| CVE-2026-8949 | 7.5 | — | — | — | mozilla / firefox | Integer overflow in the Widget: Win32 component. | 162d ago |
| CVE-2026-8946 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Audio/Video: Web Codecs component. | 162d ago |
| CVE-2026-8945 | 7.5 | — | — | — | mozilla / firefox | Sandbox escape in Firefox and Firefox Focus for Android. | 162d ago |
| CVE-2026-42100 | 7.5 | — | — | — | sparxsystems / pro cloud server | Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) atta | 162d ago |
| CVE-2026-42099 | 7.5 | — | — | — | sparxsystems / pro cloud server | Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. | 162d ago |
| CVE-2026-8912 | 7.5 | — | — | — | — | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions | 162d ago |
| CVE-2026-7507 | 7.5 | — | — | — | redhat / build of keycloak | A session fixation vulnerability was found in Keycloak's login-actions endpoints. | 162d ago |
| CVE-2026-7307 | 7.5 | — | — | — | redhat / build of keycloak | A flaw was found in Keycloak. | 162d ago |
| CVE-2026-31910 | 7.5 | — | — | — | apache / ofbiz | Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. | 162d ago |
| CVE-2026-31909 | 7.5 | — | — | — | apache / ofbiz | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. | 162d ago |
| CVE-2026-8813 | 7.5 | — | — | — | — | This affects versions of the package exifreader before 4.39.0. | 162d ago |
| CVE-2025-15609 | 7.5 | — | — | — | — | The Fortis for WooCommerce WordPress plugin before 1.3.1 may leak sensitive API keys to unauthenticated attackers, | 162d ago |
| CVE-2026-33232 | 7.5 | — | — | — | — | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence | 163d ago |
| CVE-2026-29963 | 7.5 | — | — | — | hsclabs / mailinspector | HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in | 163d ago |
| CVE-2026-29962 | 7.5 | — | — | — | hsclabs / mailinspector | HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user- | 163d ago |
| CVE-2025-56352 | 7.5 | — | — | — | — | In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violation | 163d ago |
| CVE-2026-39079 | 7.5 | — | — | — | — | An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitiv | 163d ago |
| CVE-2026-42009 | 7.5 | — | — | — | gnu / gnutls | A flaw was found in gnutls. | 163d ago |
| CVE-2026-6381 | 7.5 | — | — | — | — | The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, al | 163d ago |
| CVE-2018-25329 | 7.5 | — | — | — | — | WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated att | 164d ago |
| CVE-2018-25326 | 7.5 | — | — | — | — | Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to re | 164d ago |
| CVE-2018-25325 | 7.5 | — | — | — | — | Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete a | 164d ago |
| CVE-2021-47977 | 7.5 | — | — | — | — | WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerabilit | 165d ago |
| CVE-2021-47973 | 7.5 | — | — | — | — | Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the applicatio | 165d ago |
| CVE-2021-47972 | 7.5 | — | — | — | — | Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the a | 165d ago |
| CVE-2021-47971 | 7.5 | — | — | — | — | My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pas | 165d ago |
| CVE-2021-47970 | 7.5 | — | — | — | — | Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by cre | 165d ago |
| CVE-2021-47969 | 7.5 | — | — | — | — | Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasti | 165d ago |
| CVE-2021-47942 | 7.5 | — | — | — | hacs / home assistant community store | Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthen | 165d ago |
| CVE-2020-37245 | 7.5 | — | — | — | — | Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows | 165d ago |
| CVE-2026-8696 | 7.5 | — | — | — | radare / radare2 | radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_pids_list() function within the GDB client core t | 166d ago |
| CVE-2026-45398 | 7.5 | — | — | — | openwebui / open webui | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. | 166d ago |
| CVE-2026-8686 | 7.5 | — | — | — | freertos / coremqtt | Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause | 166d ago |
| CVE-2026-46366 | 7.5 | — | — | — | — | phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that la | 166d ago |
| CVE-2026-46359 | 7.5 | — | — | — | — | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticate | 166d ago |
| CVE-2026-44826 | 7.5 | — | — | — | — | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. | 166d ago |
| CVE-2021-47959 | 7.5 | — | — | — | — | WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers | 166d ago |
| CVE-2026-46474 | 7.5 | — | — | — | — | Trog::TOTP versions before 1.006 for Perl generate secrets using rand. | 166d ago |
| CVE-2026-8695 | 7.5 | — | — | — | radare / radare2 | radare2 6.1.5 contains a use-after-free vulnerability in the gdbr_threads_list() function that allows remote attack | 166d ago |
| CVE-2026-44714 | 7.5 | — | — | — | — | The bitcoinj library is a Java implementation of the Bitcoin protocol. | 166d ago |
| CVE-2026-38728 | 7.5 | — | — | — | — | An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the S | 166d ago |
| CVE-2026-41552 | 7.5 | — | — | — | dhtmlx / pdf export module | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTM | 166d ago |
| CVE-2026-6403 | 7.5 | — | — | — | — | The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. | 166d ago |
| CVE-2026-44671 | 7.5 | — | — | — | zitadel / zitadel | ZITADEL is an open source identity management platform. | 167d ago |
| CVE-2026-44673 | 7.5 | — | — | — | — | libyang is a YANG data modeling language library. | 167d ago |
| CVE-2026-8585 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who | 167d ago |
| CVE-2026-8557 | 7.5 | — | — | — | google / chrome | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromi | 167d ago |
| CVE-2026-8547 | 7.5 | — | — | — | google / chrome | Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote a | 167d ago |
| CVE-2026-8521 | 7.5 | — | — | — | google / chrome | Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrar | 167d ago |
| CVE-2026-8510 | 7.5 | — | — | — | google / chrome | Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had comp | 167d ago |
| CVE-2026-46356 | 7.5 | — | — | — | fleetdm / fleet | Fleet is open source device management software. | 167d ago |
| CVE-2026-24899 | 7.5 | — | — | — | fleetdm / fleet | Fleet is open source device management software. | 167d ago |
| CVE-2026-27886 | 7.5 | — | — | — | strapi / strapi | Strapi is an open source headless content management system. | 167d ago |
| CVE-2026-23998 | 7.5 | — | — | — | fleetdm / fleet | Fleet is open source device management software. | 167d ago |
| CVE-2026-6332 | 7.5 | — | — | — | schneider-electric / ecostruxure machine expert hvac | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensi | 167d ago |
| CVE-2026-42334 | 7.5 | — | — | — | mongoosejs / mongoose | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. | 167d ago |
| CVE-2026-42594 | 7.5 | — | — | — | thecodingmachine / gotenberg | Gotenberg is a Docker-powered stateless API for PDF files. | 167d ago |
| CVE-2026-44375 | 7.5 | — | — | — | — | Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. | 167d ago |
| CVE-2026-44216 | 7.5 | — | — | — | bytecodealliance / wasmtime | Wasmtime is a runtime for WebAssembly. | 167d ago |
| CVE-2026-42186 | 7.5 | — | — | — | openbao / openbao | OpenBao is an open source identity-based secrets management system. | 167d ago |
