| CVE-2026-18464 | 7.5 | — | — | — | — | The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, whic | 81d ago |
| CVE-2026-18357 | 7.5 | — | — | — | — | The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in | 81d ago |
| CVE-2026-18032 | 7.5 | — | — | — | — | The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unau | 81d ago |
| CVE-2026-16988 | 7.5 | — | — | — | — | The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marke | 81d ago |
| CVE-2026-10595 | 7.5 | — | — | — | — | A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route im | 81d ago |
| CVE-2026-17510 | 7.5 | — | — | — | — | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zer | 81d ago |
| CVE-2026-16594 | 7.5 | — | — | — | — | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its au | 82d ago |
| CVE-2026-16578 | 7.5 | — | — | — | — | The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 | 82d ago |
| CVE-2026-52880 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 82d ago |
| CVE-2026-52879 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 82d ago |
| CVE-2026-52878 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 82d ago |
| CVE-2026-47249 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 82d ago |
| CVE-2026-65819 | 7.5 | — | — | — | — | gopacket provides packet processing capabilities for Go. | 82d ago |
| CVE-2026-62296 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 82d ago |
| CVE-2026-62295 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 82d ago |
| CVE-2026-15972 | 7.5 | — | — | — | — | Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of | 82d ago |
| CVE-2025-63235 | 7.5 | — | — | — | — | In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplica | 82d ago |
| CVE-2026-19082 | 7.5 | — | — | — | — | Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero | 82d ago |
| CVE-2026-20348 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 82d ago |
| CVE-2026-20347 | 7.5 | — | — | — | — | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to caus | 82d ago |
| CVE-2026-20346 | 7.5 | — | — | — | — | A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 82d ago |
| CVE-2026-20345 | 7.5 | — | — | — | — | A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 82d ago |
| CVE-2026-20339 | 7.5 | — | — | — | — | A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to caus | 82d ago |
| CVE-2026-20338 | 7.5 | — | — | — | — | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS | 82d ago |
| CVE-2026-20337 | 7.5 | — | — | — | — | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS | 82d ago |
| CVE-2026-15816 | 7.5 | — | — | — | — | A flaw was found in dracut. | 83d ago |
| CVE-2026-71559 | 7.5 | — | — | — | apache / fory | Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to caus | 83d ago |
| CVE-2026-49007 | 7.5 | — | — | — | — | By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials | 83d ago |
| CVE-2026-16262 | 7.5 | — | — | — | — | The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the init | 83d ago |
| CVE-2026-16041 | 7.5 | — | — | — | — | The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its R | 83d ago |
| CVE-2026-14943 | 7.5 | — | — | — | — | The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2 | 83d ago |
| CVE-2026-62918 | 7.5 | — | — | — | microsoft / teams | Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spo | 83d ago |
| CVE-2026-71488 | 7.5 | — | — | — | — | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. | 83d ago |
| CVE-2026-70636 | 7.5 | — | — | — | — | Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to acc | 83d ago |
| CVE-2026-70559 | 7.5 | — | — | — | — | Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annota | 83d ago |
| CVE-2026-67422 | 7.5 | — | — | — | — | pymdown-extensions is a collection of extensions for the Python Markdown library. | 83d ago |
| CVE-2026-5855 | 7.5 | — | — | — | — | Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer | 83d ago |
| CVE-2026-45378 | 7.5 | — | — | — | — | Decidim is a participatory democracy framework. | 83d ago |
| CVE-2026-19176 | 7.5 | — | — | — | google / chrome | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the | 83d ago |
| CVE-2026-19165 | 7.5 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to | 83d ago |
| CVE-2026-19159 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to | 83d ago |
| CVE-2026-19158 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convince | 83d ago |
| CVE-2026-19156 | 7.5 | — | — | — | google / chrome | Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to | 83d ago |
| CVE-2026-19142 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to | 83d ago |
| CVE-2026-16620 | 7.5 | — | — | — | — | The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allow | 83d ago |
| CVE-2026-16619 | 7.5 | — | — | — | — | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification | 83d ago |
| CVE-2026-13399 | 7.5 | — | — | — | — | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization check | 83d ago |
| CVE-2026-12584 | 7.5 | — | — | — | — | The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity o | 83d ago |
| CVE-2026-10599 | 7.5 | — | — | — | — | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment tr | 83d ago |
| CVE-2026-10524 | 7.5 | — | — | — | — | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product | 83d ago |
| CVE-2026-68750 | 7.5 | — | — | — | rrrene / htmlsanitizeex | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unau | 83d ago |
| CVE-2026-68749 | 7.5 | — | — | — | rrrene / htmlsanitizeex | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an u | 83d ago |
| CVE-2026-53985 | 7.5 | — | — | — | — | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server' | 83d ago |
| CVE-2026-53977 | 7.5 | — | — | — | — | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to | 83d ago |
| CVE-2026-18427 | 7.5 | — | — | — | fastify / fastify-static | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. | 83d ago |
| CVE-2026-70646 | 7.5 | — | — | — | — | aiosend is a synchronous and asynchronous Crypto Pay API client. | 83d ago |
| CVE-2026-66712 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | 83d ago |
| CVE-2026-65543 | 7.5 | — | — | — | — | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | 83d ago |
| CVE-2026-65523 | 7.5 | — | — | — | — | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation | 83d ago |
| CVE-2026-65504 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. | 83d ago |
