| CVE-2026-13462 | 7.5 | — | — | — | — | PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificat | 111d ago |
| CVE-2026-11404 | 7.5 | — | — | — | — | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv | 111d ago |
| CVE-2026-60109 | 7.5 | — | — | — | zeek / zeek | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows | 111d ago |
| CVE-2026-60108 | 7.5 | — | — | — | zeek / zeek | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauth | 111d ago |
| CVE-2026-56292 | 7.5 | — | — | — | acymailing / acymailing | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyM | 111d ago |
| CVE-2026-59692 | 7.5 | — | — | — | — | A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. | 111d ago |
| CVE-2026-1989 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. | 111d ago |
| CVE-2026-57111 | 7.5 | — | — | — | apache / helix | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters. | 112d ago |
| CVE-2026-31984 | 7.5 | — | — | — | nozominetworks / cmc | A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging func | 112d ago |
| CVE-2026-47840 | 7.5 | — | — | — | — | A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certifica | 112d ago |
| CVE-2026-47831 | 7.5 | — | — | — | — | Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-ste | 112d ago |
| CVE-2026-11571 | 7.5 | — | — | — | — | The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during emai | 112d ago |
| CVE-2026-54772 | 7.5 | — | — | — | — | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. | 112d ago |
| CVE-2026-54499 | 7.5 | — | — | — | stanford / stanza | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human la | 112d ago |
| CVE-2026-15117 | 7.5 | — | — | — | google / chrome | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user | 112d ago |
| CVE-2026-15111 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to | 112d ago |
| CVE-2026-55470 | 7.5 | — | — | — | hapifhir / hl7 fhir core | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 112d ago |
| CVE-2026-51535 | 7.5 | — | — | — | — | In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network pr | 112d ago |
| CVE-2026-44160 | 7.5 | — | — | — | fluentd / fluentd | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and s | 112d ago |
| CVE-2026-44025 | 7.5 | — | — | — | fluentd / fluentd | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and s | 112d ago |
| CVE-2026-56669 | 7.5 | — | — | — | — | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server | 112d ago |
| CVE-2026-49866 | 7.5 | — | — | — | — | libp2p is a JavaScript Implementation of libp2p networking stack. | 112d ago |
| CVE-2026-15167 | 7.5 | — | — | — | wireshark / wireshark | DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 112d ago |
| CVE-2026-0288 | 7.5 | — | — | — | paloaltonetworks / pan-os | Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks | 112d ago |
| CVE-2026-59939 | 7.5 | — | — | — | httplib2 project / httplib2 | httplib2 is a comprehensive HTTP client library for Python. | 112d ago |
| CVE-2026-59936 | 7.5 | — | — | — | pypdf project / pypdf | pypdf is a free and open-source pure-python PDF library. | 112d ago |
| CVE-2026-59935 | 7.5 | — | — | — | pypdf project / pypdf | pypdf is a free and open-source pure-python PDF library. | 112d ago |
| CVE-2026-59803 | 7.5 | — | — | — | — | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode | 112d ago |
| CVE-2026-58250 | 7.5 | — | — | — | linuxfoundation / nats-server | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. | 112d ago |
| CVE-2026-58210 | 7.5 | — | — | — | linuxfoundation / nats-server | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. | 112d ago |
| CVE-2026-55760 | 7.5 | — | — | — | — | Handlebars.java provides logic-less and semantic Mustache templates with Java. | 112d ago |
| CVE-2026-55404 | 7.5 | — | — | — | yt-dlp project / yt-dlp | yt-dlp and youtube-dl are command-line audio/video downloaders. | 112d ago |
| CVE-2026-59937 | 7.5 | — | — | — | pypdf project / pypdf | pypdf is a free and open-source pure-python PDF library. | 112d ago |
| CVE-2026-59928 | 7.5 | — | — | — | mistune project / mistune | Mistune is a Python Markdown parser with renderers and plugins. | 112d ago |
| CVE-2026-59925 | 7.5 | — | — | — | mistune project / mistune | Mistune is a Python Markdown parser with renderers and plugins. | 112d ago |
| CVE-2026-59922 | 7.5 | — | — | — | mistune project / mistune | Mistune is a Python Markdown parser with renderers and plugins. | 112d ago |
| CVE-2026-59892 | 7.5 | — | — | — | — | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. | 112d ago |
| CVE-2026-59887 | 7.5 | — | — | — | markdown-it / linkify-it | linkify-it is a links recognition library with full Unicode support. | 112d ago |
| CVE-2026-59879 | 7.5 | — | — | — | immutable-js / immutable | Immutable.js provides many Persistent Immutable data structures. | 112d ago |
| CVE-2026-29008 | 7.5 | — | — | — | denx / u-boot | U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net | 112d ago |
| CVE-2025-3110 | 7.5 | — | — | — | openvpn / openvpn access server | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remo | 112d ago |
| CVE-2026-59880 | 7.5 | — | — | — | immutable-js / immutable | Immutable.js provides many Persistent Immutable data structures. | 112d ago |
| CVE-2026-59874 | 7.5 | — | — | — | isaacs / tar | node-tar is a tar archive manipulation library for Node.js. | 112d ago |
| CVE-2026-59873 | 7.5 | — | — | — | isaacs / tar | node-tar is a tar archive manipulation library for Node.js. | 112d ago |
| CVE-2026-59869 | 7.5 | — | — | — | nodeca / js-yaml | js-yaml is a JavaScript YAML parser and dumper. | 112d ago |
| CVE-2026-59725 | 7.5 | — | — | — | socket / engine.io | Socket.IO enables bidirectional and low-latency communication for every platform. | 112d ago |
| CVE-2026-59724 | 7.5 | — | — | — | socket / engine.io | Socket.IO enables bidirectional and low-latency communication for every platform. | 112d ago |
| CVE-2026-59703 | 7.5 | — | — | — | — | repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attack | 112d ago |
| CVE-2026-49147 | 7.5 | — | — | — | — | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several ou | 112d ago |
| CVE-2026-49146 | 7.5 | — | — | — | — | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackr | 112d ago |
| CVE-2026-49145 | 7.5 | — | — | — | — | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. | 112d ago |
| CVE-2026-10708 | 7.5 | — | — | — | — | This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. | 112d ago |
| CVE-2026-10706 | 7.5 | — | — | — | — | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user | 112d ago |
| CVE-2026-10699 | 7.5 | — | — | — | progress / moveit transfer | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modul | 112d ago |
| CVE-2026-58656 | 7.5 | — | — | — | — | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Acces | 112d ago |
| CVE-2026-56250 | 7.5 | — | — | — | — | Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through Postg | 112d ago |
| CVE-2026-56226 | 7.5 | — | — | — | — | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), | 112d ago |
| CVE-2026-53482 | 7.5 | — | — | — | dell / data domain operating system | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS | 112d ago |
| CVE-2026-44840 | 7.5 | — | — | — | — | Dgraph is an open source distributed GraphQL database. | 112d ago |
| CVE-2026-15053 | 7.5 | — | — | — | tanium / server | Tanium addressed a denial of service vulnerability in Tanium Server. | 112d ago |
