| CVE-2026-51716 | 7.5 | — | — | — | — | Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthent | 59d ago |
| CVE-2026-51695 | 7.5 | — | — | — | — | Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 59d ago |
| CVE-2026-51694 | 7.5 | — | — | — | — | Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenti | 59d ago |
| CVE-2026-51688 | 7.5 | — | — | — | — | Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica | 59d ago |
| CVE-2026-76763 | 7.5 | — | — | — | — | A flaw was found in SmallRye GraphQL. | 59d ago |
| CVE-2026-51673 | 7.5 | — | — | — | — | Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att | 59d ago |
| CVE-2026-51671 | 7.5 | — | — | — | — | Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauth | 59d ago |
| CVE-2026-51668 | 7.5 | — | — | — | — | Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate | 59d ago |
| CVE-2026-19616 | 7.5 | — | — | — | — | Missing Authorization vulnerability in TBC Technology Inc. | 59d ago |
| CVE-2026-71257 | 7.5 | — | — | — | apache / wicket | Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request wi | 59d ago |
| CVE-2026-82880 | 7.5 | — | — | — | — | YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and Ope | 59d ago |
| CVE-2026-19873 | 7.5 | — | — | — | — | HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query | 59d ago |
| CVE-2026-82861 | 7.5 | — | — | — | — | @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit | 59d ago |
| CVE-2026-81624 | 7.5 | — | — | — | — | Undertow is a flexible performant web server used in JBoss EAP and WildFly. | 59d ago |
| CVE-2026-56718 | 7.5 | — | — | — | — | AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd w | 59d ago |
| CVE-2026-82657 | 7.5 | — | — | — | — | Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announce | 60d ago |
| CVE-2026-82655 | 7.5 | — | — | — | — | Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_sh | 60d ago |
| CVE-2026-82644 | 7.5 | — | — | — | — | WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), whi | 60d ago |
| CVE-2026-82639 | 7.5 | — | — | — | — | NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoin | 60d ago |
| CVE-2026-82638 | 7.5 | — | — | — | — | jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attac | 60d ago |
| CVE-2026-75807 | 7.5 | — | — | — | — | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, | 61d ago |
| CVE-2026-82472 | 7.5 | — | — | — | — | Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentic | 61d ago |
| CVE-2026-82453 | 7.5 | — | — | — | — | rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. | 61d ago |
| CVE-2026-77007 | 7.5 | — | — | — | — | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authori | 61d ago |
| CVE-2026-76586 | 7.5 | — | — | — | — | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the am | 61d ago |
| CVE-2026-55841 | 7.5 | — | — | — | — | Graylog is a free and open log management platform. | 61d ago |
| CVE-2026-55784 | 7.5 | — | — | — | — | free5GC is an open-source implementation of the 5G core network. | 61d ago |
| CVE-2026-82333 | 7.5 | — | — | — | expressjs / multer | multer is a middleware for handling multipart/form-data in Node.js. | 61d ago |
| CVE-2026-81520 | 7.5 | — | — | — | — | A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication sessi | 61d ago |
| CVE-2026-81518 | 7.5 | — | — | — | — | When mongosqld is configured with a client certificate authority file, the listener requests a client certificate | 61d ago |
| CVE-2026-81517 | 7.5 | — | — | — | — | An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate en | 61d ago |
| CVE-2026-77078 | 7.5 | — | — | — | expressjs / multer | multer is a middleware for handling multipart/form-data in Node.js. | 61d ago |
| CVE-2026-77037 | 7.5 | — | — | — | expressjs / multer | multer is a middleware for handling multipart/form-data in Node.js. | 61d ago |
| CVE-2026-51662 | 7.5 | — | — | — | — | Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauth | 61d ago |
| CVE-2026-18899 | 7.5 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal. | 61d ago |
| CVE-2026-17203 | 7.5 | — | — | — | — | IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive info | 61d ago |
| CVE-2026-82288 | 7.5 | — | — | — | — | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags en | 62d ago |
| CVE-2026-82275 | 7.5 | — | — | — | — | Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict fi | 62d ago |
| CVE-2026-82270 | 7.5 | — | — | — | — | Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route th | 62d ago |
| CVE-2026-82268 | 7.5 | — | — | — | — | Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that t | 62d ago |
| CVE-2026-75124 | 7.5 | — | — | — | — | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability | 62d ago |
| CVE-2026-55584 | 7.5 | — | — | — | — | phpSysInfo is a customizable PHP script that displays system information. | 62d ago |
| CVE-2026-55552 | 7.5 | — | — | — | — | Yamcs is a mission control framework. | 62d ago |
| CVE-2026-55484 | 7.5 | — | — | — | — | ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. | 62d ago |
| CVE-2026-55215 | 7.5 | — | — | — | — | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. | 62d ago |
| CVE-2026-54788 | 7.5 | — | — | — | — | dd-trace-rs provides Datadog application performance monitoring for Rust. | 62d ago |
| CVE-2026-51659 | 7.5 | — | — | — | — | Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 62d ago |
| CVE-2026-51658 | 7.5 | — | — | — | — | Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att | 62d ago |
| CVE-2026-51650 | 7.5 | — | — | — | — | Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 62d ago |
| CVE-2026-51648 | 7.5 | — | — | — | — | Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 62d ago |
| CVE-2026-51647 | 7.5 | — | — | — | — | Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 62d ago |
| CVE-2026-51644 | 7.5 | — | — | — | — | Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 62d ago |
| CVE-2026-51642 | 7.5 | — | — | — | — | Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthent | 62d ago |
| CVE-2026-51641 | 7.5 | — | — | — | — | Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 62d ago |
| CVE-2026-51627 | 7.5 | — | — | — | — | Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 62d ago |
| CVE-2026-51625 | 7.5 | — | — | — | — | Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate | 62d ago |
| CVE-2026-51624 | 7.5 | — | — | — | — | Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 62d ago |
| CVE-2026-51623 | 7.5 | — | — | — | — | Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 62d ago |
| CVE-2026-51621 | 7.5 | — | — | — | — | Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 62d ago |
| CVE-2026-51620 | 7.5 | — | — | — | — | Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 62d ago |
