| CVE-2026-28954 | 7.5 | — | — | — | apple / ipados | A file quarantine bypass was addressed with additional checks. | 170d ago |
| CVE-2026-28953 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 170d ago |
| CVE-2026-28952 | 7.5 | — | — | — | apple / ipados | An integer overflow was addressed with improved input validation. | 170d ago |
| CVE-2026-28944 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 170d ago |
| CVE-2026-28943 | 7.5 | — | — | — | apple / ipados | A logging issue was addressed with improved data redaction. | 170d ago |
| CVE-2026-28936 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved checks. | 170d ago |
| CVE-2026-28930 | 7.5 | — | — | — | apple / macos | A permissions issue was addressed with additional restrictions. | 170d ago |
| CVE-2026-28929 | 7.5 | — | — | — | apple / ipados | A logic issue was addressed with improved checks. | 170d ago |
| CVE-2026-28925 | 7.5 | — | — | — | apple / macos | A buffer overflow was addressed with improved bounds checking. | 170d ago |
| CVE-2026-28924 | 7.5 | — | — | — | apple / macos | A race condition was addressed with improved handling of symbolic links. | 170d ago |
| CVE-2026-28913 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 170d ago |
| CVE-2026-28908 | 7.5 | — | — | — | apple / macos | A denial of service issue was addressed by removing the vulnerable code. | 170d ago |
| CVE-2026-28906 | 7.5 | — | — | — | apple / ipados | This issue was addressed through improved state management. | 170d ago |
| CVE-2026-28905 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 170d ago |
| CVE-2026-28904 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved memory handling. | 170d ago |
| CVE-2026-28883 | 7.5 | — | — | — | apple / ipados | A use-after-free issue was addressed with improved memory management. | 170d ago |
| CVE-2026-28873 | 7.5 | — | — | — | apple / ipados | This issue was addressed with additional entitlement checks. | 170d ago |
| CVE-2026-28872 | 7.5 | — | — | — | apple / ipados | A resource exhaustion issue was addressed with improved input validation. | 170d ago |
| CVE-2026-28860 | 7.5 | — | — | — | apple / ipados | The issue was addressed with improved input validation. | 170d ago |
| CVE-2026-28848 | 7.5 | — | — | — | apple / macos | A buffer overflow was addressed with improved bounds checking. | 170d ago |
| CVE-2026-28846 | 7.5 | — | — | — | apple / ipados | A buffer overflow was addressed with improved bounds checking. | 170d ago |
| CVE-2026-2614exploited | 7.5 | 3.7% | 1/3 | +110d | lfprojects / mlflow | A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3 | 170d ago |
| CVE-2026-7790 | 7.5 | — | — | — | ninenines / cowlib | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Excessive Allocatio | 170d ago |
| CVE-2026-7210 | 7.5 | — | — | — | python / python | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which | 170d ago |
| CVE-2026-4890 | 7.5 | — | — | — | — | A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a deni | 170d ago |
| CVE-2026-33361 | 7.5 | — | — | — | — | In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 2 | 170d ago |
| CVE-2026-33359 | 7.5 | — | — | — | — | In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), mo | 170d ago |
| CVE-2026-33357 | 7.5 | — | — | — | — | In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 22 | 170d ago |
| CVE-2026-31248 | 7.5 | — | — | — | — | Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. | 170d ago |
| CVE-2026-34092 | 7.5 | — | — | — | mediawiki / mediawiki | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. | 170d ago |
| CVE-2026-34091 | 7.5 | — | — | — | mediawiki / mediawiki | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. | 170d ago |
| CVE-2026-34090 | 7.5 | — | — | — | mediawiki / checkuser | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. | 170d ago |
| CVE-2026-34089 | 7.5 | — | — | — | wikimedia / scribunto | Vulnerability in Wikimedia Foundation Scribunto. | 170d ago |
| CVE-2026-34088 | 7.5 | — | — | — | mediawiki / mediawiki | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. | 170d ago |
| CVE-2026-34087 | 7.5 | — | — | — | mediawiki / mediawiki | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. | 170d ago |
| CVE-2026-31247 | 7.5 | — | — | — | — | Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. | 170d ago |
| CVE-2025-65418 | 7.5 | — | — | — | — | docuFORM Managed Print Service Client 11.11c is vulnerable to a directory traversal allowing attackers to read arb | 170d ago |
| CVE-2026-8177 | 7.5 | — | — | — | — | XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing | 171d ago |
| CVE-2026-45180 | 7.5 | — | — | — | — | Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. | 171d ago |
| CVE-2021-47944 | 7.5 | — | — | — | — | memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pa | 171d ago |
| CVE-2026-7263 | 7.5 | — | — | — | php / php | In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorre | 171d ago |
| CVE-2026-7568 | 7.5 | — | — | — | php / php | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphon | 171d ago |
| CVE-2026-7262 | 7.5 | — | — | — | php / php | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP | 171d ago |
| CVE-2026-7258 | 7.5 | — | — | — | php / php | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functio | 171d ago |
| CVE-2026-33538 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 218d ago |
| CVE-2026-33508 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 218d ago |
| CVE-2026-33498 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 218d ago |
| CVE-2026-32854 | 7.5 | — | — | — | libvncserver project / libvncserver | LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities | 218d ago |
| CVE-2026-33680 | 7.5 | — | — | — | vikunja / vikunja | Vikunja is an open-source self-hosted task management platform. | 218d ago |
| CVE-2026-33554 | 7.5 | — | — | — | — | ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages. | 218d ago |
| CVE-2026-30653 | 7.5 | — | — | — | free5gc / free5gc | An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function Hand | 218d ago |
| CVE-2026-27651 | 7.5 | — | — | — | f5 / nginx open source | When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can | 218d ago |
| CVE-2026-33497exploited | 7.5 | 19.6% | 1/3 | +140d | langflow / langflow | Langflow is a tool for building and deploying AI-powered agents and workflows. | 218d ago |
| CVE-2026-33484 | 7.5 | — | — | — | langflow / langflow | Langflow is a tool for building and deploying AI-powered agents and workflows. | 218d ago |
| CVE-2026-33418 | 7.5 | — | — | — | dicebear / dicebear | DiceBear is an avatar library for designers and developers. | 218d ago |
| CVE-2026-4727 | 7.5 | — | — | — | mozilla / firefox | Denial-of-service in the Libraries component in NSS. | 218d ago |
| CVE-2026-4726 | 7.5 | — | — | — | mozilla / firefox | Denial-of-service in the XML component. | 218d ago |
| CVE-2026-4719 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics: Text component. | 218d ago |
| CVE-2026-4714 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Audio/Video component. | 218d ago |
| CVE-2026-4713 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics component. | 218d ago |
