8) | — | ✅ |
| CVE-2026-50692 — Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-52775 — YesWiki is a wiki system written in PHP. | High (8.8) | — | ✅ |
| CVE-2026-52872 — Streambert is a cross-platform Electron Desktop App to stream and download video content. | High (8.8) | — | ✅ |
| CVE-2026-52876 — Streambert is a cross-platform Electron Desktop App to stream and download video content. | High (8.8) | — | ✅ |
| CVE-2026-53527 — LeafWiki is a self-hosted wiki. | High (8.8) | — | ✅ |
| CVE-2026-53528 — LeafWiki is a self-hosted wiki. | High (8.8) | — | ✅ |
| CVE-2026-53542 — Termix is a web-based server management platform with SSH terminal, tunneling, and file… | High (8.8) | — | ✅ |
| CVE-2026-53547 — Termix is a web-based server management platform with SSH terminal, tunneling, and file… | High (8.8) | — | ✅ |
| CVE-2026-54121 — Improper authorization in Active Directory Certificate Services (AD CS) allows an… | High (8.8) | — | ✅ |
| CVE-2026-54239 — Faust.js is a headless WordPress toolkit. | High (8.8) | — | ✅ |
| CVE-2026-54368 — CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx()… | High (8.8) | — | ✅ |
| CVE-2026-54449 — LangBot is a global IM bot platform designed for LLMs. | High (8.8) | — | ✅ |
| CVE-2026-54504 — MCP Documentation Server is a local-first document management and semantic search server… | High (8.8) | — | ✅ |
| CVE-2026-54519 — AI Agent Automation is a modular AI agent workflow automation platform with schedulers,… | High (8.8) | — | ✅ |
| CVE-2026-54525 — Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. | High (8.8) | — | ✅ |
| CVE-2026-54540 — Pheditor is a single-file editor and file manager written in PHP. | High (8.8) | — | ✅ |
| CVE-2026-54612 — Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or… | High (8.8) | — | ✅ |
| CVE-2026-54653 — datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and… | High (8.8) | — | ✅ |
| CVE-2026-54671 — WeGIA is a web manager for charitable institutions. | High (8.8) | — | ✅ |
| CVE-2026-54721 — Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. | High (8.8) | — | ✅ |
| CVE-2026-54795 — Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization… | High (8.8) | — | ✅ |
| CVE-2026-54916 — NetBox Device Type Library is a collection of community-sourced device type definitions… | High (8.8) | — | ✅ |
| CVE-2026-54999 — Concurrent execution using shared resource with improper synchronization ('race… | High (8.8) | — | ✅ |
| CVE-2026-55005 — Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-55052 — Missing authorization in Microsoft Office SharePoint allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-55239 — Tianji is an open source analytics, uptime monitoring, and server status platform. | High (8.8) | — | ✅ |
| CVE-2026-55242 — ERPNext is a free and open source Enterprise Resource Planning tool. | High (8.8) | — | ✅ |
| CVE-2026-55485 — Piccolo Admin is an admin interface and content management system for Python, built on… | High (8.8) | — | ✅ |
| CVE-2026-55521 — Yamcs is a mission control framework. | High (8.8) | — | ✅ |
| CVE-2026-55578 — Pheditor is a single-file editor and file manager written in PHP. | High (8.8) | — | ✅ |
| CVE-2026-55585 — QWED is open-source AI verification infrastructure for deterministic verification of LLM… | High (8.8) | — | ✅ |
| CVE-2026-55676 — Malcolm is a network traffic analysis tool suite. | High (8.8) | — | ✅ |
| CVE-2026-55681 — WeGIA is a web manager for charitable institutions. | High (8.8) | — | ✅ |
| CVE-2026-55997 — Rancher issues long-lived registration tokens to authenticate nodes and agents joining a… | High (8.8) | — | ✅ |
| CVE-2026-56194 — Heap-based buffer overflow in Windows Network File System allows an authorized attacker… | High (8.8) | — | ✅ |
| CVE-2026-56196 — Relative path traversal in Windows Admin Center allows an authorized attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-56197 — Improper neutralization of special elements used in a command ('command injection') in… | High (8.8) | — | ✅ |
| CVE-2026-56642 — Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized… | High (8.8) | — | ✅ |
| CVE-2026-56647 — Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an… | High (8.8) | — | ✅ |
| CVE-2026-56702 — Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-5674 — A flaw was found in PipeWire, a multimedia server. | High (8.8) | — | ✅ |
| CVE-2026-56747 — Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl… | High (8.8) | — | ✅ |
| CVE-2026-56748 — Improper validation of symbolic links in the Pack Git import feature in Cribl Stream… | High (8.8) | — | ✅ |
| CVE-2026-57087 — Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized… | High (8.8) | — | ✅ |
| CVE-2026-57090 — Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized… | High (8.8) | — | ✅ |
| CVE-2026-57094 — Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized… | High (8.8) | — | ✅ |
| CVE-2026-57102 — Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an… | High (8.8) | — | ✅ |
| CVE-2026-57510 — SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-57785 — Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions. | High (8.8) | — | ✅ |
| CVE-2026-57863 — Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update… | High (8.8) | — | ✅ |
| CVE-2026-57969 — Missing authentication for critical function in Azure CycleCloud allows an authorized… | High (8.8) | — | ✅ |
| CVE-2026-57996 — phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API… | High (8.8) | — | ✅ |
| CVE-2026-58095 — mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator… | High (8.8) | — | ✅ |
| CVE-2026-58195 — Agentic-Flow is an AI agent orchestration platform. | High (8.8) | — | ✅ |
| CVE-2026-58222 — A security flaw combining LDAP filter injection and improper authorization checks was… | High (8.8) | — | ✅ |
| CVE-2026-58243 — SAP ABAP Development Tools does not perform necessary authorization checks for certain… | High (8.8) | — | ✅ |
| CVE-2026-58277 — Improper authorization in Microsoft Office SharePoint allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-58474 — whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet… | High (8.8) | — | ✅ |
| CVE-2026-58534 — Heap-based buffer overflow in Microsoft Input Method Editor (IME) allows an authorized… | High (8.8) | — | ✅ |
| CVE-2026-58565 — Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization… | High (8.8) | — | ✅ |
| CVE-2026-58566 — Dell PowerStore, an Incorrect Authorization vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-58567 — Dell PowerStore contains an OS Command Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-58569 — Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere… | High (8.8) | — | ✅ |
| CVE-2026-58571 — Dell PowerStore contains an OS Command Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-58572 — Dell PowerStore contains a Code Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-58575 — Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-58594 — Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-58608 — Concurrent execution using shared resource with improper synchronization ('race… | High (8.8) | — | ✅ |
| CVE-2026-58626 — Use after free in Windows Remote Desktop Services allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-58655 — The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0… | High (8.8) | — | ✅ |
| CVE-2026-59109 — SQL injection in the Zalktis accounting application via | High (8.8) | — | ✅ |
| CVE-2026-59260 — OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing… | High (8.8) | — | ✅ |
| CVE-2026-59541 — Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions. | High (8.8) | — | ✅ |
| CVE-2026-5956 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | High (8.8) | — | ✅ |
| CVE-2026-59565 — A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service… | High (8.8) | — | ✅ |
| CVE-2026-59567 — Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local… | High (8.8) | — | ✅ |
| CVE-2026-59681 — A OS command injection vulnerability in yast2-auth-client allows an attacker who controls… | High (8.8) | — | ✅ |
| CVE-2026-59733 — Rclone is a command-line program to sync files and directories to and from different… | High (8.8) | — | ✅ |
| CVE-2026-59808 — AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where… | High (8.8) | — | ✅ |
CVE-2026-60009 — In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend… |
High (8.8) | — | ✅ |
| CVE-2026-60134 — Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated… | High (8.8) | — | ✅ |
| CVE-2026-60368 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | High (8.8) | — | ✅ |
| CVE-2026-60373 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | High (8.8) | — | ✅ |
| CVE-2026-60439 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | High (8.8) | — | ✅ |
| CVE-2026-60455 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | High (8.8) | — | ✅ |
| CVE-2026-60715 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-60716 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-60722 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-60726 — Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-60729 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-60731 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-60751 — Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component:… | High (8.8) | — | ✅ |
| CVE-2026-60767 — Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component:… | High (8.8) | — | ✅ |
| CVE-2026-60879 — Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… | High (8.8) | — | ✅ |
| CVE-2026-60967 — Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… | High (8.8) | — | ✅ |
| CVE-2026-60976 — Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component:… | High (8.8) | — | ✅ |
| CVE-2026-61002 — Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B… | High (8.8) | — | ✅ |
| CVE-2026-61017 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61022 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61032 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61040 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61042 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61058 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61118 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61213 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61231 — Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-61246 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | High (8.8) | — | ✅ |
| CVE-2026-61273 — Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards… | High (8.8) | — | ✅ |
| CVE-2026-61276 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-61284 — Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise… | High (8.8) | — | ✅ |
| CVE-2026-61319 — Vulnerability in the Oracle U.S. | High (8.8) | — | ✅ |
| CVE-2026-61330 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.8) | — | ✅ |
| CVE-2026-61341 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.8) | — | ✅ |
| CVE-2026-61457 — The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload… | High (8.8) | — | ✅ |
| CVE-2026-6147 — The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to… | High (8.8) | — | ✅ |
| CVE-2026-61518 — ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. | High (8.8) | — | ✅ |
| CVE-2026-61876 — LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status… | High (8.8) | — | ✅ |
| CVE-2026-61892 — Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. | High (8.8) | — | ✅ |
| CVE-2026-62062 — Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross… | High (8.8) | — | ✅ |
| CVE-2026-62202 — OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability… | High (8.8) | — | ✅ |
| CVE-2026-62207 — OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that… | High (8.8) | — | ✅ |
| CVE-2026-62217 — OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot… | High (8.8) | — | ✅ |
| CVE-2026-62218 — OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-62223 — OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-62228 — OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec… | High (8.8) | — | ✅ |
| CVE-2026-62229 — OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist… | High (8.8) | — | ✅ |
| CVE-2026-62233 — grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey,… | High (8.8) | — | ✅ |
| CVE-2026-62312 — 9Router is an AI router & token saver. | High (8.8) | — | ✅ |
| CVE-2026-62316 — Microsoft UFO open-source framework for intelligent automation across devices and… | High (8.8) | — | ✅ |
| CVE-2026-62450 — Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-62462 — Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-62500 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-62612 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-62619 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-62623 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-62631 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-62666 — Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… | High (8.8) | — | ✅ |
| CVE-2026-62675 — Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding… | High (8.8) | — | ✅ |
| CVE-2026-62677 — Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding… | High (8.8) | — | ✅ |
| CVE-2026-62870 — Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code… | High (8.8) | — | ✅ |
| CVE-2026-63085 — Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass… | High (8.8) | — | ✅ |
| CVE-2026-63093 — Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-63506 — Tina is a headless content management system. | High (8.8) | — | ✅ |
| CVE-2026-63626 — Mongoose is an embedded web server and network library. | High (8.8) | — | ✅ |
| CVE-2026-63727 — Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege… | High (8.8) | — | ✅ |
| CVE-2026-64830 — FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-64831 — FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-64832 — FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC… | High (8.8) | — | ✅ |
| CVE-2026-64835 — FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-65013 — Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level… | High (8.8) | — | ✅ |
| CVE-2026-65091 — NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway… | High (8.8) | — | ✅ |
| CVE-2026-65423 — An integer overflow in the UA_Variant arrayDimensions product | High (8.8) | — | ✅ |
| CVE-2026-65542 — Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | High (8.8) | — | ✅ |
| CVE-2026-65608 — Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-65616 — Incorrect authorization validation in refresh token signature allows non-admin users to… | High (8.8) | — | ✅ |
| CVE-2026-65617 — A deserialization weakness in JFrog Artifactory package handling could allow a… | High (8.8) | — | ✅ |
| CVE-2026-65668 — Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-65674 — Deserialization of untrusted data in SQL Server allows an authorized attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-65690 — Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath… | High (8.8) | — | ✅ |
| CVE-2026-65897 — Grav API Plugin versions before 1.0.10 fail to validate the groups field in… | High (8.8) | — | ✅ |
| CVE-2026-65906 — In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox… | High (8.8) | — | ✅ |
| CVE-2026-65917 — CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object… | High (8.8) | — | ✅ |
| CVE-2026-65921 — A path validation weakness in archive extraction/write handling allows entries with… | High (8.8) | — | ✅ |
| CVE-2026-66014 — JFrog Artifactory contains an authentication handling weakness in internal request… | High (8.8) | — | ✅ |
| CVE-2026-66032 — libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-66036 — FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write… | High (8.8) | — | ✅ |
| CVE-2026-66039 — FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow… | High (8.8) | — | ✅ |
| CVE-2026-66040 — FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write… | High (8.8) | — | ✅ |
| CVE-2026-66041 — FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write… | High (8.8) | — | ✅ |
| CVE-2026-66246 — iControl is affected by a Broken Access Control vulnerability, which could allow an… | High (8.8) | — | ✅ |
| CVE-2026-66405 — DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. | High (8.8) | — | ✅ |
| CVE-2026-66416 — Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-66420 — MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass… | High (8.8) | — | ✅ |
| CVE-2026-66602 — Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress… | High (8.8) | — | ✅ |
| CVE-2026-66748 — Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution… | High (8.8) | — | ✅ |
| CVE-2026-66842 — BIG-IP has a vulnerability where an authenticated user of any role may be able to create… | High (8.8) | — | ✅ |
| CVE-2026-66875 — In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote… | High (8.8) | — | ✅ |
| CVE-2026-67195 — Perspective 5.0.0 contains a remote code execution vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-67206 — Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-67207 — Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-67325 — GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to… | High (8.8) | — | ✅ |
| CVE-2026-67343 — ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET… | High (8.8) | — | ✅ |
| CVE-2026-67351 — Serendipity before 2.6.1 contains an authentication context confusion vulnerability where… | High (8.8) | — | ✅ |
| CVE-2026-67356 — ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger… | High (8.8) | — | ✅ |
| CVE-2026-67623 — Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-68561 — Wekan is open source kanban built with Meteor. | High (8.8) | — | ✅ |
| CVE-2026-68861 — Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of… | High (8.8) | — | ✅ |
| CVE-2026-69100 — LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote… | High (8.8) | — | ✅ |
| CVE-2026-69118 — Cachet through 2.4.1 contains a server-side template injection vulnerability in incident… | High (8.8) | — | ✅ |
| CVE-2026-70619 — Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-70674 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.8) | — | ✅ |
| CVE-2026-70686 — Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component:… | High (8.8) | — | ✅ |
| CVE-2026-70688 — Vulnerability in Oracle Essbase (component: Calculator). | High (8.8) | — | ✅ |
| CVE-2026-70707 — Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70710 — Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70715 — Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). | High (8.8) | — | ✅ |
| CVE-2026-70729 — Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component:… | High (8.8) | — | ✅ |
| CVE-2026-70737 — Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of… | High (8.8) | — | ✅ |
| CVE-2026-70742 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70747 — Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70761 — Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70787 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70792 — Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70812 — Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70813 — Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite… | High (8.8) | — | ✅ |
| CVE-2026-70818 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70819 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70821 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70863 — Vulnerability in Oracle Application Testing Suite. | High (8.8) | — | ✅ |
| CVE-2026-70874 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.8) | — | ✅ |
| CVE-2026-70877 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.8) | — | ✅ |
| CVE-2026-70886 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.8) | — | ✅ |
| CVE-2026-70899 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.8) | — | ✅ |
| CVE-2026-70918 — Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component:… | High (8.8) | — | ✅ |
| CVE-2026-70922 — Vulnerability in the Oracle Financial Services Enterprise Case Management product of… | High (8.8) | — | ✅ |
| CVE-2026-70928 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70940 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70941 — Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component:… | High (8.8) | — | ✅ |
| CVE-2026-70944 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70948 — Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component:… | High (8.8) | — | ✅ |
| CVE-2026-70949 — Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component:… | High (8.8) | — | ✅ |
| CVE-2026-70951 — Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component:… | High (8.8) | — | ✅ |
| CVE-2026-70956 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70965 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-70966 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-71039 — Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:… | High (8.8) | — | ✅ |
| CVE-2026-71044 — Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). | High (8.8) | — | ✅ |
| CVE-2026-71045 — Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:… | High (8.8) | — | ✅ |
| CVE-2026-71046 — Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:… | High (8.8) | — | ✅ |
| CVE-2026-71051 — Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain… | High (8.8) | — | ✅ |
| CVE-2026-71052 — Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply… | High (8.8) | — | ✅ |
| CVE-2026-71055 — Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle… | High (8.8) | — | ✅ |
| CVE-2026-71058 — Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web… | High (8.8) | — | ✅ |
| CVE-2026-71067 — Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain… | High (8.8) | — | ✅ |
| CVE-2026-71106 — Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle… | High (8.8) | — | ✅ |
| CVE-2026-71150 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.8) | — | ✅ |
| CVE-2026-71176 — Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization… | High (8.8) | — | ✅ |
| CVE-2026-71235 — Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or… | High (8.8) | — | ✅ |
| CVE-2026-71243 — The backmeup npm package assembles shell command strings by directly concatenating its… | High (8.8) | — | ✅ |
| CVE-2026-71281 — Hugging Face peft's LoRA-GA and CorDA initialization modules… | High (8.8) | — | ✅ |
