| CVE-2026-49234 | 7.5 | — | — | — | nlnetlabs / routinator | When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint | 142d ago |
| CVE-2026-49233 | 7.5 | — | — | — | nlnetlabs / routinator | Routinator does not properly check the module component of rsync URIs, which are used to create the file system pa | 142d ago |
| CVE-2026-43974 | 7.5 | — | — | — | ninenines / gun | Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP se | 142d ago |
| CVE-2026-43973 | 7.5 | — | — | — | ninenines / gun | Uncontrolled Resource Consumption vulnerability in ninenines gun (gun_http module) allows a malicious server to ex | 142d ago |
| CVE-2026-36789 | 7.5 | — | — | — | — | Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in | 142d ago |
| CVE-2026-47430 | 7.5 | — | — | — | apache / cordova inappbrowser | ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` | 142d ago |
| CVE-2026-3238 | 7.5 | — | — | — | — | A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. | 142d ago |
| CVE-2023-54350 | 7.5 | — | — | — | — | WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that a | 143d ago |
| CVE-2026-49494 | 7.5 | — | — | — | — | Xcitium Client Security (XCS) before 13.8.2.10019 and Comodo Internet Security (CIS) through 12.3.4.8162 (fix expe | 143d ago |
| CVE-2026-10725 | 7.5 | — | — | — | crux / protocol\ | Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. | 144d ago |
| CVE-2026-9290exploited | 7.5 | 2.5% | 1/3 | +129d | — | The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion | 145d ago |
| CVE-2026-36785 | 7.5 | — | — | — | — | Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the page par | 145d ago |
| CVE-2026-46493 | 7.5 | — | — | — | — | HAX CMS helps manage microsite universe with PHP or NodeJs backends. | 145d ago |
| CVE-2026-45291 | 7.5 | — | — | — | — | Cloudburst Network provides network components used within Cloudburst projects. | 145d ago |
| CVE-2026-45290 | 7.5 | — | — | — | — | Cloudburst Network provides network components used within Cloudburst projects. | 145d ago |
| CVE-2026-36501 | 7.5 | — | — | — | — | An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial o | 145d ago |
| CVE-2026-50234 | 7.5 | — | — | — | — | Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read ar | 145d ago |
| CVE-2026-21035 | 7.5 | — | — | — | samsung / plus tv | Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive | 145d ago |
| CVE-2026-11296 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who | 146d ago |
| CVE-2026-11265 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak | 146d ago |
| CVE-2026-11255 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a | 146d ago |
| CVE-2026-11242 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149.0.7827.53 allowed a remote att | 146d ago |
| CVE-2026-11239 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who h | 146d ago |
| CVE-2026-11154 | 7.5 | — | — | — | google / chrome | Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the r | 146d ago |
| CVE-2026-11151 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a r | 146d ago |
| CVE-2026-11149 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote | 146d ago |
| CVE-2026-11058 | 7.5 | — | — | — | google / chrome | Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacke | 146d ago |
| CVE-2026-10969 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote | 146d ago |
| CVE-2026-10946 | 7.5 | — | — | — | google / chrome | Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a us | 146d ago |
| CVE-2026-10906 | 7.5 | — | — | — | google / chrome | Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convince | 146d ago |
| CVE-2026-10901 | 7.5 | — | — | — | google / chrome | Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced | 146d ago |
| CVE-2026-10900 | 7.5 | — | — | — | google / chrome | Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced | 146d ago |
| CVE-2026-10899 | 7.5 | — | — | — | google / chrome | Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a | 146d ago |
| CVE-2025-8873 | 7.5 | — | — | — | — | On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane | 146d ago |
| CVE-2026-10796 | 7.5 | — | — | — | openjsf / node version manager | nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configu | 146d ago |
| CVE-2026-49941 | 7.5 | — | — | — | rrwo / net\ | Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. | 146d ago |
| CVE-2026-46741 | 7.5 | — | — | — | sanbeg / etsy\ | Etsy::StatsD versions through 1.002002 for Perl allow metric injections. | 146d ago |
| CVE-2026-38570 | 7.5 | — | — | — | — | bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a de | 146d ago |
| CVE-2026-28318exploited | 7.5 | 43.7% | 3/3 | +1d | solarwinds / serv-u | SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authenti | 146d ago |
| CVE-2025-46638 | 7.5 | — | — | — | — | Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. | 146d ago |
| CVE-2026-50213 | 7.5 | — | — | — | acer / connect m6e 5g firmware | The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be cra | 146d ago |
| CVE-2026-50210 | 7.5 | — | — | — | acer / connect m6e 5g firmware | The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible | 146d ago |
| CVE-2026-49193 | 7.5 | — | — | — | acer / connect m6e 5g firmware | Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly | 146d ago |
| CVE-2026-49187 | 7.5 | — | — | — | acer / connect m6e 5g firmware | The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential mi | 146d ago |
| CVE-2026-8829 | 7.5 | — | — | — | oalders / html\ | HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. | 147d ago |
| CVE-2026-41858 | 7.5 | — | — | — | — | Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-uti | 147d ago |
| CVE-2026-10737 | 7.5 | — | — | — | — | The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capab | 147d ago |
| CVE-2026-8889 | 7.5 | — | — | — | securly / securly | Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashe | 147d ago |
| CVE-2026-8888 | 7.5 | — | — | — | securly / securly | Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns | 147d ago |
| CVE-2026-8881 | 7.5 | — | — | — | securly / securly | Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a single iteration fo | 147d ago |
| CVE-2026-8879 | 7.5 | — | — | — | securly / securly | Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome | 147d ago |
| CVE-2026-8878 | 7.5 | — | — | — | securly / securly | Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that allow unauthentic | 147d ago |
| CVE-2026-46265 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunr | 147d ago |
| CVE-2026-37462 | 7.5 | — | — | — | — | An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to c | 147d ago |
| CVE-2026-37460 | 7.5 | — | — | — | — | Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10 | 147d ago |
| CVE-2026-41032 | 7.5 | — | — | — | — | It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclos | 147d ago |
| CVE-2026-50031 | 7.5 | — | — | — | — | ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. | 148d ago |
| CVE-2026-9516 | 7.5 | — | — | — | rurban / cpanel\ | Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode f | 148d ago |
| CVE-2026-42504 | 7.5 | — | — | — | — | Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. | 148d ago |
| CVE-2024-14036 | 7.5 | — | — | — | — | Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows ne | 148d ago |
