| CVE-2018-25365 | 7.5 | — | — | — | — | PCViewer vt1000 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitra | 156d ago |
| CVE-2026-48829 | 7.5 | — | — | — | — | In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a know | 157d ago |
| CVE-2018-25358 | 7.5 | — | — | — | — | D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retri | 158d ago |
| CVE-2026-23663 | 7.5 | — | — | — | microsoft / global secure access | Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a netwo | 159d ago |
| CVE-2025-45145 | 7.5 | — | — | — | — | Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote | 159d ago |
| CVE-2026-8671 | 7.5 | — | — | — | avantra / avantra | Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows all | 159d ago |
| CVE-2026-44417 | 7.5 | — | — | — | apache / cxf | The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that | 159d ago |
| CVE-2026-5740 | 7.5 | — | — | — | mattermost / mattermost server | Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly vali | 159d ago |
| CVE-2026-9011 | 7.5 | — | — | — | — | The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass | 159d ago |
| CVE-2026-8679 | 7.5 | — | — | — | — | The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and incl | 159d ago |
| CVE-2026-4834 | 7.5 | — | — | — | — | The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions u | 159d ago |
| CVE-2026-46597 | 7.5 | — | — | — | golang / crypto | An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well- | 159d ago |
| CVE-2026-39829 | 7.5 | — | — | — | golang / crypto | The RSA and DSA public key parsers did not enforce size limits on key parameters. | 159d ago |
| CVE-2026-46473 | 7.5 | — | — | — | — | Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. | 160d ago |
| CVE-2025-13479 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. | 160d ago |
| CVE-2026-45255 | 7.5 | — | — | — | freebsd / freebsd | When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names | 160d ago |
| CVE-2026-42001 | 7.5 | — | — | — | powerdns / authoritative | Insufficient Validation of Autoprimary SOA Queries | 160d ago |
| CVE-2026-44062 | 7.5 | — | — | — | — | A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authe | 160d ago |
| CVE-2026-44060 | 7.5 | — | — | — | — | An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker t | 160d ago |
| CVE-2026-44055 | 7.5 | — | — | — | — | A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attack | 160d ago |
| CVE-2026-44052 | 7.5 | — | — | — | — | Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an atta | 160d ago |
| CVE-2026-44049 | 7.5 | — | — | — | — | An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allow | 160d ago |
| CVE-2026-40092 | 7.5 | — | — | — | — | nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. | 161d ago |
| CVE-2026-47373 | 7.5 | — | — | — | — | Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing attacks. | 161d ago |
| CVE-2026-9137 | 7.5 | — | — | — | misp-project / misp | The CSP report endpoint in MISP intended to limit logged CSP reports to 1 KB but incorrectly allowed reports up to | 161d ago |
| CVE-2026-9123 | 7.5 | — | — | — | google / chrome | Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a l | 161d ago |
| CVE-2026-9117 | 7.5 | — | — | — | google / chrome | Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had | 161d ago |
| CVE-2026-20239 | 7.5 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2. | 161d ago |
| CVE-2026-39047 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RA | 161d ago |
| CVE-2025-32750 | 7.5 | — | — | — | dell / powerflex appliance intelligent catalog | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulner | 161d ago |
| CVE-2026-5947 | 7.5 | — | — | — | isc / bind | Undefined behavior may result due to a race condition leading to a use-after-free violation. | 161d ago |
| CVE-2026-5946 | 7.5 | — | — | — | isc / bind | Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet | 161d ago |
| CVE-2026-3039 | 7.5 | — | — | — | isc / bind | BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive me | 161d ago |
| CVE-2026-9064 | 7.5 | — | — | — | redhat / directory server | A flaw was found in 389-ds-base. | 161d ago |
| CVE-2026-42959 | 7.5 | — | — | — | nlnetlabs / unbound | NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validato | 161d ago |
| CVE-2026-42944 | 7.5 | — | — | — | nlnetlabs / unbound | NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow whe | 161d ago |
| CVE-2026-41292 | 7.5 | — | — | — | nlnetlabs / unbound | NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to | 161d ago |
| CVE-2026-40622 | 7.5 | — | — | — | nlnetlabs / unbound | NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the 'ghost domain names' famil | 161d ago |
| CVE-2026-9010 | 7.5 | — | — | — | — | The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' para | 161d ago |
| CVE-2026-9003 | 7.5 | — | — | — | — | E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remot | 161d ago |
| CVE-2026-24210 | 7.5 | — | — | — | nvidia / triton inference server | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an integer overflow. | 161d ago |
| CVE-2026-24209 | 7.5 | — | — | — | nvidia / triton inference server | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. | 161d ago |
| CVE-2026-24163 | 7.5 | — | — | — | nvidia / tensorrt llm | NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe d | 161d ago |
| CVE-2025-33255 | 7.5 | — | — | — | nvidia / tensorrt llm | NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe de | 161d ago |
| CVE-2026-3985 | 7.5 | — | — | — | — | The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Inject | 162d ago |
| CVE-2026-8073 | 7.5 | — | — | — | — | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary fil | 162d ago |
| CVE-2026-33633 | 7.5 | — | — | — | kovidgoyal / kitty | Kitty is a cross-platform GPU based terminal. | 162d ago |
| CVE-2026-47358 | 7.5 | — | — | — | tenable / terrascan | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in up | 162d ago |
| CVE-2026-47357 | 7.5 | — | — | — | tenable / terrascan | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in t | 162d ago |
| CVE-2026-47356 | 7.5 | — | — | — | tenable / terrascan | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in | 162d ago |
| CVE-2026-47100zero day | 7.5 | 0.46% | 1/3 | 5d before | — | Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the pu | 162d ago |
| CVE-2026-43634 | 7.5 | — | — | — | — | HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote atta | 162d ago |
| CVE-2026-8968 | 7.5 | — | — | — | mozilla / firefox | Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. | 162d ago |
| CVE-2026-8967 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Graphics: WebGPU component. | 162d ago |
| CVE-2026-8966 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the IP Protection component. | 162d ago |
| CVE-2026-8965 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the DOM: Security component. | 162d ago |
| CVE-2026-8964 | 7.5 | — | — | — | mozilla / firefox | Spoofing issue in the Popup Blocker component. | 162d ago |
| CVE-2026-8963 | 7.5 | — | — | — | mozilla / firefox | Spoofing issue in the Web Speech component. | 162d ago |
| CVE-2026-8960 | 7.5 | — | — | — | mozilla / firefox | Spoofing issue in WebExtensions. | 162d ago |
| CVE-2026-8954 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions, integer overflow in the Audio/Video component. | 162d ago |
