| CVE-2026-5356 | 7.5 | — | — | — | — | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper | 112d ago |
| CVE-2026-6854 | 7.5 | — | — | — | — | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via | 112d ago |
| CVE-2026-6230 | 7.5 | — | — | — | — | The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in a | 112d ago |
| CVE-2026-9700 | 7.5 | — | — | — | — | The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions | 113d ago |
| CVE-2026-9842 | 7.5 | — | — | — | — | The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions u | 113d ago |
| CVE-2026-14244 | 7.5 | — | — | — | — | The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and | 113d ago |
| CVE-2026-51937 | 7.5 | — | — | — | — | An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java | 113d ago |
| CVE-2026-14895 | 7.5 | — | — | — | — | String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. | 113d ago |
| CVE-2026-58469 | 7.5 | — | — | — | gnu / wget | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_meta | 113d ago |
| CVE-2026-59708 | 7.5 | — | — | — | — | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating gr | 113d ago |
| CVE-2026-56812 | 7.5 | — | — | — | phoenixframework / phoenix | Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScrip | 113d ago |
| CVE-2026-56811 | 7.5 | — | — | — | phoenixframework / phoenix | Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket mod | 113d ago |
| CVE-2026-6101 | 7.5 | — | — | — | — | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up | 113d ago |
| CVE-2026-5799 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. | 114d ago |
| CVE-2026-5730 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. | 114d ago |
| CVE-2026-38976 | 7.5 | — | — | — | — | mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a | 114d ago |
| CVE-2026-55727 | 7.5 | — | — | — | — | A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to buil | 114d ago |
| CVE-2026-55574 | 7.5 | — | — | — | vllm / vllm | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. | 114d ago |
| CVE-2026-54234 | 7.5 | — | — | — | vllm / vllm | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. | 114d ago |
| CVE-2026-55380 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 114d ago |
| CVE-2026-55379 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 114d ago |
| CVE-2026-54060 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 114d ago |
| CVE-2026-54059 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 114d ago |
| CVE-2026-13753 | 7.5 | — | — | — | — | Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unau | 114d ago |
| CVE-2026-40140 | 7.5 | — | — | — | beyondtrust / privileged remote access | BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability i | 114d ago |
| CVE-2026-13698 | 7.5 | — | — | — | openvpn / openvpn | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows re | 114d ago |
| CVE-2026-13708 | 7.5 | — | — | — | — | Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers | 114d ago |
| CVE-2026-55994 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery | 114d ago |
| CVE-2026-55993 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery | 114d ago |
| CVE-2026-46726 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery | 114d ago |
| CVE-2026-46592 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF | 114d ago |
| CVE-2026-46585 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene C | 114d ago |
| CVE-2026-46457 | 7.5 | — | — | — | apache / camel | Improper Input Validation vulnerability in Apache Camel NATS component. | 114d ago |
| CVE-2026-24012 | 7.5 | — | — | — | apache / iotdb | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. | 114d ago |
| CVE-2026-14809 | 7.5 | — | — | — | — | Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote at | 114d ago |
| CVE-2024-6228 | 7.5 | — | — | — | — | The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value | 115d ago |
| CVE-2026-14570 | 7.5 | — | — | — | — | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator | 116d ago |
| CVE-2026-58421 | 7.5 | — | — | — | — | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | 117d ago |
| CVE-2026-58419 | 7.5 | — | — | — | — | Notification API leaks private issue metadata after access revocation | 117d ago |
| CVE-2026-58299 | 7.5 | — | — | — | microsoft / edge chromium | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to | 117d ago |
| CVE-2026-58294 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 117d ago |
| CVE-2026-58292 | 7.5 | — | — | — | microsoft / edge chromium | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over | 117d ago |
| CVE-2026-58290 | 7.5 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 117d ago |
| CVE-2026-58276 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 117d ago |
| CVE-2026-57992 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 117d ago |
| CVE-2026-57986 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 117d ago |
| CVE-2026-57984 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 117d ago |
| CVE-2026-57975 | 7.5 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 117d ago |
| CVE-2026-27779 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allow | 117d ago |
| CVE-2026-27660 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write per | 117d ago |
| CVE-2026-27657 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 allow a user to change another user's primary email address. | 117d ago |
| CVE-2026-26307 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume | 117d ago |
| CVE-2026-25712 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden member | 117d ago |
| CVE-2026-25038 | 7.5 | — | — | — | — | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | 117d ago |
| CVE-2026-24690 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. | 117d ago |
| CVE-2026-24451 | 7.5 | — | — | — | — | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exp | 117d ago |
| CVE-2026-47896 | 7.5 | — | — | — | apache / lucene.net | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net | 117d ago |
| CVE-2026-47897 | 7.5 | — | — | — | apache / lucene.net | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net | 118d ago |
| CVE-2026-9546 | 7.5 | — | — | — | haxx / curl | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. | 118d ago |
| CVE-2026-9545 | 7.5 | — | — | — | haxx / curl | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second t | 118d ago |
