| CVE-2026-55737 | 7.5 | — | — | — | erlang / erlang\/otp | Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker wh | 93d ago |
| CVE-2026-54890 | 7.5 | — | — | — | erlang / erlang\/otp | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (ert | 93d ago |
| CVE-2026-42792 | 7.5 | — | — | — | erlang / erlang\/otp | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remo | 93d ago |
| CVE-2026-66050 | 7.5 | — | — | — | — | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allo | 93d ago |
| CVE-2026-59548 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. | 93d ago |
| CVE-2026-59539 | 7.5 | — | — | — | — | Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions. | 93d ago |
| CVE-2026-59536 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | 93d ago |
| CVE-2026-59534 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | 93d ago |
| CVE-2026-59532 | 7.5 | — | — | — | — | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. | 93d ago |
| CVE-2026-59531 | 7.5 | — | — | — | — | Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. | 93d ago |
| CVE-2026-59530 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | 93d ago |
| CVE-2026-59529 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | 93d ago |
| CVE-2026-59528 | 7.5 | — | — | — | — | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. | 93d ago |
| CVE-2026-58389 | 7.5 | — | — | — | apache / thrift | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. | 94d ago |
| CVE-2026-55969 | 7.5 | — | — | — | apache / thrift | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. | 94d ago |
| CVE-2026-55968 | 7.5 | — | — | — | apache / thrift | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache T | 94d ago |
| CVE-2026-49158 | 7.5 | — | — | — | apache / thrift | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. | 94d ago |
| CVE-2026-48586 | 7.5 | — | — | — | apache / thrift | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, | 94d ago |
| CVE-2026-48145 | 7.5 | — | — | — | apache / thrift | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. | 94d ago |
| CVE-2026-45112 | 7.5 | — | — | — | apache / thrift | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. | 94d ago |
| CVE-2026-43871 | 7.5 | — | — | — | apache / thrift | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bin | 94d ago |
| CVE-2026-41608 | 7.5 | — | — | — | apache / thrift | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. | 94d ago |
| CVE-2026-14235 | 7.5 | — | — | — | — | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting s | 94d ago |
| CVE-2026-12493 | 7.5 | — | — | — | — | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approv | 94d ago |
| CVE-2026-63720 | 7.5 | — | — | — | — | datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who | 95d ago |
| CVE-2026-64430 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from | 96d ago |
| CVE-2026-64414 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko rep | 96d ago |
| CVE-2026-64395 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicat | 96d ago |
| CVE-2026-64374 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be default off for | 96d ago |
| CVE-2026-64312 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-para | 96d ago |
| CVE-2026-64281 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport cl | 96d ago |
| CVE-2026-66373 | 7.5 | — | — | — | — | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code ex | 96d ago |
| CVE-2026-66035 | 7.5 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability | 96d ago |
| CVE-2026-66034 | 7.5 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malic | 96d ago |
| CVE-2026-66033 | 7.5 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in | 96d ago |
| CVE-2026-64210 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ | 96d ago |
| CVE-2026-64208 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pr | 96d ago |
| CVE-2026-66144 | 7.5 | — | — | — | apache / neethi | Although remote policy references are not retrieved during policy normalization, if they are manually retrieved vi | 96d ago |
| CVE-2026-66143 | 7.5 | — | — | — | apache / neethi | It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi | 96d ago |
| CVE-2026-66142 | 7.5 | — | — | — | apache / neethi | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply ne | 96d ago |
| CVE-2026-45816 | 7.5 | — | — | — | apache / nimble | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. | 96d ago |
| CVE-2026-45815 | 7.5 | — | — | — | apache / nimble | Reachable Assertion vulnerability in Apache NimBLE. | 96d ago |
| CVE-2026-45811 | 7.5 | — | — | — | apache / nimble | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. | 96d ago |
| CVE-2026-14603 | 7.5 | — | — | — | — | The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST end | 97d ago |
| CVE-2026-12981 | 7.5 | — | — | — | — | The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating us | 97d ago |
| CVE-2026-12497exploited | 7.5 | 0.39% | 1/3 | +81d | — | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPre | 97d ago |
| CVE-2026-40430 | 7.5 | — | — | — | — | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could exp | 97d ago |
| CVE-2026-65694 | 7.5 | — | — | — | — | Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows un | 97d ago |
| CVE-2026-50039 | 7.5 | — | — | — | — | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory | 97d ago |
| CVE-2026-50032 | 7.5 | — | — | — | — | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attack | 97d ago |
| CVE-2026-15967 | 7.5 | — | — | — | progress / moveit transfer | Insufficient session expiration vulnerability in Progress MOVEit Transfer. | 97d ago |
| CVE-2026-15966 | 7.5 | — | — | — | progress / moveit transfer | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. | 97d ago |
| CVE-2026-10697 | 7.5 | — | — | — | progress / moveit transfer | Improper Authentication vulnerability in Progress MOVEit Transfer. | 97d ago |
| CVE-2026-25800 | 7.5 | — | — | — | — | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. | 97d ago |
| CVE-2026-16756 | 7.5 | — | — | — | — | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() | 97d ago |
| CVE-2026-65919 | 7.5 | — | — | — | — | Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView an | 97d ago |
| CVE-2026-44909 | 7.5 | — | — | — | — | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. | 97d ago |
| CVE-2026-15615 | 7.5 | — | — | — | — | Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restriction | 97d ago |
| CVE-2026-15614 | 7.5 | — | — | — | — | Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s | 97d ago |
| CVE-2026-43823 | 7.5 | — | — | — | apple / swift-crypto | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in | 97d ago |
