| CVE-2026-53180 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: timers/migration: Fix livelock in tmigr_handle | 125d ago |
| CVE-2026-53165 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null folio->mapping der | 125d ago |
| CVE-2026-12937 | 7.5 | — | — | — | — | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulne | 125d ago |
| CVE-2026-9702 | 7.5 | — | — | — | — | The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer b | 125d ago |
| CVE-2026-12490 | 7.5 | — | — | — | nlnetlabs / nsd | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certif | 125d ago |
| CVE-2026-12245 | 7.5 | — | — | — | nlnetlabs / nsd | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the | 125d ago |
| CVE-2026-13311 | 7.5 | — | — | — | shell-quote project / shell-quote | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator | 126d ago |
| CVE-2026-12077exploited | 7.5 | 0.46% | 1/3 | +110d | — | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude | 126d ago |
| CVE-2025-60474 | 7.5 | — | — | — | gpac / gpac | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02. | 126d ago |
| CVE-2025-60467 | 7.5 | — | — | — | gpac / gpac | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/M | 126d ago |
| CVE-2026-9776 | 7.5 | — | — | — | aten / unizon | ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. | 126d ago |
| CVE-2026-54066exploited | 7.5 | 2.2% | 1/3 | +40d | — | SiYuan is an open-source personal knowledge management system. | 126d ago |
| CVE-2026-52794 | 7.5 | — | — | — | sentry / sentry | Sentry is an error tracking and performance monitoring tool. | 126d ago |
| CVE-2026-52799 | 7.5 | — | — | — | — | Gogs is an open source self-hosted Git service. | 126d ago |
| CVE-2026-50129 | 7.5 | — | — | — | — | Mastodon is a free, open-source social network server based on ActivityPub. | 126d ago |
| CVE-2026-1840 | 7.5 | — | — | — | — | The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication | 126d ago |
| CVE-2026-53950 | 7.5 | — | — | — | — | @tryghost/activitypub is Ghost’s social/federation client app. | 126d ago |
| CVE-2026-13029 | 7.5 | — | — | — | google / chrome | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a | 126d ago |
| CVE-2026-49851 | 7.5 | — | — | — | — | Mistune is a Python Markdown parser with renderers and plugins. | 126d ago |
| CVE-2026-44020 | 7.5 | — | — | — | docling / docling | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative A | 126d ago |
| CVE-2026-44017 | 7.5 | — | — | — | docling / docling | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative A | 126d ago |
| CVE-2026-54904 | 7.5 | — | — | — | rubyconcurrency / concurrent ruby | concurrent-ruby is a modern concurrency tools for Ruby. | 126d ago |
| CVE-2026-54297 | 7.5 | — | — | — | faraday project / faraday | Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. | 126d ago |
| CVE-2026-53087 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix leaking free_bds While recl | 126d ago |
| CVE-2026-53070 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmi | 126d ago |
| CVE-2026-53069 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net, bpf: fix null-ptr-deref in xdp_master_red | 126d ago |
| CVE-2026-53026 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4_file access extra count in nfsd | 126d ago |
| CVE-2026-53003 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 stat | 126d ago |
| CVE-2026-52998 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL d | 126d ago |
| CVE-2026-52983 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix BQL imbalance in TX path Fix | 126d ago |
| CVE-2026-52981 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: neigh: let neigh_xmit take skb ownership neigh | 126d ago |
| CVE-2026-52974 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: tls: fix strparser anchor skb leak on off | 126d ago |
| CVE-2026-52960 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ceph: put folios not suitable for writeback Th | 126d ago |
| CVE-2026-52957 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decod | 126d ago |
| CVE-2026-52956 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in | 126d ago |
| CVE-2026-52954 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in deco | 126d ago |
| CVE-2026-52946 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fas | 126d ago |
| CVE-2026-52945 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAP | 126d ago |
| CVE-2026-11877 | 7.5 | — | — | — | microfocus / access manager | An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. | 126d ago |
| CVE-2026-57281 | 7.5 | — | — | — | jenkins / script security | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotation | 126d ago |
| CVE-2026-56270exploited | 7.5 | 2.0% | 1/3 | +14d | flowiseai / flowise | Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/ | 126d ago |
| CVE-2026-52932 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: xfrm: ipcomp: Free destination pages on acomp | 126d ago |
| CVE-2026-52929 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-strea | 126d ago |
| CVE-2026-52922 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation err | 126d ago |
| CVE-2026-9179 | 7.5 | — | — | — | — | The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-jso | 126d ago |
| CVE-2026-9178 | 7.5 | — | — | — | — | The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and includ | 126d ago |
| CVE-2026-8705 | 7.5 | — | — | — | — | The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter | 126d ago |
| CVE-2026-10735zero day | 7.5 | 0.43% | 1/3 | 8d before | — | Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3. | 126d ago |
| CVE-2026-50193 | 7.5 | — | — | — | fasterxml / jackson-databind | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor | 127d ago |
| CVE-2026-53754 | 7.5 | — | — | — | kidocode / crawl4ai | Crawl4AI is an open-source LLM friendly web crawler & scraper. | 127d ago |
| CVE-2026-52844 | 7.5 | — | — | — | caddyserver / caddy | Caddy is an extensible server platform that uses TLS by default. | 127d ago |
| CVE-2025-61029 | 7.5 | — | — | — | — | An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of | 127d ago |
| CVE-2025-61024 | 7.5 | — | — | — | — | An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Den | 127d ago |
| CVE-2026-55446 | 7.5 | — | — | — | langflow / langflow | Langflow is a tool for building and deploying AI-powered agents and workflows. | 127d ago |
| CVE-2026-13007 | 7.5 | — | — | — | tenable / identity exposure | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive app | 127d ago |
| CVE-2025-61028 | 7.5 | — | — | — | — | An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial | 127d ago |
| CVE-2025-61027 | 7.5 | — | — | — | — | An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of | 127d ago |
| CVE-2025-61025 | 7.5 | — | — | — | — | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial | 127d ago |
| CVE-2025-61023 | 7.5 | — | — | — | — | An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of | 127d ago |
| CVE-2025-61022 | 7.5 | — | — | — | — | An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a De | 127d ago |