| CVE-2026-71287 — Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column… | High (8.8) | — | ✅ |
CVE-2026-71288 — Koha's guided report builder (reports/guided_reports.pl) reads the order_by CGI… |
High (8.8) | — | ✅ |
| CVE-2026-71291 — Bolt CMS renders content field values through Twig's full application-level Environment… | High (8.8) | — | ✅ |
| CVE-2026-71513 — NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler… | High (8.8) | — | ✅ |
| CVE-2026-7187 — Missing authentication for critical function vulnerability in Universal Software Inc. | High (8.8) | — | ✅ |
| CVE-2026-71961 — Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection… | High (8.8) | — | ✅ |
| CVE-2026-71963 — Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code… | High (8.8) | — | ✅ |
| CVE-2026-71965 — CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code… | High (8.8) | — | ✅ |
| CVE-2026-71966 — CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection… | High (8.8) | — | ✅ |
| CVE-2026-71981 — Cypht before 2.12.2 contains a PHP object injection vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-72561 — A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217… | High (8.8) | — | ✅ |
| CVE-2026-72562 — An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3… | High (8.8) | — | ✅ |
| CVE-2026-72573 — An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an… | High (8.8) | — | ✅ |
| CVE-2026-72578 — A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an… | High (8.8) | — | ✅ |
| CVE-2026-72642 — The native inference process that Elasticsearch uses to evaluate uploaded machine… | High (8.8) | — | ✅ |
| CVE-2026-72649 — Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning… | High (8.8) | — | ✅ |
| CVE-2026-72778 — Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain… | High (8.8) | — | ✅ |
| CVE-2026-72781 — Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a… | High (8.8) | — | ✅ |
| CVE-2026-72819 — Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects… | High (8.8) | — | ✅ |
| CVE-2026-72827 — Grav CMS before 2.0.13 contains a server-side template injection vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-72831 — The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect… | High (8.8) | — | ✅ |
| CVE-2026-72833 — The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a… | High (8.8) | — | ✅ |
| CVE-2026-72837 — File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy… | High (8.8) | — | ✅ |
| CVE-2026-72840 — OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that… | High (8.8) | — | ✅ |
| CVE-2026-72866 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | High (8.8) | — | ✅ |
| CVE-2026-72875 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | High (8.8) | — | ✅ |
| CVE-2026-72883 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | High (8.8) | — | ✅ |
| CVE-2026-72984 — Access of resource using incompatible type ('type confusion') in Microsoft Edge… | High (8.8) | — | ✅ |
| CVE-2026-73040 — Dockge validates a stack name only on the write path. | High (8.8) | — | ✅ |
| CVE-2026-73222 — Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. | High (8.8) | — | ✅ |
| CVE-2026-73224 — electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | High (8.8) | — | ✅ |
| CVE-2026-73226 — electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | High (8.8) | — | ✅ |
| CVE-2026-73305 — Budibase is an open-source low-code platform. | High (8.8) | — | ✅ |
| CVE-2026-73514 — The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b,… | High (8.8) | — | ✅ |
| CVE-2026-73614 — Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters… | High (8.8) | — | ✅ |
| CVE-2026-73615 — Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where… | High (8.8) | — | ✅ |
| CVE-2026-73625 — GitPython versions before 3.1.54 contain a remote code execution vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-73667 — OpenChoreo is a complete, open-source developer platform for Kubernetes. | High (8.8) | — | ✅ |
| CVE-2026-73673 — Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update… | High (8.8) | — | ✅ |
| CVE-2026-73680 — Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg… | High (8.8) | — | ✅ |
| CVE-2026-73702 — A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. | High (8.8) | — | ✅ |
| CVE-2026-73703 — A vulnerability in the web-based management interface of HPE Networking Fabric Composer… | High (8.8) | — | ✅ |
| CVE-2026-73704 — A command sanitization bypass exists in the API of HPE Networking Fabric Composer. | High (8.8) | — | ✅ |
| CVE-2026-73705 — An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could… | High (8.8) | — | ✅ |
| CVE-2026-73750 — Vulnerabilities exist in the authentication module that may improperly process malformed… | High (8.8) | — | ✅ |
| CVE-2026-73751 — An authenticated user with low-privileged access could submit crafted input through the… | High (8.8) | — | ✅ |
| CVE-2026-73752 — An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. | High (8.8) | — | ✅ |
| CVE-2026-73753 — Exploitation through affected command-line operations could allow an authenticated… | High (8.8) | — | ✅ |
| CVE-2026-73782 — A format string vulnerability exists in the command line interface of AOS-CX that could… | High (8.8) | — | ✅ |
| CVE-2026-73841 — OpenChoreo is a complete, open-source developer platform for Kubernetes. | High (8.8) | — | ✅ |
| CVE-2026-74770 — Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of… | High (8.8) | — | ✅ |
| CVE-2026-75149 — marimo before 0.23.15 contains a code injection vulnerability in the notebook… | High (8.8) | — | ✅ |
| CVE-2026-75419 — go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-75574 — The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders… | High (8.8) | — | ✅ |
| CVE-2026-75814 — The Ebyte device does not adequately verify the origin or authenticity of | High (8.8) | — | ✅ |
| CVE-2026-75918 — phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file… | High (8.8) | — | ✅ |
| CVE-2026-75977 — The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via… | High (8.8) | — | ✅ |
| CVE-2026-76060 — An authenticated OS command injection vulnerability exists in ZoneMinder's event export… | High (8.8) | — | ✅ |
| CVE-2026-76073 — Label Studio does not scope the annotation detail endpoint to the requesting user's… | High (8.8) | — | ✅ |
| CVE-2026-76111 — Dell PowerStore contains an Incorrect Authorization vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-76220 — GitPython before 3.1.58 contains a command execution vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-76221 — GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name… | High (8.8) | — | ✅ |
| CVE-2026-76224 — ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3) contains a remote code… | High (8.8) | — | ✅ |
| CVE-2026-76253 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds… | High (8.8) | — | ✅ |
| CVE-2026-76259 — In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and… | High (8.8) | — | ✅ |
| CVE-2026-76313 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.8) | — | ✅ |
| CVE-2026-76314 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.8) | — | ✅ |
| CVE-2026-76315 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.8) | — | ✅ |
| CVE-2026-76316 — In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an… | High (8.8) | — | ✅ |
| CVE-2026-76317 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.8) | — | ✅ |
| CVE-2026-76319 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged… | High (8.8) | — | ✅ |
| CVE-2026-76335 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an authenticated… | High (8.8) | — | ✅ |
| CVE-2026-76350 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds… | High (8.8) | — | ✅ |
| CVE-2026-76351 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure… | High (8.8) | — | ✅ |
| CVE-2026-76352 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.8) | — | ✅ |
| CVE-2026-76389 — In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user… | High (8.8) | — | ✅ |
| CVE-2026-76395 — In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could… | High (8.8) | — | ✅ |
| CVE-2026-76409 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76453 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76459 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76463 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76470 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76472 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76484 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.8) | — | ✅ |
| CVE-2026-76639 — Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution… | High (8.8) | — | ✅ |
| CVE-2026-7667 — IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a… | High (8.8) | — | ✅ |
| CVE-2026-76748 — A privilege escalation vulnerability exists in the API of AOS-S. | High (8.8) | — | ✅ |
| CVE-2026-76801 — The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart… | High (8.8) | — | ✅ |
| CVE-2026-76832 — Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal… | High (8.8) | — | ✅ |
| CVE-2026-76836 — AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that… | High (8.8) | — | ✅ |
| CVE-2026-76841 — Xinference loads models with Hugging Face remote code execution unconditionally enabled,… | High (8.8) | — | ✅ |
| CVE-2026-76847 — act starts an HTTP Artifacts V4 backend whenever a workflow uses… | High (8.8) | — | ✅ |
| CVE-2026-77203 — The Groups – Memberships and Access Control plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-77234 — Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged… | High (8.8) | — | ✅ |
| CVE-2026-77393 — In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped… | High (8.8) | — | ✅ |
| CVE-2026-7755 — IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to… | High (8.8) | — | ✅ |
| CVE-2026-77614 — Opencast is a free, open-source platform to support the management of educational audio… | High (8.8) | — | ✅ |
| CVE-2026-77931 — MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers… | High (8.8) | — | ✅ |
| CVE-2026-77966 — The affected Ebyte | High (8.8) | — | ✅ |
| CVE-2026-78037 — Xiiaozet LK100W is vulnerable to OS command injection through its | High (8.8) | — | ✅ |
| CVE-2026-78170 — A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. | High (8.8) | — | ✅ |
| CVE-2026-78236 — An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate… | High (8.8) | — | ✅ |
| CVE-2026-78257 — Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions. | High (8.8) | — | ✅ |
| CVE-2026-78295 — Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions. | High (8.8) | — | ✅ |
| CVE-2026-78314 — SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to | High (8.8) | — | ✅ |
| CVE-2026-78315 — SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to | High (8.8) | — | ✅ |
| CVE-2026-78316 — SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to | High (8.8) | — | ✅ |
| CVE-2026-78317 — SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to | High (8.8) | — | ✅ |
| CVE-2026-78376 — A flaw was found in WebKitGTK. | High (8.8) | — | ✅ |
| CVE-2026-78685 — Medical Practice Management System developed by Le-yan has a Remote Code Execution… | High (8.8) | — | ✅ |
| CVE-2026-79665 — Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens… | High (8.8) | — | ✅ |
| CVE-2026-79682 — Dell PowerStore contains a Command Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-79683 — Dell PowerStore contains a Protection Mechanism Failure vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-79684 — Dell PowerStore contains a Protection Mechanism Failure vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-79686 — Dell PowerStore contains a Protection Mechanism Failure vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-79744 — MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP… | High (8.8) | — | ✅ |
| CVE-2026-79784 — Vocos instantiates a class named by a configuration file without restricting which class… | High (8.8) | — | ✅ |
| CVE-2026-79799 — A vulnerability in the web-based management interface of ClearPass Policy Manager could… | High (8.8) | — | ✅ |
| CVE-2026-79800 — An authenticated path traversal vulnerability exists in the command line interface of… | High (8.8) | — | ✅ |
| CVE-2026-79802 — A command injection vulnerability exists in the client software of ClearPass Policy… | High (8.8) | — | ✅ |
| CVE-2026-79803 — A command injection vulnerability exists in the API of ClearPass Policy Manager. | High (8.8) | — | ✅ |
| CVE-2026-80049 — Airbyte Platform resolves the workspace used for its authorization decision from a field… | High (8.8) | — | ✅ |
| CVE-2026-80193 — Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry… | High (8.8) | — | ✅ |
| CVE-2026-80202 — Kimai before 2.56.0 does not enforce team-membership checks in… | High (8.8) | — | ✅ |
| CVE-2026-80237 — EFence developed by Thinking Software Technology has an Arbitrary File Upload… | High (8.8) | — | ✅ |
| CVE-2026-80275 — Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and… | High (8.8) | — | ✅ |
| CVE-2026-80298 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | High (8.8) | — | ✅ |
| CVE-2026-80348 — TarsWeb enforces its per-application roles by calling AuthService from individual… | High (8.8) | — | ✅ |
| CVE-2026-8056 — IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component… | High (8.8) | — | ✅ |
| CVE-2026-81271 — Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions. | High (8.8) | — | ✅ |
| CVE-2026-81283 — Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions. | High (8.8) | — | ✅ |
| CVE-2026-81532 — A user able to submit SQL through an application using the MongoDB Connector for BI ODBC… | High (8.8) | — | ✅ |
| CVE-2026-81534 — The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote… | High (8.8) | — | ✅ |
| CVE-2026-81543 — The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege… | High (8.8) | — | ✅ |
| CVE-2026-81579 — In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the… | High (8.8) | — | ✅ |
| CVE-2026-81581 — Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for… | High (8.8) | — | ✅ |
| CVE-2026-81625 — A remote attacker with user privileges may use a malicious or compromised NASL… | High (8.8) | — | ✅ |
| CVE-2026-81769 — Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege… | High (8.8) | — | ✅ |
| CVE-2026-81772 — Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions. | High (8.8) | — | ✅ |
| CVE-2026-8182 — IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to… | High (8.8) | — | ✅ |
| CVE-2026-81849 — Improper limitation of a pathname to a restricted directory in the aws:downloadContent… | High (8.8) | — | ✅ |
| CVE-2026-82026 — Radar before 1.12.2 contains a missing authorization vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-82039 — UTMStack before 11.2.16 contains a SQL injection vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-82217 — In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode"… | High (8.8) | — | ✅ |
| CVE-2026-82278 — BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow… | High (8.8) | — | ✅ |
| CVE-2026-82447 — Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that… | High (8.8) | — | ✅ |
| CVE-2026-82450 — BookStack before 26.05.4 contains a remote code execution vulnerability in the portable… | High (8.8) | — | ✅ |
| CVE-2026-82538 — ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-82566 — The Botslab G980H dash camera firmware contains a session management vulnerability in… | High (8.8) | — | ✅ |
| CVE-2026-82628 — A vulnerability was found in Colorful iGameCenter 2.0.0.81. | High (8.8) | — | ✅ |
| CVE-2026-82635 — Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri… | High (8.8) | — | ✅ |
| CVE-2026-82642 — Readest is an open-source e-book reader built on Tauri. | High (8.8) | — | ✅ |
| CVE-2026-82680 — A weakness has been identified in D-Link DSM-G600 1.01. | High (8.8) | — | ✅ |
| CVE-2026-82712 — Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site… | High (8.8) | — | ✅ |
| CVE-2026-82807 — A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. | High (8.8) | — | ✅ |
| CVE-2026-82828 — Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that… | High (8.8) | — | ✅ |
| CVE-2026-82882 — Devtron through 2.2.0 fails to enforce authorization checks on the GET… | High (8.8) | — | ✅ |
| CVE-2026-82908 — A vulnerability was found in MSI Dragon Center up to 2.0.155.0. | High (8.8) | — | ✅ |
| CVE-2026-83497 — Unrestricted deserialization of untrusted data in the cursor pagination component in the… | High (8.8) | — | ✅ |
| CVE-2026-83596 — A flaw was found in WebKitGTK. | High (8.8) | — | ✅ |
| CVE-2026-84117 — Privilege escalation in Firefox for Android. | High (8.8) | — | ✅ |
| CVE-2026-84123 — Privilege escalation due to use-after-free in the Graphics: WebGPU component. | High (8.8) | — | ✅ |
| CVE-2026-84128 — Privilege escalation in the WebDriver BiDi component. | High (8.8) | — | ✅ |
| CVE-2026-84202 — ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing… | High (8.8) | — | ✅ |
| CVE-2026-84268 — A flaw was found in the SFTP backend in gvfs. | High (8.8) | — | ✅ |
| CVE-2026-84399 — The Botslab G980H dash camera firmware contains an authorization vulnerability in its… | High (8.8) | — | ✅ |
| CVE-2026-84482 — WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability… | High (8.8) | — | ✅ |
| CVE-2026-84645 — In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing… | High (8.8) | — | ✅ |
| CVE-2026-84647 — In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in… | High (8.8) | — | ✅ |
| CVE-2026-84648 — In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not… | High (8.8) | — | ✅ |
| CVE-2026-84649 — In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except… | High (8.8) | — | ✅ |
| CVE-2026-84650 — In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be… | High (8.8) | — | ✅ |
| CVE-2026-84668 — Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML… | High (8.8) | — | ✅ |
| CVE-2026-84669 — A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows… | High (8.8) | — | ✅ |
| CVE-2026-84670 — Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes… | High (8.8) | — | ✅ |
| CVE-2026-84671 — Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to… | High (8.8) | — | ✅ |
| CVE-2026-84672 — Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier… | High (8.8) | — | ✅ |
| CVE-2026-84673 — Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting… | High (8.8) | — | ✅ |
| CVE-2026-84694 — Coolify before 4.2.0 fails to properly escape environment variable key names in Docker… | High (8.8) | — | ✅ |
| CVE-2026-84715 — FeatherPanel versions before 1.3.7.10 fail to validate permissions in the… | High (8.8) | — | ✅ |
| CVE-2026-84752 — Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. | High (8.8) | — | ✅ |
| CVE-2026-84764 — Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <=… | High (8.8) | — | ✅ |
| CVE-2026-84770 — Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. | High (8.8) | — | ✅ |
| CVE-2026-8478 — IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-84801 — Craft CMS versions before 5.10.11 fail to validate admin status in the… | High (8.8) | — | ✅ |
| CVE-2026-85046 — Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2026-85049 — Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker… | High (8.8) | — | ✅ |
| CVE-2026-85051 — Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2026-85053 — Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82… | High (8.8) | — | ✅ |
| CVE-2026-85094 — The Canva Android App before 2.376.0 did not restrict the headers returned to an external… | High (8.8) | — | ✅ |
| CVE-2026-85110 — A vulnerability was identified in Tenda HG10 300001138. | High (8.8) | — | ✅ |
| CVE-2026-85174 — SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible… | High (8.8) | — | ✅ |
| CVE-2026-85175 — SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the… | High (8.8) | — | ✅ |
| CVE-2026-85176 — DbGate fails to validate jslid parameters in the jsldata controller, allowing… | High (8.8) | — | ✅ |
| CVE-2026-85452 — MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp… | High (8.8) | — | ✅ |
| CVE-2026-85496 — The Botslab G980H dash camera firmware generates session identifiers using a small… | High (8.8) | — | ✅ |
| CVE-2026-85540 — DreamMaker developed by Interinfo has a SQL Injection vulnerability. | High (8.8) | — | ✅ |
| CVE-2026-85542 — IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the… | High (8.8) | — | ✅ |
| CVE-2026-85604 — Grav before 2.0.19 (affected versions <= 2.0.17) contains a remote code execution… | High (8.8) | — | ✅ |
| CVE-2026-85607 — Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC… | High (8.8) | — | ✅ |
| CVE-2026-85610 — OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing… | High (8.8) | — | ✅ |
| CVE-2026-85623 — goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks… | High (8.8) | — | ✅ |
| CVE-2026-85634 — A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the… | High (8.8) | — | ✅ |
| CVE-2026-85659 — The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account… | High (8.8) | — | ✅ |
| CVE-2026-86166 — A vulnerability was determined in Tenda HG10 300001138. | High (8.8) | — | ✅ |
| CVE-2026-86169 — Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack… | High (8.8) | — | ✅ |
| CVE-2026-86177 — Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in… | High (8.8) | — | ✅ |
| CVE-2026-86461 — The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-86567 — A flaw was found in DPDK lib/vhost. | High (8.8) | — | ✅ |
| CVE-2026-86801 — The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint… | High (8.8) | — | ✅ |
| CVE-2026-86848 — A flaw was found in DPDK lib/vhost vhost-crypto. | High (8.8) | — | ✅ |
| CVE-2026-86864 — pgAdmin 4's Backup tool appended the client-supplied 'database' field from the… | High (8.8) | — | ✅ |
| CVE-2026-87093 — Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit… | High (8.8) | — | ✅ |
| CVE-2026-8761 — The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up… | High (8.8) | — | ✅ |
| CVE-2026-88164 — Missing authorization in Microsoft Office SharePoint allows an authorized attacker to… | High (8.8) | — | ✅ |
| CVE-2026-88962 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-89036 — Appwrite before 2.0.0 contains an argument injection vulnerability that allows… | High (8.8) | — | ✅ |
| CVE-2026-89067 — Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit… | High (8.8) | — | ✅ |
