| CVE-2025-52293 | 7.5 | — | — | — | gpac / gpac | A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2. | 141d ago |
| CVE-2025-52292 | 7.5 | — | — | — | gpac / gpac | A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a | 141d ago |
| CVE-2023-43688 | 7.5 | — | — | — | — | An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). | 141d ago |
| CVE-2026-9076 | 7.5 | — | — | — | openssl / openssl | Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data | 141d ago |
| CVE-2026-49847 | 7.5 | — | — | — | freeswitch / freeswitch | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switch | 141d ago |
| CVE-2026-49842 | 7.5 | — | — | — | freeswitch / freeswitch | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switch | 141d ago |
| CVE-2026-49475 | 7.5 | — | — | — | freeswitch / freeswitch | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switch | 141d ago |
| CVE-2026-49160 | 7.5 | — | — | — | microsoft / windows 10 1607 | Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network. | 141d ago |
| CVE-2026-48563 | 7.5 | — | — | — | microsoft / windows 10 1809 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 141d ago |
| CVE-2026-47654 | 7.5 | — | — | — | microsoft / windows server 2016 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 141d ago |
| CVE-2026-45771 | 7.5 | — | — | — | freeswitch / freeswitch | FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switch | 141d ago |
| CVE-2026-45639 | 7.5 | — | — | — | microsoft / remote desktop client | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 141d ago |
| CVE-2026-45591 | 7.5 | — | — | — | microsoft / asp.net core | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 141d ago |
| CVE-2026-45583 | 7.5 | — | — | — | microsoft / exchange server | Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized atta | 141d ago |
| CVE-2026-45445 | 7.5 | — | — | — | openssl / openssl | Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, t | 141d ago |
| CVE-2026-44801 | 7.5 | — | — | — | microsoft / remote desktop client | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 141d ago |
| CVE-2026-44799 | 7.5 | — | — | — | microsoft / remote desktop client | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network | 141d ago |
| CVE-2026-42993 | 7.5 | — | — | — | microsoft / windows 10 21h2 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network | 141d ago |
| CVE-2026-42992 | 7.5 | — | — | — | microsoft / windows app | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network | 141d ago |
| CVE-2026-42913 | 7.5 | — | — | — | microsoft / remote desktop client | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Clie | 141d ago |
| CVE-2026-42909 | 7.5 | — | — | — | microsoft / remote desktop client | Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Clie | 141d ago |
| CVE-2026-42908 | 7.5 | — | — | — | microsoft / windows app | Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network. | 141d ago |
| CVE-2026-42765 | 7.5 | — | — | — | openssl / openssl | Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for t | 141d ago |
| CVE-2026-42764 | 7.5 | — | — | — | openssl / openssl | Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the | 141d ago |
| CVE-2026-42570 | 7.5 | — | — | — | svelte / devalue | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient fo | 141d ago |
| CVE-2026-42567 | 7.5 | — | — | — | svelte / svelte | Svelte is a performance oriented web framework. | 141d ago |
| CVE-2026-40376 | 7.5 | — | — | — | microsoft / visual studio code | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a netwo | 141d ago |
| CVE-2026-34183 | 7.5 | — | — | — | openssl / openssl | Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets contai | 141d ago |
| CVE-2026-34180 | 7.5 | — | — | — | openssl / openssl | Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 giga | 141d ago |
| CVE-2017-20250 | 7.5 | — | — | — | — | Mac Photo Gallery 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download ar | 141d ago |
| CVE-2017-20248 | 7.5 | — | — | — | — | Apptha Slider Gallery 1.0 contains a path traversal vulnerability that allows unauthenticated attackers to downloa | 141d ago |
| CVE-2026-46749 | 7.5 | — | — | — | siemens / sinec ins | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). | 141d ago |
| CVE-2026-9185 | 7.5 | — | — | — | — | The 6Storage Rentals plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all | 141d ago |
| CVE-2026-41850 | 7.5 | — | — | — | vmware / spring framework | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algori | 141d ago |
| CVE-2026-41849 | 7.5 | — | — | — | vmware / spring framework | An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). | 141d ago |
| CVE-2026-41842 | 7.5 | — | — | — | vmware / spring framework | Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resour | 141d ago |
| CVE-2026-41007 | 7.5 | — | — | — | vmware / spring hateoas | Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied stri | 141d ago |
| CVE-2026-41006 | 7.5 | — | — | — | vmware / spring hateoas | Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER me | 141d ago |
| CVE-2026-40984 | 7.5 | — | — | — | — | In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-ser | 141d ago |
| CVE-2026-40983 | 7.5 | — | — | — | — | In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-ser | 141d ago |
| CVE-2026-26236 | 7.5 | — | — | — | qnap / qumagie | A missing authorization vulnerability has been reported to affect QuMagie. | 141d ago |
| CVE-2026-11694 | 7.5 | — | — | — | google / chrome | Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had comprom | 142d ago |
| CVE-2026-11690 | 7.5 | — | — | — | google / chrome | Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker wh | 142d ago |
| CVE-2026-11667 | 7.5 | — | — | — | google / chrome | Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromise | 142d ago |
| CVE-2026-11644 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user | 142d ago |
| CVE-2026-11641 | 7.5 | — | — | — | google / chrome | Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who conv | 142d ago |
| CVE-2026-11639 | 7.5 | — | — | — | google / chrome | Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute | 142d ago |
| CVE-2026-11636 | 7.5 | — | — | — | google / chrome | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convi | 142d ago |
| CVE-2026-11632 | 7.5 | — | — | — | google / chrome | Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user | 142d ago |
| CVE-2026-40519 | 7.5 | — | — | — | — | Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code | 142d ago |
| CVE-2026-46306 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frame | 142d ago |
| CVE-2026-46304 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet | 142d ago |
| CVE-2026-49975 | 7.5 | — | — | — | apache / http server | Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of serv | 142d ago |
| CVE-2026-49755 | 7.5 | — | — | — | wojtekmach / req | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in wojtekmach Req allows attacker-c | 142d ago |
| CVE-2026-42536 | 7.5 | — | — | — | apache / http server | Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted con | 142d ago |
| CVE-2026-36786 | 7.5 | — | — | — | — | Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the list1 pa | 142d ago |
| CVE-2026-34356 | 7.5 | — | — | — | apache / http server | Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverse | 142d ago |
| CVE-2026-34355 | 7.5 | — | — | — | apache / http server | A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted back | 142d ago |
| CVE-2026-22164 | 7.5 | — | — | — | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap m | 142d ago |
| CVE-2026-49235 | 7.5 | — | — | — | nlnetlabs / routinator | When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crash | 142d ago |
