| CVE-2026-24184 | 7.5 | — | — | — | nvidia / cumulus linux | NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where | 71d ago |
| CVE-2026-75897 | 7.5 | — | — | — | — | Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request pay | 72d ago |
| CVE-2026-50578 | 7.5 | — | — | — | — | ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's elec | 72d ago |
| CVE-2026-75915 | 7.5 | — | — | — | — | CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool t | 72d ago |
| CVE-2026-75914 | 7.5 | — | — | — | — | CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to ca | 72d ago |
| CVE-2026-75859 | 7.5 | — | — | — | — | CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing at | 72d ago |
| CVE-2026-73337 | 7.5 | — | — | — | joomla / joomla\! | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state c | 72d ago |
| CVE-2026-19500 | 7.5 | — | — | — | — | The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on | 72d ago |
| CVE-2026-73997 | 7.5 | — | — | — | — | Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions. | 72d ago |
| CVE-2026-73994 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | 72d ago |
| CVE-2026-73377 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | 72d ago |
| CVE-2026-73181exploited | 7.5 | 0.50% | 1/3 | +71d | — | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions. | 72d ago |
| CVE-2026-66622 | 7.5 | — | — | — | — | Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. | 72d ago |
| CVE-2026-66046 | 7.5 | — | — | — | — | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the s | 72d ago |
| CVE-2026-56684 | 7.5 | — | — | — | — | Valkey is a distributed key-value database. | 72d ago |
| CVE-2026-32549 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | 72d ago |
| CVE-2026-32481 | 7.5 | — | — | — | — | Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions. | 72d ago |
| CVE-2026-32472 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions. | 72d ago |
| CVE-2026-32468 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions. | 72d ago |
| CVE-2026-28571 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. | 72d ago |
| CVE-2026-28567 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | 72d ago |
| CVE-2026-74982 | 7.5 | — | — | — | mozilla / firefox | Denial-of-service in the Widget component. | 72d ago |
| CVE-2026-74977 | 7.5 | — | — | — | mozilla / firefox | Integer overflow in the Graphics component. | 72d ago |
| CVE-2026-74966 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Form Autofill component. | 72d ago |
| CVE-2026-74958 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the WebRTC component. | 72d ago |
| CVE-2026-74954 | 7.5 | — | — | — | mozilla / firefox | Information disclosure due to side-channel in the Storage: Cache API component. | 72d ago |
| CVE-2026-74934 | 7.5 | — | — | — | mozilla / firefox | Site isolation issue in the Graphics: CanvasWebGL component. | 72d ago |
| CVE-2026-75840 | 7.5 | — | — | — | — | ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist e | 72d ago |
| CVE-2026-74906 | 7.5 | — | — | — | — | SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoin | 72d ago |
| CVE-2026-74904 | 7.5 | — | — | — | — | SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go | 72d ago |
| CVE-2026-15585 | 7.5 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Comp | 72d ago |
| CVE-2026-11801 | 7.5 | — | — | — | — | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up t | 72d ago |
| CVE-2026-67918 | 7.5 | — | — | — | — | Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive informati | 72d ago |
| CVE-2026-65343 | 7.5 | — | — | — | apple / ipados | A use after free issue was addressed with improved memory management. | 72d ago |
| CVE-2026-75482 | 7.5 | — | — | — | — | SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request p | 72d ago |
| CVE-2026-75479 | 7.5 | — | — | — | — | JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that all | 72d ago |
| CVE-2026-75111 | 7.5 | — | — | — | — | Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing u | 72d ago |
| CVE-2026-75105 | 7.5 | — | — | — | — | phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token wa | 72d ago |
| CVE-2026-71518 | 7.5 | — | — | — | — | Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows | 72d ago |
| CVE-2026-68005 | 7.5 | — | — | — | — | An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP requ | 72d ago |
| CVE-2026-74238 | 7.5 | — | — | — | — | TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function t | 72d ago |
| CVE-2026-50776 | 7.5 | — | — | — | — | Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote attacker to obtain | 72d ago |
| CVE-2026-45698 | 7.5 | — | — | — | — | Netatalk is a Free and Open Source file server suite for Unix-like operating systems. | 72d ago |
| CVE-2026-73523 | 7.5 | — | — | — | — | COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unaut | 72d ago |
| CVE-2026-73522 | 7.5 | — | — | — | — | COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote at | 72d ago |
| CVE-2026-71980 | 7.5 | — | — | — | — | Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe( | 72d ago |
| CVE-2026-71979 | 7.5 | — | — | — | — | INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a st | 72d ago |
| CVE-2026-59902 | 7.5 | — | — | — | — | Netty is an asynchronous, event-driven network application framework. | 72d ago |
| CVE-2026-59893 | 7.5 | — | — | — | — | sqlparse is a non-validating SQL parser module for Python. | 72d ago |
| CVE-2026-73646 | 7.5 | — | — | — | — | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abs | 73d ago |
| CVE-2026-64868 | 7.5 | — | — | — | — | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. | 73d ago |
| CVE-2026-16471 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not | 73d ago |
| CVE-2026-16467 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality N | 73d ago |
| CVE-2026-74892 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server co | 73d ago |
| CVE-2026-74888 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per | 73d ago |
| CVE-2026-74884 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the | 73d ago |
| CVE-2026-74882 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 pr | 73d ago |
| CVE-2026-74879 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that | 73d ago |
| CVE-2026-74874 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel select | 73d ago |
| CVE-2026-74868 | 7.5 | — | — | — | — | SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth im | 73d ago |