| CVE-2026-89426 — The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is… | High (8.8) | — | ✅ |
| CVE-2026-91184 — Description | High (8.8) | — | ✅ |
| CVE-2026-9201 — IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute… | High (8.8) | — | ✅ |
| CVE-2026-92115 — The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command… | High (8.8) | — | ✅ |
| CVE-2026-92553 — The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is… | High (8.8) | — | ✅ |
| CVE-2026-92580 — In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. | High (8.8) | — | ✅ |
| CVE-2026-92593 — Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794:… | High (8.8) | — | ✅ |
| CVE-2026-92748 — BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in… | High (8.8) | — | ✅ |
| CVE-2026-92761 — WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing… | High (8.8) | — | ✅ |
| CVE-2026-92762 — Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through… | High (8.8) | — | ✅ |
| CVE-2026-92780 — KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API… | High (8.8) | — | ✅ |
| CVE-2026-92788 — Coze Studio through 0.5.1 fails to validate that table names in workflow SQL… | High (8.8) | — | ✅ |
| CVE-2026-92796 — Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all… | High (8.8) | — | ✅ |
| CVE-2026-92801 — cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the… | High (8.8) | — | ✅ |
| CVE-2026-92817 — The Ignition Perspective module does not properly validate session privileges when… | High (8.8) | — | ✅ |
| CVE-2026-92918 — admin3 through 3.0.0 persists user session tokens in the audit log event body when… | High (8.8) | — | ✅ |
| CVE-2026-92970 — HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload… | High (8.8) | — | ✅ |
| CVE-2026-92985 — SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files… | High (8.8) | — | ✅ |
| CVE-2026-92986 — SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without… | High (8.8) | — | ✅ |
| CVE-2026-93675 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-93834 — A use-after-free vulnerability was found in QEMU's 9pfs subsystem. | High (8.8) | — | ✅ |
| CVE-2026-94422 — An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9… | High (8.8) | — | ✅ |
| CVE-2026-94512 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code… | High (8.8) | — | ✅ |
| CVE-2026-94609 — authentik is an open-source identity provider. | High (8.8) | — | ✅ |
| CVE-2026-95534 — Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements… | High (8.8) | — | ✅ |
| CVE-2026-95687 — The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to… | High (8.8) | — | ✅ |
| CVE-2026-95985 — The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote… | High (8.8) | — | ✅ |
| CVE-2026-96451 — Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member… | High (8.8) | — | ✅ |
| CVE-2026-96883 — pgcollection is an open source extension to PostgreSQL. | High (8.8) | — | ✅ |
| CVE-2026-96940 — Weak authorization in Microsoft Exchange Server allows an authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-97284 — Contributor PHP Object Injection in Icegram <= 3.1.31 versions. | High (8.8) | — | ✅ |
| CVE-2026-97291 — Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66… | High (8.8) | — | ✅ |
| CVE-2026-97644 — The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is… | High (8.8) | — | ✅ |
| CVE-2026-97655 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary… | High (8.8) | — | ✅ |
| CVE-2026-97673 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-97676 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-97678 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-97679 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.8) | — | ✅ |
| CVE-2026-9999 — Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216… | High (8.8) | — | ✅ |
| CVE-2026-0799 — In BPF instructions that load/store a value from/to a scratch memory register the… | High (8.7) | — | ✅ |
| CVE-2026-100720 — Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. | High (8.7) | — | ✅ |
| CVE-2026-101157 — A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker… | High (8.7) | — | ✅ |
| CVE-2026-101294 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere… | High (8.7) | — | ✅ |
| CVE-2026-102092 — Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS)… | High (8.7) | — | ✅ |
| CVE-2026-102100 — Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. | High (8.7) | — | ✅ |
| CVE-2026-103253 — n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1… | High (8.7) | — | ✅ |
| CVE-2026-105798 — SimpleChat is a secure AI conversation application with personal and group workspaces for… | High (8.7) | — | ✅ |
| CVE-2026-105862 — Payload is a free and open source headless content management system. | High (8.7) | — | ✅ |
| CVE-2026-15064 — IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server -… | High (8.7) | — | ✅ |
| CVE-2026-15325 — IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server -… | High (8.7) | — | ✅ |
| CVE-2026-16315 — OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel… | High (8.7) | — | ✅ |
| CVE-2026-18608 — A flaw was found in the Data Science Pipelines Operator (DSPO). | High (8.7) | — | ✅ |
| CVE-2026-18860 — Velociraptor allows multi-tenant deployments named "Orgs". | High (8.7) | — | ✅ |
| CVE-2026-3415 — The XML and schema validation functionalities within the SchemaValidator Mediator process… | High (8.7) | — | ✅ |
| CVE-2026-40877 — Combodo iTop is a web-based IT service management tool. | High (8.7) | — | ✅ |
| CVE-2026-44739 — Pimcore is an Open Source Data & Experience Management Platform. | High (8.7) | — | ✅ |
| CVE-2026-47665 — Penpot is an open-source design and prototyping platform. | High (8.7) | — | ✅ |
| CVE-2026-47743 — Shopper is a Headless e-commerce Admin Panel. | High (8.7) | — | ✅ |
| CVE-2026-48026 — lakeFS is an open-source tool that transforms object storage into a Git-like repositories. | High (8.7) | — | ✅ |
| CVE-2026-48413 — Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that… | High (8.7) | — | ✅ |
| CVE-2026-49283 — The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. | High (8.7) | — | ✅ |
| CVE-2026-49478 — Fulcio is a certificate authority for issuing code signing certificates for an OpenID… | High (8.7) | — | ✅ |
| CVE-2026-54049 — Sakai is a Collaboration and Learning Environment (CLE). | High (8.7) | — | ✅ |
| CVE-2026-54498 — view_component is a framework for building reusable, testable, and encapsulated view… | High (8.7) | — | ✅ |
| CVE-2026-55230 — Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or… | High (8.7) | — | ✅ |
| CVE-2026-55872 — GYM One is open-source gym management software for fitness centers, personal trainers,… | High (8.7) | — | ✅ |
| CVE-2026-58157 — Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data… | High (8.7) | — | ✅ |
| CVE-2026-59335 — Improper handling of case sensitivity (CWE-178) in the identity zone authorization check… | High (8.7) | — | ✅ |
| CVE-2026-60084 — SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the… | High (8.7) | — | ✅ |
| CVE-2026-60707 — Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60860 — Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60903 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60934 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60935 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60954 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60980 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60981 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-60996 — Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion… | High (8.7) | — | ✅ |
| CVE-2026-61193 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-61215 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-61219 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.7) | — | ✅ |
| CVE-2026-61332 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.7) | — | ✅ |
| CVE-2026-61825 — code16 Sharp is a Laravel-based framework for building content-management and… | High (8.7) | — | ✅ |
| CVE-2026-62589 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | High (8.7) | — | ✅ |
| CVE-2026-62607 — Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component:… | High (8.7) | — | ✅ |
| CVE-2026-62836 — Improper restriction of communication channel to intended endpoints in Azure SQL Managed… | High (8.7) | — | ✅ |
| CVE-2026-63459 — Vendure is an open-source headless commerce platform. | High (8.7) | — | ✅ |
| CVE-2026-63498 — Snipe-IT is an IT asset/license management system. | High (8.7) | — | ✅ |
| CVE-2026-66394 — SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities… | High (8.7) | — | ✅ |
| CVE-2026-66787 — A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for… | High (8.7) | — | ✅ |
| CVE-2026-67336 — better-auth versions before 1.6.11 contain insecure cryptographic defaults in the… | High (8.7) | — | ✅ |
| CVE-2026-68899 — Wekan is open source kanban built with Meteor. | High (8.7) | — | ✅ |
| CVE-2026-70492 — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | High (8.7) | — | ✅ |
| CVE-2026-70778 — Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component:… | High (8.7) | — | ✅ |
| CVE-2026-70882 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.7) | — | ✅ |
| CVE-2026-70900 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.7) | — | ✅ |
| CVE-2026-70903 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.7) | — | ✅ |
| CVE-2026-71000 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.7) | — | ✅ |
| CVE-2026-71050 — Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain… | High (8.7) | — | ✅ |
| CVE-2026-71233 — InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal… | High (8.7) | — | ✅ |
| CVE-2026-71236 — Grocy's API request-body parser (controllers/Api/BaseApiController.php,… | High (8.7) | — | ✅ |
| CVE-2026-71404 — A flaw was found in Rancher Manager. | High (8.7) | — | ✅ |
| CVE-2026-72730 — Discourse is an open-source discussion platform. | High (8.7) | — | ✅ |
| CVE-2026-73031 — telegram-search contains a stored cross-site scripting vulnerability that allows remote… | High (8.7) | — | ✅ |
| CVE-2026-76660 — A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds | High (8.7) | — | ✅ |
| CVE-2026-77615 — Paella Player is a set of libraries to create a multi stream video player. | High (8.7) | — | ✅ |
| CVE-2026-77693 — The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability… | High (8.7) | — | ✅ |
| CVE-2026-77811 — Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards… | High (8.7) | — | ✅ |
| CVE-2026-78213 — Heptabase developed by Hepta Platforms, Inc. | High (8.7) | — | ✅ |
| CVE-2026-79679 — Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used… | High (8.7) | — | ✅ |
| CVE-2026-80465 — A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions <… | High (8.7) | — | ✅ |
| CVE-2026-82466 — Rodauth before 2.46.0 contains an authentication bypass vulnerability in the… | High (8.7) | — | ✅ |
| CVE-2026-84695 — BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the… | High (8.7) | — | ✅ |
| CVE-2026-85057 — ZITADEL is an open source identity management platform. | High (8.7) | — | ✅ |
| CVE-2026-85781 — Unverified ownership of a storage access point in the volume deletion component of the… | High (8.7) | — | ✅ |
| CVE-2026-86123 — SQL Chat contains four unauthenticated API endpoints that accept client-supplied database… | High (8.7) | — | ✅ |
| CVE-2026-91122 — Discourse is an open-source discussion platform. | High (8.7) | — | ✅ |
| CVE-2026-100236 — A flaw was found in the DPDK GSO library. | High (8.6) | — | ✅ |
| CVE-2026-100697 — Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin… | High (8.6) | — | ✅ |
| CVE-2026-102121 — A form-rendering interface in the Advanced Forms component is reachable without… | High (8.6) | — | ✅ |
| CVE-2026-104457 — YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags… | High (8.6) | — | ✅ |
| CVE-2026-104464 — YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows… | High (8.6) | — | ✅ |
| CVE-2026-105115 — OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation… | High (8.6) | — | ✅ |
| CVE-2026-105897 — ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could… | High (8.6) | — | ✅ |
| CVE-2026-106616 — ColdFusion is affected by an Improper Restriction of XML External Entity Reference… | High (8.6) | — | ✅ |
| CVE-2026-107205 — LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess… | High (8.6) | — | ✅ |
| CVE-2026-110459 — A malicious actor with access to the network could exploit an Improper Access Control… | High (8.6) | — | ✅ |
| CVE-2026-110628 — Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery… | High (8.6) | — | ✅ |
| CVE-2026-110769 — holaOS through 2026.822.1 contains a missing authorization vulnerability in… | High (8.6) | — | ✅ |
| CVE-2026-111446 — Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to… | High (8.6) | — | ✅ |
| CVE-2026-14869 — The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request… | High (8.6) | — | ✅ |
| CVE-2026-16328 — In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend… | High (8.6) | — | ✅ |
| CVE-2026-16815 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… | High (8.6) | — | ✅ |
| CVE-2026-17502 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… | High (8.6) | — | ✅ |
| CVE-2026-18953 — Improper limitation of a pathname to a restricted directory in the get_resource tool in… | High (8.6) | — | ✅ |
| CVE-2026-19305 — IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive… | High (8.6) | — | ✅ |
| CVE-2026-20263 — A vulnerability in the Blocks Extensible Exchange Protocol (BEEP) feature of Cisco IOS XE… | High (8.6) | — | ✅ |
| CVE-2026-20268 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-20269 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-20270 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-20271 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-20273 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-20276 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-20301 — A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as… | High (8.6) | — | ✅ |
| CVE-2026-20352 — A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow… | High (8.6) | — | ✅ |
| CVE-2026-22620 — Improper input validation in the authentication component of Eaton's Tripp Lite series… | High (8.6) | — | ✅ |
| CVE-2026-27330 — Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. | High (8.6) | — | ✅ |
| CVE-2026-28171 — Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7 versions. | High (8.6) | — | ✅ |
| CVE-2026-28698 — Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system… | High (8.6) | — | ✅ |
| CVE-2026-32477 — Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce… | High (8.6) | — | ✅ |
| CVE-2026-3430 — The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a… | High (8.6) | — | ✅ |
| CVE-2026-34634 — ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could… | High (8.6) | — | ✅ |
| CVE-2026-34741 — Combodo iTop is a web based IT service management tool. | High (8.6) | — | ✅ |
| CVE-2026-44023 — Docling Core defines core data types and transformations for the document processing… | High (8.6) | — | ✅ |
| CVE-2026-44094 — An unauthenticated remote attacker can enforce the system to fall back to a firmware… | High (8.6) | — | ✅ |
| CVE-2026-44098 — This vulnerability allows an unauthenticated remote attacker with control over the OCPP… | High (8.6) | — | ✅ |
| CVE-2026-45293 — WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce… | High (8.6) | — | ✅ |
| CVE-2026-48120 — Kakoune is a code editor. | High (8.6) | — | ✅ |
| CVE-2026-48388 — Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element… | High (8.6) | — | ✅ |
| CVE-2026-48395 — Bridge is affected by an Untrusted Search Path vulnerability that could result in… | High (8.6) | — | ✅ |
| CVE-2026-48396 — Bridge is affected by an Incorrect Authorization vulnerability that could result in… | High (8.6) | — | ✅ |
| CVE-2026-48397 — Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that… | High (8.6) | — | ✅ |
| CVE-2026-48441 — Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted… | High (8.6) | — | ✅ |
| CVE-2026-48448 — Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special… | High (8.6) | — | ✅ |
| CVE-2026-48795 — AdonisJS is a TypeScript-first web framework. | High (8.6) | — | ✅ |
| CVE-2026-52854 — Maps is a MediaWiki extension that enables visualization of geographic data through… | High (8.6) | — | ✅ |
| CVE-2026-53983 — Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request… | High (8.6) | — | ✅ |
| CVE-2026-54367 — CentreStack before 17.2 contains an authentication bypass vulnerability that allows… | High (8.6) | — | ✅ |
| CVE-2026-54511 — LogTape is an unobtrusive logging library. | High (8.6) | — | ✅ |
| CVE-2026-54603 — OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including… | High (8.6) | — | ✅ |
| CVE-2026-54609 — QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. | High (8.6) | — | ✅ |
| CVE-2026-54650 — openhole exposes localhost to the internet in one command. | High (8.6) | — | ✅ |
| CVE-2026-55103 — Discourse ActivityPub adds ActivityPub support to Discourse. | High (8.6) | — | ✅ |
| CVE-2026-55534 — PraisonAI is a multi-agent teams system. | High (8.6) | — | ✅ |
| CVE-2026-55539 — PraisonAI is a multi-agent teams system. | High (8.6) | — | ✅ |
| CVE-2026-55848 — mapfish-print is a component of MapFish for printing templated cartographic maps. | High (8.6) | — | ✅ |
| CVE-2026-57206 — SimpleChat is a secure AI conversation application with personal and group workspaces for… | High (8.6) | — | ✅ |
| CVE-2026-58182 — The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and… | High (8.6) | — | ✅ |
| CVE-2026-59499 — CWE-200: Exposure of Sensitive | High (8.6) | — | ✅ |
| CVE-2026-59505 — CWE-284: Improper Access Control | High (8.6) | — | ✅ |
| CVE-2026-60699 — Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-61033 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-61045 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-61228 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-61230 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-61286 — Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise… | High (8.6) | — | ✅ |
| CVE-2026-61836 — Directus is a real-time API and App dashboard for managing SQL database content. | High (8.6) | — | ✅ |
| CVE-2026-62535 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.6) | — | ✅ |
| CVE-2026-62586 — Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component:… | High (8.6) | — | ✅ |
| CVE-2026-62599 — Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite… | High (8.6) | — | ✅ |
| CVE-2026-62620 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-62625 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-62628 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-62636 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.6) | — | ✅ |
| CVE-2026-63086 — text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF)… | High (8.6) | — | ✅ |
| CVE-2026-63088 — stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that… | High (8.6) | — | ✅ |
| CVE-2026-63219 — GeoNetwork is a catalog application to manage spatially referenced resources. | High (8.6) | — | ✅ |
| CVE-2026-63306 — stoatchat before 0.13.5 contains an unauthenticated server-side request forgery… | High (8.6) | — | ✅ |
| CVE-2026-63637 — Dgraph is an open source distributed GraphQL database. | High (8.6) | — | ✅ |
| CVE-2026-64814 — In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a… | High (8.6) | — | ✅ |
| CVE-2026-64940 — Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability… | High (8.6) | — | ✅ |
| CVE-2026-65702 — Vanna through 2.0.2 contains a path traversal vulnerability in the… | High (8.6) | — | ✅ |
| CVE-2026-65908 — In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious… | High (8.6) | — | ✅ |
| CVE-2026-66800 — Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker… | High (8.6) | — | ✅ |
| CVE-2026-67201 — V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF)… | High (8.6) | — | ✅ |
| CVE-2026-67346 — Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery… | High (8.6) | — | ✅ |
| CVE-2026-67425 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | High (8.6) | — | ✅ |
| CVE-2026-67427 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | High (8.6) | — | ✅ |
| CVE-2026-68584 — SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish… | High (8.6) | — | ✅ |
| CVE-2026-68586 — SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and… | High (8.6) | — | ✅ |
| CVE-2026-68587 — SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the… | High (8.6) | — | ✅ |
| CVE-2026-68791 — Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to… | High (8.6) | — | ✅ |
| CVE-2026-69519 — Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to… | High (8.6) | — | ✅ |
| CVE-2026-69558 — Authorization bypass through user-controlled key in Microsoft Partner Center allows an… | High (8.6) | — | ✅ |
| CVE-2026-70721 — Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle… | High (8.6) | — | ✅ |
| CVE-2026-70996 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.6) | — | ✅ |
| CVE-2026-71131 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component:… | High (8.6) | — | ✅ |
| CVE-2026-71255 — nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side… | High (8.6) | — | ✅ |
| CVE-2026-71259 — ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url()… | High (8.6) | — | ✅ |
| CVE-2026-71270 — Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not… | High (8.6) | — | ✅ |
| CVE-2026-72581 — A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit… | High (8.6) | — | ✅ |
| CVE-2026-72742 — DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output… | High (8.6) | — | ✅ |
| CVE-2026-72777 — Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in… | High (8.6) | — | ✅ |
| CVE-2026-72810 — SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in… | High (8.6) | — | ✅ |
| CVE-2026-72848 — SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies… | High (8.6) | — | ✅ |
| CVE-2026-73247 — Kestra is an open-source, event-driven orchestration platform. | High (8.6) | — | ✅ |
| CVE-2026-73608 — SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in… | High (8.6) | — | ✅ |
| CVE-2026-73706 — A vulnerability in the API of HPE Networking Fabric Composer could allow an… | High (8.6) | — | ✅ |
| CVE-2026-73939 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.6) | — | ✅ |
