| CVE-2026-18125 | 7.5 | — | — | — | — | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthentica | 79d ago |
| CVE-2026-72766 | 7.5 | — | — | — | n8n / n8n | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Sen | 79d ago |
| CVE-2026-69109 | 7.5 | — | — | — | — | A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). | 79d ago |
| CVE-2026-72606 | 7.5 | — | — | — | — | A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to mak | 79d ago |
| CVE-2026-72605 | 7.5 | — | — | — | — | A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbi | 79d ago |
| CVE-2026-72602 | 7.5 | — | — | — | — | A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote a | 79d ago |
| CVE-2026-72601 | 7.5 | — | — | — | — | A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form su | 79d ago |
| CVE-2026-72600 | 7.5 | — | — | — | — | A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to do | 79d ago |
| CVE-2026-72552 | 7.5 | — | — | — | — | A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to mak | 79d ago |
| CVE-2026-72548 | 7.5 | — | — | — | — | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote atta | 79d ago |
| CVE-2026-72545 | 7.5 | — | — | — | — | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated r | 79d ago |
| CVE-2026-72544 | 7.5 | — | — | — | — | An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote atta | 79d ago |
| CVE-2026-72543 | 7.5 | — | — | — | — | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated r | 79d ago |
| CVE-2026-71217 | 7.5 | — | — | — | — | A flaw was found in iperf3. | 79d ago |
| CVE-2026-15567 | 7.5 | — | — | — | — | A flaw was found in Wildfly. | 79d ago |
| CVE-2026-15565 | 7.5 | — | — | — | — | A flaw was found in Undertow. | 79d ago |
| CVE-2026-15562 | 7.5 | — | — | — | — | A flaw was found in EAP's jboss-remoting. | 79d ago |
| CVE-2026-15561 | 7.5 | — | — | — | — | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. | 79d ago |
| CVE-2026-19424 | 7.5 | — | — | — | — | Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. | 79d ago |
| CVE-2026-72915 | 7.5 | — | — | — | — | Mastodon is a free, open-source social network server based on ActivityPub. | 79d ago |
| CVE-2026-72914 | 7.5 | — | — | — | — | Mastodon is a free, open-source social network server based on ActivityPub. | 79d ago |
| CVE-2026-18618 | 7.5 | — | — | — | — | A flaw was found in ml-metadata. | 79d ago |
| CVE-2026-18611 | 7.5 | — | — | — | — | A flaw was found in the Data Science Pipelines Operator. | 79d ago |
| CVE-2026-11810 | 7.5 | — | — | — | — | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c | 79d ago |
| CVE-2026-72871 | 7.5 | — | — | — | — | Dokploy is a free, self-hostable Platform as a Service (PaaS). | 79d ago |
| CVE-2026-71962 | 7.5 | — | — | — | flowiseai / flowise | Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assi | 79d ago |
| CVE-2026-48048 | 7.5 | — | — | — | — | XWiki Platform is a generic wiki platform. | 79d ago |
| CVE-2026-72692 | 7.5 | — | — | — | — | A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remo | 80d ago |
| CVE-2026-72691 | 7.5 | — | — | — | — | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated rem | 80d ago |
| CVE-2026-72689 | 7.5 | — | — | — | — | A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthen | 80d ago |
| CVE-2026-72688 | 7.5 | — | — | — | — | A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated rem | 80d ago |
| CVE-2026-68414 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work | 80d ago |
| CVE-2026-68379 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIME_WAIT socket reference leak on PS | 80d ago |
| CVE-2026-68315 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_st | 80d ago |
| CVE-2026-68299 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() f | 80d ago |
| CVE-2026-68287 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit | 80d ago |
| CVE-2026-68157 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup | 80d ago |
| CVE-2026-68155 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monit | 80d ago |
| CVE-2026-68141 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callb | 80d ago |
| CVE-2026-68131 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in ob | 80d ago |
| CVE-2026-68129 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When | 80d ago |
| CVE-2026-68120 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rtase: Workaround for TX hang caused by hardwa | 80d ago |
| CVE-2026-68119 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response pad | 80d ago |
| CVE-2026-68096 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in audit | 80d ago |
| CVE-2026-72586 | 7.5 | — | — | — | — | A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker | 80d ago |
| CVE-2026-72582 | 7.5 | — | — | — | — | A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker t | 80d ago |
| CVE-2026-72579 | 7.5 | — | — | — | — | An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can int | 80d ago |
| CVE-2026-72572 | 7.5 | — | — | — | — | A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read an | 80d ago |
| CVE-2026-72571 | 7.5 | — | — | — | — | A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote atta | 80d ago |
| CVE-2026-65942 | 7.5 | — | — | — | apache / ranger | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. | 80d ago |
| CVE-2026-61899 | 7.5 | — | — | — | apache / tapestry | Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath as | 80d ago |
| CVE-2026-55814 | 7.5 | — | — | — | apache / ranger | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. | 80d ago |
| CVE-2026-44630 | 7.5 | — | — | — | — | Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker t | 80d ago |
| CVE-2026-66403 | 7.5 | — | — | — | — | DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. | 80d ago |
| CVE-2026-18946 | 7.5 | — | — | — | — | The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files upload | 80d ago |
| CVE-2026-18470 | 7.5 | — | — | — | — | The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from | 80d ago |
| CVE-2026-17542 | 7.5 | — | — | — | — | The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager co | 80d ago |
| CVE-2026-17541 | 7.5 | — | — | — | — | The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, a | 80d ago |
| CVE-2026-17022 | 7.5 | — | — | — | — | The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token b | 80d ago |
| CVE-2026-14206 | 7.5 | — | — | — | — | The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that re | 80d ago |
