| CVE-2026-14257 | 7.5 | — | — | — | juliangruber / brace-expansion | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. | 97d ago |
| CVE-2026-65500 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5 | 98d ago |
| CVE-2026-65495 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. | 98d ago |
| CVE-2026-65493 | 7.5 | — | — | — | — | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. | 98d ago |
| CVE-2026-65481 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Vino <= 1.9 versions. | 98d ago |
| CVE-2026-65477 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions. | 98d ago |
| CVE-2026-61954 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | 98d ago |
| CVE-2026-61943 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. | 98d ago |
| CVE-2026-59554 | 7.5 | — | — | — | — | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. | 98d ago |
| CVE-2026-59547 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. | 98d ago |
| CVE-2026-64611 | 7.5 | — | — | — | — | A flaw was found in libcupsfilters. | 98d ago |
| CVE-2026-65755 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere ex | 98d ago |
| CVE-2026-65754 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include p | 98d ago |
| CVE-2026-65430 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where lea | 98d ago |
| CVE-2026-64799 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere exten | 98d ago |
| CVE-2026-52688 | 7.5 | — | — | — | — | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | 98d ago |
| CVE-2024-58330 | 7.5 | — | — | — | — | A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker | 98d ago |
| CVE-2026-9713 | 7.5 | — | — | — | — | The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 't | 98d ago |
| CVE-2026-14291 | 7.5 | — | — | — | — | The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one o | 98d ago |
| CVE-2026-12082 | 7.5 | — | — | — | — | The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API | 98d ago |
| CVE-2026-15074 | 7.5 | — | — | — | fastify / fastify-static | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames befo | 98d ago |
| CVE-2026-60370 | 7.5 | — | — | — | oracle / platform security for java | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized | 98d ago |
| CVE-2026-64797 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded | 98d ago |
| CVE-2026-64792 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs ext | 98d ago |
| CVE-2026-63683 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and | 98d ago |
| CVE-2026-13089 | 7.5 | — | — | — | — | OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled al | 98d ago |
| CVE-2026-14899 | 7.5 | — | — | — | mozilla / thunderbird | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabl | 98d ago |
| CVE-2026-64834 | 7.5 | — | — | — | ffmpeg / ffmpeg | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavform | 98d ago |
| CVE-2026-13204 | 7.5 | — | — | — | — | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG | 98d ago |
| CVE-2026-12617 | 7.5 | — | — | — | — | The issue is unexpected program termination based on ordering and/or specific content in responses to queries for | 98d ago |
| CVE-2026-11721 | 7.5 | — | — | — | — | It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than | 98d ago |
| CVE-2026-11622 | 7.5 | — | — | — | — | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from | 98d ago |
| CVE-2026-11605 | 7.5 | — | — | — | — | The issue is a resource exhaustion vulnerability associated with DNSSEC validation. | 98d ago |
| CVE-2026-11331 | 7.5 | — | — | — | — | An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names lon | 98d ago |
| CVE-2026-62145 | 7.5 | — | — | — | — | A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges | 98d ago |
| CVE-2026-55973 | 7.5 | — | — | — | nlnetlabs / unbound | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-C | 98d ago |
| CVE-2026-44690 | 7.5 | — | — | — | nlnetlabs / unbound | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels field combined | 98d ago |
| CVE-2026-40691 | 7.5 | — | — | — | nlnetlabs / unbound | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts | 98d ago |
| CVE-2026-32665 | 7.5 | — | — | — | nlnetlabs / unbound | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first | 98d ago |
| CVE-2026-13189 | 7.5 | — | — | — | progress / telerik ui for asp.net ajax | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the s | 98d ago |
| CVE-2026-13184 | 7.5 | — | — | — | progress / telerik ui for asp.net ajax | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and mac | 98d ago |
| CVE-2026-13183 | 7.5 | — | — | — | progress / telerik ui for asp.net ajax | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptog | 98d ago |
| CVE-2026-13182 | 7.5 | — | — | — | progress / telerik ui for asp.net ajax | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish dec | 98d ago |
| CVE-2026-65598 | 7.5 | — | — | — | n8n / n8n | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that al | 99d ago |
| CVE-2026-57600 | 7.5 | — | — | — | — | Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attac | 99d ago |
| CVE-2026-63047 | 7.5 | — | — | — | — | Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5. | 99d ago |
| CVE-2026-45820 | 7.5 | — | — | — | 101arrowz / fflate | fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). | 99d ago |
| CVE-2026-12987 | 7.5 | — | — | — | — | The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using N | 99d ago |
| CVE-2026-56819 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 99d ago |
| CVE-2026-16422 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowe | 99d ago |
| CVE-2026-65319 | 7.5 | — | — | — | — | Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthentica | 99d ago |
| CVE-2026-65315 | 7.5 | — | — | — | — | Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that al | 99d ago |
| CVE-2026-62521 | 7.5 | — | — | — | oracle / human resources management system | Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General). | 99d ago |
| CVE-2026-62495 | 7.5 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Process Manufacturing Process Execution product of Oracle E-Business Suite (component: | 99d ago |
| CVE-2026-62493 | 7.5 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). | 99d ago |
| CVE-2026-61337 | 7.5 | — | — | — | oracle / lease and finance management | Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal O | 99d ago |
| CVE-2026-61309 | 7.5 | — | — | — | oracle / in-memory cost management for discrete industries | Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite ( | 99d ago |
| CVE-2026-61236 | 7.5 | — | — | — | oracle / peoplesoft enterprise fin common objects | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Staf | 99d ago |
| CVE-2026-61232 | 7.5 | — | — | — | oracle / peoplesoft enterprise fin common objects | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Comm | 99d ago |
| CVE-2026-61226 | 7.5 | — | — | — | oracle / communications converged application server | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (componen | 99d ago |