| CVE-2026-75916 — SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '(('… | High (8.6) | — | ✅ |
| CVE-2026-75917 — SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree… | High (8.6) | — | ✅ |
| CVE-2026-75932 — Jet Admin allows an attacker to create a malicious app and connect it to a target user's… | High (8.6) | — | ✅ |
| CVE-2026-76456 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-76457 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-76458 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.6) | — | ✅ |
| CVE-2026-77775 — Headroom's LLM proxy lets a client choose the upstream destination with the… | High (8.6) | — | ✅ |
| CVE-2026-78284 — Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions. | High (8.6) | — | ✅ |
| CVE-2026-81091 — The proxy middleware in mcp-use's inspector forwards requests to a destination the caller… | High (8.6) | — | ✅ |
| CVE-2026-81093 — The get-html-skeleton tool fetched a URL the caller supplied after checking only its… | High (8.6) | — | ✅ |
| CVE-2026-81455 — Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing… | High (8.6) | — | ✅ |
| CVE-2026-81573 — If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration… | High (8.6) | — | ✅ |
| CVE-2026-81889 — elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. | High (8.6) | — | ✅ |
| CVE-2026-82286 — gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST… | High (8.6) | — | ✅ |
| CVE-2026-82641 — keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all… | High (8.6) | — | ✅ |
| CVE-2026-82645 — AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the… | High (8.6) | — | ✅ |
| CVE-2026-84700 — PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived… | High (8.6) | — | ✅ |
| CVE-2026-85614 — OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery… | High (8.6) | — | ✅ |
| CVE-2026-85620 — Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where… | High (8.6) | — | ✅ |
| CVE-2026-86119 — Webstudio through 0.296.0 contains an unauthenticated server-side request forgery… | High (8.6) | — | ✅ |
| CVE-2026-87963 — The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the… | High (8.6) | — | ✅ |
| CVE-2026-88789 — Improper Restriction of XML External Entity Reference in the XSLT support extension… | High (8.6) | — | ✅ |
| CVE-2026-91882 — Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of… | High (8.6) | — | ✅ |
| CVE-2026-92576 — HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the… | High (8.6) | — | ✅ |
| CVE-2026-92950 — vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows… | High (8.6) | — | ✅ |
| CVE-2026-92954 — vm2 is a sandbox library for running untrusted JavaScript in Node.js. | High (8.6) | — | ✅ |
| CVE-2026-92972 — SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated… | High (8.6) | — | ✅ |
| CVE-2026-95588 — Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions. | High (8.6) | — | ✅ |
| CVE-2026-95634 — CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability… | High (8.6) | — | ✅ |
| CVE-2026-95639 — Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could… | High (8.6) | — | ✅ |
| CVE-2026-97818 — phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in… | High (8.6) | — | ✅ |
| CVE-2026-10053 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before… | High (8.5) | — | ✅ |
| CVE-2026-100618 — Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. | High (8.5) | — | ✅ |
| CVE-2026-10079 — A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). | High (8.5) | — | ✅ |
| CVE-2026-102155 — An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight… | High (8.5) | — | ✅ |
| CVE-2026-102379 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.5) | — | ✅ |
| CVE-2026-103247 — n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate… | High (8.5) | — | ✅ |
| CVE-2026-103338 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.5) | — | ✅ |
| CVE-2026-105067 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.5) | — | ✅ |
| CVE-2026-106459 — Backstage is an open framework for building developer portals. | High (8.5) | — | ✅ |
| CVE-2026-106486 — Backstage is an open framework for building developer portals. | High (8.5) | — | ✅ |
| CVE-2026-106500 — Backstage is an open framework for building developer portals. | High (8.5) | — | ✅ |
| CVE-2026-110867 — Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows… | High (8.5) | — | ✅ |
| CVE-2026-110868 — Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows… | High (8.5) | — | ✅ |
| CVE-2026-11536 — IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution… | High (8.5) | — | ✅ |
| CVE-2026-16053 — Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are… | High (8.5) | — | ✅ |
| CVE-2026-16908 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain… | High (8.5) | — | ✅ |
| CVE-2026-16967 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain… | High (8.5) | — | ✅ |
| CVE-2026-17107 — A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced… | High (8.5) | — | ✅ |
| CVE-2026-17168 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker… | High (8.5) | — | ✅ |
| CVE-2026-17179 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to… | High (8.5) | — | ✅ |
| CVE-2026-17192 — A VCO feature does not sufficiently validate caller-supplied input, allowing requests to… | High (8.5) | — | ✅ |
| CVE-2026-17617 — IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request… | High (8.5) | — | ✅ |
| CVE-2026-17624 — IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0… | High (8.5) | — | ✅ |
| CVE-2026-17633 — IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to… | High (8.5) | — | ✅ |
| CVE-2026-18359 — Server-side request forgery in the METS and IIIF import URI handling in Scripta… | High (8.5) | — | ✅ |
| CVE-2026-18597 — The PDF creation feature of Foxit PDF Services API supports referencing external files. | High (8.5) | — | ✅ |
| CVE-2026-18947 — A flaw was found in Feast. | High (8.5) | — | ✅ |
| CVE-2026-22681 — OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows… | High (8.5) | — | ✅ |
| CVE-2026-24552 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.5) | — | ✅ |
| CVE-2026-25405 — Contributor SQL Injection in eRoom <= 1.7.1 versions. | High (8.5) | — | ✅ |
| CVE-2026-28002 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.5) | — | ✅ |
| CVE-2026-28156 — Subscriber SQL Injection in Do Lasso <= 358 versions. | High (8.5) | — | ✅ |
| CVE-2026-28168 — Subscriber SQL Injection in CubeWP <= 1.1.30 versions. | High (8.5) | — | ✅ |
| CVE-2026-32471 — Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions. | High (8.5) | — | ✅ |
| CVE-2026-32478 — Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions. | High (8.5) | — | ✅ |
| CVE-2026-32550 — Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. | High (8.5) | — | ✅ |
| CVE-2026-32552 — Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions. | High (8.5) | — | ✅ |
| CVE-2026-32564 — Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63… | High (8.5) | — | ✅ |
| CVE-2026-45414 — Decidim is a participatory democracy framework. | High (8.5) | — | ✅ |
| CVE-2026-46682 — BigBlueButton is an open-source virtual classroom. | High (8.5) | — | ✅ |
| CVE-2026-49332 — A flaw was found in openshift/oauth-proxy. | High (8.5) | — | ✅ |
| CVE-2026-50218 — Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly… | High (8.5) | — | ✅ |
| CVE-2026-55108 — KubeVela is an open source application delivery platform. | High (8.5) | — | ✅ |
| CVE-2026-55234 — Wekan is open source kanban built with Meteor. | High (8.5) | — | ✅ |
| CVE-2026-55526 — PraisonAI is a multi-agent teams system. | High (8.5) | — | ✅ |
| CVE-2026-55765 — CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes… | High (8.5) | — | ✅ |
| CVE-2026-56167 — Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to… | High (8.5) | — | ✅ |
| CVE-2026-57862 — Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that… | High (8.5) | — | ✅ |
| CVE-2026-59551 — Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10… | High (8.5) | — | ✅ |
| CVE-2026-60758 — Vulnerability in the Siebel Artificial Intelligence product of Oracle Siebel CRM… | High (8.5) | — | ✅ |
| CVE-2026-60798 — Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component:… | High (8.5) | — | ✅ |
| CVE-2026-60841 — Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware… | High (8.5) | — | ✅ |
| CVE-2026-60849 — Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware… | High (8.5) | — | ✅ |
| CVE-2026-61212 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.5) | — | ✅ |
| CVE-2026-61326 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.5) | — | ✅ |
| CVE-2026-62226 — OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the… | High (8.5) | — | ✅ |
| CVE-2026-62246 — Kamaji is the Hosted Control Plane Manager for Kubernetes. | High (8.5) | — | ✅ |
| CVE-2026-62590 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | High (8.5) | — | ✅ |
| CVE-2026-62596 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | High (8.5) | — | ✅ |
| CVE-2026-62615 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.5) | — | ✅ |
| CVE-2026-6267 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before… | High (8.5) | — | ✅ |
| CVE-2026-65092 — NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause… | High (8.5) | — | ✅ |
| CVE-2026-65450 — Contributor SQL Injection in MapSVG <= 8.14.0 versions. | High (8.5) | — | ✅ |
| CVE-2026-65451 — Contributor SQL Injection in MapSVG <= 8.14.0 versions. | High (8.5) | — | ✅ |
| CVE-2026-65454 — Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions. | High (8.5) | — | ✅ |
| CVE-2026-65526 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.5) | — | ✅ |
| CVE-2026-65547 — Subscriber SQL Injection in Creative Mail <= 1.6.9 versions. | High (8.5) | — | ✅ |
| CVE-2026-65569 — Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. | High (8.5) | — | ✅ |
| CVE-2026-65818 — Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to… | High (8.5) | — | ✅ |
| CVE-2026-65895 — Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical… | High (8.5) | — | ✅ |
| CVE-2026-66415 — Leantime 3.6.2 contains a server-side request forgery and local file inclusion… | High (8.5) | — | ✅ |
| CVE-2026-66430 — Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. | High (8.5) | — | ✅ |
| CVE-2026-66580 — Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. | High (8.5) | — | ✅ |
| CVE-2026-66594 — Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions. | High (8.5) | — | ✅ |
| CVE-2026-66658 — Subscriber SQL Injection in Reviewer <= 3.14.2 versions. | High (8.5) | — | ✅ |
| CVE-2026-66668 — Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions. | High (8.5) | — | ✅ |
| CVE-2026-67424 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | High (8.5) | — | ✅ |
| CVE-2026-67428 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | High (8.5) | — | ✅ |
| CVE-2026-67625 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code… | High (8.5) | — | ✅ |
| CVE-2026-68558 — Wekan is open source kanban built with Meteor. | High (8.5) | — | ✅ |
| CVE-2026-68883 — Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate… | High (8.5) | — | ✅ |
| CVE-2026-69419 — Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized… | High (8.5) | — | ✅ |
| CVE-2026-69543 — Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized… | High (8.5) | — | ✅ |
| CVE-2026-69857 — Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized… | High (8.5) | — | ✅ |
| CVE-2026-70178 — Missing authorization in Microsoft Fabric allows an authorized attacker to elevate… | High (8.5) | — | ✅ |
| CVE-2026-70551 — A user who can read an existing remote VCS repository can replace its configured origin… | High (8.5) | — | ✅ |
| CVE-2026-70718 — Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite… | High (8.5) | — | ✅ |
| CVE-2026-70728 — Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). | High (8.5) | — | ✅ |
| CVE-2026-70807 — Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite… | High (8.5) | — | ✅ |
| CVE-2026-70859 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component:… | High (8.5) | — | ✅ |
| CVE-2026-70885 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.5) | — | ✅ |
| CVE-2026-71002 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.5) | — | ✅ |
| CVE-2026-71049 — Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain… | High (8.5) | — | ✅ |
| CVE-2026-71057 — Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI… | High (8.5) | — | ✅ |
| CVE-2026-71062 — Vulnerability in the RDBMS component of Oracle Database Server. | High (8.5) | — | ✅ |
| CVE-2026-71155 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.5) | — | ✅ |
| CVE-2026-71271 — Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a… | High (8.5) | — | ✅ |
| CVE-2026-71272 — Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves… | High (8.5) | — | ✅ |
| CVE-2026-71274 — OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels… | High (8.5) | — | ✅ |
| CVE-2026-71280 — go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied… | High (8.5) | — | ✅ |
CVE-2026-71473 — A flaw was found in the search-v2-operator component. |
High (8.5) | — | ✅ |
| CVE-2026-71576 — A flaw was found in multicluster-global-hub. | High (8.5) | — | ✅ |
| CVE-2026-72855 — Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI… | High (8.5) | — | ✅ |
| CVE-2026-72860 — The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl… | High (8.5) | — | ✅ |
| CVE-2026-73629 — Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the… | High (8.5) | — | ✅ |
| CVE-2026-73654 — Trigger.dev is a platform for building and deploying fully managed AI agents and… | High (8.5) | — | ✅ |
| CVE-2026-73707 — Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. | High (8.5) | — | ✅ |
| CVE-2026-73998 — Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. | High (8.5) | — | ✅ |
| CVE-2026-74013 — Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. | High (8.5) | — | ✅ |
| CVE-2026-76412 — A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could… | High (8.5) | — | ✅ |
| CVE-2026-76838 — Hi.Events validates a webhook destination only when it is registered, never when it is… | High (8.5) | — | ✅ |
| CVE-2026-78285 — Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions. | High (8.5) | — | ✅ |
| CVE-2026-81027 — one-api gates one of its two channel-pinning paths and not the other. | High (8.5) | — | ✅ |
| CVE-2026-81277 — Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. | High (8.5) | — | ✅ |
| CVE-2026-81287 — Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. | High (8.5) | — | ✅ |
| CVE-2026-82227 — Contributor SQL Injection in WPBulky <= 1.2.2 versions. | High (8.5) | — | ✅ |
| CVE-2026-85179 — Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users… | High (8.5) | — | ✅ |
| CVE-2026-85616 — Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in… | High (8.5) | — | ✅ |
| CVE-2026-85651 — Trigger.dev versions before 4.5.2 fail to validate environment membership during run… | High (8.5) | — | ✅ |
| CVE-2026-85886 — Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code… | High (8.5) | — | ✅ |
| CVE-2026-87023 — Tanium addressed a path traversal vulnerability in Comply. | High (8.5) | — | ✅ |
| CVE-2026-87030 — Tanium addressed a path traversal vulnerability in Comply. | High (8.5) | — | ✅ |
| CVE-2026-9077 — IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to… | High (8.5) | — | ✅ |
| CVE-2026-9203 — A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6… | High (8.5) | — | ✅ |
| CVE-2026-92958 — vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. | High (8.5) | — | ✅ |
| CVE-2026-92982 — A flaw was found in Ansible Operator Plugins. | High (8.5) | — | ✅ |
| CVE-2026-93292 — SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in… | High (8.5) | — | ✅ |
| CVE-2026-93426 — SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key… | High (8.5) | — | ✅ |
| CVE-2026-93449 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.5) | — | ✅ |
| CVE-2026-97730 — In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion… | High (8.5) | — | ✅ |
| CVE-2026-100368 — CliInvoke is a .NET library for invoking command-line programs, and its… | High (8.4) | — | ✅ |
CVE-2026-100369 — CliInvoke and its formerly named AlastairLundy.CliInvoke package are .NET libraries for… |
High (8.4) | — | ✅ |
| CVE-2026-100693 — Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in… | High (8.4) | — | ✅ |
| CVE-2026-100839 — Contrast is a confidential-computing runtime for Kubernetes. | High (8.4) | — | ✅ |
| CVE-2026-100844 — MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component… | High (8.4) | — | ✅ |
| CVE-2026-101156 — A stored cross-site scripting (XSS) vulnerability may allow an authenticated,… | High (8.4) | — | ✅ |
| CVE-2026-101158 — A missing input validation vulnerability in the Fileserver upload API allows an… | High (8.4) | — | ✅ |
| CVE-2026-10534 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow… | High (8.4) | — | ✅ |
| CVE-2026-10535 — IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow… | High (8.4) | — | ✅ |
| CVE-2026-11885 — IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and… | High (8.4) | — | ✅ |
| CVE-2026-12364 — The user-space system-call verifier z_vrfy_z_log_msg_static_create() in… | High (8.4) | — | ✅ |
| CVE-2026-12436 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before… | High (8.4) | — | ✅ |
| CVE-2026-16832 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.4) | — | ✅ |
| CVE-2026-17091 — IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.4) | — | ✅ |
| CVE-2026-17583 — The affected | High (8.4) | — | ✅ |
| CVE-2026-18249 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated… | High (8.4) | — | ✅ |
| CVE-2026-18824 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker… | High (8.4) | — | ✅ |
| CVE-2026-18842 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain… | High (8.4) | — | ✅ |
| CVE-2026-20334 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.4) | — | ✅ |
| CVE-2026-32918 — OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the… | High (8.4) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-44901 — Wazuh is a free and open source platform used for threat prevention, detection, and… | High (8.4) | — | ✅ |
| CVE-2026-55581 — mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. | High (8.4) | — | ✅ |
| CVE-2026-55582 — mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. | High (8.4) | — | ✅ |
| CVE-2026-55786 — Flyto2 Core is an execution kernel for automation and AI-agent workflows. | High (8.4) | — | ✅ |
| CVE-2026-55978 — An improper access control vulnerability in CatchPulse could allow a non-administrative… | High (8.4) | — | ✅ |
| CVE-2026-59090 — A flaw was found in GIMP's PSD file format plugin. | High (8.4) | — | ✅ |
| CVE-2026-59566 — A locally exploitable buffer overflow bug can cause a local denial-of-service attack on… | High (8.4) | — | ✅ |
| CVE-2026-59686 — An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection… | High (8.4) | — | ✅ |
| CVE-2026-59687 — An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection… | High (8.4) | — | ✅ |
| CVE-2026-59688 — An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection… | High (8.4) | — | ✅ |
| CVE-2026-60928 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.4) | — | ✅ |
| CVE-2026-63388 — Libevent is an event notification library. | High (8.4) | — | ✅ |
| CVE-2026-64804 — In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting… | High (8.4) | — | ✅ |
| CVE-2026-64805 — In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting… | High (8.4) | — | ✅ |
| CVE-2026-64806 — In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting… | High (8.4) | — | ✅ |
| CVE-2026-64808 — In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting… | High (8.4) | — | ✅ |
| CVE-2026-64809 — In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting… | High (8.4) | — | ✅ |
| CVE-2026-66140 — Exim before 4.99.5 allows directory traversal to access files outside of the spool area,… | High (8.4) | — | ✅ |
| CVE-2026-66396 — SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when… | High (8.4) | — | ✅ |
| CVE-2026-67323 — GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword… | High (8.4) | — | ✅ |
| CVE-2026-70731 — Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). | High (8.4) | — | ✅ |
| CVE-2026-70840 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.4) | — | ✅ |
| CVE-2026-70842 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.4) | — | ✅ |
| CVE-2026-71385 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.4) | — | ✅ |
| CVE-2026-72696 — Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler… | High (8.4) | — | ✅ |
| CVE-2026-72734 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | High (8.4) | — | ✅ |
| CVE-2026-73781 — A vulnerability in the web-based management interface of AOS-CX could allow an… | High (8.4) | — | ✅ |
| CVE-2026-75995 — ColdFusion is affected by an Improper Input Validation vulnerability that could result in… | High (8.4) | — | ✅ |
| CVE-2026-78675 — GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules,… | High (8.4) | — | ✅ |
| CVE-2026-79774 — Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape… | High (8.4) | — | ✅ |
| CVE-2026-80427 — bestzip builds the argument list for the system zip utility without separating options… | High (8.4) | — | ✅ |
| CVE-2026-81097 — The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a… | High (8.4) | — | ✅ |
| CVE-2026-81683 — openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS… | High (8.4) | — | ✅ |
| CVE-2026-82862 — Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root,… | High (8.4) | — | ✅ |
| CVE-2026-86476 — A flaw was found in gst-plugins-base. | High (8.4) | — | ✅ |
| CVE-2026-8718 — tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c,… | High (8.4) | — | ✅ |
| CVE-2026-94591 — Armatura One stores database and message-broker credentials in an install configuration… | High (8.4) | — | ✅ |
| CVE-2026-94592 — Armatura One's database initialization routine assigns a fixed, vendor-defined password… | High (8.4) | — | ✅ |
| CVE-2026-96749 — An integer overflow in the BSON document encoding component of the MongoDB Python… | High (8.4) | — | ✅ |
| CVE-2026-100551 — OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS… | High (8.3) | — | ✅ |
| CVE-2026-100557 — OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill… | High (8.3) | — | ✅ |
