| CVE-2026-62386 | 7.5 | — | — | — | — | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL | 104d ago |
| CVE-2026-62230 | 7.5 | — | — | — | — | Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking ac | 104d ago |
| CVE-2026-54340 | 7.5 | — | — | — | h2o / h2o | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. | 104d ago |
| CVE-2026-39359 | 7.5 | — | — | — | wazuh / wazuh | Wazuh is a free and open source platform used for threat prevention, detection, and response. | 104d ago |
| CVE-2026-34150 | 7.5 | — | — | — | wazuh / wazuh | Wazuh is a free and open source platform used for threat prevention, detection, and response. | 104d ago |
| CVE-2026-44453 | 7.5 | — | — | — | h2o / h2o | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. | 104d ago |
| CVE-2026-44436 | 7.5 | — | — | — | h2o / quicly | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. | 104d ago |
| CVE-2026-44435 | 7.5 | — | — | — | h2o / quicly | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. | 104d ago |
| CVE-2026-43977 | 7.5 | — | — | — | — | wger is a free, open-source workout and fitness manager. | 104d ago |
| CVE-2026-59117 | 7.5 | — | — | — | microsoft / terminal | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network. | 104d ago |
| CVE-2026-33692 | 7.5 | — | — | — | — | WWBN AVideo is an open source video platform. | 104d ago |
| CVE-2026-62309 | 7.5 | — | — | — | coredns.io / coredns | CoreDNS is a DNS server written in Go. | 104d ago |
| CVE-2026-15352 | 7.5 | — | — | — | — | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). | 104d ago |
| CVE-2026-45576 | 7.5 | — | — | — | netfoundry / zrok | zrok is software for sharing web services, files, and network resources. | 104d ago |
| CVE-2026-45367 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 104d ago |
| CVE-2026-13401 | 7.5 | — | — | — | — | XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. | 104d ago |
| CVE-2026-13397 | 7.5 | — | — | — | — | HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. | 104d ago |
| CVE-2026-53598 | 7.5 | — | — | — | — | Prompty is a markdown file format (.prompty) for LLM prompts. | 104d ago |
| CVE-2026-59862 | 7.5 | — | — | — | — | Kiota is an OpenAPI based HTTP Client code generator. | 104d ago |
| CVE-2026-59861 | 7.5 | — | — | — | — | Kiota is an OpenAPI based HTTP Client code generator. | 104d ago |
| CVE-2026-21729 | 7.5 | — | — | — | — | Loki queries with large limits can cause large memory allocations which can impact the availability of the service | 105d ago |
| CVE-2026-12753 | 7.5 | — | — | — | — | The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL | 105d ago |
| CVE-2026-48863 | 7.5 | — | — | — | — | A flaw was found in libsolv. | 105d ago |
| CVE-2026-23538 | 7.5 | — | — | — | — | A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to e | 105d ago |
| CVE-2026-36590 | 7.5 | — | — | — | emqx / nanomq | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set funct | 105d ago |
| CVE-2026-49353 | 7.5 | — | — | — | — | 9Router is an AI router & token saver. | 105d ago |
| CVE-2026-40957 | 7.5 | — | — | — | absolute / secure access | o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. | 105d ago |
| CVE-2026-62351 | 7.5 | — | — | — | — | TDengine is a time-series database optimized for Internet of Things devices. | 105d ago |
| CVE-2026-12997 | 7.5 | — | — | — | — | The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | 105d ago |
| CVE-2026-59955 | 7.5 | — | — | — | — | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. | 105d ago |
| CVE-2026-59954 | 7.5 | — | — | — | — | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. | 105d ago |
| CVE-2026-45804 | 7.5 | — | — | — | huggingface / diffusers | Diffusers is the a library for pretrained diffusion models. | 105d ago |
| CVE-2026-45793 | 7.5 | — | — | — | — | Composer is a dependency Manager for the PHP language. | 105d ago |
| CVE-2026-20187 | 7.5 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 105d ago |
| CVE-2026-20158 | 7.5 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 105d ago |
| CVE-2026-20157 | 7.5 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 105d ago |
| CVE-2026-20153 | 7.5 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 105d ago |
| CVE-2026-61371 | 7.5 | — | — | — | — | Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing trunc | 105d ago |
| CVE-2026-59762 | 7.5 | — | — | — | f5 / big-ip next cloud-native network functions | When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory res | 105d ago |
| CVE-2026-60085 | 7.5 | — | — | — | — | PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox bac | 105d ago |
| CVE-2026-56339 | 7.5 | — | — | — | — | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SE | 105d ago |
| CVE-2025-56365 | 7.5 | — | — | — | csa-iot / matter | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction mo | 106d ago |
| CVE-2025-56364 | 7.5 | — | — | — | csa-iot / matter | A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `Get | 106d ago |
| CVE-2025-56363 | 7.5 | — | — | — | csa-iot / matter | A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the Re | 106d ago |
| CVE-2025-56362 | 7.5 | — | — | — | csa-iot / matter | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within t | 106d ago |
| CVE-2026-54572 | 7.5 | — | — | — | rclone / rclone | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. | 106d ago |
| CVE-2026-48808 | 7.5 | — | — | — | symfony / twig | Twig is a template language for PHP. | 106d ago |
| CVE-2026-48352 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an applicat | 106d ago |
| CVE-2026-48351 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an applicat | 106d ago |
| CVE-2026-48295 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in | 106d ago |
| CVE-2025-56361 | 7.5 | — | — | — | csa-iot / matter | A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within t | 106d ago |
| CVE-2026-52100 | 7.5 | — | — | — | — | Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacke | 106d ago |
| CVE-2026-49855 | 7.5 | — | — | — | — | Tornado is a Python web framework and asynchronous networking library. | 106d ago |
| CVE-2026-49477 | 7.5 | — | — | — | facelessuser / soup sieve | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. | 106d ago |
| CVE-2026-49476 | 7.5 | — | — | — | facelessuser / soup sieve | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. | 106d ago |
| CVE-2026-48815 | 7.5 | — | — | — | — | sigstore-js provides JavaScript libraries for interacting with Sigstore services. | 106d ago |
| CVE-2026-48801 | 7.5 | — | — | — | markdown-it / linkify-it | linkify-it is a links recognition library with full Unicode support. | 106d ago |
| CVE-2026-47471 | 7.5 | — | — | — | — | NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could c | 106d ago |
| CVE-2026-15777 | 7.5 | — | — | — | google / chrome | Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a u | 106d ago |
| CVE-2026-15765 | 7.5 | — | — | — | google / chrome | Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to | 106d ago |
