| CVE-2026-26445 | 7.5 | — | — | — | — | stomper 5e2741e is vulnerable to Denial of Service. | 63d ago |
| CVE-2026-36851 | 7.5 | — | — | — | — | Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration | 64d ago |
| CVE-2025-61164 | 7.5 | — | — | — | — | Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. | 64d ago |
| CVE-2025-61162 | 7.5 | — | — | — | — | Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a craft | 64d ago |
| CVE-2026-80588 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX | 64d ago |
| CVE-2026-80527 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale | 64d ago |
| CVE-2026-80520 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missin | 64d ago |
| CVE-2026-74750 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workque | 64d ago |
| CVE-2026-74745 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ a | 64d ago |
| CVE-2026-74742 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer tx | 64d ago |
| CVE-2026-74741 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non | 64d ago |
| CVE-2026-73108 | 7.5 | — | — | — | — | RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. | 64d ago |
| CVE-2026-19271 | 7.5 | — | — | — | — | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLG | 64d ago |
| CVE-2026-15990 | 7.5 | — | — | — | — | The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi | 64d ago |
| CVE-2026-80205 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and Tok | 64d ago |
| CVE-2026-80347 | 7.5 | — | — | — | — | mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal | 64d ago |
| CVE-2026-16444 | 7.5 | — | — | — | — | Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an | 64d ago |
| CVE-2026-18884exploited | 7.5 | 0.54% | 1/3 | +15d | — | The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' G | 64d ago |
| CVE-2026-74928 | 7.5 | — | — | — | — | The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allo | 64d ago |
| CVE-2026-80198 | 7.5 | — | — | — | — | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates | 64d ago |
| CVE-2026-80196 | 7.5 | — | — | — | — | Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after | 64d ago |
| CVE-2026-80191 | 7.5 | — | — | — | — | GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticat | 64d ago |
| CVE-2026-18259 | 7.5 | — | — | — | — | Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. | 64d ago |
| CVE-2026-68763 | 7.5 | — | — | — | apache / tomcat | Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog trac | 64d ago |
| CVE-2026-65927 | 7.5 | — | — | — | apache / tomcat | Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite proces | 64d ago |
| CVE-2026-79216 | 7.5 | — | — | — | google / chrome | Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the | 64d ago |
| CVE-2026-79139 | 7.5 | — | — | — | google / chrome | Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker | 64d ago |
| CVE-2026-79083 | 7.5 | — | — | — | google / chrome | Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote atta | 64d ago |
| CVE-2026-78915 | 7.5 | — | — | — | google / chrome | Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to | 64d ago |
| CVE-2026-78906 | 7.5 | — | — | — | google / chrome | Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute a | 64d ago |
| CVE-2026-78901 | 7.5 | — | — | — | google / chrome | Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code i | 64d ago |
| CVE-2026-75465 | 7.5 | — | — | — | — | The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control iss | 64d ago |
| CVE-2026-65097 | 7.5 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a do | 64d ago |
| CVE-2026-74932 | 7.5 | — | — | — | — | The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the | 64d ago |
| CVE-2026-55099 | 7.5 | — | — | — | — | icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. | 64d ago |
| CVE-2026-55620 | 7.5 | — | — | — | — | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail a | 65d ago |
| CVE-2026-71443 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an applicat | 65d ago |
| CVE-2026-71442 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result i | 65d ago |
| CVE-2026-71360 | 7.5 | — | — | — | — | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to appli | 65d ago |
| CVE-2026-55553 | 7.5 | — | — | — | — | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features | 65d ago |
| CVE-2026-19913 | 7.5 | — | — | — | — | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper valid | 65d ago |
| CVE-2026-79770 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector t | 65d ago |
| CVE-2023-54354 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which | 65d ago |
| CVE-2022-50998 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected | 65d ago |
| CVE-2021-47996 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9 | 65d ago |
| CVE-2026-55525 | 7.5 | — | — | — | — | PraisonAI is a multi-agent teams system. | 65d ago |
| CVE-2026-63076 | 7.5 | — | — | — | — | Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter | 65d ago |
| CVE-2026-63075 | 7.5 | — | — | — | — | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while n | 65d ago |
| CVE-2026-63072 | 7.5 | — | — | — | — | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, | 65d ago |
| CVE-2026-54874 | 7.5 | — | — | — | — | Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffe | 65d ago |
| CVE-2026-18798 | 7.5 | — | — | — | — | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initi | 65d ago |
| CVE-2026-14457 | 7.5 | — | — | — | — | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the priva | 65d ago |
| CVE-2026-79658 | 7.5 | — | — | — | — | Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n midd | 65d ago |
| CVE-2026-67578 | 7.5 | — | — | — | — | FA-50 all versions miss authentication for some configuration. | 65d ago |
| CVE-2026-78682 | 7.5 | — | — | — | nltk / nltk | NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk. | 65d ago |
| CVE-2026-78681 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declar | 65d ago |
| CVE-2026-78677 | 7.5 | — | — | — | gitpython project / gitpython | GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbit | 65d ago |
| CVE-2026-76846 | 7.5 | — | — | — | — | Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block a | 65d ago |
| CVE-2026-72700 | 7.5 | — | — | — | — | The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account acti | 65d ago |
| CVE-2026-56709 | 7.5 | — | — | — | — | Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing | 65d ago |