| CVE-2026-100568 — OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command… | High (8.3) | — | ✅ |
| CVE-2026-100588 — OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator… | High (8.3) | — | ✅ |
| CVE-2026-100589 — OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser… | High (8.3) | — | ✅ |
| CVE-2026-100608 — Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. | High (8.3) | — | ✅ |
| CVE-2026-102667 — Joyland AI app allows an attacker with shared network access to inject JavaScript into… | High (8.3) | — | ✅ |
| CVE-2026-103946 — An SQL injection vulnerability could allow an authenticated user to read or modify data… | High (8.3) | — | ✅ |
| CVE-2026-10673 — The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver… | High (8.3) | — | ✅ |
| CVE-2026-16708 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive… | High (8.3) | — | ✅ |
| CVE-2026-17006 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.3) | — | ✅ |
| CVE-2026-17101 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or… | High (8.3) | — | ✅ |
| CVE-2026-17497 — NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for… | High (8.3) | — | ✅ |
| CVE-2026-18848 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.3) | — | ✅ |
| CVE-2026-20296 — In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud… | High (8.3) | — | ✅ |
| CVE-2026-22621 — Improper input validation in one of the session management interface of Eaton's Tripp… | High (8.3) | — | ✅ |
| CVE-2026-38820 — openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell… | High (8.3) | — | ✅ |
| CVE-2026-45449 — : Improper Neutralization of Special Elements used in an OS Command ('OS Command… | High (8.3) | — | ✅ |
| CVE-2026-45450 — : Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability… | High (8.3) | — | ✅ |
| CVE-2026-45451 — : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. | High (8.3) | — | ✅ |
| CVE-2026-45452 — Use of Externally-Controlled format string vulnerability in Unitronics Unitronics… | High (8.3) | — | ✅ |
| CVE-2026-45730 — Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. | High (8.3) | — | ✅ |
| CVE-2026-47158 — Vaultwarden is a Bitwarden-compatible server written in Rust. | High (8.3) | — | ✅ |
| CVE-2026-47882 — When enabling Spring Boot DevTools support for a remote application target (for example a… | High (8.3) | — | ✅ |
| CVE-2026-5219 — Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade… | High (8.3) | — | ✅ |
| CVE-2026-52769 — YesWiki is a wiki system written in PHP. | High (8.3) | — | ✅ |
| CVE-2026-52771 — YesWiki is a wiki system written in PHP. | High (8.3) | — | ✅ |
| CVE-2026-52877 — Streambert is a cross-platform Electron Desktop App to stream and download video content. | High (8.3) | — | ✅ |
| CVE-2026-53516 — Better Auth is an authentication and authorization library for TypeScript. | High (8.3) | — | ✅ |
| CVE-2026-54597 — ITFlow provides an IT documentation, ticketing and accounting system for small managed… | High (8.3) | — | ✅ |
| CVE-2026-54661 — swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI… | High (8.3) | — | ✅ |
| CVE-2026-54662 — swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI… | High (8.3) | — | ✅ |
| CVE-2026-54664 — swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI… | High (8.3) | — | ✅ |
| CVE-2026-54666 — swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI… | High (8.3) | — | ✅ |
| CVE-2026-55723 — When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or… | High (8.3) | — | ✅ |
| CVE-2026-55739 — Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies… | High (8.3) | — | ✅ |
| CVE-2026-56241 — Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted… | High (8.3) | — | ✅ |
| CVE-2026-58153 — Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper… | High (8.3) | — | ✅ |
| CVE-2026-58281 — Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an… | High (8.3) | — | ✅ |
| CVE-2026-58596 — Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized… | High (8.3) | — | ✅ |
| CVE-2026-59258 — immich before 3.0.3 contains a broken access control vulnerability in the PUT… | High (8.3) | — | ✅ |
| CVE-2026-61305 — Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI… | High (8.3) | — | ✅ |
| CVE-2026-62455 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.3) | — | ✅ |
| CVE-2026-63137 — Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via… | High (8.3) | — | ✅ |
| CVE-2026-65709 — sysPass JSON-RPC Broken Object-Level Authorization (BOLA/IDOR) | High (8.3) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-66027 — Suna before 0.9.102 contains a broken access control vulnerability in the message queue… | High (8.3) | — | ✅ |
| CVE-2026-66154 — An insufficient certificate validation in a privileged communication workflow, was… | High (8.3) | — | ✅ |
| CVE-2026-67327 — better-auth versions >= 1.1.3 and < 1.6.22 (and pre-release versions >= 1.7.0-beta.0 and… | High (8.3) | — | ✅ |
| CVE-2026-67331 — better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization… | High (8.3) | — | ✅ |
| CVE-2026-69119 — Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth… | High (8.3) | — | ✅ |
| CVE-2026-70770 — Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite… | High (8.3) | — | ✅ |
| CVE-2026-71095 — Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle… | High (8.3) | — | ✅ |
| CVE-2026-71206 — Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC… | High (8.3) | — | ✅ |
| CVE-2026-71242 — Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes /… | High (8.3) | — | ✅ |
| CVE-2026-72970 — Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized… | High (8.3) | — | ✅ |
| CVE-2026-73618 — Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB… | High (8.3) | — | ✅ |
| CVE-2026-73708 — A business logic vulnerability exists in the API of HPE Networking Fabric Composer. | High (8.3) | — | ✅ |
| CVE-2026-73709 — A vulnerability in the underlying operating system of HPE Networking Fabric Composer… | High (8.3) | — | ✅ |
| CVE-2026-73780 — A vulnerability in the web-based management interface of AOS-CX switches exposes some… | High (8.3) | — | ✅ |
| CVE-2026-73929 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.3) | — | ✅ |
| CVE-2026-73931 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.3) | — | ✅ |
| CVE-2026-76391 — In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or… | High (8.3) | — | ✅ |
| CVE-2026-76394 — In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the… | High (8.3) | — | ✅ |
| CVE-2026-77180 — When NGINX Ingress Controller is configured with Ingress annotations, an injection… | High (8.3) | — | ✅ |
| CVE-2026-79912 — A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. | High (8.3) | — | ✅ |
| CVE-2026-82021 — Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled… | High (8.3) | — | ✅ |
| CVE-2026-82157 — Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper… | High (8.3) | — | ✅ |
| CVE-2026-82404 — TOON is a compact, human-readable serialization of JSON data for LLM prompts. | High (8.3) | — | ✅ |
| CVE-2026-84115 — A vulnerability was found in Cleo Harmony up to 5.8.1.10. | High (8.3) | — | ✅ |
| CVE-2026-85048 — Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote… | High (8.3) | — | ✅ |
| CVE-2026-85212 — CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of… | High (8.3) | — | ✅ |
| CVE-2026-87034 — Tanium addressed a SQL injection vulnerability in Comply. | High (8.3) | — | ✅ |
| CVE-2026-8712 — Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows… | High (8.3) | — | ✅ |
| CVE-2026-92752 — metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check… | High (8.3) | — | ✅ |
| CVE-2026-93371 — A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. | High (8.3) | — | ✅ |
| CVE-2026-93453 — SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin… | High (8.3) | — | ✅ |
| CVE-2026-97680 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.3) | — | ✅ |
| CVE-2026-10025 — IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an… | High (8.2) | — | ✅ |
| CVE-2026-100391 — MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the… | High (8.2) | — | ✅ |
| CVE-2026-100567 — OpenClaw is an agent gateway distributed as the npm package 'openclaw'. | High (8.2) | — | ✅ |
| CVE-2026-100673 — The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through… | High (8.2) | — | ✅ |
| CVE-2026-100676 — January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version… | High (8.2) | — | ✅ |
| CVE-2026-100833 — Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies… | High (8.2) | — | ✅ |
| CVE-2026-101966 — A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper… | High (8.2) | — | ✅ |
| CVE-2026-102695 — OmniFaces is a utility library for Faces. | High (8.2) | — | ✅ |
| CVE-2026-103065 — Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki… | High (8.2) | — | ✅ |
| CVE-2026-104051 — PictShare before 3.7.1 contains an information disclosure vulnerability that allows… | High (8.2) | — | ✅ |
| CVE-2026-104445 — YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub… | High (8.2) | — | ✅ |
| CVE-2026-105034 — The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial… | High (8.2) | — | ✅ |
| CVE-2026-105443 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient… | High (8.2) | — | ✅ |
| CVE-2026-105898 — ColdFusion is affected by an Incorrect Authorization vulnerability that could result in… | High (8.2) | — | ✅ |
| CVE-2026-108480 — Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting… | High (8.2) | — | ✅ |
| CVE-2026-10849 — The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an… | High (8.2) | — | ✅ |
| CVE-2026-111282 — Driftregion iso14229 before 0.10.1 contains an integer wraparound in… | High (8.2) | — | ✅ |
| CVE-2026-12382 — A flaw was found in the AAP Gateway Envoy proxy configuration. | High (8.2) | — | ✅ |
| CVE-2026-12540 — A flaw was found in Foreman. | High (8.2) | — | ✅ |
| CVE-2026-12541 — A flaw was found in Foreman. | High (8.2) | — | ✅ |
| CVE-2026-12722 — Missing authentication for critical function vulnerability in FTC Software IT Services… | High (8.2) | — | ✅ |
| CVE-2026-12984 — Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows… | High (8.2) | — | ✅ |
| CVE-2026-14679 — Stack buffer overflow in PostgreSQL argument name matching allows an object creator to… | High (8.2) | — | ✅ |
| CVE-2026-14886 — Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a… | High (8.2) | — | ✅ |
| CVE-2026-14996 — IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to… | High (8.2) | — | ✅ |
| CVE-2026-15061 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow… | High (8.2) | — | ✅ |
| CVE-2026-16002 — The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker… | High (8.2) | — | ✅ |
| CVE-2026-16661 — IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-16686 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access… | High (8.2) | — | ✅ |
| CVE-2026-16707 — IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-16857 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate… | High (8.2) | — | ✅ |
| CVE-2026-16930 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-16933 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-16943 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute… | High (8.2) | — | ✅ |
| CVE-2026-17081 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary… | High (8.2) | — | ✅ |
| CVE-2026-17093 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-17100 — Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-17220 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… | High (8.2) | — | ✅ |
| CVE-2026-17272 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… | High (8.2) | — | ✅ |
| CVE-2026-17485 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… | High (8.2) | — | ✅ |
| CVE-2026-17494 — IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a… | High (8.2) | — | ✅ |
| CVE-2026-18141 — A flaw was found in aap-gateway, a component of Ansible Automation Platform's… | High (8.2) | — | ✅ |
| CVE-2026-18329 — Description | High (8.2) | — | ✅ |
| CVE-2026-18509 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege… | High (8.2) | — | ✅ |
| CVE-2026-18670 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a… | High (8.2) | — | ✅ |
| CVE-2026-18794 — The OpenRGB network protocol allows attackers to cause memory exhaustion and… | High (8.2) | — | ✅ |
| CVE-2026-18840 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute… | High (8.2) | — | ✅ |
| CVE-2026-18891 — IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary… | High (8.2) | — | ✅ |
| CVE-2026-18904 — IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive… | High (8.2) | — | ✅ |
| CVE-2026-19234 — Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through… | High (8.2) | — | ✅ |
| CVE-2026-19442 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the… | High (8.2) | — | ✅ |
| CVE-2026-19889 — GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all… | High (8.2) | — | ✅ |
| CVE-2026-20045 — A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified… | High (8.2) | — | ✅ |
| CVE-2026-20277 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.2) | — | ✅ |
| CVE-2026-22068 — Regular Expression without Anchors vulnerability in Apache Traffic Server. | High (8.2) | — | ✅ |
| CVE-2026-24253 — NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an… | High (8.2) | — | ✅ |
| CVE-2026-24262 — NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged… | High (8.2) | — | ✅ |
| CVE-2026-24263 — NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged… | High (8.2) | — | ✅ |
| CVE-2026-27654 — NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module… | High (8.2) | Snort, Sigma | ✅ |
| CVE-2026-35147 — HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. | High (8.2) | — | ✅ |
| CVE-2026-35149 — HCL DFXServer is affected by an Authentication Bypass vulnerability via server response… | High (8.2) | — | ✅ |
| CVE-2026-41424 — Wazuh is a free and open source platform used for threat prevention, detection, and… | High (8.2) | — | ✅ |
| CVE-2026-43910 — Appium Java Client is the Java language binding for writing Appium tests that conform to… | High (8.2) | — | ✅ |
| CVE-2026-44506 — Medplum is a developer platform that enables development of healthcare apps. | High (8.2) | — | ✅ |
| CVE-2026-45325 — Gestor de Oferta is a web application for managing mobility service offerings. | High (8.2) | — | ✅ |
| CVE-2026-46485 — Dashy is a self-hostable personal dashboard. | High (8.2) | — | ✅ |
| CVE-2026-47483 — NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof… | High (8.2) | — | ✅ |
| CVE-2026-47623 — NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause… | High (8.2) | — | ✅ |
| CVE-2026-47626 — NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged… | High (8.2) | — | ✅ |
| CVE-2026-47877 — Spring Security Authorization Server's default consent page renders user-controlled… | High (8.2) | — | ✅ |
| CVE-2026-48390 — Bridge is affected by an Incorrect Authorization vulnerability that could result in… | High (8.2) | — | ✅ |
| CVE-2026-48391 — Bridge is affected by an Untrusted Search Path vulnerability that could result in… | High (8.2) | — | ✅ |
| CVE-2026-48763 — TypeBot is a chatbot builder tool. | High (8.2) | — | ✅ |
| CVE-2026-48771 — ishankportfolio is a portfolio website. | High (8.2) | — | ✅ |
| CVE-2026-49825 — lxml is a library for processing XML and HTML in the Python language. | High (8.2) | — | ✅ |
| CVE-2026-49998 — Centrifugo is an open-source scalable real-time messaging server. | High (8.2) | — | ✅ |
| CVE-2026-52767 — YesWiki is a wiki system written in PHP. | High (8.2) | — | ✅ |
| CVE-2026-53500 — Thumbor is an open-source photo thumbnail service by globo.com. | High (8.2) | — | ✅ |
| CVE-2026-53501 — Thumbor is an open-source photo thumbnail service by globo.com. | High (8.2) | — | ✅ |
| CVE-2026-54253 — TS3 Manager is modern web interface for maintaining Teamspeak3 servers. | High (8.2) | — | ✅ |
| CVE-2026-54354 — MapServer is a system for developing web-based GIS applications. | High (8.2) | — | ✅ |
| CVE-2026-54574 — proot-distro is a utility for managing proot containers. | High (8.2) | — | ✅ |
| CVE-2026-54682 — DiscordChatExporter saves Discord chat logs to a file. | High (8.2) | — | ✅ |
| CVE-2026-54690 — datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and… | High (8.2) | — | ✅ |
| CVE-2026-54691 — datamodel-code-generator generates Python data models from schema definitions. | High (8.2) | — | ✅ |
| CVE-2026-54727 — proot-distro is a utility for managing proot containers. | High (8.2) | — | ✅ |
| CVE-2026-55383 — InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and… | High (8.2) | — | ✅ |
| CVE-2026-55528 — PraisonAI is a multi-agent teams system. | High (8.2) | — | ✅ |
| CVE-2026-55533 — PraisonAI is a multi-agent teams system. | High (8.2) | — | ✅ |
| CVE-2026-55571 — djust provides Phoenix LiveView-style reactive server-side rendering for Django with… | High (8.2) | — | ✅ |
| CVE-2026-56259 — Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API… | High (8.2) | — | ✅ |
| CVE-2026-56670 — ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. | High (8.2) | — | ✅ |
| CVE-2026-56672 — ComfyUI is a node-based diffusion model GUI, API, and backend. | High (8.2) | — | ✅ |
| CVE-2026-56795 — Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search… | High (8.2) | — | ✅ |
| CVE-2026-58159 — Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL… | High (8.2) | — | ✅ |
| CVE-2026-58184 — The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie… | High (8.2) | — | ✅ |
| CVE-2026-58188 — Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass… | High (8.2) | — | ✅ |
| CVE-2026-58658 — GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information… | High (8.2) | — | ✅ |
| CVE-2026-59316 — Spring Authorization Server's default consent page renders user-controlled values without… | High (8.2) | — | ✅ |
| CVE-2026-59324 — When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering… | High (8.2) | — | ✅ |
| CVE-2026-59501 — CWE-284: Improper Access Control | High (8.2) | — | ✅ |
| CVE-2026-60005 — NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. | High (8.2) | — | ✅ |
| CVE-2026-60796 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component:… | High (8.2) | — | ✅ |
| CVE-2026-60944 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-60955 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-61011 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-61016 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-61038 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-61054 — Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-61222 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.2) | — | ✅ |
| CVE-2026-61302 — Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-61340 — Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business… | High (8.2) | — | ✅ |
| CVE-2026-61824 — Defuddle cleans up HTML pages. | High (8.2) | — | ✅ |
| CVE-2026-62448 — Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component:… | High (8.2) | — | ✅ |
| CVE-2026-62485 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.2) | — | ✅ |
| CVE-2026-62598 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | High (8.2) | — | ✅ |
| CVE-2026-62605 — Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite… | High (8.2) | — | ✅ |
| CVE-2026-63135 — YOURLS is a self-hosted, customizable URL shortener written in PHP. | High (8.2) | — | ✅ |
| CVE-2026-63376 — toml-node is a TOML parser for Node.js and the browser. | High (8.2) | — | ✅ |
| CVE-2026-63407 — Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… | High (8.2) | — | ✅ |
| CVE-2026-63765 — Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct… | High (8.2) | — | ✅ |
| CVE-2026-65604 — Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies… | High (8.2) | — | ✅ |
| CVE-2026-65842 — Plate is a rich-text editor with AI and shadcn/ui. | High (8.2) | — | ✅ |
| CVE-2026-6627 — The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable… | High (8.2) | — | ✅ |
| CVE-2026-66708 — Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | High (8.2) | — | ✅ |
| CVE-2026-67270 — Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper… | High (8.2) | — | ✅ |
| CVE-2026-70456 — rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args()… | High (8.2) | — | ✅ |
| CVE-2026-70458 — rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows… | High (8.2) | — | ✅ |
| CVE-2026-70461 — rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows… | High (8.2) | — | ✅ |
| CVE-2026-70486 — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | High (8.2) | — | ✅ |
| CVE-2026-70702 — Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File… | High (8.2) | — | ✅ |
| CVE-2026-70703 — Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply… | High (8.2) | — | ✅ |
| CVE-2026-70722 — Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite… | High (8.2) | — | ✅ |
| CVE-2026-70743 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | High (8.2) | — | ✅ |
| CVE-2026-70773 — Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite… | High (8.2) | — | ✅ |
| CVE-2026-70852 — Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component:… | High (8.2) | — | ✅ |
| CVE-2026-70870 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-70887 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-70892 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-70893 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-70897 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-70909 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.2) | — | ✅ |
| CVE-2026-70952 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.2) | — | ✅ |
| CVE-2026-70964 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.2) | — | ✅ |
| CVE-2026-70993 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.2) | — | ✅ |
| CVE-2026-71016 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.2) | — | ✅ |
| CVE-2026-71018 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.2) | — | ✅ |
| CVE-2026-71024 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.2) | — | ✅ |
| CVE-2026-71096 — Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle… | High (8.2) | — | ✅ |
| CVE-2026-71129 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component:… | High (8.2) | — | ✅ |
| CVE-2026-71130 — Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component:… | High (8.2) | — | ✅ |
| CVE-2026-71159 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.2) | — | ✅ |
