| CVE-2026-14164 | 7.5 | — | — | — | — | A double free issue has been identified in libarchive's RAR5 reader. | 121d ago |
| CVE-2026-8023 | 7.5 | — | — | — | zephyrproject / zephyr | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS | 121d ago |
| CVE-2026-51219 | 7.5 | — | — | — | — | A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 | 121d ago |
| CVE-2026-51218 | 7.5 | — | — | — | — | A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 all | 121d ago |
| CVE-2026-51221 | 7.5 | — | — | — | — | A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cau | 121d ago |
| CVE-2026-41896 | 7.5 | — | — | — | — | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | 121d ago |
| CVE-2026-56018 | 7.5 | — | — | — | — | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded m | 121d ago |
| CVE-2026-56017 | 7.5 | — | — | — | — | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meanin | 121d ago |
| CVE-2026-56780 | 7.5 | — | — | — | — | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/p | 121d ago |
| CVE-2026-36848 | 7.5 | — | — | — | gigamon / gigavue-os | Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem. | 121d ago |
| CVE-2026-56124 | 7.5 | — | — | — | — | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attac | 121d ago |
| CVE-2026-55844 | 7.5 | — | — | — | — | Home Assistant is open source home automation software that puts local control and privacy first. | 121d ago |
| CVE-2026-49049exploited | 7.5 | 0.99% | 2/3 | +11d | ollyo / helix3 | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitra | 121d ago |
| CVE-2026-13676 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. | 121d ago |
| CVE-2026-41992 | 7.5 | — | — | — | gnu / gzip | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse o | 121d ago |
| CVE-2026-10083 | 7.5 | — | — | — | — | The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an | 122d ago |
| CVE-2026-36478 | 7.5 | — | — | — | — | An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the | 124d ago |
| CVE-2026-46604 | 7.5 | — | — | — | golang / tiff | The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. | 124d ago |
| CVE-2026-38641 | 7.5 | — | — | — | — | An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service | 124d ago |
| CVE-2026-38639 | 7.5 | — | — | — | — | An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denia | 124d ago |
| CVE-2026-53284 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree af | 124d ago |
| CVE-2026-47193 | 7.5 | — | — | — | — | OpenProject is open-source, web-based project management software. | 124d ago |
| CVE-2026-47220 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 124d ago |
| CVE-2026-54341 | 7.5 | — | — | — | — | Dragonfly is an in-memory data store built for modern application workloads. | 124d ago |
| CVE-2026-48743 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 124d ago |
| CVE-2026-48044 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 124d ago |
| CVE-2026-48042 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 124d ago |
| CVE-2026-57231 | 7.5 | — | — | — | podman project / podman | Podman is a tool for managing OCI containers and pods. | 124d ago |
| CVE-2026-55677 | 7.5 | — | — | — | — | Echo is a Go web framework. | 124d ago |
| CVE-2026-5757 | 7.5 | — | — | — | ollama / ollama | Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacke | 124d ago |
| CVE-2026-0828 | 7.5 | — | — | — | — | Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows | 124d ago |
| CVE-2026-57647 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions. | 124d ago |
| CVE-2026-56069 | 7.5 | — | — | — | — | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions. | 124d ago |
| CVE-2026-56061 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions. | 124d ago |
| CVE-2026-56060 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions. | 124d ago |
| CVE-2026-56029 | 7.5 | — | — | — | — | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions. | 124d ago |
| CVE-2026-56025 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions. | 124d ago |
| CVE-2026-54847 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions. | 124d ago |
| CVE-2026-54846 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions. | 124d ago |
| CVE-2026-54839 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule B | 124d ago |
| CVE-2026-54837 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions | 124d ago |
| CVE-2026-54835 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. | 124d ago |
| CVE-2026-54834 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. | 124d ago |
| CVE-2026-54832 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. | 124d ago |
| CVE-2026-54824 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. | 124d ago |
| CVE-2026-30041 | 7.5 | — | — | — | — | An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrar | 124d ago |
| CVE-2025-68064 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. | 124d ago |
| CVE-2025-68063 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 | 124d ago |
| CVE-2026-57913 | 7.5 | — | — | — | — | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and | 124d ago |
| CVE-2026-57912 | 7.5 | — | — | — | — | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and n | 124d ago |
| CVE-2026-11702 | 7.5 | — | — | — | — | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. | 124d ago |
| CVE-2026-11625 | 7.5 | — | — | — | — | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. | 124d ago |
| CVE-2026-57876 | 7.5 | — | — | — | — | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1 | 124d ago |
| CVE-2026-57875 | 7.5 | — | — | — | — | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsing logic of multiple CGI | 124d ago |
| CVE-2026-57874 | 7.5 | — | — | — | — | An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 and GV-LPC | 124d ago |
| CVE-2026-57873 | 7.5 | — | — | — | — | An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi in GeoVision GV-LPC2011 a | 124d ago |
| CVE-2026-57872 | 7.5 | — | — | — | — | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision GV-LPC2011 and GV-LPC221 | 124d ago |
| CVE-2026-49486 | 7.5 | — | — | — | apache / apache-airflow-providers-ftp | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `p | 124d ago |
| CVE-2026-10823 | 7.5 | — | — | — | — | The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints | 125d ago |
| CVE-2026-48933 | 7.5 | — | — | — | nodejs / node.js | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple | 125d ago |
