| CVE-2026-9963 | 7.5 | — | — | — | google / chrome | Uninitialized Use in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a | 153d ago |
| CVE-2026-9960 | 7.5 | — | — | — | google / chrome | Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised t | 153d ago |
| CVE-2026-9956 | 7.5 | — | — | — | google / chrome | Use after free in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a use | 153d ago |
| CVE-2026-9954 | 7.5 | — | — | — | google / chrome | Use after free in TabStrip in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user | 153d ago |
| CVE-2026-9934 | 7.5 | — | — | — | google / chrome | Use after free in Aura in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to e | 153d ago |
| CVE-2026-9933 | 7.5 | — | — | — | google / chrome | Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to | 153d ago |
| CVE-2026-9922 | 7.5 | — | — | — | google / chrome | Use after free in GPU in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised | 153d ago |
| CVE-2026-9909 | 7.5 | — | — | — | google / chrome | Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the | 153d ago |
| CVE-2026-9901 | 7.5 | — | — | — | google / chrome | Use after free in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the | 153d ago |
| CVE-2026-10022 | 7.5 | — | — | — | google / chrome | Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install | 153d ago |
| CVE-2026-10009 | 7.5 | — | — | — | google / chrome | Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised th | 153d ago |
| CVE-2026-10006 | 7.5 | — | — | — | google / chrome | Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code insi | 153d ago |
| CVE-2026-10005 | 7.5 | — | — | — | google / chrome | Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who con | 153d ago |
| CVE-2026-10003 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to | 153d ago |
| CVE-2026-48116 | 7.5 | — | — | — | mintplexlabs / anythingllm | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during | 153d ago |
| CVE-2026-44883 | 7.5 | — | — | — | portainer / portainer | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be | 153d ago |
| CVE-2026-39929 | 7.5 | — | — | — | — | Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read | 153d ago |
| CVE-2026-10044 | 7.5 | — | — | — | — | Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts | 153d ago |
| CVE-2026-46835 | 7.5 | — | — | — | oracle / database server | Vulnerability in the Net Service component of Oracle Database Server. | 153d ago |
| CVE-2026-46834 | 7.5 | — | — | — | oracle / database server | Vulnerability in the Net Service component of Oracle Database Server. | 153d ago |
| CVE-2026-46829 | 7.5 | — | — | — | oracle / rest data services | Vulnerability in Oracle REST Data Services (component: Mongoapi). | 153d ago |
| CVE-2026-49128 | 7.5 | — | — | — | — | Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrT | 153d ago |
| CVE-2026-32847 | 7.5 | — | — | — | hkuds / deepcode | DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backe | 153d ago |
| CVE-2026-45332 | 7.5 | — | — | — | — | Automad is a flat-file content management system and template engine. | 153d ago |
| CVE-2026-34126 | 7.5 | — | — | — | tp-link / tapo l535e firmware | TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Blu | 153d ago |
| CVE-2026-9096 | 7.5 | — | — | — | — | Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. | 153d ago |
| CVE-2026-45017 | 7.5 | — | — | — | jg-rp / python liquid | Python Liquid is a Python engine for the Liquid template language. | 153d ago |
| CVE-2026-44594 | 7.5 | — | — | — | — | esm.sh is a no-build content delivery network (CDN) for web development. | 153d ago |
| CVE-2026-41565 | 7.5 | — | — | — | — | CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. | 153d ago |
| CVE-2026-35672 | 7.5 | — | — | — | — | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiC | 153d ago |
| CVE-2026-46177 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message | 153d ago |
| CVE-2026-46133 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC p | 153d ago |
| CVE-2026-46124 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file han | 153d ago |
| CVE-2026-46114 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE paylo | 153d ago |
| CVE-2026-46110 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory | 153d ago |
| CVE-2026-7797 | 7.5 | — | — | — | — | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable t | 153d ago |
| CVE-2026-32995 | 7.5 | — | — | — | — | The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0 | 153d ago |
| CVE-2026-44660 | 7.5 | — | — | — | ultrajson project / ultrajson | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. | 154d ago |
| CVE-2026-8361 | 7.5 | — | — | — | — | A path traversal vulnerability exists in WOSDefaultHttpModule.dll when processing a URL path starting with /woshome | 154d ago |
| CVE-2026-8360 | 7.5 | — | — | — | — | Function calls to WOSCommonUtil.dll!WOSSysInfoGetDeviceInterface() in various DLLs (i.e., WOSProfileMgrModule.dll, | 154d ago |
| CVE-2026-8359 | 7.5 | — | — | — | — | When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loade | 154d ago |
| CVE-2026-45104 | 7.5 | — | — | — | osgeo / mapserver | MapServer is a system for developing web-based GIS applications. | 154d ago |
| CVE-2026-44635 | 7.5 | — | — | — | — | Kysely is a type-safe TypeScript SQL query builder. | 154d ago |
| CVE-2026-48151 | 7.5 | — | — | — | — | Budibase is an open-source low-code platform. | 154d ago |
| CVE-2026-45090 | 7.5 | — | — | — | — | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | 154d ago |
| CVE-2026-45088 | 7.5 | — | — | — | — | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | 154d ago |
| CVE-2026-45047 | 7.5 | — | — | — | — | bird-lg-go is a BIRD looking glass in Go. | 154d ago |
| CVE-2026-44378 | 7.5 | — | — | — | botan project / botan | Botan is a C++ cryptography library. | 154d ago |
| CVE-2026-44325 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open-source implementation of the 5G core network. | 154d ago |
| CVE-2026-44322 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open-source implementation of the 5G core network. | 154d ago |
| CVE-2026-44321 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open-source implementation of the 5G core network. | 154d ago |
| CVE-2026-44319 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open-source implementation of the 5G core network. | 154d ago |
| CVE-2026-44316 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open-source implementation of the 5G core network. | 154d ago |
| CVE-2026-42459 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open-source implementation of the 5G core network. | 154d ago |
| CVE-2026-48922 | 7.5 | — | — | — | jenkins / credentials binding | Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file a | 154d ago |
| CVE-2026-48921 | 7.5 | — | — | — | jenkins / pipeline\ | Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in sh | 154d ago |
| CVE-2026-48544 | 7.5 | — | — | — | — | Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() | 154d ago |
| CVE-2026-45022 | 7.5 | — | — | — | go-git project / go-git | go-git is an extensible git implementation library written in pure Go. | 154d ago |
| CVE-2026-44902 | 7.5 | — | — | — | opentelemetry / opentelemetry\/auto-instrumentations-node | opentelemetry-js is the OpenTelemetry JavaScript Client. | 154d ago |
| CVE-2026-8180 | 7.5 | — | — | — | ibm / aspera high-speed transfer endpoint | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3. | 154d ago |