| CVE-2026-71252 — toner-management's admin state-changing handlers (add.php, edit.php, delete.php under… | High (8.2) | — | ✅ |
| CVE-2026-71264 — WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson()… | High (8.2) | — | ✅ |
| CVE-2026-71315 — Nuxt is an open-source web development framework for Vue.js. | High (8.2) | — | ✅ |
| CVE-2026-71854 — OpenAEV is an open source platform allowing organizations to plan, schedule and conduct… | High (8.2) | — | ✅ |
| CVE-2026-7189 — Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. | High (8.2) | — | ✅ |
| CVE-2026-72922 — AutoGPT is a workflow automation platform for creating, deploying, and managing… | High (8.2) | — | ✅ |
| CVE-2026-73613 — filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability… | High (8.2) | — | ✅ |
| CVE-2026-73650 — SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… | High (8.2) | — | ✅ |
| CVE-2026-73658 — Trigger.dev is a platform for building and deploying fully managed AI agents and… | High (8.2) | — | ✅ |
| CVE-2026-73666 — OpenChoreo is a developer platform for Kubernetes. | High (8.2) | — | ✅ |
| CVE-2026-73710 — Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an… | High (8.2) | — | ✅ |
| CVE-2026-73779 — Vulnerabilities have been identified in the operating system of AOS-CX switches that… | High (8.2) | — | ✅ |
| CVE-2026-73798 — A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial… | High (8.2) | — | ✅ |
| CVE-2026-73925 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.2) | — | ✅ |
| CVE-2026-73937 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.2) | — | ✅ |
| CVE-2026-75871 — GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all… | High (8.2) | — | ✅ |
| CVE-2026-76208 — phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in… | High (8.2) | — | ✅ |
| CVE-2026-76222 — GitPython before 3.1.58 fails to validate submodule names from .gitmodules files,… | High (8.2) | — | ✅ |
| CVE-2026-76402 — In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach… | High (8.2) | — | ✅ |
| CVE-2026-76413 — A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO)… | High (8.2) | — | ✅ |
| CVE-2026-76468 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.2) | — | ✅ |
| CVE-2026-76842 — The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request… | High (8.2) | — | ✅ |
| CVE-2026-77214 — libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in… | High (8.2) | — | ✅ |
| CVE-2026-77348 — Wallos is an open-source, self-hostable personal subscription tracker. | High (8.2) | — | ✅ |
| CVE-2026-77538 — A malicious actor with access to the network could exploit an Improper Access Control… | High (8.2) | — | ✅ |
| CVE-2026-77822 — IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain… | High (8.2) | — | ✅ |
| CVE-2026-78209 — exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or… | High (8.2) | — | ✅ |
| CVE-2026-79674 — NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader… | High (8.2) | — | ✅ |
| CVE-2026-79821 — A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in… | High (8.2) | — | ✅ |
| CVE-2026-79829 — A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which… | High (8.2) | — | ✅ |
| CVE-2026-80208 — APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount… | High (8.2) | — | ✅ |
| CVE-2026-80236 — Efence developed by Thinking Software Technology has a SQL Injection vulnerability. | High (8.2) | — | ✅ |
| CVE-2026-81574 — In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input… | High (8.2) | — | ✅ |
| CVE-2026-81730 — Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in… | High (8.2) | — | ✅ |
| CVE-2026-82211 — The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result… | High (8.2) | — | ✅ |
| CVE-2026-82234 — SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the… | High (8.2) | — | ✅ |
| CVE-2026-82285 — bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the… | High (8.2) | — | ✅ |
| CVE-2026-82473 — KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server… | High (8.2) | — | ✅ |
| CVE-2026-82876 — Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus… | High (8.2) | — | ✅ |
| CVE-2026-83946 — Improper neutralization of input during web page generation ('cross-site scripting') in… | High (8.2) | — | ✅ |
| CVE-2026-84187 — AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that… | High (8.2) | — | ✅ |
| CVE-2026-84696 — Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor… | High (8.2) | — | ✅ |
| CVE-2026-84757 — Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. | High (8.2) | — | ✅ |
| CVE-2026-85056 — ZITADEL is an open source identity management platform. | High (8.2) | — | ✅ |
| CVE-2026-85077 — Sanic is an opensource python web server/framework. | High (8.2) | — | ✅ |
| CVE-2026-85432 — MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message… | High (8.2) | — | ✅ |
| CVE-2026-85455 — MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt… | High (8.2) | — | ✅ |
| CVE-2026-85613 — OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the… | High (8.2) | — | ✅ |
| CVE-2026-86039 — libp2p is a JavaScript implementation of the libp2p networking stack. | High (8.2) | — | ✅ |
| CVE-2026-86145 — PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached… | High (8.2) | — | ✅ |
| CVE-2026-86361 — Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission… | High (8.2) | — | ✅ |
| CVE-2026-86362 — Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control… | High (8.2) | — | ✅ |
| CVE-2026-86565 — A flaw was found in DPDK lib/vhost. | High (8.2) | — | ✅ |
| CVE-2026-91160 — OpenWA is a free, open source, self-hosted WhatsApp API gateway. | High (8.2) | — | ✅ |
| CVE-2026-92903 — Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized… | High (8.2) | — | ✅ |
| CVE-2026-93456 — django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in… | High (8.2) | — | ✅ |
| CVE-2026-93905 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an… | High (8.2) | — | ✅ |
| CVE-2026-97662 — An argument injection issue in the diff scan operation in AWS security-agent-mcp-server… | High (8.2) | — | ✅ |
| CVE-2026-100387 — pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-100389 — GestSup versions before 3.2.61 contain a remote code execution vulnerability in the basic… | High (8.1) | — | ✅ |
| CVE-2026-100532 — @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the… | High (8.1) | — | ✅ |
| CVE-2026-100627 — Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect… | High (8.1) | — | ✅ |
| CVE-2026-100646 — SiYuan is a self-hosted personal knowledge management system. | High (8.1) | — | ✅ |
| CVE-2026-100680 — Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the… | High (8.1) | — | ✅ |
| CVE-2026-100684 — Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO… | High (8.1) | — | ✅ |
| CVE-2026-100686 — Budibase versions before 3.45.0 fail to validate per-app authorization in the POST… | High (8.1) | — | ✅ |
| CVE-2026-100838 — Contrast is a confidential-computing runtime for Kubernetes. | High (8.1) | — | ✅ |
| CVE-2026-101923 — The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content… | High (8.1) | — | ✅ |
| CVE-2026-101955 — A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks… | High (8.1) | — | ✅ |
| CVE-2026-101997 — An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | High (8.1) | — | ✅ |
| CVE-2026-102037 — An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of Juniper… | High (8.1) | — | ✅ |
| CVE-2026-102062 — An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper… | High (8.1) | — | ✅ |
| CVE-2026-102084 — An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon… | High (8.1) | — | ✅ |
| CVE-2026-102101 — Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. | High (8.1) | — | ✅ |
| CVE-2026-102126 — A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an… | High (8.1) | — | ✅ |
| CVE-2026-102986 — Plane is an open-source project management tool. | High (8.1) | — | ✅ |
| CVE-2026-103250 — n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1… | High (8.1) | — | ✅ |
| CVE-2026-103277 — Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution… | High (8.1) | — | ✅ |
| CVE-2026-103283 — Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows… | High (8.1) | — | ✅ |
| CVE-2026-103360 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.1) | — | ✅ |
| CVE-2026-103367 — The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to… | High (8.1) | — | ✅ |
| CVE-2026-103473 — Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-103493 — In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was… | High (8.1) | — | ✅ |
| CVE-2026-103758 — Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows… | High (8.1) | — | ✅ |
| CVE-2026-103895 — The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is… | High (8.1) | — | ✅ |
| CVE-2026-103977 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and… | High (8.1) | — | ✅ |
| CVE-2026-104059 — Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the… | High (8.1) | — | ✅ |
| CVE-2026-104103 — Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI… | High (8.1) | — | ✅ |
| CVE-2026-104108 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and… | High (8.1) | — | ✅ |
| CVE-2026-104414 — Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that… | High (8.1) | — | ✅ |
| CVE-2026-104443 — YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that… | High (8.1) | — | ✅ |
| CVE-2026-104448 — YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the… | High (8.1) | — | ✅ |
| CVE-2026-104467 — YesWiki before 4.6.7 contains an authorization bypass vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-104745 — The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to… | High (8.1) | — | ✅ |
| CVE-2026-104909 — The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions… | High (8.1) | — | ✅ |
| CVE-2026-104988 — A flaw was found in Dogtag PKI (pki-core). | High (8.1) | — | ✅ |
| CVE-2026-104995 — The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in… | High (8.1) | — | ✅ |
| CVE-2026-105858 — Payload is a free and open source headless content management system. | High (8.1) | — | ✅ |
| CVE-2026-105865 — Payload is a free and open source headless content management system. | High (8.1) | — | ✅ |
| CVE-2026-106471 — A flaw was found in Candlepin. | High (8.1) | — | ✅ |
| CVE-2026-106488 — Backstage is an open framework for building developer portals. | High (8.1) | — | ✅ |
| CVE-2026-106503 — Backstage is an open framework for building developer portals. | High (8.1) | — | ✅ |
| CVE-2026-10666 — parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the… | High (8.1) | — | ✅ |
| CVE-2026-107181 — Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-107183 — llama.cpp before b11393 contains a use-after-free and double free vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-10818 — WPForms Pro Unauthenticated Arbitrary File Upload (→ RCE) | High (8.1) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2026-109221 — The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is… | High (8.1) | — | ✅ |
| CVE-2026-109447 — The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role… | High (8.1) | — | ✅ |
| CVE-2026-110455 — A malicious actor with access to the network and under certain conditions could exploit… | High (8.1) | — | ✅ |
| CVE-2026-110616 — NullHub through 2026.5.29 contains a missing authentication vulnerability that allows… | High (8.1) | — | ✅ |
| CVE-2026-110618 — SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its… | High (8.1) | — | ✅ |
| CVE-2026-110632 — Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP… | High (8.1) | — | ✅ |
| CVE-2026-110646 — Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-110770 — Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that… | High (8.1) | — | ✅ |
| CVE-2026-110858 — GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-110863 — Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication… | High (8.1) | — | ✅ |
| CVE-2026-111094 — In JetBrains TeamCity before 2026.2, | High (8.1) | — | ✅ |
| CVE-2026-111445 — Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a… | High (8.1) | — | ✅ |
| CVE-2026-111447 — Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key… | High (8.1) | — | ✅ |
| CVE-2026-12633 — The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN… | High (8.1) | — | ✅ |
| CVE-2026-13059 — An authenticated user with low privileges may be able to perform unauthorized reads and… | High (8.1) | — | ✅ |
| CVE-2026-13072 — When compute mode is enabled on a standalone mongod instance, insufficient validation of… | High (8.1) | — | ✅ |
| CVE-2026-13445 — IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the… | High (8.1) | — | ✅ |
| CVE-2026-13448 — IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code… | High (8.1) | — | ✅ |
| CVE-2026-13473 — IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through… | High (8.1) | — | ✅ |
| CVE-2026-14169 — Due to incorrect behavior order a low privileged remote attacker could trigger account… | High (8.1) | — | ✅ |
| CVE-2026-14316 — The revoked-key error path builds a human-readable failure reason using sprintf() into a… | High (8.1) | — | ✅ |
| CVE-2026-14668 — Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows… | High (8.1) | — | ✅ |
| CVE-2026-14974 — IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker… | High (8.1) | — | ✅ |
| CVE-2026-14982 — The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to… | High (8.1) | — | ✅ |
| CVE-2026-15078 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain… | High (8.1) | — | ✅ |
| CVE-2026-15176 — A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured… | High (8.1) | — | ✅ |
| CVE-2026-15450 — The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to… | High (8.1) | — | ✅ |
| CVE-2026-15459 — The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all… | High (8.1) | — | ✅ |
| CVE-2026-15467 — A flaw was found in the trustyai-service-operator's LMEvalJob controller. | High (8.1) | — | ✅ |
| CVE-2026-15556 — A flaw was found in Picketlink's SP signature validation; a SAML response containing zero… | High (8.1) | — | ✅ |
| CVE-2026-15573 — A flaw was found in Keycloak's Authorization Services. | High (8.1) | — | ✅ |
| CVE-2026-15979 — The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is… | High (8.1) | — | ✅ |
| CVE-2026-15983 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to… | High (8.1) | — | ✅ |
| CVE-2026-15985 — The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to… | High (8.1) | — | ✅ |
| CVE-2026-1609 — A flaw was found in Keycloak. | High (8.1) | — | ✅ |
| CVE-2026-16102 — A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an… | High (8.1) | — | ✅ |
| CVE-2026-16144 — The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable… | High (8.1) | — | ✅ |
| CVE-2026-16231 — hbs is an Express view engine that wraps Handlebars. | High (8.1) | — | ✅ |
| CVE-2026-16867 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources… | High (8.1) | — | ✅ |
| CVE-2026-16868 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service… | High (8.1) | — | ✅ |
| CVE-2026-17000 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.1) | — | ✅ |
| CVE-2026-17031 — The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is… | High (8.1) | — | ✅ |
| CVE-2026-17045 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform… | High (8.1) | — | ✅ |
| CVE-2026-17060 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain… | High (8.1) | — | ✅ |
| CVE-2026-17069 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass… | High (8.1) | — | ✅ |
| CVE-2026-17092 — The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for… | High (8.1) | — | ✅ |
| CVE-2026-17138 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.1) | — | ✅ |
| CVE-2026-17197 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security… | High (8.1) | — | ✅ |
| CVE-2026-17206 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due… | High (8.1) | — | ✅ |
| CVE-2026-17414 — IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.1) | — | ✅ |
| CVE-2026-17429 — IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through… | High (8.1) | — | ✅ |
| CVE-2026-17496 — NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with… | High (8.1) | — | ✅ |
| CVE-2026-18129 — Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager… | High (8.1) | — | ✅ |
| CVE-2026-18175 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database… | High (8.1) | — | ✅ |
| CVE-2026-18221 — IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access… | High (8.1) | — | ✅ |
| CVE-2026-18411 — The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a… | High (8.1) | — | ✅ |
| CVE-2026-18500 — @fastify/jwt is a JSON Web Token plugin for Fastify. | High (8.1) | — | ✅ |
| CVE-2026-18544 — IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass… | High (8.1) | — | ✅ |
| CVE-2026-18712 — An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an… | High (8.1) | — | ✅ |
| CVE-2026-18830 — Insufficient input validation in Amazon Bedrock AgentCore harness might allow an… | High (8.1) | — | ✅ |
| CVE-2026-18844 — The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands… | High (8.1) | — | ✅ |
| CVE-2026-19002 — A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI… | High (8.1) | — | ✅ |
| CVE-2026-19004 — An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety… | High (8.1) | — | ✅ |
| CVE-2026-19091 — The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin… | High (8.1) | — | ✅ |
| CVE-2026-19111 — Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and… | High (8.1) | — | ✅ |
| CVE-2026-19186 — ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed… | High (8.1) | — | ✅ |
| CVE-2026-19219 — In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection… | High (8.1) | — | ✅ |
| CVE-2026-19303 — IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to… | High (8.1) | — | ✅ |
| CVE-2026-19437 — IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… | High (8.1) | — | ✅ |
| CVE-2026-19513 — The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all… | High (8.1) | — | ✅ |
| CVE-2026-19629 — A privilege escalation vulnerability exists in Tenable Security Center that allows a user… | High (8.1) | — | ✅ |
| CVE-2026-19718 — The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security… | High (8.1) | — | ✅ |
| CVE-2026-19750 — A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. | High (8.1) | — | ✅ |
| CVE-2026-19768 — Improper control of generation of code ('Code Injection') in the settings feature in… | High (8.1) | — | ✅ |
| CVE-2026-19900 — A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. | High (8.1) | — | ✅ |
| CVE-2026-19901 — A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. | High (8.1) | — | ✅ |
| CVE-2026-19942 — The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client… | High (8.1) | — | ✅ |
| CVE-2026-20156 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.1) | — | ✅ |
| CVE-2026-20335 — As part of Cisco's ongoing commitment to proactive security and product quality, the… | High (8.1) | — | ✅ |
| CVE-2026-24079 — Cryptographic Issue while processing registration requests with malformed or missing… | High (8.1) | — | ✅ |
| CVE-2026-26950 — Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification… | High (8.1) | — | ✅ |
| CVE-2026-27543 — Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | High (8.1) | — | ✅ |
| CVE-2026-28150 — Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. | High (8.1) | — | ✅ |
| CVE-2026-28151 — Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | High (8.1) | — | ✅ |
| CVE-2026-28152 — Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | High (8.1) | — | ✅ |
| CVE-2026-28186 — Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | High (8.1) | — | ✅ |
| CVE-2026-28472 — OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket… | High (8.1) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-32257 — Winter is a free, open-source content management system (CMS) based on the Laravel PHP… | High (8.1) | — | ✅ |
| CVE-2026-32258 — Winter is a free, open-source content management system (CMS) based on the Laravel PHP… | High (8.1) | — | ✅ |
| CVE-2026-34968 — Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode… | High (8.1) | — | ✅ |
| CVE-2026-39909 — llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's… | High (8.1) | — | ✅ |
| CVE-2026-39915 — TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote… | High (8.1) | — | ✅ |
| CVE-2026-39923 — Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that… | High (8.1) | — | ✅ |
| CVE-2026-42016 — JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege… | High (8.1) | — | ✅ |
| CVE-2026-42533 — A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses… | High (8.1) | — | ✅ |
| CVE-2026-43629 — llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the… | High (8.1) | — | ✅ |
| CVE-2026-43631 — llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-43632 — llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-43978 — wger is a free, open-source workout and fitness manager. | High (8.1) | — | ✅ |
| CVE-2026-44019 — Docling Core defines core data types and transformations for the document processing… | High (8.1) | — | ✅ |
| CVE-2026-44642 — Piwigo is a full featured open source photo gallery application for the web. | High (8.1) | — | ✅ |
| CVE-2026-45260 — Pimcore is an Open Source Data & Experience Management Platform. | High (8.1) | — | ✅ |
| CVE-2026-46351 — BigBlueButton is an open-source virtual classroom. | High (8.1) | — | ✅ |
| CVE-2026-46353 — BigBlueButton is an open-source virtual classroom. | High (8.1) | — | ✅ |
| CVE-2026-46570 — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in… | High (8.1) | — | ✅ |
| CVE-2026-48060 — Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. | High (8.1) | — | ✅ |
| CVE-2026-48081 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | High (8.1) | — | ✅ |
| CVE-2026-49035 — The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS… | High (8.1) | — | ✅ |
| CVE-2026-51568 — modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file. | High (8.1) | — | ✅ |
| CVE-2026-51570 — modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file. | High (8.1) | — | ✅ |
| CVE-2026-53510 — Savon is a Ruby SOAP client. | High (8.1) | — | ✅ |
| CVE-2026-53517 — Better Auth is an authentication and authorization library for TypeScript. | High (8.1) | — | ✅ |
| CVE-2026-53580 — Trilium is an open-source hierarchical note-taking application. | High (8.1) | — | ✅ |
