| CVE-2026-8932 | 7.5 | — | — | — | haxx / curl | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that | 118d ago |
| CVE-2026-4967 | 7.5 | — | — | — | — | In IMS, there is a possible out of bounds read due to a missing bounds check. | 118d ago |
| CVE-2026-12064 | 7.5 | — | — | — | haxx / curl | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs | 118d ago |
| CVE-2026-11586 | 7.5 | — | — | — | haxx / curl | By default, curl automatically responds to WebSocket PING frames. | 118d ago |
| CVE-2026-11352 | 7.5 | — | — | — | haxx / curl | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of servic | 118d ago |
| CVE-2026-14352 | 7.5 | — | — | — | — | The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ | 118d ago |
| CVE-2026-14327 | 7.5 | — | — | — | — | The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | 118d ago |
| CVE-2026-13084 | 7.5 | — | — | — | watchguard / fireware | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to | 118d ago |
| CVE-2026-12413 | 7.5 | — | — | — | libreswan / libreswan | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. | 118d ago |
| CVE-2026-52192 | 7.5 | — | — | — | — | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the | 118d ago |
| CVE-2026-52191 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 118d ago |
| CVE-2026-52189 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 118d ago |
| CVE-2026-38970 | 7.5 | — | — | — | — | pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. | 118d ago |
| CVE-2026-59096 | 7.5 | — | — | — | — | Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration doc | 118d ago |
| CVE-2026-59094 | 7.5 | — | — | — | — | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed | 118d ago |
| CVE-2026-58467 | 7.5 | — | — | — | — | Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenti | 118d ago |
| CVE-2026-52187 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 118d ago |
| CVE-2026-58465 | 7.5 | — | — | — | — | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block | 118d ago |
| CVE-2026-55952 | 7.5 | — | — | — | erlang / erlang\/otp | The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 C | 118d ago |
| CVE-2024-58352zero day | 7.5 | 0.90% | 1/3 | same day | — | Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query | 118d ago |
| CVE-2026-56842 | 7.5 | — | — | — | ui / unifi network application | A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization | 118d ago |
| CVE-2026-55113 | 7.5 | — | — | — | ui / unifi talk application | A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability foun | 118d ago |
| CVE-2026-55112 | 7.5 | — | — | — | ui / unifi dream machine pro firmware | A malicious actor with access to the network and low privileges and under certain conditions could exploit an Impr | 118d ago |
| CVE-2026-55111 | 7.5 | — | — | — | ui / protect floodlight firmware | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect F | 118d ago |
| CVE-2026-55110 | 7.5 | — | — | — | ui / unifi os server | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharin | 118d ago |
| CVE-2026-54409 | 7.5 | — | — | — | ui / unifi protect | A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization | 118d ago |
| CVE-2026-54405 | 7.5 | — | — | — | ui / unifi network application | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni | 118d ago |
| CVE-2026-58652 | 7.5 | — | — | — | — | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding | 118d ago |
| CVE-2026-57749 | 7.5 | — | — | — | — | Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions. | 118d ago |
| CVE-2026-57748 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Shopify <= 1.0.0 versions. | 118d ago |
| CVE-2026-39448 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. | 118d ago |
| CVE-2026-11946 | 7.5 | — | — | — | — | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. | 118d ago |
| CVE-2025-69134 | 7.5 | — | — | — | — | Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. | 118d ago |
| CVE-2025-69133 | 7.5 | — | — | — | — | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. | 118d ago |
| CVE-2026-8441exploited | 7.5 | 0.46% | 1/3 | +103d | — | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the | 118d ago |
| CVE-2026-13369exploited | 7.5 | 0.60% | 1/3 | +103d | — | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() fu | 118d ago |
| CVE-2026-13251 | 7.5 | — | — | — | — | The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2. | 118d ago |
| CVE-2026-9563 | 7.5 | — | — | — | — | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a defaul | 118d ago |
| CVE-2026-33592 | 7.5 | — | — | — | — | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. | 119d ago |
| CVE-2026-14249 | 7.5 | — | — | — | — | The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 v | 119d ago |
| CVE-2026-14426 | 7.5 | — | — | — | google / chrome | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to eng | 119d ago |
| CVE-2026-14409 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced | 119d ago |
| CVE-2026-52190 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 119d ago |
| CVE-2026-38891 | 7.5 | — | — | — | — | An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers | 119d ago |
| CVE-2026-36912 | 7.5 | — | — | — | — | A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4 | 119d ago |
| CVE-2026-58593 | 7.5 | — | — | — | nodebb / nodebb | NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. | 119d ago |
| CVE-2026-14265 | 7.5 | — | — | — | amazon / advanced jdbc wrapper | Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3 | 119d ago |
| CVE-2026-49119 | 7.5 | — | — | — | gradio project / gradio | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method th | 119d ago |
| CVE-2026-54428 | 7.5 | — | — | — | apache / httpcomponents core | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5. | 119d ago |
| CVE-2026-58454 | 7.5 | — | — | — | — | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability | 119d ago |
| CVE-2026-54399 | 7.5 | — | — | — | apache / httpcomponents core | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4. | 119d ago |
| CVE-2026-20244 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 119d ago |
| CVE-2026-20243 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 119d ago |
| CVE-2026-20217 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to caus | 119d ago |
| CVE-2026-20216 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker | 119d ago |
| CVE-2026-20215 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 119d ago |
| CVE-2026-20214 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 119d ago |
| CVE-2026-20213 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 119d ago |
| CVE-2026-20191 | 7.5 | — | — | — | — | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files f | 119d ago |
| CVE-2026-58036 | 7.5 | — | — | — | mediawiki / mediawiki | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. | 119d ago |
