| CVE-2026-6479 | 7.5 | — | — | — | postgresql / postgresql | Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_ | 167d ago |
| CVE-2026-4031 | 7.5 | — | — | — | — | The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, | 167d ago |
| CVE-2026-4029 | 7.5 | — | — | — | — | The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all version | 167d ago |
| CVE-2026-6514 | 7.5 | — | — | — | — | The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, | 167d ago |
| CVE-2026-1659 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, | 167d ago |
| CVE-2025-14870 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10. | 167d ago |
| CVE-2025-14869 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10. | 167d ago |
| CVE-2026-46419 | 7.5 | — | — | — | — | Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return v | 168d ago |
| CVE-2026-44478 | 7.5 | — | — | — | — | hoppscotch is an open source API development ecosystem. | 168d ago |
| CVE-2026-44439 | 7.5 | — | — | — | lookyloo / playwright capture | PlaywrightCapture is a simple replacement for splash using playwright. | 168d ago |
| CVE-2026-42561 | 7.5 | — | — | — | — | Python-Multipart is a streaming multipart parser for Python. | 168d ago |
| CVE-2026-42304 | 7.5 | — | — | — | twisted / twisted | Twisted is an event-based framework for internet applications, supporting Python 3.6+. | 168d ago |
| CVE-2025-27850 | 7.5 | — | — | — | garmin / empirbus wireless display unit firmware | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. | 168d ago |
| CVE-2026-42552 | 7.5 | — | — | — | — | Flight is an extensible micro-framework for PHP. | 168d ago |
| CVE-2026-42551 | 7.5 | — | — | — | — | Flight is an extensible micro-framework for PHP. | 168d ago |
| CVE-2026-42587 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 168d ago |
| CVE-2026-42583 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 168d ago |
| CVE-2026-42582 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 168d ago |
| CVE-2026-42579 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 168d ago |
| CVE-2026-42578 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 168d ago |
| CVE-2026-42577 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 168d ago |
| CVE-2026-0262 | 7.5 | — | — | — | paloaltonetworks / pan-os | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker | 168d ago |
| CVE-2026-45109 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 168d ago |
| CVE-2026-44579 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 168d ago |
| CVE-2026-44004 | 7.5 | — | — | — | vm2 project / vm2 | vm2 is an open source vm/sandbox for Node.js. | 168d ago |
| CVE-2026-44575 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 168d ago |
| CVE-2026-44573 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 168d ago |
| CVE-2026-44432 | 7.5 | — | — | — | python / urllib3 | urllib3 is an HTTP client library for Python. | 168d ago |
| CVE-2026-44290 | 7.5 | — | — | — | protobufjs project / protobufjs | protobufjs compiles protobuf definitions into JavaScript (JS) functions. | 168d ago |
| CVE-2026-44289 | 7.5 | — | — | — | protobufjs project / protobufjs | protobufjs compiles protobuf definitions into JavaScript (JS) functions. | 168d ago |
| CVE-2026-42920 | 7.5 | — | — | — | f5 / big-ip access policy manager | When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traf | 168d ago |
| CVE-2026-42409 | 7.5 | — | — | — | f5 / big-ip next cloud-native network functions | When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a vir | 168d ago |
| CVE-2026-41956 | 7.5 | — | — | — | f5 / big-ip access policy manager | When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Ma | 168d ago |
| CVE-2026-41227 | 7.5 | — | — | — | f5 / big-ip advanced web application firewall | On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase | 168d ago |
| CVE-2026-41218 | 7.5 | — | — | — | f5 / big-ip access policy manager | When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, C | 168d ago |
| CVE-2026-40629 | 7.5 | — | — | — | f5 / big-ip access policy manager | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop pro | 168d ago |
| CVE-2026-40618 | 7.5 | — | — | — | f5 / big-ip access policy manager | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Tec | 168d ago |
| CVE-2026-40423 | 7.5 | — | — | — | f5 / big-ip access policy manager | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microke | 168d ago |
| CVE-2026-40067 | 7.5 | — | — | — | f5 / big-ip access policy manager | When a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the apmd process | 168d ago |
| CVE-2026-40060 | 7.5 | — | — | — | f5 / big-ip application security manager | When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can caus | 168d ago |
| CVE-2026-39458 | 7.5 | — | — | — | f5 / big-ip access policy manager | When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanc | 168d ago |
| CVE-2026-39455 | 7.5 | — | — | — | f5 / big-ip access policy manager | When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentica | 168d ago |
| CVE-2025-28344 | 7.5 | — | — | — | — | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack. | 168d ago |
| CVE-2025-28343 | 7.5 | — | — | — | — | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons. | 168d ago |
| CVE-2020-37220 | 7.5 | — | — | — | — | Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to ob | 168d ago |
| CVE-2020-37219 | 7.5 | — | — | — | — | Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to lis | 168d ago |
| CVE-2026-39806 | 7.5 | — | — | — | mtrudel / bandit | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remo | 168d ago |
| CVE-2026-39803 | 7.5 | — | — | — | mtrudel / bandit | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote | 168d ago |
| CVE-2026-6276 | 7.5 | — | — | — | haxx / curl | Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently d | 168d ago |
| CVE-2026-5773 | 7.5 | — | — | — | haxx / curl | libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. | 168d ago |
| CVE-2026-4798exploited | 7.5 | 0.51% | 1/3 | +153d | — | The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter | 168d ago |
| CVE-2026-6929 | 7.5 | — | — | — | — | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based | 168d ago |
| CVE-2026-8336 | 7.5 | — | — | — | mongodb / mongodb | After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map functi | 168d ago |
| CVE-2026-1250 | 7.5 | — | — | — | — | The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injecti | 169d ago |
| CVE-2026-44302 | 7.5 | — | — | — | — | Snappier is a high performance C# implementation of the Snappy compression algorithm. | 169d ago |
| CVE-2026-44296 | 7.5 | — | — | — | — | Deskflow is a keyboard and mouse sharing app. | 169d ago |
| CVE-2026-44241 | 7.5 | — | — | — | — | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM ap | 169d ago |
| CVE-2026-42855 | 7.5 | — | — | — | espressif / arduino-esp32 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrolle | 169d ago |
| CVE-2026-42544 | 7.5 | — | — | — | — | Granian is a Rust HTTP server for Python applications. | 169d ago |
| CVE-2026-42268 | 7.5 | — | — | — | owasp / modsecurity | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. | 169d ago |