| CVE-2026-53783 — rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition… | High (8.1) | — | ✅ |
| CVE-2026-53790 — rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that… | High (8.1) | — | ✅ |
| CVE-2026-53795 — rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers… | High (8.1) | — | ✅ |
| CVE-2026-54083 — Wazuh is an open-source security platform providing unified XDR and SIEM protection for… | High (8.1) | — | ✅ |
| CVE-2026-54330 — Ceph is an open-source distributed storage platform providing object, block, and file… | High (8.1) | — | ✅ |
| CVE-2026-54342 — In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all… | High (8.1) | — | ✅ |
| CVE-2026-54418 — Leantime through 3.6.2 exposes the JSON-RPC methods… | High (8.1) | — | ✅ |
| CVE-2026-54446 — NetLicensing MCP Server is a natural-language interface that enables agentic applications… | High (8.1) | — | ✅ |
| CVE-2026-54520 — AI Agent Automation is a modular AI agent workflow automation platform with schedulers,… | High (8.1) | — | ✅ |
| CVE-2026-54593 — Pterodactyl is a free, open-source game server management panel. | High (8.1) | — | ✅ |
| CVE-2026-54596 — ITFlow provides an IT documentation, ticketing and accounting system for small managed… | High (8.1) | — | ✅ |
| CVE-2026-55065 — Vikunja is an open-source self-hosted task management platform. | High (8.1) | — | ✅ |
| CVE-2026-55173 — WWBN AVideo is an open source video platform. | High (8.1) | — | ✅ |
| CVE-2026-55228 — Weblate is a web-based continuous localization platform used to manage software… | High (8.1) | — | ✅ |
| CVE-2026-55587 — AliasVault is a privacy-first password manager with built-in email aliasing. | High (8.1) | — | ✅ |
| CVE-2026-55682 — WeGIA is a web manager for charitable institutions. | High (8.1) | — | ✅ |
| CVE-2026-56100 — SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege… | High (8.1) | — | ✅ |
| CVE-2026-56313 — Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-56428 — The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific… | High (8.1) | — | ✅ |
| CVE-2026-57489 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and… | High (8.1) | — | ✅ |
| CVE-2026-57490 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and… | High (8.1) | — | ✅ |
| CVE-2026-58177 — The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and… | High (8.1) | — | ✅ |
| CVE-2026-58179 — The Apache Traffic Server regex_remap plugin overflows the stack and integers from… | High (8.1) | — | ✅ |
| CVE-2026-5857 — Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets… | High (8.1) | — | ✅ |
| CVE-2026-58660 — Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used… | High (8.1) | — | ✅ |
| CVE-2026-59347 — VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. | High (8.1) | — | ✅ |
| CVE-2026-59545 — Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. | High (8.1) | — | ✅ |
| CVE-2026-60742 — Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… | High (8.1) | — | ✅ |
| CVE-2026-60757 — Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Search). | High (8.1) | — | ✅ |
| CVE-2026-60779 — Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component:… | High (8.1) | — | ✅ |
| CVE-2026-60791 — Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component:… | High (8.1) | — | ✅ |
| CVE-2026-60831 — Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… | High (8.1) | — | ✅ |
| CVE-2026-60992 — Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion… | High (8.1) | — | ✅ |
| CVE-2026-61177 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.1) | — | ✅ |
| CVE-2026-61229 — Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware… | High (8.1) | — | ✅ |
| CVE-2026-61265 — Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards… | High (8.1) | — | ✅ |
| CVE-2026-61268 — Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards… | High (8.1) | — | ✅ |
| CVE-2026-61270 — Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards… | High (8.1) | — | ✅ |
| CVE-2026-61281 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-61293 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-61307 — Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of… | High (8.1) | — | ✅ |
| CVE-2026-61321 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.1) | — | ✅ |
| CVE-2026-61591 — djust provides Phoenix LiveView-style reactive server-side rendering for Django with… | High (8.1) | — | ✅ |
| CVE-2026-61641 — Wallos is an open-source, self-hostable personal subscription tracker. | High (8.1) | — | ✅ |
| CVE-2026-61699 — nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. | High (8.1) | — | ✅ |
| CVE-2026-61979 — Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. | High (8.1) | — | ✅ |
| CVE-2026-6205 — An external control of file name or path vulnerability in Upload API in Synology… | High (8.1) | — | ✅ |
| CVE-2026-62209 — OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the… | High (8.1) | — | ✅ |
| CVE-2026-62231 — The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization… | High (8.1) | — | ✅ |
| CVE-2026-62234 — Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing… | High (8.1) | — | ✅ |
| CVE-2026-62251 — Homer is open source telecom observability software. | High (8.1) | — | ✅ |
| CVE-2026-62442 — Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM… | High (8.1) | — | ✅ |
| CVE-2026-62471 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-62477 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-62491 — Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component:… | High (8.1) | — | ✅ |
| CVE-2026-62501 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-62502 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-62531 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-62591 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | High (8.1) | — | ✅ |
| CVE-2026-62595 — Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open… | High (8.1) | — | ✅ |
| CVE-2026-62600 — Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal… | High (8.1) | — | ✅ |
| CVE-2026-62667 — Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your… | High (8.1) | — | ✅ |
| CVE-2026-62685 — File Browser is a file managing interface for uploading, deleting, previewing, renaming,… | High (8.1) | — | ✅ |
| CVE-2026-63035 — A heap use-after-free vulnerability in the TransferSubscriptions service | High (8.1) | — | ✅ |
| CVE-2026-63094 — SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication… | High (8.1) | — | ✅ |
| CVE-2026-63231 — A post-authentication SQL injection | High (8.1) | — | ✅ |
| CVE-2026-63304 — AVideo through 29.0 contains an OS command injection vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-63305 — AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php… | High (8.1) | — | ✅ |
| CVE-2026-63442 — OPNsense is a FreeBSD based firewall and routing platform. | High (8.1) | — | ✅ |
| CVE-2026-6464 — Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to… | High (8.1) | — | ✅ |
| CVE-2026-64665 — Statamic is a Laravel and Git powered content management system (CMS). | High (8.1) | — | ✅ |
| CVE-2026-64679 — Atlantis is a self-hosted golang application that listens for Terraform pull request… | High (8.1) | — | ✅ |
| CVE-2026-64815 — In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI… | High (8.1) | — | ✅ |
| CVE-2026-65081 — NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an… | High (8.1) | — | ✅ |
| CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow,… | High (8.1) | — | ✅ |
| CVE-2026-65105 — NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a… | High (8.1) | — | ✅ |
| CVE-2026-65313 — A provisioning script used when installing HIPASE-250 (formerly 250 | High (8.1) | — | ✅ |
| CVE-2026-65570 — Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | High (8.1) | — | ✅ |
| CVE-2026-65708 — sysPass through version 3.2.11 contains an insecure direct object reference vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-65916 — CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization… | High (8.1) | — | ✅ |
| CVE-2026-66047 — ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated… | High (8.1) | — | ✅ |
| CVE-2026-66318 — Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized… | High (8.1) | — | ✅ |
| CVE-2026-66362 — Description: | High (8.1) | — | ✅ |
| CVE-2026-66374 — Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow… | High (8.1) | — | ✅ |
| CVE-2026-66407 — DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket… | High (8.1) | — | ✅ |
| CVE-2026-66450 — Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions. | High (8.1) | — | ✅ |
| CVE-2026-66653 — Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | High (8.1) | — | ✅ |
| CVE-2026-66656 — Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | High (8.1) | — | ✅ |
| CVE-2026-66657 — Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | High (8.1) | — | ✅ |
| CVE-2026-66670 — Unauthenticated Local File Inclusion in Måne <= 1.7 versions. | High (8.1) | — | ✅ |
| CVE-2026-66671 — Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions. | High (8.1) | — | ✅ |
| CVE-2026-66710 — Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. | High (8.1) | — | ✅ |
| CVE-2026-67102 — HCL BigFix Service Management is affected by a high-severity Broken Access Control… | High (8.1) | — | ✅ |
| CVE-2026-67192 — Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow… | High (8.1) | — | ✅ |
| CVE-2026-67328 — @better-auth/sso versions before 1.6.21 contain multiple authentication bypass… | High (8.1) | — | ✅ |
| CVE-2026-67345 — MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI… | High (8.1) | — | ✅ |
| CVE-2026-67348 — Julep contains an insecure direct object reference vulnerability in the… | High (8.1) | — | ✅ |
| CVE-2026-67595 — VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload… | High (8.1) | — | ✅ |
| CVE-2026-67610 — OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2… | High (8.1) | — | ✅ |
| CVE-2026-67611 — OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows… | High (8.1) | — | ✅ |
| CVE-2026-68581 — Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token… | High (8.1) | — | ✅ |
| CVE-2026-69088 — Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method… | High (8.1) | — | ✅ |
| CVE-2026-70422 — Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization… | High (8.1) | — | ✅ |
| CVE-2026-70460 — rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious… | High (8.1) | — | ✅ |
| CVE-2026-70463 — rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. | High (8.1) | — | ✅ |
| CVE-2026-70482 — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | High (8.1) | — | ✅ |
| CVE-2026-70494 — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | High (8.1) | — | ✅ |
| CVE-2026-70617 — Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that… | High (8.1) | — | ✅ |
| CVE-2026-70634 — TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in… | High (8.1) | — | ✅ |
| CVE-2026-70671 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.1) | — | ✅ |
| CVE-2026-70675 — Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware… | High (8.1) | — | ✅ |
| CVE-2026-70684 — Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise… | High (8.1) | — | ✅ |
| CVE-2026-70701 — Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component:… | High (8.1) | — | ✅ |
| CVE-2026-70704 — Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite… | High (8.1) | — | ✅ |
| CVE-2026-70708 — Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite… | High (8.1) | — | ✅ |
| CVE-2026-70738 — Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-70744 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70746 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70749 — Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70762 — Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite… | High (8.1) | — | ✅ |
| CVE-2026-70782 — Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite… | High (8.1) | — | ✅ |
| CVE-2026-70795 — Vulnerability in the Oracle Applications Platform Engineering product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-70805 — Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business… | High (8.1) | — | ✅ |
| CVE-2026-70811 — Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component:… | High (8.1) | — | ✅ |
| CVE-2026-70814 — Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite… | High (8.1) | — | ✅ |
| CVE-2026-70815 — Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business… | High (8.1) | — | ✅ |
| CVE-2026-70830 — Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business… | High (8.1) | — | ✅ |
| CVE-2026-70835 — Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component:… | High (8.1) | — | ✅ |
| CVE-2026-70868 — Vulnerability in Oracle Application Testing Suite. | High (8.1) | — | ✅ |
| CVE-2026-70878 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-70881 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-70901 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-70904 — Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-70924 — Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware… | High (8.1) | — | ✅ |
| CVE-2026-70925 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70929 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70931 — Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component:… | High (8.1) | — | ✅ |
| CVE-2026-70943 — Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70957 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70959 — Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion… | High (8.1) | — | ✅ |
| CVE-2026-70999 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.1) | — | ✅ |
| CVE-2026-71035 — Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager… | High (8.1) | — | ✅ |
| CVE-2026-71042 — Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: PGC /… | High (8.1) | — | ✅ |
| CVE-2026-71053 — Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply… | High (8.1) | — | ✅ |
| CVE-2026-71068 — Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain… | High (8.1) | — | ✅ |
| CVE-2026-71110 — Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative… | High (8.1) | — | ✅ |
| CVE-2026-71112 — Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle… | High (8.1) | — | ✅ |
| CVE-2026-71239 — DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content)… | High (8.1) | — | ✅ |
| CVE-2026-71285 — Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects… | High (8.1) | — | ✅ |
| CVE-2026-71320 — Nuxt is an open-source web development framework for Vue.js. | High (8.1) | — | ✅ |
| CVE-2026-71504 — Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members… | High (8.1) | — | ✅ |
| CVE-2026-71506 — Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments… | High (8.1) | — | ✅ |
| CVE-2026-72001 — Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows… | High (8.1) | — | ✅ |
| CVE-2026-72563 — A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any… | High (8.1) | — | ✅ |
| CVE-2026-72595 — A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any… | High (8.1) | — | ✅ |
| CVE-2026-72596 — A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated… | High (8.1) | — | ✅ |
| CVE-2026-72665 — Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery… | High (8.1) | — | ✅ |
| CVE-2026-72695 — Grav before 2.0.16 contains a path traversal vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-72741 — Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken… | High (8.1) | — | ✅ |
| CVE-2026-72836 — FileBrowser before 2.63.19 does not account for case-insensitive filesystems when… | High (8.1) | — | ✅ |
| CVE-2026-72856 — Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT… | High (8.1) | — | ✅ |
| CVE-2026-72903 — Tabby (formerly Terminus) is a highly configurable terminal emulator. | High (8.1) | — | ✅ |
| CVE-2026-72921 — SeaweedFS is a distributed storage system. | High (8.1) | — | ✅ |
| CVE-2026-73030 — unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-73223 — electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | High (8.1) | — | ✅ |
| CVE-2026-73225 — electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | High (8.1) | — | ✅ |
| CVE-2026-73227 — electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. | High (8.1) | — | ✅ |
| CVE-2026-7327 — An improper privilege management vulnerability in the REST API document processing… | High (8.1) | — | ✅ |
| CVE-2026-73387 — Unauthenticated Local File Inclusion in Resido <= 1.5 versions. | High (8.1) | — | ✅ |
| CVE-2026-73482 — phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-73515 — PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows… | High (8.1) | — | ✅ |
| CVE-2026-73612 — File Browser before v2.63.22 fails to validate access rules for descendants during… | High (8.1) | — | ✅ |
| CVE-2026-73620 — GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and… | High (8.1) | — | ✅ |
| CVE-2026-73624 — GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the… | High (8.1) | — | ✅ |
| CVE-2026-73659 — Trigger.dev is the open-source platform for building AI workflows in TypeScript. | High (8.1) | — | ✅ |
| CVE-2026-73683 — Laravel Socialite's Facebook provider contains an authentication bypass vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-73711 — A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric… | High (8.1) | — | ✅ |
| CVE-2026-73712 — A vulnerability in the API of HPE Networking Fabric Composer could allow an… | High (8.1) | — | ✅ |
| CVE-2026-73777 — Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could… | High (8.1) | — | ✅ |
| CVE-2026-73778 — A vulnerability exists in the Credential Manager component that may allow for… | High (8.1) | — | ✅ |
| CVE-2026-7444 — The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request… | High (8.1) | — | ✅ |
| CVE-2026-75146 — FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer… | High (8.1) | — | ✅ |
| CVE-2026-7520 — The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized… | High (8.1) | — | ✅ |
| CVE-2026-75903 — The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all… | High (8.1) | — | ✅ |
| CVE-2026-75960 — Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected… | High (8.1) | — | ✅ |
| CVE-2026-76205 — phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and… | High (8.1) | — | ✅ |
| CVE-2026-76207 — phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where… | High (8.1) | — | ✅ |
| CVE-2026-76219 — GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-76331 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.1) | — | ✅ |
| CVE-2026-76338 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an… | High (8.1) | — | ✅ |
| CVE-2026-76354 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… | High (8.1) | — | ✅ |
| CVE-2026-76356 — In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP… | High (8.1) | — | ✅ |
| CVE-2026-76387 — In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise… | High (8.1) | — | ✅ |
| CVE-2026-76388 — In Splunk Enterprise Security versions below 8.6.1, a user who holds the ess_analyst… | High (8.1) | — | ✅ |
| CVE-2026-76397 — In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could… | High (8.1) | — | ✅ |
| CVE-2026-76399 — In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could… | High (8.1) | — | ✅ |
| CVE-2026-76633 — WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change… | High (8.1) | — | ✅ |
| CVE-2026-76834 — b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901… | High (8.1) | — | ✅ |
| CVE-2026-76886 — C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of… | High (8.1) | — | ✅ |
| CVE-2026-77176 — A flaw was found in Kata Containers. | High (8.1) | — | ✅ |
| CVE-2026-77294 — TREK is a collaborative travel planner. | High (8.1) | — | ✅ |
| CVE-2026-77317 — SeaweedFS is a distributed storage system for files and blobs. | High (8.1) | — | ✅ |
| CVE-2026-77567 — Filament is a collection of full-stack components for accelerated Laravel development. | High (8.1) | — | ✅ |
| CVE-2026-7769 — IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and… | High (8.1) | — | ✅ |
| CVE-2026-77967 — The Botslab G980H dash camera firmware accepts a reusable authentication value without… | High (8.1) | — | ✅ |
| CVE-2026-77977 — Ebyte gateway product's vendor configuration utility does not require authentication… | High (8.1) | — | ✅ |
| CVE-2026-78379 — Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon… | High (8.1) | — | ✅ |
| CVE-2026-78478 — The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to,… | High (8.1) | — | ✅ |
| CVE-2026-78562 — The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all… | High (8.1) | — | ✅ |
| CVE-2026-78566 — The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up… | High (8.1) | — | ✅ |
| CVE-2026-78572 — The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection in all… | High (8.1) | — | ✅ |
| CVE-2026-78583 — Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input… | High (8.1) | — | ✅ |
| CVE-2026-79746 — MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP… | High (8.1) | — | ✅ |
| CVE-2026-79957 — ServiceNext contains an insecure direct object reference (IDOR) in the… | High (8.1) | — | ✅ |
| CVE-2026-80192 — @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5… | High (8.1) | — | ✅ |
| CVE-2026-81029 — OpenMetadata accepts a caller-supplied post-authentication redirect target and appends… | High (8.1) | — | ✅ |
| CVE-2026-81035 — Midday allows any member of a team to delete it. | High (8.1) | — | ✅ |
| CVE-2026-81036 — Stalwart Mail Server does not compare an OAuth redirect target against any registered… | High (8.1) | — | ✅ |
| CVE-2026-81273 — Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | High (8.1) | — | ✅ |
| CVE-2026-81442 — Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper… | High (8.1) | — | ✅ |
| CVE-2026-81473 — Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper… | High (8.1) | — | ✅ |
| CVE-2026-81475 — Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing… | High (8.1) | — | ✅ |
| CVE-2026-81476 — Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper… | High (8.1) | — | ✅ |
| CVE-2026-81478 — Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of… | High (8.1) | — | ✅ |
| CVE-2026-81522 — A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers… | High (8.1) | — | ✅ |
| CVE-2026-81525 — The MongoDB client library for PHP does not sufficiently sanitize special elements in… | High (8.1) | — | ✅ |
