| CVE-2026-26197 | 7.5 | — | — | — | hdfgroup / hdf5 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. | 100d ago |
| CVE-2026-64622 | 7.5 | — | — | — | — | Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (chec | 100d ago |
| CVE-2026-63760 | 7.5 | — | — | — | surrealdb / surrealdb | SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when pro | 100d ago |
| CVE-2026-63747 | 7.5 | — | — | — | surrealdb / surrealdb | SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when | 100d ago |
| CVE-2026-6656 | 7.5 | — | — | — | — | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. | 101d ago |
| CVE-2026-12592 | 7.5 | — | — | — | — | The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before | 101d ago |
| CVE-2026-42566 | 7.5 | — | — | — | meshtastic / meshtastic firmware | Meshtastic is an open source mesh networking solution. | 101d ago |
| CVE-2026-64175 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware re | 101d ago |
| CVE-2026-64148 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wa | 101d ago |
| CVE-2026-64141 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare | 101d ago |
| CVE-2026-64140 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_sh | 101d ago |
| CVE-2026-64116 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_ho | 101d ago |
| CVE-2026-64048 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an | 101d ago |
| CVE-2026-64020 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We d | 101d ago |
| CVE-2026-64003 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL de | 101d ago |
| CVE-2026-63980 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nv | 101d ago |
| CVE-2026-63972 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-de | 101d ago |
| CVE-2026-63968 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_selec | 101d ago |
| CVE-2026-63955 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disable | 101d ago |
| CVE-2026-16221 | 7.5 | — | — | — | openjsf / fast-uri | Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4. | 101d ago |
| CVE-2026-53397 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode fail | 101d ago |
| CVE-2026-53395 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_cre | 101d ago |
| CVE-2026-53394 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on | 101d ago |
| CVE-2026-53392 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle versio | 101d ago |
| CVE-2026-53391 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_ | 101d ago |
| CVE-2026-53383 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound re | 101d ago |
| CVE-2026-53994 | 7.5 | — | — | — | proftpd / proftpd | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. | 102d ago |
| CVE-2024-58368 | 7.5 | — | — | — | surrealdb / surrealdb | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests contai | 102d ago |
| CVE-2026-59173 | 7.5 | — | — | — | apache / traffic server | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. | 102d ago |
| CVE-2026-56741 | 7.5 | — | — | — | jline / jline | JLine is a Java library for handling console input. | 103d ago |
| CVE-2026-56740 | 7.5 | — | — | — | jline / jline | JLine is a Java library for handling console input. | 103d ago |
| CVE-2026-49485 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 103d ago |
| CVE-2026-54466 | 7.5 | — | — | — | faye / websocket-driver | websocket-driver is a WebSocket protocol handler with pluggable I/O. | 103d ago |
| CVE-2026-52203 | 7.5 | — | — | — | — | An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter. | 103d ago |
| CVE-2026-50274 | 7.5 | — | — | — | — | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security | 103d ago |
| CVE-2026-50272 | 7.5 | — | — | — | — | dd-trace is the Datadog APM client for Node.js. | 103d ago |
| CVE-2026-50271 | 7.5 | — | — | — | — | Datadog dd-trace-py is the Datadog Python APM client. | 103d ago |
| CVE-2026-44891 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 103d ago |
| CVE-2026-7872 | 7.5 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT si | 103d ago |
| CVE-2026-54465 | 7.5 | — | — | — | faye / websocket-driver | websocket-driver is a WebSocket protocol handler with pluggable I/O. | 103d ago |
| CVE-2026-54463 | 7.5 | — | — | — | faye / websocket-driver | websocket-driver is a WebSocket protocol handler with pluggable I/O. | 103d ago |
| CVE-2026-51833 | 7.5 | — | — | — | — | Xenforo 2.3.8 is vulnerable to SSRF. | 103d ago |
| CVE-2026-50151 | 7.5 | — | — | — | linuxfoundation / oras | oras-go is a Go library for managing OCI artifacts. | 103d ago |
| CVE-2026-45799 | 7.5 | — | — | — | squareup / wire | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. | 103d ago |
| CVE-2026-15322 | 7.5 | — | — | — | ibm / engineering ai hub | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due t | 103d ago |
| CVE-2025-51678 | 7.5 | — | — | — | — | An issue was discovered in RISC-V PicoRV32 commit 87c89a. | 103d ago |
| CVE-2026-9171 | 7.5 | — | — | — | ibm / powervm novalink | IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, ca | 103d ago |
| CVE-2026-52746 | 7.5 | — | — | — | jsonata / jsonata | JSONata is a JSON query and transformation language. | 103d ago |
| CVE-2026-45309 | 7.5 | — | — | — | asyncssh project / asyncssh | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol | 103d ago |
| CVE-2026-50273 | 7.5 | — | — | — | — | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. | 103d ago |
| CVE-2026-63101 | 7.5 | — | — | — | — | Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attac | 103d ago |
| CVE-2026-49212 | 7.5 | — | — | — | symfony / ux | Symfony UX is a JavaScript ecosystem for Symfony. | 103d ago |
| CVE-2026-49211 | 7.5 | — | — | — | symfony / ux | Symfony UX is a JavaScript ecosystem for Symfony. | 103d ago |
| CVE-2026-12691 | 7.5 | — | — | — | — | Missing authentication for critical function vulnerability in Vimesoft Inc. | 103d ago |
| CVE-2026-14741 | 7.5 | — | — | — | — | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. | 103d ago |
| CVE-2026-7488 | 7.5 | — | — | — | — | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. | 103d ago |
| CVE-2026-8396 | 7.5 | — | — | — | — | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. | 103d ago |
| CVE-2026-7189 | 7.5 | — | — | — | — | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. | 103d ago |
| CVE-2026-11575 | 7.5 | — | — | — | — | The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming | 104d ago |
| CVE-2026-13765 | 7.5 | — | — | — | — | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sen | 104d ago |
