| CVE-2026-50877 | 7.5 | — | — | — | — | An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with name | 135d ago |
| CVE-2026-50870 | 7.5 | — | — | — | — | An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows at | 135d ago |
| CVE-2026-41708 | 7.5 | — | — | — | broadcom / spring cloud sleuth | In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-se | 135d ago |
| CVE-2026-39007 | 7.5 | — | — | — | — | An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information | 135d ago |
| CVE-2026-47777 | 7.5 | — | — | — | — | Mastodon is a free, open-source social network server based on ActivityPub. | 135d ago |
| CVE-2026-9863 | 7.5 | — | — | — | fortra / core privileged access manager server | Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for lega | 135d ago |
| CVE-2026-5079 | 7.5 | — | — | — | expressjs / multer | Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nest | 135d ago |
| CVE-2026-49064 | 7.5 | — | — | — | — | Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensit | 135d ago |
| CVE-2018-25437 | 7.5 | — | — | — | — | WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticate | 135d ago |
| CVE-2016-20081 | 7.5 | — | — | — | — | WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated a | 135d ago |
| CVE-2016-20076 | 7.5 | — | — | — | — | WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete ar | 135d ago |
| CVE-2026-9848 | 7.5 | — | — | — | — | The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in | 138d ago |
| CVE-2026-53868 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arb | 138d ago |
| CVE-2026-53834 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that | 138d ago |
| CVE-2026-4870 | 7.5 | — | — | — | ibm / qiskit software development kit | IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading to a denial of | 138d ago |
| CVE-2026-44786 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 138d ago |
| CVE-2026-50108 | 7.5 | — | — | — | — | The Naxclow platform API that returns device relay registration details exposes a persistent credential without ve | 138d ago |
| CVE-2026-12143 | 7.5 | — | — | — | — | form-data is a library for creating readable multipart/form-data streams. | 138d ago |
| CVE-2026-9638 | 7.5 | — | — | — | — | Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. | 138d ago |
| CVE-2026-50011 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-50010 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-48748 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-48059 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-48006 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-46340 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-45416 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-44894 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-44893 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 138d ago |
| CVE-2026-50645 | 7.5 | — | — | — | apache / cxf | There is no restriction on the amount of attachment headers that a message can contain when being deserialized by | 138d ago |
| CVE-2026-44892 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 139d ago |
| CVE-2026-44890 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 139d ago |
| CVE-2026-44250 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 139d ago |
| CVE-2025-46315 | 7.5 | — | — | — | apple / macos | A permissions issue was addressed with additional restrictions. | 139d ago |
| CVE-2026-46697 | 7.5 | — | — | — | — | Fediverse Embeds embeds fediverse posts on WordPress sites. | 139d ago |
| CVE-2026-3329 | 7.5 | — | — | — | sonatype / nexus repository manager | A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonat | 139d ago |
| CVE-2026-44496 | 7.5 | — | — | — | axios / axios | Axios is a promise based HTTP client for the browser and Node.js. | 139d ago |
| CVE-2026-44488 | 7.5 | — | — | — | axios / axios | Axios is a promise based HTTP client for the browser and Node.js. | 139d ago |
| CVE-2026-44487 | 7.5 | — | — | — | axios / axios | Axios is a promise based HTTP client for the browser and Node.js. | 139d ago |
| CVE-2026-44486 | 7.5 | — | — | — | axios / axios | Axios is a promise based HTTP client for the browser and Node.js. | 139d ago |
| CVE-2026-7787 | 7.5 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by b | 139d ago |
| CVE-2026-7250 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11 | 139d ago |
| CVE-2026-5497 | 7.5 | — | — | — | vllm / vllm | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unboun | 139d ago |
| CVE-2026-41856 | 7.5 | — | — | — | vmware / spring for graphql | The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotati | 139d ago |
| CVE-2026-53461 | 7.5 | — | — | — | imagemagick / imagemagick | ImageMagick is free and open-source software used for editing and manipulating digital images. | 140d ago |
| CVE-2026-53460 | 7.5 | — | — | — | imagemagick / imagemagick | ImageMagick is free and open-source software used for editing and manipulating digital images. | 140d ago |
| CVE-2026-52726 | 7.5 | — | — | — | — | Dulwich is a pure-Python implementation of the Git file formats and protocols. | 140d ago |
| CVE-2026-49218 | 7.5 | — | — | — | imagemagick / imagemagick | ImageMagick is free and open-source software used for editing and manipulating digital images. | 140d ago |
| CVE-2026-48110 | 7.5 | — | — | — | — | Russh is a Rust SSH client & server library. | 140d ago |
| CVE-2026-46702 | 7.5 | — | — | — | — | Russh is a Rust SSH client & server library. | 140d ago |
| CVE-2026-46679 | 7.5 | — | — | — | — | libp2p is a JavaScript Implementation of libp2p networking stack. | 140d ago |
| CVE-2026-46673 | 7.5 | — | — | — | — | Russh is a Rust SSH client & server library. | 140d ago |
| CVE-2026-46669 | 7.5 | — | — | — | openvm / openvm | OpenVM is a performant and modular zkVM framework built for customization and extensibility. | 140d ago |
| CVE-2026-46625 | 7.5 | — | — | — | js-cookie / javascript cookie | JavaScript Cookie is a JavaScript API for handling cookies, client-side. | 140d ago |
| CVE-2026-46522 | 7.5 | — | — | — | imagemagick / imagemagick | ImageMagick is free and open-source software used for editing and manipulating digital images. | 140d ago |
| CVE-2026-46520 | 7.5 | — | — | — | imagemagick / imagemagick | ImageMagick is free and open-source software used for editing and manipulating digital images. | 140d ago |
| CVE-2026-45783 | 7.5 | — | — | — | — | libp2p is a JavaScript Implementation of libp2p networking stack. | 140d ago |
| CVE-2026-42542 | 7.5 | — | — | — | tdengine / tdengine | TDengine is an open source, time-series database optimized for Internet of Things devices. | 140d ago |
| CVE-2026-10143 | 7.5 | — | — | — | dpkp / kafka-python | kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allow | 140d ago |
| CVE-2026-10142 | 7.5 | — | — | — | dpkp / kafka-python | kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malici | 140d ago |
| CVE-2026-0270 | 7.5 | — | — | — | paloaltonetworks / cortex xsoar | A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauth | 140d ago |
