| CVE-2026-65532 | 7.6 | — | — | — | — | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | 98d ago |
| CVE-2026-65462 | 7.6 | — | — | — | — | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | 98d ago |
| CVE-2026-62518 | 7.6 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operatio | 100d ago |
| CVE-2026-62515 | 7.6 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (component: Intern | 100d ago |
| CVE-2026-61325 | 7.6 | — | — | — | oracle / advanced benefits | Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). | 100d ago |
| CVE-2026-61181 | 7.6 | — | — | — | oracle / agile product lifecycle management for process | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (compone | 100d ago |
| CVE-2026-61132 | 7.6 | — | — | — | oracle / commerce platform | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework) | 100d ago |
| CVE-2026-60886 | 7.6 | — | — | — | oracle / work in process | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). | 100d ago |
| CVE-2026-60642 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 100d ago |
| CVE-2026-60641 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 100d ago |
| CVE-2026-60584 | 7.6 | — | — | — | oracle / transportation management | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: CSV Management). | 100d ago |
| CVE-2026-60578 | 7.6 | — | — | — | oracle / enterprise command center framework | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor | 100d ago |
| CVE-2026-60528 | 7.6 | — | — | — | oracle / weblogic server | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). | 100d ago |
| CVE-2026-60522 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 100d ago |
| CVE-2026-10680 | 7.6 | — | — | — | zephyrproject / zephyr | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host | 100d ago |
| CVE-2026-47414 | 7.6 | — | — | — | — | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. | 100d ago |
| CVE-2026-55544 | 7.6 | — | — | — | — | NextCRM is open-source customer relationship management (CRM) software. | 101d ago |
| CVE-2026-46701 | 7.6 | — | — | — | network-ai / network-ai | Network-AI is a TypeScript/Node.js multi-agent orchestrator. | 101d ago |
| CVE-2026-63869 | 7.6 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index i | 102d ago |
| CVE-2025-71398 | 7.6 | — | — | — | surrealdb / surrealdb | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass | 103d ago |
| CVE-2026-52870 | 7.6 | — | — | — | lfprojects / mcp python sdk | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). | 106d ago |
| CVE-2026-45337 | 7.6 | — | — | — | better-auth / better auth | Better Auth is an authentication and authorization library for TypeScript. | 106d ago |
| CVE-2026-50147 | 7.6 | — | — | — | metabase / metabase | Metabase is an open-source business intelligence and embedded analytics tool. | 106d ago |
| CVE-2026-54560 | 7.6 | — | — | — | — | Cloudreve is a self-hosted file management and sharing system. | 106d ago |
| CVE-2026-58233 | 7.6 | — | — | — | — | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially cra | 107d ago |
| CVE-2026-62186 | 7.6 | — | — | — | openclaw / openclaw | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model ov | 108d ago |
| CVE-2026-62185 | 7.6 | — | — | — | — | Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to ac | 108d ago |
| CVE-2026-61955 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویت | 108d ago |
| CVE-2026-57773 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanc | 108d ago |
| CVE-2026-55405 | 7.6 | — | — | — | — | LangChain4j is a Java library for building LLM-powered applications on the JVM. | 111d ago |
| CVE-2026-57985 | 7.6 | — | — | — | microsoft / edge chromium | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over | 118d ago |
| CVE-2026-13707 | 7.6 | — | — | — | mediawiki / mediawiki | Session fixation vulnerability in Wikimedia Foundation OAuth. | 120d ago |
| CVE-2026-6688 | 7.6 | — | — | — | elm-chan / fatfs | FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename hand | 120d ago |
| CVE-2026-6687 | 7.6 | — | — | — | elm-chan / fatfs | FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is | 120d ago |
| CVE-2026-6682 | 7.6 | — | — | — | elm-chan / fatfs | In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can w | 120d ago |
| CVE-2026-7831 | 7.6 | — | — | — | uvnc / ultravnc | UltraVNC viewer through 1.8.2.2 contains an off-by-one stack buffer overflow in the RFB ServerInit message handler. | 120d ago |
| CVE-2026-56249 | 7.6 | — | — | — | — | Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows | 120d ago |
| CVE-2026-13449 | 7.6 | — | — | — | ibm / business automation manager | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injectio | 121d ago |
| CVE-2026-58376 | 7.6 | — | — | — | — | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated | 121d ago |
| CVE-2026-58056 | 7.6 | — | — | — | — | RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connectio | 123d ago |
| CVE-2026-57631 | 7.6 | — | — | — | — | Administrator SQL Injection in Popup box <= 6.0.1 versions. | 125d ago |
| CVE-2026-57628 | 7.6 | — | — | — | — | Administrator SQL Injection in WP All Import <= 4.0.1 versions. | 125d ago |
| CVE-2026-54826 | 7.6 | — | — | — | — | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. | 125d ago |
| CVE-2026-39951 | 7.6 | — | — | — | cacti / cacti | Cacti is an open source performance and fault management framework. | 126d ago |
| CVE-2026-11998 | 7.6 | — | — | — | — | A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URL | 127d ago |
| CVE-2026-55583 | 7.6 | — | — | — | — | Twenty is an open-source CRM (customer relationship management) platform. | 127d ago |
| CVE-2026-56231 | 7.6 | — | — | — | — | Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/: | 127d ago |
| CVE-2026-56052 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Fu | 127d ago |
| CVE-2026-54317 | 7.6 | — | — | — | home-assistant / home-assistant | Home Assistant is open source home automation software that puts local control and privacy first. | 128d ago |
| CVE-2026-54013 | 7.6 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 128d ago |
| CVE-2026-55409 | 7.6 | — | — | — | — | Filament is a collection of full-stack components for accelerated Laravel development. | 129d ago |
| CVE-2026-56239 | 7.6 | — | — | — | — | Capgo before 12.128.2 contains a potential privilege escalation vulnerability in the public.apply_usage_overage SE | 130d ago |
| CVE-2026-56208 | 7.6 | — | — | — | — | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. | 132d ago |
| CVE-2026-46699 | 7.6 | — | — | — | — | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services i | 133d ago |
| CVE-2026-55746 | 7.6 | — | — | — | — | Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File S | 133d ago |
| CVE-2026-54804 | 7.6 | — | — | — | — | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | 134d ago |
| CVE-2026-39546 | 7.6 | — | — | — | — | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. | 134d ago |
| CVE-2026-35327 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 134d ago |
| CVE-2026-52712 | 7.6 | — | — | — | — | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. | 135d ago |
| CVE-2026-53705 | 7.6 | — | — | — | — | A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. | 136d ago |
