| CVE-2026-33180 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 222d ago |
| CVE-2026-31904 | 7.5 | — | — | — | ctek / charge portal | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. | 222d ago |
| CVE-2026-31903 | 7.5 | — | — | — | igl / eparking.fi | The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. | 222d ago |
| CVE-2026-23536exploited | 7.5 | 2.4% | 1/3 | +178d | — | A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthentic | 222d ago |
| CVE-2026-33164 | 7.5 | — | — | — | struktur / libde265 | libde265 is an open source implementation of the h.265 video codec. | 222d ago |
| CVE-2026-33155 | 7.5 | — | — | — | qluster / deepdiff | DeepDiff is a project focused on Deep Difference and search of any Python data. | 222d ago |
| CVE-2026-33154 | 7.5 | — | — | — | dynaconf / dynaconf | dynaconf is a configuration management tool for Python. | 222d ago |
| CVE-2026-33151 | 7.5 | — | — | — | socket / socket.io-parser | Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. | 222d ago |
| CVE-2026-33143 | 7.5 | — | — | — | hackerbay / oneuptime | OneUptime is a solution for monitoring and managing online services. | 222d ago |
| CVE-2026-4437 | 7.5 | — | — | — | gnu / glibc | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend i | 222d ago |
| CVE-2026-32309 | 7.5 | — | — | — | cryptomator / cryptomator | Cryptomator encrypts data being stored on cloud infrastructure. | 222d ago |
| CVE-2025-46597 | 7.5 | — | — | — | bitcoin / bitcoin core | Bitcoin Core 0.13.0 through 29.x has an integer overflow. | 222d ago |
| CVE-2026-33128 | 7.5 | — | — | — | h3 / h3 | H3 is a minimal H(TTP) framework. | 222d ago |
| CVE-2026-33069 | 7.5 | — | — | — | pjsip / pjsip | PJSIP is a free and open source multimedia communication library written in C. | 222d ago |
| CVE-2026-32701 | 7.5 | — | — | — | qwik / qwik | Qwik is a performance-focused JavaScript framework. | 222d ago |
| CVE-2026-33064 | 7.5 | — | — | — | free5gc / udm | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. | 222d ago |
| CVE-2026-33040 | 7.5 | — | — | — | protocol / libp2p-gossipsub | libp2p-rust is the official rust language Implementation of the libp2p networking stack. | 222d ago |
| CVE-2026-33036 | 7.5 | — | — | — | naturalintelligence / fast-xml-parser | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. | 222d ago |
| CVE-2026-33013 | 7.5 | — | — | — | objectcomputing / micronaut | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM ap | 222d ago |
| CVE-2026-33012 | 7.5 | — | — | — | objectcomputing / micronaut | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM ap | 222d ago |
| CVE-2026-33011 | 7.5 | — | — | — | nestjs / nest | Nest is a framework for building scalable Node.js server-side applications. | 222d ago |
| CVE-2026-32949 | 7.5 | — | — | — | fit2cloud / sqlbot | SQLBot is an intelligent data query system based on a large language model and RAG. | 222d ago |
| CVE-2026-33063 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open source 5G core network. | 222d ago |
| CVE-2026-33062 | 7.5 | — | — | — | free5gc / free5gc | free5GC is an open source 5G core network. | 222d ago |
| CVE-2026-32933 | 7.5 | — | — | — | luckypennysoftware / automapper | AutoMapper is a convention-based object-object mapper in .NET. | 222d ago |
| CVE-2026-32875 | 7.5 | — | — | — | ultrajson project / ultrajson | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. | 222d ago |
| CVE-2026-32874 | 7.5 | — | — | — | ultrajson project / ultrajson | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. | 222d ago |
| CVE-2026-32873 | 7.5 | — | — | — | vshakitskiy / ewe | ewe is a Gleam web server. | 222d ago |
| CVE-2026-32829 | 7.5 | — | — | — | pseitz / lz4 flex | lz4_flex is a pure Rust implementation of LZ4 compression/decompression. | 222d ago |
| CVE-2026-29097 | 7.5 | — | — | — | suitecrm / suitecrm | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. | 223d ago |
| CVE-2026-32815 | 7.5 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 223d ago |
| CVE-2026-32030 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that | 223d ago |
| CVE-2026-32025 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients t | 223d ago |
| CVE-2026-32011 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles | 223d ago |
| CVE-2026-29072 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 223d ago |
| CVE-2026-27934 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 223d ago |
| CVE-2026-3547 | 7.5 | — | — | — | wolfssl / wolfssl | Out-of-bounds read in ALPN parsing due to incomplete validation. | 223d ago |
| CVE-2026-25667 | 7.5 | — | — | — | microsoft / .net | ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to ca | 223d ago |
| CVE-2026-2645 | 7.5 | — | — | — | wolfssl / wolfssl | In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. | 223d ago |
| CVE-2026-30403 | 7.5 | — | — | — | wgstart / wgcloud | There is an arbitrary file read vulnerability in the test connection function of backend database management in wg | 223d ago |
| CVE-2026-3029 | 7.5 | — | — | — | — | A path traversal and arbitrary file write vulnerability exist in the embedded get function in '_main_.py' in PyMuPD | 223d ago |
| CVE-2026-30404 | 7.5 | — | — | — | wgstart / wgcloud | The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) | 223d ago |
| CVE-2026-4424 | 7.5 | — | — | — | libarchive / libarchive | A flaw was found in libarchive. | 223d ago |
| CVE-2026-3658 | 7.5 | — | — | — | — | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable t | 223d ago |
| CVE-2006-10002 | 7.5 | — | — | — | toddr / xml\ | XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (d | 223d ago |
| CVE-2026-25443 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-ord | 223d ago |
| CVE-2026-25312 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting | 223d ago |
| CVE-2026-28461 | 7.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint | 223d ago |
| CVE-2026-32805 | 7.5 | — | — | — | ctfer-io / romeo | Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for fu | 224d ago |
| CVE-2026-32944 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 224d ago |
| CVE-2026-32886 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 224d ago |
| CVE-2026-32878 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 224d ago |
| CVE-2026-31973 | 7.5 | — | — | — | samtools / samtools | SAMtools is a program for reading, manipulating and writing bioinformatics file formats. | 224d ago |
| CVE-2026-31964 | 7.5 | — | — | — | htslib / htslib | HTSlib is a library for reading and writing bioinformatics file formats. | 224d ago |
| CVE-2026-29858 | 7.5 | — | — | — | aapanel / aapanel | A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot s | 224d ago |
| CVE-2026-29856 | 7.5 | — | — | — | aapanel / aapanel | An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a | 224d ago |
| CVE-2026-27135 | 7.5 | — | — | — | nghttp2 / nghttp2 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. | 224d ago |
| CVE-2026-30345 | 7.5 | — | — | — | — | A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write a | 224d ago |
| CVE-2026-33002 | 7.5 | — | — | — | jenkins / jenkins | Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin val | 224d ago |
| CVE-2026-32609 | 7.5 | — | — | — | nicolargo / glances | Glances is an open-source system cross-platform monitoring tool. | 224d ago |