| CVE-2026-81630 — The Botslab G980H dash camera firmware does not adequately verify the authenticity of… | High (8.1) | — | ✅ |
| CVE-2026-81728 — Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. | High (8.1) | — | ✅ |
| CVE-2026-81891 — elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. | High (8.1) | — | ✅ |
| CVE-2026-81892 — EasyAdmin is a fast and modern admin generator for Symfony applications. | High (8.1) | — | ✅ |
| CVE-2026-82228 — Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. | High (8.1) | — | ✅ |
| CVE-2026-82239 — Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST… | High (8.1) | — | ✅ |
| CVE-2026-82240 — Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the… | High (8.1) | — | ✅ |
| CVE-2026-82245 — Budibase before 3.41.3 fails to enforce role-based authorization on license management… | High (8.1) | — | ✅ |
| CVE-2026-82269 — Gophish through 0.12.1 fails to enforce account lockout and password change requirements… | High (8.1) | — | ✅ |
| CVE-2026-82279 — HyperDX through 1.10.1 fails to enforce role-based access controls in team management… | High (8.1) | — | ✅ |
| CVE-2026-82283 — VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers,… | High (8.1) | — | ✅ |
| CVE-2026-82284 — Quivr versions through 0.0.322 fail to validate chat ownership in the GET… | High (8.1) | — | ✅ |
| CVE-2026-82287 — Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers… | High (8.1) | — | ✅ |
| CVE-2026-82291 — HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while… | High (8.1) | — | ✅ |
| CVE-2026-82302 — Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration… | High (8.1) | — | ✅ |
| CVE-2026-82461 — pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or… | High (8.1) | — | ✅ |
| CVE-2026-82463 — pac4j-core before 6.5.6 contains an authentication bypass vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-82684 — Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing… | High (8.1) | — | ✅ |
| CVE-2026-83595 — AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php… | High (8.1) | — | ✅ |
| CVE-2026-8400 — IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server -… | High (8.1) | — | ✅ |
| CVE-2026-84189 — LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message)… | High (8.1) | — | ✅ |
| CVE-2026-84203 — Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes… | High (8.1) | — | ✅ |
| CVE-2026-84218 — A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation… | High (8.1) | — | ✅ |
| CVE-2026-84381 — HTTPX2 is a next generation HTTP client for Python. | High (8.1) | — | ✅ |
| CVE-2026-84504 — fastify versions before 5.12.2 treat the object resolved by a successful Ajv async… | High (8.1) | — | ✅ |
| CVE-2026-84779 — Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents… | High (8.1) | — | ✅ |
| CVE-2026-85160 — AVideo through commit c91b5975d contains a cross-site request forgery and path traversal… | High (8.1) | — | ✅ |
| CVE-2026-85214 — vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing… | High (8.1) | — | ✅ |
| CVE-2026-85388 — Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in… | High (8.1) | — | ✅ |
| CVE-2026-85410 — The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup… | High (8.1) | — | ✅ |
| CVE-2026-85427 — MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability… | High (8.1) | — | ✅ |
| CVE-2026-85625 — sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object… | High (8.1) | — | ✅ |
| CVE-2026-85660 — cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the… | High (8.1) | — | ✅ |
| CVE-2026-85694 — LaVague 0.2.35 contains a remote code execution vulnerability in… | High (8.1) | — | ✅ |
| CVE-2026-86117 — Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth… | High (8.1) | — | ✅ |
| CVE-2026-86242 — Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an… | High (8.1) | — | ✅ |
| CVE-2026-87004 — Tugtainer is a self-hosted app for automating updates of Docker containers. | High (8.1) | — | ✅ |
| CVE-2026-87036 — Tanium addressed an improper access controls vulnerability in Comply. | High (8.1) | — | ✅ |
| CVE-2026-87075 — Tanium addressed an improper access controls vulnerability in Comply. | High (8.1) | — | ✅ |
| CVE-2026-8789 — The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of… | High (8.1) | — | ✅ |
| CVE-2026-87935 — The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all… | High (8.1) | — | ✅ |
| CVE-2026-89413 — The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all… | High (8.1) | — | ✅ |
| CVE-2026-9196 — IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute… | High (8.1) | — | ✅ |
| CVE-2026-92154 — F´ (F Prime) is a framework that enables development and deployment of spaceflight and… | High (8.1) | — | ✅ |
| CVE-2026-92578 — WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored… | High (8.1) | — | ✅ |
| CVE-2026-92713 — The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable… | High (8.1) | — | ✅ |
| CVE-2026-92749 — SafeLine through 9.4.1 derives the management console session-signing secret from a… | High (8.1) | — | ✅ |
| CVE-2026-92751 — CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing… | High (8.1) | — | ✅ |
| CVE-2026-92763 — Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources… | High (8.1) | — | ✅ |
| CVE-2026-92776 — Wiki.js through 2.5.314 fails to require path separators when matching START and END page… | High (8.1) | — | ✅ |
| CVE-2026-92782 — Chroma through 1.5.9 fails to validate tenant and database segments when resolving… | High (8.1) | — | ✅ |
| CVE-2026-92785 — Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without… | High (8.1) | — | ✅ |
| CVE-2026-92793 — GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking… | High (8.1) | — | ✅ |
| CVE-2026-92806 — phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the… | High (8.1) | — | ✅ |
| CVE-2026-92820 — The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file… | High (8.1) | — | ✅ |
| CVE-2026-92914 — AVideo LoginControl contains an authentication bypass vulnerability in the PGP second… | High (8.1) | — | ✅ |
| CVE-2026-92919 — admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler,… | High (8.1) | — | ✅ |
| CVE-2026-92943 — Improper validation of certificate with host mismatch in the MQTT client TLS connection… | High (8.1) | — | ✅ |
| CVE-2026-92984 — HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request… | High (8.1) | — | ✅ |
| CVE-2026-9317 — Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC… | High (8.1) | — | ✅ |
| CVE-2026-93354 — Taskview Community before 1.56.0 contains a missing authentication vulnerability that… | High (8.1) | — | ✅ |
| CVE-2026-93393 — A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver… | High (8.1) | — | ✅ |
| CVE-2026-93445 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.1) | — | ✅ |
| CVE-2026-93479 — A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses… | High (8.1) | — | ✅ |
| CVE-2026-94505 — The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress… | High (8.1) | — | ✅ |
| CVE-2026-94611 — authentik is an open-source identity provider. | High (8.1) | — | ✅ |
| CVE-2026-97205 — NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. | High (8.1) | — | ✅ |
| CVE-2026-97296 — Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms… | High (8.1) | — | ✅ |
| CVE-2026-97674 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to… | High (8.1) | — | ✅ |
| CVE-2026-97875 — Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation,… | High (8.1) | — | ✅ |
| CVE-2026-100559 — OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped… | High (8.0) | — | ✅ |
| CVE-2026-100561 — OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an… | High (8.0) | — | ✅ |
CVE-2026-100585 — OpenClaw (npm package openclaw) before 2026.7.1 fails to enforce the owner-only… |
High (8.0) | — | ✅ |
| CVE-2026-100641 — SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before… | High (8.0) | — | ✅ |
| CVE-2026-100643 — SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values… | High (8.0) | — | ✅ |
| CVE-2026-100645 — SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in… | High (8.0) | — | ✅ |
| CVE-2026-100671 — Grav is a flat-file CMS. | High (8.0) | — | ✅ |
| CVE-2026-100683 — Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in… | High (8.0) | — | ✅ |
| CVE-2026-101152 — Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote,… | High (8.0) | — | ✅ |
| CVE-2026-101153 — On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path… | High (8.0) | — | ✅ |
| CVE-2026-103067 — Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership… | High (8.0) | — | ✅ |
| CVE-2026-103292 — Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data… | High (8.0) | — | ✅ |
| CVE-2026-103647 — Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5… | High (8.0) | — | ✅ |
| CVE-2026-104932 — The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version… | High (8.0) | — | ✅ |
| CVE-2026-105429 — Improper neutralization of special elements in the NetBird client SSH configuration… | High (8.0) | — | ✅ |
| CVE-2026-105816 — Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries… | High (8.0) | — | ✅ |
| CVE-2026-110450 — Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation… | High (8.0) | — | ✅ |
| CVE-2026-111095 — In JetBrains TeamCity before 2026.2, | High (8.0) | — | ✅ |
| CVE-2026-12703 — TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic… | High (8.0) | — | ✅ |
| CVE-2026-12736 — The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up… | High (8.0) | — | ✅ |
| CVE-2026-14951 — An low privileged remote attacker can cause authenticated users to perform unintended… | High (8.0) | — | ✅ |
| CVE-2026-15581 — A flaw was found in the TrustyAI Service (TAS) deployment. | High (8.0) | — | ✅ |
| CVE-2026-18599 — A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. | High (8.0) | — | ✅ |
| CVE-2026-24169 — NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an… | High (8.0) | — | ✅ |
| CVE-2026-30826 — Combodo iTop is a web based IT service management tool. | High (8.0) | — | ✅ |
| CVE-2026-30890 — Combodo iTop is a web based IT service management tool. | High (8.0) | — | ✅ |
| CVE-2026-31803 — Combodo iTop is a web based IT service management tool. | High (8.0) | — | ✅ |
| CVE-2026-31880 — Combodo iTop is a web based IT service management tool. | High (8.0) | — | ✅ |
| CVE-2026-32978 — OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run… | High (8.0) | Snort, YARA, Nginx, Apache, Sigma | ✅ |
| CVE-2026-35425 — Improper access control in Azure API Management (APIM) allows an authorized attacker to… | High (8.0) | — | ✅ |
| CVE-2026-40530 — An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API… | High (8.0) | — | ✅ |
| CVE-2026-45162 — Pimcore is an Open Source Data & Experience Management Platform. | High (8.0) | — | ✅ |
| CVE-2026-47858 — Starting Spring Boot applications in the Spring Tools with the live information mode… | High (8.0) | — | ✅ |
| CVE-2026-47873 — The Boot Dashboard Docker integration in Spring Tools publishes container control ports… | High (8.0) | — | ✅ |
| CVE-2026-48080 — OpenReception's appointment booking software provides an end-to-end encrypted appointment… | High (8.0) | — | ✅ |
| CVE-2026-49832 — DSpace open source software is a repository application which provides durable access to… | High (8.0) | — | ✅ |
| CVE-2026-52831 — Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. | High (8.0) | — | ✅ |
| CVE-2026-52833 — Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. | High (8.0) | — | ✅ |
| CVE-2026-53615 — util-linux is a random collection of Linux utilities. | High (8.0) | — | ✅ |
| CVE-2026-53932 — laravel-backup-restore restores database backups made with spatie/laravel-backup. | High (8.0) | — | ✅ |
| CVE-2026-58390 — OPNsense is a FreeBSD based firewall and routing platform. | High (8.0) | — | ✅ |
| CVE-2026-59307 — An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict… | High (8.0) | — | ✅ |
| CVE-2026-59680 — An OS command injection vulnerability was found in yast2-users. | High (8.0) | — | ✅ |
| CVE-2026-59689 — An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection… | High (8.0) | — | ✅ |
| CVE-2026-59690 — A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection… | High (8.0) | — | ✅ |
| CVE-2026-60371 — Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… | High (8.0) | — | ✅ |
| CVE-2026-60961 — Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware… | High (8.0) | — | ✅ |
| CVE-2026-60998 — Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion… | High (8.0) | — | ✅ |
| CVE-2026-62215 — OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP… | High (8.0) | — | ✅ |
| CVE-2026-62602 — Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion… | High (8.0) | — | ✅ |
| CVE-2026-68772 — ZenML 0.94.6 contains a remote code execution vulnerability in the… | High (8.0) | — | ✅ |
| CVE-2026-70454 — rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode)… | High (8.0) | — | ✅ |
| CVE-2026-70690 — Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US… | High (8.0) | — | ✅ |
| CVE-2026-70802 — Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business… | High (8.0) | — | ✅ |
| CVE-2026-71122 — Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle… | High (8.0) | — | ✅ |
| CVE-2026-71279 — Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a… | High (8.0) | — | ✅ |
| CVE-2026-71312 — rclone is a command-line program to sync files and directories to and from different… | High (8.0) | — | ✅ |
| CVE-2026-75486 — Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an… | High (8.0) | — | ✅ |
| CVE-2026-75941 — A potential vulnerability was reported in the Lenovo Legion Zone application, distributed… | High (8.0) | — | ✅ |
| CVE-2026-76139 — A flaw was found in acm-operator-bundle. | High (8.0) | — | ✅ |
| CVE-2026-77586 — In MongoDB Connector for BI, MongoDB object names such as collection, field, and index… | High (8.0) | — | ✅ |
| CVE-2026-78414 — Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS… | High (8.0) | — | ✅ |
| CVE-2026-78428 — For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can… | High (8.0) | — | ✅ |
| CVE-2026-79662 — Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in… | High (8.0) | — | ✅ |
| CVE-2026-79755 — Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. | High (8.0) | — | ✅ |
| CVE-2026-79824 — A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to… | High (8.0) | — | ✅ |
| CVE-2026-82282 — Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing… | High (8.0) | — | ✅ |
| CVE-2026-84665 — Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the… | High (8.0) | — | ✅ |
| CVE-2026-85012 — Improper neutralization of special elements used in an OS command (CWE-78) in the… | High (8.0) | — | ✅ |
| CVE-2026-85469 — A flaw was found in quay-builder-qemu. | High (8.0) | — | ✅ |
| CVE-2026-86140 — In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer… | High (8.0) | — | ✅ |
| CVE-2026-86185 — Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and… | High (8.0) | — | ✅ |
| CVE-2026-89069 — Improper neutralization of input during web page generation ('cross-site scripting')… | High (8.0) | — | ✅ |
| CVE-2026-93953 — The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to… | High (8.0) | — | ✅ |
| CVE-2026-96956 — Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate… | High (8.0) | — | ✅ |
| CVE-2026-97735 — ITFlow before 26.08 allows SVG attachments in the ticket email parser… | High (8.0) | — | ✅ |
| CVE-2026-43284 — DirtyFrag: Linux Kernel ESP Page-Cache Write LPE | High (7.8) | — | ✅ |
| CVE-2026-43500 — DirtyFrag: Linux Kernel RxRPC Page-Cache Write LPE | High (7.8) | — | ✅ |
| CVE-2026-19685 — NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and… | High (7.1) | — | ✅ |
CVE-2026-46333 — In the Linux kernel, a vulnerability exists in the ptrace subsystem's get_dumpable()… |
High (7.1) | Snort, Sigma | ✅ |
| CVE-2026-19429 — Jenkins FilePath.untarFrom() in all versions, including those with the CVE-2026-33001… | Medium (6.5) | — | ✅ |
| CVE-2026-6579 — A weakness has been identified in liangliangyy DjangoBlog up to 2.1.0.0. | Medium (6.5) | — | ✅ |
| CVE-2026-107450 — In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations… | Medium (5.4) | — | ✅ |
| CVE-2026-101956 — An Improper Authentication vulnerability in the J-Web web management component of Juniper… | Unrated | — | ✅ |
| CVE-2026-102095 — Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side… | Unrated | — | ✅ |
| CVE-2026-103668 — An SQL Injection vulnerability exists in the Site Search function of Movable Type, which… | Unrated | — | ✅ |
| CVE-2026-109901 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Unrated | — | ✅ |
| CVE-2026-1281 — A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve… | Unrated | — | ✅ |
| CVE-2026-13308 — Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution… | Unrated | — | ✅ |
| CVE-2026-14364 — The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is… | Unrated | — | ✅ |
| CVE-2026-14980 — IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to… | Unrated | — | ✅ |
| CVE-2026-15265 — A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a… | Unrated | — | ✅ |
| CVE-2026-15484 — A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. | Unrated | — | ✅ |
| CVE-2026-15560 — when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR… | Unrated | — | ✅ |
| CVE-2026-16870 — Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2… | Unrated | — | ✅ |
| CVE-2026-18210 — Improper neutralization of special elements used in an SQL command ('SQL injection')… | Unrated | — | ✅ |
| CVE-2026-18264 — NoMachine getstat Command Injection Remote Code Execution Vulnerability. | Unrated | — | ✅ |
| CVE-2026-18265 — OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. | Unrated | — | ✅ |
| CVE-2026-18279 — Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. | Unrated | — | ✅ |
| CVE-2026-18281 — Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution… | Unrated | — | ✅ |
| CVE-2026-18282 — Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution… | Unrated | — | ✅ |
| CVE-2026-18613 — A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. | Unrated | — | ✅ |
| CVE-2026-28184 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering… | Unrated | — | ✅ |
| CVE-2026-44986 — Penpot is an open-source design tool for design and code collaboration. | Unrated | — | ✅ |
| CVE-2026-51274 — In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 SYLT… | Unrated | — | ✅ |
| CVE-2026-51275 — In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC… | Unrated | — | ✅ |
| CVE-2026-52887 — NocoBase is an AI-powered no-code/low-code platform for building business applications… | Unrated | — | ✅ |
| CVE-2026-5490 — DriveLock SQL Injection Privilege Escalation Vulnerability. | Unrated | — | ✅ |
| CVE-2026-57092 — Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges… | Unrated | — | ✅ |
| CVE-2026-58066 — Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7,… | Unrated | — | ✅ |
| CVE-2026-58096 — LcpDecodeConfig() did not validate the length of received endpoint discriminator options… | Unrated | — | ✅ |
| CVE-2026-61843 — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and… | Unrated | — | ✅ |
| CVE-2026-62203 — OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability… | Unrated | — | ✅ |
| CVE-2026-62928 — XING CPTrans-ME-X contains an OS Command Injection (CWE-78). | Unrated | — | ✅ |
| CVE-2026-63587 — The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS… | Unrated | — | ✅ |
| CVE-2026-64637 — Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an… | Unrated | — | ✅ |
| CVE-2026-65084 — NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an… | Unrated | — | ✅ |
| CVE-2026-68062 — SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. | Unrated | — | ✅ |
| CVE-2026-68959 — SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. | Unrated | — | ✅ |
| CVE-2026-68960 — A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT… | Unrated | — | ✅ |
| CVE-2026-69096 — OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode… | Unrated | — | ✅ |
| CVE-2026-69657 — XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). | Unrated | — | ✅ |
| CVE-2026-70403 — XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). | Unrated | — | ✅ |
| CVE-2026-70408 — An incorrect authorization vulnerability exists in acmailer, which may allow a user to… | Unrated | — | ✅ |
| CVE-2026-70846 — Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component:… | Unrated | — | ✅ |
| CVE-2026-71993 — MSI Radix AXE6600 router firmware version v781521 contains a command injection… | Unrated | — | ✅ |
| CVE-2026-72740 — Dokploy is a free, self-hostable Platform as a Service (PaaS). | Unrated | — | ✅ |
| CVE-2026-73034 — DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote… | Unrated | — | ✅ |
| CVE-2026-73682 — Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection)… | Unrated | — | ✅ |
| CVE-2026-73790 — A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system… | Unrated | — | ✅ |
| CVE-2026-73843 — OpenChoreo is a complete, open-source developer platform for Kubernetes. | Unrated | — | ✅ |
| CVE-2026-74791 — Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when… | Unrated | — | ✅ |
| CVE-2026-78032 — SOY CMS contains an issue with deserialization of untrusted data. | Unrated | — | ✅ |
| CVE-2026-82475 — iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the… | Unrated | — | ✅ |
| CVE-2026-82549 — A vulnerability was identified in Linux Foundation Magma 1.9.0. | Unrated | — | ✅ |
| CVE-2026-84370 — SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… | Unrated | — | ✅ |
| CVE-2026-84796 — Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL… | Unrated | — | ✅ |
| CVE-2026-85617 — snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk… | Unrated | — | ✅ |
| CVE-2026-89068 — Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP… | Unrated | — | ✅ |
| CVE-2026-92783 — Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id}… | Unrated | — | ✅ |
| CVE-2026-93029 — There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage… | Unrated | — | ✅ |
| CVE-2026-93697 — There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass… | Unrated | — | ✅ |
| CVE-2026-93698 — Insufficient validation allows arbitrary commands to be executed via the Multilang… | Unrated | — | ✅ |
| CVE-2026-96408 — A code injection vulnerability exists in the upgrade script of Movable Type, which may… | Unrated | — | ✅ |