| CVE-2026-28814 | 7.5 | — | — | — | apache / jspwiki | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to ob | 90d ago |
| CVE-2026-28811 | 7.5 | — | — | — | apache / jspwiki | Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. | 90d ago |
| CVE-2026-10842 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0 | 90d ago |
| CVE-2026-6540 | 7.5 | — | — | — | tigera / calico | Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perfo | 90d ago |
| CVE-2026-67349 | 7.5 | — | — | — | — | OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES en | 90d ago |
| CVE-2026-41186 | 7.5 | — | — | — | tigera / calico | When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane compo | 90d ago |
| CVE-2026-16308 | 7.5 | — | — | — | — | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow | 90d ago |
| CVE-2026-14519 | 7.5 | — | — | — | ibm / app connect enterprise | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacke | 90d ago |
| CVE-2026-12947 | 7.5 | — | — | — | ibm / app connect enterprise | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive | 90d ago |
| CVE-2026-11897 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused | 90d ago |
| CVE-2026-60075 | 7.5 | — | — | — | — | Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time | 90d ago |
| CVE-2026-60074 | 7.5 | — | — | — | — | Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numer | 90d ago |
| CVE-2026-57859 | 7.5 | — | — | — | — | e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that al | 90d ago |
| CVE-2026-54366 | 7.5 | — | — | — | — | CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated | 91d ago |
| CVE-2026-54365 | 7.5 | — | — | — | — | CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows u | 91d ago |
| CVE-2026-44107 | 7.5 | — | — | — | — | A reboot of the charging controller can be triggered via Modbus TCP without authentication. | 91d ago |
| CVE-2026-16529 | 7.5 | — | — | — | — | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU | 91d ago |
| CVE-2026-15240 | 7.5 | — | — | — | — | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to th | 91d ago |
| CVE-2026-13178 | 7.5 | — | — | — | — | The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supp | 91d ago |
| CVE-2026-12687 | 7.5 | — | — | — | — | The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register in | 91d ago |
| CVE-2026-12500 | 7.5 | — | — | — | — | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that upda | 91d ago |
| CVE-2026-1360 | 7.5 | — | — | — | — | The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and i | 91d ago |
| CVE-2026-17979 | 7.5 | — | — | — | google / chrome | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sa | 91d ago |
| CVE-2026-17952 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a use | 91d ago |
| CVE-2026-17948 | 7.5 | — | — | — | google / chrome | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a | 91d ago |
| CVE-2026-17930 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote | 91d ago |
| CVE-2026-17916 | 7.5 | — | — | — | google / chrome | Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who | 91d ago |
| CVE-2026-17898 | 7.5 | — | — | — | google / chrome | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to ins | 91d ago |
| CVE-2026-17896 | 7.5 | — | — | — | google / chrome | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary | 91d ago |
| CVE-2026-17887 | 7.5 | — | — | — | google / chrome | Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user | 91d ago |
| CVE-2026-17816 | 7.5 | — | — | — | google / chrome | Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta | 91d ago |
| CVE-2026-17774 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attack | 91d ago |
| CVE-2026-17698 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a loca | 91d ago |
| CVE-2026-67437 | 7.5 | — | — | — | — | OliveTin gives access to predefined shell commands from a web interface. | 91d ago |
| CVE-2026-50782 | 7.5 | — | — | — | — | Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_ | 91d ago |
| CVE-2026-67432 | 7.5 | — | — | — | — | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. | 91d ago |
| CVE-2026-5491 | 7.5 | — | — | — | — | DriveLock Directory Traversal Information Disclosure Vulnerability. | 91d ago |
| CVE-2026-5487 | 7.5 | — | — | — | — | DriveLock Directory Traversal Information Disclosure Vulnerability. | 91d ago |
| CVE-2026-5057 | 7.5 | — | — | — | — | ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. | 91d ago |
| CVE-2026-15975 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, | 91d ago |
| CVE-2026-59898 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 91d ago |
| CVE-2026-59901 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 91d ago |
| CVE-2026-59899 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 91d ago |
| CVE-2025-60931 | 7.5 | — | — | — | — | An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10 | 91d ago |
| CVE-2026-65886 | 7.5 | — | — | — | balbooa / gridbox | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows | 91d ago |
| CVE-2026-67215 | 7.5 | — | — | — | davegamble / cjson | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 690 | 91d ago |
| CVE-2026-65889 | 7.5 | — | — | — | balbooa / gridbox | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method | 91d ago |
| CVE-2026-65943 | 7.5 | — | — | — | rolandd / ro csvi | Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0 | 92d ago |
| CVE-2026-58189 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplificati | 92d ago |
| CVE-2026-58186 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. | 92d ago |
| CVE-2026-58181 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. | 92d ago |
| CVE-2026-58180 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. | 92d ago |
| CVE-2026-58178 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. | 92d ago |
| CVE-2026-58175 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server leaks memory when handling HostDB SRV records. | 92d ago |
| CVE-2026-58164 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. | 92d ago |
| CVE-2026-58163 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. | 92d ago |
| CVE-2026-58161 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. | 92d ago |
| CVE-2026-65324 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow c | 92d ago |
| CVE-2026-58151 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. | 92d ago |
| CVE-2026-54719 | 7.5 | — | — | — | — | goshs is a feature-rich single-binary file server for red teamers and developers. | 92d ago |
