| CVE-2026-23242 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereferen | 224d ago |
| CVE-2026-32596 | 7.5 | — | — | — | nicolargo / glances | Glances is an open-source system cross-platform monitoring tool. | 224d ago |
| CVE-2026-32256 | 7.5 | — | — | — | borewit / music-metadata | music-metadata is a metadata parser for audio and video media files. | 224d ago |
| CVE-2026-30922 | 7.5 | — | — | — | pyasn1 / pyasn1 | pyasn1 is a generic ASN.1 library for Python. | 224d ago |
| CVE-2026-29112 | 7.5 | — | — | — | dicebear / dicebear | DiceBear is an avatar library for designers and developers. | 224d ago |
| CVE-2026-27980 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 224d ago |
| CVE-2026-27979 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 224d ago |
| CVE-2026-22727 | 7.5 | — | — | — | — | Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and belo | 225d ago |
| CVE-2025-14031 | 7.5 | — | — | — | ibm / sterling b2b integrator | IBM Sterling B2B Integrator and and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1 | 225d ago |
| CVE-2026-32838 | 7.5 | — | — | — | edimax / gs-5008pl firmware | Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without im | 225d ago |
| CVE-2026-1376 | 7.5 | — | — | — | ibm / i | IBM i 7.6 could allow a remote attacker to cause a denial of service using failed authentication connections due to | 225d ago |
| CVE-2026-32981 | 7.5 | — | — | — | anyscale / ray | A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. | 225d ago |
| CVE-2026-32297 | 7.5 | — | — | — | angeet / es3 kvm firmware | The Angeet ES3 KVM allows a remote, unauthenticated attacker to write arbitrary files, including configuration fil | 225d ago |
| CVE-2026-32295 | 7.5 | — | — | — | jetkvm / kvm | JetKVM before 0.5.4 does not rate limit login requests, enabling brute-force attempts to guess credentials. | 225d ago |
| CVE-2026-32292 | 7.5 | — | — | — | gl-inet / comet gl-rm1 firmware | The GL-iNet Comet (GL-RM1) KVM web interface does not limit login requests, enabling brute-force attempts to guess | 225d ago |
| CVE-2026-28779 | 7.5 | — | — | — | apache / airflow | Apache Airflow versions 3.1.0 through 3.1.7 session token (_token) in cookies is set to path=/ regardless of the c | 225d ago |
| CVE-2026-4258 | 7.5 | — | — | — | bitwiseshiftleft / stanford javascript crypto library | All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing | 225d ago |
| CVE-2026-2579 | 7.5 | — | — | — | — | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection v | 225d ago |
| CVE-2026-4269 | 7.5 | — | — | — | amazon / bedrock agentcore starter toolkit | A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a rem | 226d ago |
| CVE-2026-4224 | 7.5 | — | — | — | python / python | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a de | 226d ago |
| CVE-2026-3644 | 7.5 | — | — | — | python / python | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. | 226d ago |
| CVE-2026-28498 | 7.5 | — | — | — | authlib / authlib | Authlib is a Python library which builds OAuth and OpenID Connect servers. | 226d ago |
| CVE-2025-69768 | 7.5 | — | — | — | chyrp / chyrp | SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information v | 226d ago |
| CVE-2025-66687 | 7.5 | — | — | — | — | Doom Launcher 3.8.1.0 is vulnerable to Directory Traversal due to missing file path validation during the extracti | 226d ago |
| CVE-2026-30405 | 7.5 | — | — | — | osrg / gobgp | An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attri | 226d ago |
| CVE-2026-4276 | 7.5 | — | — | — | librechat / librechat | LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries | 226d ago |
| CVE-2026-32614 | 7.5 | — | — | — | — | Go ShangMi (Commercial Cryptography) Library (GMSM) is a cryptographic library that covers the Chinese commercial | 226d ago |
| CVE-2026-32314 | 7.5 | — | — | — | protocol / yamux | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. | 226d ago |
| CVE-2026-2493 | 7.5 | — | — | — | — | IceWarp collaboration Directory Traversal Information Disclosure Vulnerability. | 226d ago |
| CVE-2026-24458 | 7.5 | — | — | — | mattermost / mattermost server | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly handle very long pass | 226d ago |
| CVE-2026-20999 | 7.5 | — | — | — | samsung / smart switch | Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger priv | 226d ago |
| CVE-2026-1947 | 7.5 | — | — | — | — | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Re | 226d ago |
| CVE-2017-20222 | 7.5 | — | — | — | telesquare / sdt-cs3b1 firmware | Telesquare SKT LTE Router SDT-CS3B1 software version 1.2.0 contains an unauthenticated remote reboot vulnerability | 226d ago |
| CVE-2017-20220 | 7.5 | — | — | — | — | Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauth | 226d ago |
| CVE-2017-20217 | 7.5 | — | — | — | — | Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the | 226d ago |
| CVE-2013-20006 | 7.5 | — | — | — | — | Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where | 226d ago |
| CVE-2026-4111 | 7.5 | — | — | — | — | A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the ar | 229d ago |
| CVE-2026-3045exploited | 7.5 | 0.30% | 1/3 | +214d | — | The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized | 229d ago |
| CVE-2026-32597 | 7.5 | — | — | — | pyjwt project / pyjwt | PyJWT is a JSON Web Token implementation in Python. | 229d ago |
| CVE-2026-32426 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32400 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32393 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32392 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32384 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32369 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32364 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 229d ago |
| CVE-2026-32319 | 7.5 | — | — | — | ellanetworks / ella core | Ella Core is a 5G core designed for private networks. | 229d ago |
| CVE-2026-31899 | 7.5 | — | — | — | courtbouillon / cairosvg | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. | 229d ago |
| CVE-2026-31882 | 7.5 | — | — | — | dagu / dagu | Dagu is a workflow engine with a built-in Web user interface. | 229d ago |
| CVE-2026-31814 | 7.5 | — | — | — | protocol / yamux | Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. | 229d ago |
| CVE-2026-2890 | 7.5 | — | — | — | — | The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and in | 229d ago |
| CVE-2026-29079 | 7.5 | — | — | — | lexbor / lexbor | Lexbor is a web browser engine library. | 229d ago |
| CVE-2026-29078 | 7.5 | — | — | — | lexbor / lexbor | Lexbor is a web browser engine library. | 229d ago |
| CVE-2026-25819 | 7.5 | — | — | — | — | HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmw | 229d ago |
| CVE-2026-22199 | 7.5 | — | — | — | gvectors / wpdiscuz | Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload. | 229d ago |
| CVE-2026-22182 | 7.5 | — | — | — | gvectors / wpdiscuz | wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to | 229d ago |
| CVE-2025-12455 | 7.5 | — | — | — | opentext / vertica | Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing. | 229d ago |
| CVE-2026-2229 | 7.5 | — | — | — | nodejs / undici | ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the ser | 230d ago |
| CVE-2026-1528 | 7.5 | — | — | — | nodejs / undici | ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. | 230d ago |
| CVE-2026-1526 | 7.5 | — | — | — | nodejs / undici | The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during per | 230d ago |
