| CVE-2026-73622 | 7.5 | — | — | — | gitpython project / gitpython | GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL | 77d ago |
| CVE-2026-19484 | 7.5 | — | — | — | fastify / fastify\/busyboy | @fastify/busboy is a multipart form-data parser. | 77d ago |
| CVE-2026-19481 | 7.5 | — | — | — | fastify / fastify\/busyboy | @fastify/busboy is a multipart form-data parser. | 77d ago |
| CVE-2026-13610 | 7.5 | — | — | — | — | The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated regi | 77d ago |
| CVE-2026-0301 | 7.5 | — | — | — | paloaltonetworks / cloud ngfw | An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables | 77d ago |
| CVE-2026-47717 | 7.5 | — | — | — | — | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. | 77d ago |
| CVE-2026-73493 | 7.5 | — | — | — | — | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. | 77d ago |
| CVE-2026-71469 | 7.5 | — | — | — | — | A flaw was found in search-v2-api. | 77d ago |
| CVE-2026-73418 | 7.5 | — | — | — | — | NextAuth.js provides authentication for Next.js. | 77d ago |
| CVE-2026-65370 | 7.5 | — | — | — | apple / servicetalk | ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attac | 77d ago |
| CVE-2026-19654 | 7.5 | — | — | — | rsyslog / rsyslog | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. | 77d ago |
| CVE-2026-73406 | 7.5 | — | — | — | — | Budibase is an open-source low-code platform. | 77d ago |
| CVE-2026-72801 | 7.5 | — | — | — | — | SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through un | 77d ago |
| CVE-2026-42018exploited | 7.5 | 9.8% | 3/3 | +29d | — | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access | 77d ago |
| CVE-2026-17271 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation | 77d ago |
| CVE-2026-16931 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling o | 77d ago |
| CVE-2026-48554 | 7.5 | — | — | — | — | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via | 77d ago |
| CVE-2026-48553 | 7.5 | — | — | — | — | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via | 77d ago |
| CVE-2026-68968 | 7.5 | — | — | — | apache / airflow | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_ | 77d ago |
| CVE-2026-73285 | 7.5 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 78d ago |
| CVE-2026-68757 | 7.5 | — | — | — | jfrog / artifactory | A user with access to a valid SAML response may impersonate another user under specific conditions. | 78d ago |
| CVE-2025-59322 | 7.5 | — | — | — | — | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encry | 78d ago |
| CVE-2025-59327 | 7.5 | — | — | — | — | In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption | 78d ago |
| CVE-2025-59325 | 7.5 | — | — | — | — | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the o | 78d ago |
| CVE-2026-19566 | 7.5 | — | — | — | — | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 p | 78d ago |
| CVE-2025-41770 | 7.5 | — | — | — | — | An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow | 78d ago |
| CVE-2026-18789exploited | 7.5 | 0.41% | 1/3 | +71d | — | The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functiona | 78d ago |
| CVE-2026-18049 | 7.5 | — | — | — | — | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one o | 78d ago |
| CVE-2026-18048 | 7.5 | — | — | — | — | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to bui | 78d ago |
| CVE-2026-16253 | 7.5 | — | — | — | — | The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup- | 78d ago |
| CVE-2026-14925 | 7.5 | — | — | — | — | The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file d | 78d ago |
| CVE-2026-73249 | 7.5 | — | — | — | — | calibre is an e-book manager. | 78d ago |
| CVE-2026-73246 | 7.5 | — | — | — | — | Kestra is an open-source, event-driven orchestration platform. | 78d ago |
| CVE-2026-29036 | 7.5 | — | — | — | — | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_ | 78d ago |
| CVE-2026-19558 | 7.5 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to | 78d ago |
| CVE-2026-73232 | 7.5 | — | — | — | — | ffuf is a fast web fuzzer written in Go. | 78d ago |
| CVE-2026-71467 | 7.5 | — | — | — | — | A flaw was found in search-v2-api. | 78d ago |
| CVE-2026-48804 | 7.5 | — | — | — | — | python-socketio is a Python implementation of the Socket.IO realtime client and server. | 78d ago |
| CVE-2026-13457 | 7.5 | — | — | — | — | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution i | 78d ago |
| CVE-2026-48809 | 7.5 | — | — | — | — | python-engineio is a Python implementation of the Engine.IO realtime client and server. | 78d ago |
| CVE-2026-48802 | 7.5 | — | — | — | — | python-engineio is a Python implementation of the Engine.IO realtime client and server. | 78d ago |
| CVE-2026-18697 | 7.5 | — | — | — | — | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) | 78d ago |
| CVE-2026-72713 | 7.5 | — | — | — | — | XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or defau | 78d ago |
| CVE-2026-48416 | 7.5 | — | — | — | — | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature byp | 78d ago |
| CVE-2022-50997zero day | 7.5 | 0.62% | 1/3 | same day | — | Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpo | 78d ago |
| CVE-2016-20097zero day | 7.5 | 0.63% | 1/3 | same day | — | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows u | 78d ago |
| CVE-2026-73089 | 7.5 | — | — | — | — | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. | 78d ago |
| CVE-2026-73088 | 7.5 | — | — | — | — | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. | 78d ago |
| CVE-2026-65681 | 7.5 | — | — | — | microsoft / windows 10 1607 | Null pointer dereference in Windows iSCSI Target Service allows an unauthorized attacker to deny service over a ne | 78d ago |
| CVE-2026-62901 | 7.5 | — | — | — | microsoft / visual studio 2022 | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. | 78d ago |
| CVE-2026-62898 | 7.5 | — | — | — | microsoft / visual studio 2022 | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. | 78d ago |
| CVE-2026-62787 | 7.5 | — | — | — | microsoft / windows 10 1607 | Use after free in Windows DNS allows an authorized attacker to execute code over a network. | 78d ago |
| CVE-2026-61363 | 7.5 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network | 78d ago |
| CVE-2026-61352 | 7.5 | — | — | — | microsoft / windows 10 1607 | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Clie | 78d ago |
| CVE-2026-59134 | 7.5 | — | — | — | microsoft / windows 10 1607 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network | 78d ago |
| CVE-2026-59132 | 7.5 | — | — | — | microsoft / windows 10 1607 | Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. | 78d ago |
| CVE-2026-54113 | 7.5 | — | — | — | microsoft / windows 10 1607 | Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny ser | 78d ago |
| CVE-2026-48439 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to appli | 78d ago |
| CVE-2026-48438 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an applicatio | 78d ago |
| CVE-2026-48386 | 7.5 | — | — | — | adobe / coldfusion | ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disc | 78d ago |
