| CVE-2026-48619 | 7.5 | — | — | — | nodejs / node.js | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to | 125d ago |
| CVE-2026-48615 | 7.5 | — | — | — | nodejs / node.js | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. | 125d ago |
| CVE-2026-9221 | 7.5 | — | — | — | — | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a reque | 125d ago |
| CVE-2026-9220 | 7.5 | — | — | — | — | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch | 125d ago |
| CVE-2026-8720 | 7.5 | — | — | — | wolfssl / wolfssl | wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, produci | 125d ago |
| CVE-2026-7532 | 7.5 | — | — | — | wolfssl / wolfssl | iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. | 125d ago |
| CVE-2026-7511 | 7.5 | — | — | — | wolfssl / wolfssl | PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correct | 125d ago |
| CVE-2026-6331 | 7.5 | — | — | — | wolfssl / wolfssl | HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HM | 125d ago |
| CVE-2026-6325 | 7.5 | — | — | — | wolfssl / wolfssl | Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a writ | 125d ago |
| CVE-2026-50176 | 7.5 | — | — | — | — | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. | 125d ago |
| CVE-2026-13283 | 7.5 | — | — | — | google / chrome | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convi | 125d ago |
| CVE-2026-11703 | 7.5 | — | — | — | wolfssl / wolfssl | Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed | 125d ago |
| CVE-2025-71324exploited | 7.5 | 1.6% | 1/3 | +38d | flowiseai / flowise | Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-uplo | 125d ago |
| CVE-2021-47987 | 7.5 | — | — | — | — | Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to | 125d ago |
| CVE-2021-47986 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the r | 125d ago |
| CVE-2026-6731 | 7.5 | — | — | — | wolfssl / wolfssl | X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. | 125d ago |
| CVE-2026-6679 | 7.5 | — | — | — | wolfssl / wolfssl | A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticat | 125d ago |
| CVE-2026-38640 | 7.5 | — | — | — | — | A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to caus | 125d ago |
| CVE-2026-38637 | 7.5 | — | — | — | — | An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denia | 125d ago |
| CVE-2026-37452 | 7.5 | — | — | — | — | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain | 125d ago |
| CVE-2026-55960 | 7.5 | — | — | — | wolfssl / wolfssl | Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. | 125d ago |
| CVE-2026-55958 | 7.5 | — | — | — | wolfssl / wolfssl | Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. | 125d ago |
| CVE-2026-46602 | 7.5 | — | — | — | — | The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt imag | 125d ago |
| CVE-2026-46601 | 7.5 | — | — | — | — | The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size. | 125d ago |
| CVE-2026-37454 | 7.5 | — | — | — | msi / center | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain | 125d ago |
| CVE-2026-37453 | 7.5 | — | — | — | msi / center | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain | 125d ago |
| CVE-2026-12340 | 7.5 | — | — | — | wolfssl / wolfssl | Out-of-bounds heap read during SM2/SM3 certificate signature verification. | 125d ago |
| CVE-2026-11310 | 7.5 | — | — | — | wolfssl / wolfssl | X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). | 125d ago |
| CVE-2026-10512 | 7.5 | — | — | — | wolfssl / wolfssl | The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reducti | 125d ago |
| CVE-2026-10097 | 7.5 | — | — | — | wolfssl / wolfssl | wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes du | 125d ago |
| CVE-2026-56770 | 7.5 | — | — | — | — | libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sent | 125d ago |
| CVE-2026-54094 | 7.5 | — | — | — | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within | 125d ago |
| CVE-2026-54091 | 7.5 | — | — | — | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within | 125d ago |
| CVE-2026-55967 | 7.5 | — | — | — | wolfssl / wolfssl | AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rej | 125d ago |
| CVE-2026-55961 | 7.5 | — | — | — | wolfssl / wolfssl | wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. | 125d ago |
| CVE-2026-55697 | 7.5 | — | — | — | pnpm / pnpm | pnpm is a package manager. | 125d ago |
| CVE-2026-55487 | 7.5 | — | — | — | pnpm / pnpm | pnpm is a package manager. | 125d ago |
| CVE-2026-48995 | 7.5 | — | — | — | pnpm / pnpm | pnpm is a package manager. | 125d ago |
| CVE-2026-11999 | 7.5 | — | — | — | wolfssl / wolfssl | X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_v | 125d ago |
| CVE-2026-55092 | 7.5 | — | — | — | aquasec / trivy | Trivy is a security scanner. | 125d ago |
| CVE-2026-13351 | 7.5 | — | — | — | zephyrproject / zephyr | Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a sma | 125d ago |
| CVE-2026-9716 | 7.5 | — | — | — | schneider-electric / powerlogic p7 firmware | CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the | 125d ago |
| CVE-2026-9650 | 7.5 | — | — | — | schneider-electric / easylogic t150 firmware | CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sen | 125d ago |
| CVE-2026-12844 | 7.5 | — | — | — | — | List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. | 125d ago |
| CVE-2026-57435 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri is an open source XML and HTML library for the Ruby programming language. | 125d ago |
| CVE-2026-57434 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri is an open source XML and HTML library for the Ruby programming language. | 125d ago |
| CVE-2026-56122 | 7.5 | — | — | — | — | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attacke | 125d ago |
| CVE-2026-54844 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions. | 125d ago |
| CVE-2026-54841 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | 125d ago |
| CVE-2026-54830 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions. | 125d ago |
| CVE-2026-54829 | 7.5 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. | 125d ago |
| CVE-2026-54828 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | 125d ago |
| CVE-2026-27366 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | 125d ago |
| CVE-2026-33612 | 7.5 | — | — | — | — | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to cache poisonin | 125d ago |
| CVE-2026-53244 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: VFS: fix possible failure to unlock in nfsd4_c | 125d ago |
| CVE-2026-53235 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb_gro_receive_li | 125d ago |
| CVE-2026-53229 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp_frame leak on | 125d ago |
| CVE-2026-53199 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_ | 125d ago |
| CVE-2026-53184 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: udp: clear skb->dev before running a sockmap v | 125d ago |
| CVE-2026-53183 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to shrink In MPTC | 125d ago |
