| CVE-2026-66766 | 7.5 | — | — | — | — | SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReD | 65d ago |
| CVE-2026-78268 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Cal | 65d ago |
| CVE-2026-77384 | 7.5 | — | — | — | — | libp2p is a JavaScript implementation of the libp2p networking stack. | 65d ago |
| CVE-2026-76098 | 7.5 | — | — | — | — | Mistune is a Python Markdown parser with renderers and plugins. | 65d ago |
| CVE-2026-75368 | 7.5 | — | — | — | — | A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to | 65d ago |
| CVE-2026-75371 | 7.5 | — | — | — | — | An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physi | 66d ago |
| CVE-2026-71922 | 7.5 | — | — | — | — | Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the set | 66d ago |
| CVE-2026-66908 | 7.5 | — | — | — | apache / camel | Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. | 66d ago |
| CVE-2026-66907 | 7.5 | — | — | — | apache / camel | Relative path traversal vulnerability in Apache Camel Google Storage component. | 66d ago |
| CVE-2026-21752 | 7.5 | — | — | — | — | HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized acce | 66d ago |
| CVE-2025-68825 | 7.5 | — | — | — | — | HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, | 66d ago |
| CVE-2026-66585 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | 66d ago |
| CVE-2026-28167zero day | 7.5 | 0.50% | 1/3 | same day | — | Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions. | 66d ago |
| CVE-2026-28153 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, | 66d ago |
| CVE-2026-76172 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 66d ago |
| CVE-2026-75975 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 66d ago |
| CVE-2026-75931 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 66d ago |
| CVE-2026-75899 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 66d ago |
| CVE-2026-78212 | 7.5 | — | — | — | — | 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. | 66d ago |
| CVE-2026-78208 | 7.5 | — | — | — | — | exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to va | 66d ago |
| CVE-2026-78206 | 7.5 | — | — | — | — | exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry siz | 66d ago |
| CVE-2026-9769 | 7.5 | — | — | — | — | justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. | 67d ago |
| CVE-2026-4671 | 7.5 | — | — | — | — | justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkifi | 67d ago |
| CVE-2026-47895 | 7.5 | — | — | — | — | In strongSwan before 6.0.7, identity parsing/cloning is mishandled. | 67d ago |
| CVE-2026-74717 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create err | 68d ago |
| CVE-2026-74696 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reusep | 68d ago |
| CVE-2026-74695 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb ds | 68d ago |
| CVE-2026-74692 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_ou | 68d ago |
| CVE-2026-74678 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax8817 | 68d ago |
| CVE-2026-74626 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on al | 68d ago |
| CVE-2026-74625 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non- | 68d ago |
| CVE-2026-74624 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log unt | 68d ago |
| CVE-2026-74621 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the h | 68d ago |
| CVE-2026-74598 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length vali | 68d ago |
| CVE-2026-66393 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that all | 68d ago |
| CVE-2026-63312 | 7.5 | — | — | — | nltk / nltk | NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pat | 68d ago |
| CVE-2026-62388 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to e | 68d ago |
| CVE-2026-62384 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers t | 68d ago |
| CVE-2026-2996 | 7.5 | — | — | — | — | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input V | 68d ago |
| CVE-2026-62380 | 7.5 | — | — | — | netty / netty | Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final conta | 68d ago |
| CVE-2026-62243 | 7.5 | — | — | — | — | Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final d | 68d ago |
| CVE-2026-59256 | 7.5 | — | — | — | — | WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens | 68d ago |
| CVE-2026-77781 | 7.5 | — | — | — | — | Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. | 68d ago |
| CVE-2026-76905 | 7.5 | — | — | — | — | kin-openapi is a Go project for handling OpenAPI files. | 68d ago |
| CVE-2026-63421 | 7.5 | — | — | — | — | Keystone is a content management system for Node.js. | 68d ago |
| CVE-2026-30866 | 7.5 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 68d ago |
| CVE-2026-27490 | 7.5 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 68d ago |
| CVE-2026-27462 | 7.5 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 68d ago |
| CVE-2026-63462 | 7.5 | — | — | — | — | Unleash is an open-source feature management platform. | 69d ago |
| CVE-2026-71862 | 7.5 | — | — | — | — | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response time | 69d ago |
| CVE-2026-55241 | 7.5 | — | — | — | — | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response time | 69d ago |
| CVE-2026-54789 | 7.5 | — | — | — | — | mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server tha | 69d ago |
| CVE-2026-77815 | 7.5 | — | — | — | — | to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segmen | 69d ago |
| CVE-2026-77814 | 7.5 | — | — | — | — | is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path. | 69d ago |
| CVE-2026-75501 | 7.5 | — | — | — | — | A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated re | 69d ago |
| CVE-2026-59654 | 7.5 | — | — | — | apache / cloudstack | Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configurat | 69d ago |
| CVE-2026-59279 | 7.5 | — | — | — | — | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of s | 69d ago |
| CVE-2026-77767 | 7.5 | — | — | — | — | Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated u | 69d ago |
| CVE-2026-47827 | 7.5 | — | — | — | — | Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell | 69d ago |
| CVE-2026-61397 | 7.5 | — | — | — | apache / cloudstack | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authenticat | 69d ago |
