| CVE-2026-57378 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Conf | 107d ago |
| CVE-2026-15574 | 7.5 | — | — | — | — | A flaw was found in the vllm-orchestrator-gateway component. | 108d ago |
| CVE-2026-14165 | 7.5 | — | — | — | — | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 th | 108d ago |
| CVE-2026-56238 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endp | 108d ago |
| CVE-2026-61439 | 7.5 | — | — | — | — | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold def | 109d ago |
| CVE-2026-56303 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL func | 109d ago |
| CVE-2026-9282exploited | 7.5 | 2.9% | 1/3 | +3d | — | The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | 110d ago |
| CVE-2026-4661 | 7.5 | — | — | — | — | The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based bli | 110d ago |
| CVE-2026-15335 | 7.5 | — | — | — | — | The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N | 110d ago |
| CVE-2026-15338 | 7.5 | — | — | — | — | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions | 110d ago |
| CVE-2026-55175 | 7.5 | — | — | — | linuxfoundation / spinnaker | Spinnaker is an open source, multi-cloud continuous delivery platform. | 110d ago |
| CVE-2026-44383 | 7.5 | — | — | — | — | Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker | 110d ago |
| CVE-2026-42952 | 7.5 | — | — | — | — | Previously, there was no throttling on repeated authentication attempts to the charging station backend, which cou | 110d ago |
| CVE-2026-57220 | 7.5 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 110d ago |
| CVE-2026-57219 | 7.5 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 110d ago |
| CVE-2026-55233 | 7.5 | — | — | — | openresty / openresty | OpenResty is a high performance web platform. | 110d ago |
| CVE-2026-55229 | 7.5 | — | — | — | — | Gotenberg is a Docker-powered stateless API for PDF files. | 110d ago |
| CVE-2026-55213 | 7.5 | — | — | — | — | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. | 110d ago |
| CVE-2026-55827 | 7.5 | — | — | — | freerdp / freerdp | FreeRDP is a free implementation of the Remote Desktop Protocol. | 110d ago |
| CVE-2026-59162 | 7.5 | — | — | — | excelize / excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | 110d ago |
| CVE-2026-59161 | 7.5 | — | — | — | excelize / excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | 110d ago |
| CVE-2026-55687 | 7.5 | — | — | — | — | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. | 110d ago |
| CVE-2026-54063 | 7.5 | — | — | — | excelize / excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | 110d ago |
| CVE-2026-39244 | 7.5 | — | — | — | — | adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed si | 110d ago |
| CVE-2025-70796 | 7.5 | — | — | — | — | An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology | 110d ago |
| CVE-2026-33382 | 7.5 | — | — | — | grafana / grafana | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before proc | 110d ago |
| CVE-2026-56279 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function tha | 110d ago |
| CVE-2026-38059 | 7.5 | — | — | — | — | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. | 110d ago |
| CVE-2026-40454 | 7.5 | — | — | — | — | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. | 111d ago |
| CVE-2026-40452 | 7.5 | — | — | — | — | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. | 111d ago |
| CVE-2026-40007 | 7.5 | — | — | — | — | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. | 111d ago |
| CVE-2026-40006 | 7.5 | — | — | — | — | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authent | 111d ago |
| CVE-2026-13347 | 7.5 | — | — | — | — | The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 | 111d ago |
| CVE-2026-12685 | 7.5 | — | — | — | — | The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor th | 111d ago |
| CVE-2026-15291 | 7.5 | — | — | — | — | The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure i | 111d ago |
| CVE-2026-15290 | 7.5 | — | — | — | — | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 111d ago |
| CVE-2026-15288 | 7.5 | — | — | — | — | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Vali | 111d ago |
| CVE-2026-59834 | 7.5 | — | — | — | — | SiYuan is an open-source personal knowledge management system. | 111d ago |
| CVE-2026-57026 | 7.5 | — | — | — | juniper / junos | An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos | 111d ago |
| CVE-2026-57023 | 7.5 | — | — | — | juniper / junos | An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Ju | 111d ago |
| CVE-2026-49256 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 111d ago |
| CVE-2026-45788 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 111d ago |
| CVE-2026-39246 | 7.5 | — | — | — | decompress project / decompress | decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. | 111d ago |
| CVE-2026-38076 | 7.5 | — | — | — | — | An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause | 111d ago |
| CVE-2026-15271 | 7.5 | — | — | — | — | A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and E | 111d ago |
| CVE-2026-51926 | 7.5 | — | — | — | — | An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the log | 111d ago |
| CVE-2026-15270 | 7.5 | — | — | — | dlink / dir-823g firmware | A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. | 111d ago |
| CVE-2026-54695 | 7.5 | — | — | — | pipecat / pipecat | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. | 111d ago |
| CVE-2026-0287 | 7.5 | — | — | — | paloaltonetworks / cloud ngfw | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker | 111d ago |
| CVE-2025-63579 | 7.5 | — | — | — | — | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. | 111d ago |
| CVE-2026-59720 | 7.5 | — | — | — | — | Hoppscotch is an open source API development ecosystem. | 111d ago |
| CVE-2026-55420 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 111d ago |
| CVE-2026-51606 | 7.5 | — | — | — | — | An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the de | 111d ago |
| CVE-2026-51605 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an | 111d ago |
| CVE-2026-51604 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an | 111d ago |
| CVE-2026-51603 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an | 111d ago |
| CVE-2026-51602 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an | 111d ago |
| CVE-2026-51601 | 7.5 | — | — | — | — | Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. | 111d ago |
| CVE-2026-51600 | 7.5 | — | — | — | — | Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including D | 111d ago |
| CVE-2026-15308 | 7.5 | — | — | — | python / python | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminate | 111d ago |
