| CVE-2026-54638 | 7.5 | — | — | — | — | gotd/td is a T Telegram MTProto API client in Go. | 92d ago |
| CVE-2026-47219 | 7.5 | — | — | — | — | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters | 92d ago |
| CVE-2026-55415 | 7.5 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 92d ago |
| CVE-2026-55391 | 7.5 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 92d ago |
| CVE-2026-55390 | 7.5 | — | — | — | — | datamodel-code-generator generates Python data models from schema definitions. | 92d ago |
| CVE-2026-55389 | 7.5 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 92d ago |
| CVE-2026-59942 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 92d ago |
| CVE-2026-59941 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 92d ago |
| CVE-2026-15280 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a pat | 92d ago |
| CVE-2026-15057 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to u | 92d ago |
| CVE-2026-14981 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0 | 92d ago |
| CVE-2026-13463 | 7.5 | — | — | — | ibm / cloud pak system | IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of | 92d ago |
| CVE-2026-55555 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 92d ago |
| CVE-2026-55554 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 92d ago |
| CVE-2026-66745 | 7.5 | — | — | — | — | Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerabi | 92d ago |
| CVE-2026-59932 | 7.5 | — | — | — | — | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | 92d ago |
| CVE-2026-50737 | 7.5 | — | — | — | enterprisedb / pglogical | When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected t | 92d ago |
| CVE-2026-50736 | 7.5 | — | — | — | enterprisedb / pglogical | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a su | 92d ago |
| CVE-2026-59933 | 7.5 | — | — | — | — | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | 92d ago |
| CVE-2026-54635 | 7.5 | — | — | — | — | pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. | 92d ago |
| CVE-2026-67185 | 7.5 | — | — | — | — | TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitr | 92d ago |
| CVE-2026-67184 | 7.5 | — | — | — | — | TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attacke | 92d ago |
| CVE-2026-67183 | 7.5 | — | — | — | — | TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust availa | 92d ago |
| CVE-2026-67182 | 7.5 | — | — | — | — | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypas | 92d ago |
| CVE-2026-54345 | 7.5 | — | — | — | gopacket / gopacket | gopacket provides packet processing capabilities for Go. | 92d ago |
| CVE-2026-54332 | 7.5 | — | — | — | gopacket / gopacket | gopacket provides packet processing capabilities for Go. | 92d ago |
| CVE-2026-61609 | 7.5 | — | — | — | — | Pterodactyl is a free, open-source game server management panel. | 92d ago |
| CVE-2026-47427 | 7.5 | — | — | — | github / mcp server | GitHub MCP Server is GitHub's official MCP Server. | 92d ago |
| CVE-2026-59878 | 7.5 | — | — | — | apache / activemq | Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. | 92d ago |
| CVE-2026-65881 | 7.5 | — | — | — | — | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < | 92d ago |
| CVE-2026-62431 | 7.5 | — | — | — | — | The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, | 92d ago |
| CVE-2026-62430 | 7.5 | — | — | — | — | Accesses to the CMOS memory contents are done using an indirect IO port pair. | 92d ago |
| CVE-2026-42493 | 7.5 | — | — | — | — | Addressing certain issues, in particular related to operations which may take excessively long and therefore would | 92d ago |
| CVE-2026-42492 | 7.5 | — | — | — | — | Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. | 92d ago |
| CVE-2026-15025 | 7.5 | — | — | — | — | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerab | 93d ago |
| CVE-2026-14785 | 7.5 | — | — | — | — | The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in a | 93d ago |
| CVE-2026-10207 | 7.5 | — | — | — | — | The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and includin | 93d ago |
| CVE-2026-14516 | 7.5 | — | — | — | — | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL | 93d ago |
| CVE-2026-13161 | 7.5 | — | — | — | — | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Inject | 93d ago |
| CVE-2026-12800 | 7.5 | — | — | — | — | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the | 93d ago |
| CVE-2026-12741 | 7.5 | — | — | — | — | The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection | 93d ago |
| CVE-2026-14924 | 7.5 | — | — | — | — | The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce check | 93d ago |
| CVE-2026-14490 | 7.5 | — | — | — | — | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Direc | 93d ago |
| CVE-2026-17524 | 7.5 | — | — | — | — | Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for p | 93d ago |
| CVE-2026-66473 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | 93d ago |
| CVE-2025-63913 | 7.5 | — | — | — | — | An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the | 93d ago |
| CVE-2026-55685 | 7.5 | — | — | — | shopify / react-router | React Router is a router for React. | 93d ago |
| CVE-2026-51078 | 7.5 | — | — | — | — | An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of t | 93d ago |
| CVE-2026-51077 | 7.5 | — | — | — | — | SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the | 93d ago |
| CVE-2026-64545 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_ | 93d ago |
| CVE-2026-43777 | 7.5 | — | — | — | apple / macos | This issue was addressed with improved input validation. | 93d ago |
| CVE-2026-43728 | 7.5 | — | — | — | apple / macos | This issue was addressed through improved state management. | 93d ago |
| CVE-2026-12383 | 7.5 | — | — | — | — | A flaw was found in the Event-Driven Ansible (EDA) server. | 93d ago |
| CVE-2026-64641 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 93d ago |
| CVE-2026-45623 | 7.5 | — | — | — | postcss / postcss | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abs | 93d ago |
| CVE-2026-66731 | 7.5 | — | — | — | — | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding | 93d ago |
| CVE-2026-66730 | 7.5 | — | — | — | — | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows a | 93d ago |
| CVE-2026-66729 | 7.5 | — | — | — | — | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that al | 93d ago |
| CVE-2026-59251 | 7.5 | — | — | — | erlang / erlang\/otp | Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauth | 93d ago |
| CVE-2026-58227 | 7.5 | — | — | — | erlang / erlang\/otp | The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain dur | 93d ago |
