| CVE-2026-4712 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Widget: Cocoa component. | 218d ago |
| CVE-2026-4709 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Audio/Video: GMP component. | 218d ago |
| CVE-2026-4708 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics component. | 218d ago |
| CVE-2026-4707 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics: Canvas2D component. | 218d ago |
| CVE-2026-4706 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics: Canvas2D component. | 218d ago |
| CVE-2026-4704 | 7.5 | — | — | — | mozilla / firefox | Denial-of-service in the WebRTC: Signaling component. | 218d ago |
| CVE-2026-4699 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Layout: Text and Fonts component. | 218d ago |
| CVE-2026-4697 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Audio/Video: Web Codecs component. | 218d ago |
| CVE-2026-4695 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Audio/Video: Web Codecs component. | 218d ago |
| CVE-2026-4694 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions, integer overflow in the Graphics component. | 218d ago |
| CVE-2026-4693 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Audio/Video: Playback component. | 218d ago |
| CVE-2026-4686 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics: Canvas2D component. | 218d ago |
| CVE-2026-4685 | 7.5 | — | — | — | mozilla / firefox | Incorrect boundary conditions in the Graphics: Canvas2D component. | 218d ago |
| CVE-2026-4684 | 7.5 | — | — | — | mozilla / firefox | Race condition, use-after-free in the Graphics: WebRender component. | 218d ago |
| CVE-2026-3509 | 7.5 | — | — | — | — | An unauthenticated remote attacker may be able to control the format string of messages processed by the Audit Log | 218d ago |
| CVE-2026-33852 | 7.5 | — | — | — | molotovcherry / android-imagemagick7 | Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue | 218d ago |
| CVE-2026-33856 | 7.5 | — | — | — | molotovcherry / android-imagemagick7 | Missing Release of Memory after Effective Lifetime vulnerability in MolotovCherry Android-ImageMagick7.This issue | 218d ago |
| CVE-2026-4662 | 7.5 | — | — | — | — | The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all ve | 218d ago |
| CVE-2026-4640 | 7.5 | — | — | — | gss / vitalsesp | Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticat | 218d ago |
| CVE-2026-33307 | 7.5 | — | — | — | mod gnutls project / mod gnutls | Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. | 218d ago |
| CVE-2026-33306 | 7.5 | — | — | — | bcrypt-ruby project / bcrypt-ruby | bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. | 218d ago |
| CVE-2026-33282 | 7.5 | — | — | — | ellanetworks / ella core | Ella Core is a 5G core designed for private networks. | 219d ago |
| CVE-2026-33250 | 7.5 | — | — | — | — | Freeciv21 is a free open source, turn-based, empire-building strategy game. | 219d ago |
| CVE-2026-33242 | 7.5 | — | — | — | salvo / salvo | Salvo is a Rust web framework. | 219d ago |
| CVE-2026-33241 | 7.5 | — | — | — | salvo / salvo | Salvo is a Rust web framework. | 219d ago |
| CVE-2026-33176 | 7.5 | — | — | — | rubyonrails / rails | Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. | 219d ago |
| CVE-2026-33174 | 7.5 | — | — | — | rubyonrails / rails | Active Storage allows users to attach cloud and local files in Rails applications. | 219d ago |
| CVE-2026-4306 | 7.5 | — | — | — | — | The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up | 219d ago |
| CVE-2026-32299 | 7.5 | — | — | — | opensource-workshop / connect-cms | Connect-CMS is a content management system. | 219d ago |
| CVE-2026-23482 | 7.5 | — | — | — | blinko / blinko | Blinko is an AI-powered card note-taking project. | 219d ago |
| CVE-2026-33512 | 7.5 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 219d ago |
| CVE-2026-26209 | 7.5 | — | — | — | agronholm / cbor2 | cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. | 219d ago |
| CVE-2026-25075 | 7.5 | — | — | — | — | strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser tha | 219d ago |
| CVE-2025-15606 | 7.5 | — | — | — | tp-link / td-w8961nd firmware | A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input s | 219d ago |
| CVE-2026-26829 | 7.5 | — | — | — | — | A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allow | 219d ago |
| CVE-2026-26828 | 7.5 | — | — | — | — | A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652 | 219d ago |
| CVE-2026-33485 | 7.5 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 219d ago |
| CVE-2026-33483 | 7.5 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 219d ago |
| CVE-2026-32969 | 7.5 | — | — | — | — | An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoi | 219d ago |
| CVE-2026-4602 | 7.5 | — | — | — | kjur / jsrsasign | Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to | 219d ago |
| CVE-2026-4598 | 7.5 | — | — | — | kjur / jsrsasign | Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ex | 219d ago |
| CVE-2026-2580 | 7.5 | — | — | — | — | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vu | 220d ago |
| CVE-2026-33292 | 7.5 | — | — | — | wwbn / avideo | WWBN AVideo is an open source video platform. | 220d ago |
| CVE-2019-25613 | 7.5 | — | — | — | echatserver / easy chat server | Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the applicat | 220d ago |
| CVE-2019-25605 | 7.5 | — | — | — | — | EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user creden | 220d ago |
| CVE-2019-25579 | 7.5 | — | — | — | codnloc / phptransformer | phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access | 221d ago |
| CVE-2019-25560 | 7.5 | — | — | — | lyricvideocreator / lyric video creator | Lyric Video Creator 2.1 contains a denial of service vulnerability that allows attackers to crash the application | 221d ago |
| CVE-2019-25552 | 7.5 | — | — | — | cewe / photo show | CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by | 221d ago |
| CVE-2026-4373 | 7.5 | — | — | — | — | The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up | 221d ago |
| CVE-2026-2468 | 7.5 | — | — | — | — | The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions u | 221d ago |
| CVE-2026-1800 | 7.5 | — | — | — | — | The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSele | 221d ago |
| CVE-2026-32056 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the | 221d ago |
| CVE-2026-32049 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buff | 221d ago |
| CVE-2026-32048 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operatio | 221d ago |
| CVE-2026-33427 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 222d ago |
| CVE-2026-32666 | 7.5 | — | — | — | — | WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. | 222d ago |
| CVE-2026-33476 | 7.5 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 222d ago |
| CVE-2026-33231 | 7.5 | — | — | — | nltk / nltk | NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting rese | 222d ago |
| CVE-2026-33204 | 7.5 | — | — | — | kelvinmo / simplejwt | SimpleJWT is a simple JSON web token library written in PHP. | 222d ago |
| CVE-2026-33203 | 7.5 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 222d ago |
