| CVE-2026-67972 | 7.5 | — | — | — | — | An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content an | 86d ago |
| CVE-2026-69185 | 7.5 | — | — | — | — | Socket.IO enables bidirectional and low-latency communication for every platform. | 86d ago |
| CVE-2026-68981 | 7.5 | — | — | — | apache / nifi | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey en | 86d ago |
| CVE-2025-15629 | 7.5 | — | — | — | tp-link / omada oc200 v3 firmware | A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect commu | 86d ago |
| CVE-2025-15628 | 7.5 | — | — | — | tp-link / omada oc200 v3 firmware | Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between | 86d ago |
| CVE-2025-15627 | 7.5 | — | — | — | tp-link / omada oc200 v3 firmware | A cryptographic weakness exists in the Omada adoption protocol. | 86d ago |
| CVE-2026-69152 | 7.5 | — | — | — | juliangruber / brace-expansion | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. | 86d ago |
| CVE-2026-61372 | 7.5 | — | — | — | apache / jena fuseki | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki | 86d ago |
| CVE-2026-18568 | 7.5 | — | — | — | xml\ / \ | XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true w | 86d ago |
| CVE-2026-69095 | 7.5 | — | — | — | — | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerabili | 87d ago |
| CVE-2026-69091 | 7.5 | — | — | — | — | Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login | 87d ago |
| CVE-2026-69089 | 7.5 | — | — | — | — | Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized | 87d ago |
| CVE-2026-18089 | 7.5 | — | — | — | timlegge / net\ | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the respo | 87d ago |
| CVE-2026-21555 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21554 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21553 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21552 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21551 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21550 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21549 | 7.5 | — | — | — | — | In modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-21548 | 7.5 | — | — | — | — | In nr modem, there is a possible improper input validation. | 87d ago |
| CVE-2026-18587 | 7.5 | — | — | — | — | A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. | 87d ago |
| CVE-2026-14682 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. | 87d ago |
| CVE-2026-13586 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). | 87d ago |
| CVE-2026-13506 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. | 87d ago |
| CVE-2026-12852 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds ch | 87d ago |
| CVE-2026-12816 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. | 87d ago |
| CVE-2026-12803 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEA | 87d ago |
| CVE-2026-12802 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. | 87d ago |
| CVE-2026-58061 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. | 87d ago |
| CVE-2026-58060 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. | 87d ago |
| CVE-2026-58059 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. | 87d ago |
| CVE-2026-20479 | 7.5 | — | — | — | mediatek / mt2735 firmware | In Modem, there is a possible out of bounds read due to a missing bounds check. | 87d ago |
| CVE-2026-59651 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. | 87d ago |
| CVE-2026-59649 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. | 87d ago |
| CVE-2026-59646 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. | 87d ago |
| CVE-2026-59645 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 sch | 87d ago |
| CVE-2026-59644 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender. | 87d ago |
| CVE-2026-59642 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. | 87d ago |
| CVE-2026-59639 | 7.5 | — | — | — | bouncycastle / bc-java | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. | 87d ago |
| CVE-2026-3245 | 7.5 | — | — | — | — | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code executio | 87d ago |
| CVE-2026-68580 | 7.5 | — | — | — | — | FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) acr | 88d ago |
| CVE-2026-68578 | 7.5 | — | — | — | — | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all en | 88d ago |
| CVE-2026-67357 | 7.5 | — | — | — | — | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings too | 88d ago |
| CVE-2026-16540 | 7.5 | — | — | — | — | The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment o | 88d ago |
| CVE-2026-16285 | 7.5 | — | — | — | — | The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check befo | 88d ago |
| CVE-2026-16261 | 7.5 | — | — | — | — | The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or t | 88d ago |
| CVE-2026-15241 | 7.5 | — | — | — | — | The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on | 88d ago |
| CVE-2026-15236 | 7.5 | — | — | — | — | The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third- | 88d ago |
| CVE-2026-15206 | 7.5 | — | — | — | — | The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number t | 88d ago |
| CVE-2026-15151 | 7.5 | — | — | — | — | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of | 88d ago |
| CVE-2026-18352 | 7.5 | — | — | — | — | The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and inclu | 88d ago |
| CVE-2026-13339 | 7.5 | — | — | — | — | The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | 88d ago |
| CVE-2026-55735 | 7.5 | — | — | — | ueberauth / guardian | Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revok | 88d ago |
| CVE-2026-55734 | 7.5 | — | — | — | ueberauth / guardian | Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions mod | 88d ago |
| CVE-2026-55733 | 7.5 | — | — | — | ueberauth / guardian | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded | 88d ago |
| CVE-2026-54894 | 7.5 | — | — | — | ueberauth / guardian | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded | 88d ago |
| CVE-2026-67322 | 7.5 | — | — | — | gitpython project / gitpython | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). | 89d ago |
| CVE-2026-67321 | 7.5 | — | — | — | axios / axios | axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormDat | 89d ago |
| CVE-2026-67320 | 7.5 | — | — | — | axios / axios | axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. | 89d ago |
