| CVE-2026-48486 | 7.5 | — | — | — | — | Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus | 56d ago |
| CVE-2026-85182 | 7.5 | — | — | — | — | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticat | 56d ago |
| CVE-2026-85180 | 7.5 | — | — | — | — | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attacker | 56d ago |
| CVE-2026-85155 | 7.5 | — | — | — | — | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with | 56d ago |
| CVE-2026-85150 | 7.5 | — | — | — | — | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. | 56d ago |
| CVE-2026-85124 | 7.5 | — | — | — | — | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segm | 56d ago |
| CVE-2026-84851 | 7.5 | — | — | — | — | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthentic | 56d ago |
| CVE-2026-84394 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. | 56d ago |
| CVE-2026-84292 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri serializes the port component of a URI without validating it. | 57d ago |
| CVE-2026-78662 | 7.5 | — | — | — | golang / crypto | Previously, a channel registered in the mux's chanList is not usable until it is established. | 57d ago |
| CVE-2026-56855 | 7.5 | — | — | — | golang / crypto | Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock | 57d ago |
| CVE-2026-84382 | 7.5 | — | — | — | — | HTTPX2 is a next generation HTTP client for Python. | 57d ago |
| CVE-2026-20281 | 7.5 | — | — | — | — | A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 t | 57d ago |
| CVE-2026-78222 | 7.5 | — | — | — | — | A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NG | 57d ago |
| CVE-2026-18058 | 7.5 | — | — | — | — | The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. | 57d ago |
| CVE-2026-81774 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions. | 57d ago |
| CVE-2026-18672 | 7.5 | — | — | — | — | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadIma | 57d ago |
| CVE-2026-77792 | 7.5 | — | — | — | — | The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outpu | 57d ago |
| CVE-2026-14957 | 7.5 | — | — | — | — | In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is | 57d ago |
| CVE-2026-84485 | 7.5 | — | — | — | — | APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, all | 57d ago |
| CVE-2026-84484 | 7.5 | — | — | — | — | ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows u | 57d ago |
| CVE-2026-84702 | 7.5 | — | — | — | — | facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write file | 57d ago |
| CVE-2026-81928 | 7.5 | — | — | — | — | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encodin | 57d ago |
| CVE-2026-84476 | 7.5 | — | — | — | — | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing att | 57d ago |
| CVE-2026-84208 | 7.5 | — | — | — | — | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's | 57d ago |
| CVE-2026-84642 | 7.5 | — | — | — | mozilla / thunderbird | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression with | 57d ago |
| CVE-2026-84641 | 7.5 | — | — | — | mozilla / thunderbird | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. | 57d ago |
| CVE-2026-84640 | 7.5 | — | — | — | mozilla / thunderbird | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. | 57d ago |
| CVE-2026-84375 | 7.5 | — | — | — | — | js-yaml is a JavaScript YAML parser and dumper. | 57d ago |
| CVE-2026-84374 | 7.5 | — | — | — | — | Laravel Excel provides supercharged Excel exports and imports in Laravel. | 57d ago |
| CVE-2026-73773 | 7.5 | — | — | — | hpe / arubaos-cx | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. | 57d ago |
| CVE-2026-73771 | 7.5 | — | — | — | hpe / arubaos-cx | An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authenti | 57d ago |
| CVE-2026-73717 | 7.5 | — | — | — | arubanetworks / fabric composer | A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer t | 58d ago |
| CVE-2026-73716 | 7.5 | — | — | — | arubanetworks / fabric composer | A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer | 58d ago |
| CVE-2026-73715 | 7.5 | — | — | — | arubanetworks / fabric composer | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to con | 58d ago |
| CVE-2026-52132 | 7.5 | — | — | — | ggml / llama.cpp | llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denia | 58d ago |
| CVE-2026-52131 | 7.5 | — | — | — | ggml / llama.cpp | llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. | 58d ago |
| CVE-2026-52130 | 7.5 | — | — | — | ggml / llama.cpp | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting | 58d ago |
| CVE-2026-52022 | 7.5 | — | — | — | kamailio / kamailio | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF r | 58d ago |
| CVE-2026-51788 | 7.5 | — | — | — | — | An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verific | 58d ago |
| CVE-2026-51768 | 7.5 | — | — | — | — | Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 58d ago |
| CVE-2026-49329 | 7.5 | — | — | — | — | A flaw was found in openshift/oauth-server. | 58d ago |
| CVE-2026-18771 | 7.5 | — | — | — | — | Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. | 58d ago |
| CVE-2026-51766 | 7.5 | — | — | — | — | Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 58d ago |
| CVE-2026-84145 | 7.5 | — | — | — | mozilla / firefox | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. | 58d ago |
| CVE-2026-84144 | 7.5 | — | — | — | mozilla / firefox | Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. | 58d ago |
| CVE-2026-84132 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Networking: HTTP component. | 58d ago |
| CVE-2026-84130 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Graphics: WebGPU component. | 58d ago |
| CVE-2026-25706 | 7.5 | — | — | — | — | Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who con | 58d ago |
| CVE-2026-19952 | 7.5 | — | — | — | — | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient | 58d ago |
| CVE-2026-82397 | 7.5 | — | — | — | — | Tornado is a Python web framework and asynchronous networking library. | 58d ago |
| CVE-2026-82393 | 7.5 | — | — | — | — | pnpm is a package manager. | 58d ago |
| CVE-2026-81297 | 7.5 | — | — | — | — | Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | 58d ago |
| CVE-2026-81296 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | 58d ago |
| CVE-2026-79407 | 7.5 | — | — | — | — | A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files vi | 58d ago |
| CVE-2026-54598 | 7.5 | — | — | — | — | Wallos is an open-source, self-hostable personal subscription tracker. | 58d ago |
| CVE-2026-51735 | 7.5 | — | — | — | — | Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 59d ago |
| CVE-2026-17615 | 7.5 | — | — | — | — | A flaw was found in RESTEasy's SourceProvider. | 59d ago |
| CVE-2026-75133 | 7.5 | — | — | — | — | Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that a | 59d ago |
| CVE-2026-51719 | 7.5 | — | — | — | — | Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 59d ago |
