| CVE-2026-67590 | 7.5 | — | — | — | apache / qpid protonj2 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 85d ago |
| CVE-2026-67552 | 7.5 | — | — | — | apache / qpid proton-dotnet | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 85d ago |
| CVE-2026-66274 | 7.5 | — | — | — | apache / qpid proton-j | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 85d ago |
| CVE-2026-16736 | 7.5 | — | — | — | — | The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled | 85d ago |
| CVE-2026-16604 | 7.5 | — | — | — | — | The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response be | 85d ago |
| CVE-2026-16603 | 7.5 | — | — | — | — | The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress | 85d ago |
| CVE-2026-16602 | 7.5 | — | — | — | — | The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from | 85d ago |
| CVE-2026-16573 | 7.5 | — | — | — | — | The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowi | 85d ago |
| CVE-2026-16561 | 7.5 | — | — | — | — | The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX a | 85d ago |
| CVE-2026-16055 | 7.5 | — | — | — | — | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPre | 85d ago |
| CVE-2026-16036 | 7.5 | — | — | — | — | The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-l | 85d ago |
| CVE-2026-15372 | 7.5 | — | — | — | — | The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its suppor | 85d ago |
| CVE-2026-68074 | 7.5 | — | — | — | apache / qpid broker-j | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 85d ago |
| CVE-2026-68060 | 7.5 | — | — | — | apache / qpid broker-j | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to pot | 85d ago |
| CVE-2026-67589 | 7.5 | — | — | — | apache / qpid protonj2 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to pot | 85d ago |
| CVE-2026-67588 | 7.5 | — | — | — | apache / qpid protonj2 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 85d ago |
| CVE-2026-67551 | 7.5 | — | — | — | apache / qpid proton-dotnet | pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to poten | 85d ago |
| CVE-2026-67465 | 7.5 | — | — | — | apache / qpid proton-dotnet | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 85d ago |
| CVE-2026-66273 | 7.5 | — | — | — | apache / qpid proton-j | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to pot | 85d ago |
| CVE-2026-66257 | 7.5 | — | — | — | apache / qpid proton-j | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 85d ago |
| CVE-2026-15918 | 7.5 | — | — | — | — | VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to on | 85d ago |
| CVE-2026-18907 | 7.5 | — | — | — | — | Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via | 85d ago |
| CVE-2026-67862 | 7.5 | — | — | — | — | open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highl | 85d ago |
| CVE-2026-67861 | 7.5 | — | — | — | — | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_g | 85d ago |
| CVE-2026-67860 | 7.5 | — | — | — | — | open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history dat | 85d ago |
| CVE-2026-67859 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Di | 85d ago |
| CVE-2026-67858 | 7.5 | — | — | — | — | Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multic | 85d ago |
| CVE-2026-67857 | 7.5 | — | — | — | — | open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/cl | 85d ago |
| CVE-2026-67856 | 7.5 | — | — | — | — | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateS | 85d ago |
| CVE-2026-67855 | 7.5 | — | — | — | — | open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_ | 85d ago |
| CVE-2026-45103 | 7.5 | — | — | — | — | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. | 85d ago |
| CVE-2026-66901 | 7.5 | — | — | — | — | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unval | 85d ago |
| CVE-2026-47618 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could caus | 85d ago |
| CVE-2026-47617 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause serve | 85d ago |
| CVE-2026-47616 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause serve | 85d ago |
| CVE-2026-47615 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supply | 85d ago |
| CVE-2026-47614 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. | 85d ago |
| CVE-2026-47613 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of a pathname to | 85d ago |
| CVE-2026-47612 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improp | 85d ago |
| CVE-2026-24255 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause | 85d ago |
| CVE-2026-56848 | 7.5 | — | — | — | — | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_ses | 85d ago |
| CVE-2026-15314 | 7.5 | — | — | — | tp-link / tapo p110 firmware | Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authentica | 85d ago |
| CVE-2026-24084 | 7.5 | — | — | — | qualcomm / sdx57m firmware | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replay | 85d ago |
| CVE-2026-67200 | 7.5 | — | — | — | — | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arb | 85d ago |
| CVE-2026-67198 | 7.5 | — | — | — | — | Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows | 85d ago |
| CVE-2026-63252 | 7.5 | — | — | — | eclipse / milo | In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial mess | 86d ago |
| CVE-2026-62927 | 7.5 | — | — | — | eclipse / milo | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-spac | 86d ago |
| CVE-2026-61387 | 7.5 | — | — | — | eclipse / milo | In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creat | 86d ago |
| CVE-2026-56846 | 7.5 | — | — | — | — | A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote | 86d ago |
| CVE-2026-56845 | 7.5 | — | — | — | — | An unauthenticated path traversal (LFI) vulnerability exists under /custom-sounds/ when CustomSounds storage is co | 86d ago |
| CVE-2026-66315 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 86d ago |
| CVE-2026-67978 | 7.5 | — | — | — | — | An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via trans | 86d ago |
| CVE-2026-48399 | 7.5 | — | — | — | adobe / campaign | Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could resul | 86d ago |
| CVE-2026-67977 | 7.5 | — | — | — | — | An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to | 86d ago |
| CVE-2026-67975 | 7.5 | — | — | — | — | Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add | 86d ago |
| CVE-2026-67974 | 7.5 | — | — | — | — | A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA | 86d ago |
| CVE-2026-67973 | 7.5 | — | — | — | — | An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via repla | 86d ago |
| CVE-2026-67970 | 7.5 | — | — | — | — | Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensit | 86d ago |
| CVE-2026-67969 | 7.5 | — | — | — | — | An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to r | 86d ago |
| CVE-2026-67976 | 7.5 | — | — | — | — | The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters | 86d ago |
