| CVE-2026-32274 | 7.5 | — | — | — | python / black | Black is the uncompromising Python code formatter. | 230d ago |
| CVE-2026-3497 | 7.5 | — | — | — | canonical / ubuntu linux | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. | 230d ago |
| CVE-2026-32236 | 7.5 | — | — | — | linuxfoundation / backstage | Backstage is an open framework for building developer portals. | 230d ago |
| CVE-2025-70873 | 7.5 | — | — | — | sqlite / sqlite | An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earl | 230d ago |
| CVE-2026-32141 | 7.5 | — | — | — | webreflection / flatted | flatted is a circular JSON parser. | 230d ago |
| CVE-2026-28254 | 7.5 | — | — | — | trane / tracer sc firmware | A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthen | 230d ago |
| CVE-2026-28253 | 7.5 | — | — | — | trane / tracer sc firmware | A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge c | 230d ago |
| CVE-2026-28356 | 7.5 | — | — | — | — | multipart is a fast multipart/form-data parser for python. | 230d ago |
| CVE-2019-25515 | 7.5 | — | — | — | jettweb / php stock news site script | Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php adminis | 230d ago |
| CVE-2026-3657zero day | 7.5 | 0.34% | 1/3 | same day | — | The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX a | 230d ago |
| CVE-2026-3932 | 7.5 | — | — | — | google / chrome | Insufficient policy enforcement in PDF in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker | 231d ago |
| CVE-2026-3924 | 7.5 | — | — | — | google / chrome | use after free in WindowDialog in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromise | 231d ago |
| CVE-2026-32130 | 7.5 | — | — | — | zitadel / zitadel | ZITADEL is an open source identity management platform. | 231d ago |
| CVE-2026-32098 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 231d ago |
| CVE-2026-31958 | 7.5 | — | — | — | tornadoweb / tornado | Tornado is a Python web framework and asynchronous networking library. | 231d ago |
| CVE-2026-31894 | 7.5 | — | — | — | wegia / wegia | WeGIA is a web manager for charitable institutions. | 231d ago |
| CVE-2026-27703 | 7.5 | — | — | — | riot-os / riot | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things | 231d ago |
| CVE-2026-31887 | 7.5 | — | — | — | shopware / shopware | Shopware is an open commerce platform. | 231d ago |
| CVE-2019-25480 | 7.5 | — | — | — | — | ARMBot contains an unrestricted file upload vulnerability in upload.php that allows unauthenticated attackers to u | 231d ago |
| CVE-2019-25478 | 7.5 | — | — | — | — | GetGo Download Manager 6.2.2.3300 contains a buffer overflow vulnerability that allows remote attackers to cause d | 231d ago |
| CVE-2019-25472 | 7.5 | — | — | — | — | IntelBras Telefone IP TIP200 and 200 LITE contain an unauthenticated arbitrary file read vulnerability in the dump | 231d ago |
| CVE-2019-25470 | 7.5 | — | — | — | — | eWON Firmware versions 12.2 to 13.0 contain an authentication bypass vulnerability that allows attackers with mini | 231d ago |
| CVE-2019-25465 | 7.5 | — | — | — | — | Hisilicon HiIpcam V100R003 contains a directory traversal vulnerability that allows unauthenticated attackers to a | 231d ago |
| CVE-2026-31872 | 7.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 231d ago |
| CVE-2026-31870 | 7.5 | — | — | — | yhirose / cpp-httplib | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. | 231d ago |
| CVE-2026-31866 | 7.5 | — | — | — | openfeature / flagd | flagd is a feature flag daemon with a Unix philosophy. | 231d ago |
| CVE-2026-30226 | 7.5 | — | — | — | svelte / devalue | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient fo | 231d ago |
| CVE-2026-21888 | 7.5 | — | — | — | emqx / nanomq | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. | 231d ago |
| CVE-2026-1069 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allow | 231d ago |
| CVE-2025-14513 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6 | 231d ago |
| CVE-2025-13929 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, | 231d ago |
| CVE-2026-86098 | 7.4 | — | — | — | — | ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function | 54d ago |
| CVE-2026-85152 | 7.4 | — | — | — | — | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or dedupli | 54d ago |
| CVE-2026-84961 | 7.4 | — | — | — | — | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes | 54d ago |
| CVE-2026-18489 | 7.4 | — | — | — | — | IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtai | 54d ago |
| CVE-2026-85525 | 7.4 | — | — | — | — | Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS cer | 54d ago |
| CVE-2026-62906 | 7.4 | — | — | — | — | Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthoriz | 55d ago |
| CVE-2026-84777 | 7.4 | — | — | — | — | Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. | 55d ago |
| CVE-2026-75034 | 7.4 | — | — | — | — | A flaw was found in Rancher Manager. | 55d ago |
| CVE-2026-85091 | 7.4 | — | — | — | — | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when | 55d ago |
| CVE-2023-20577 | 7.4 | — | — | — | — | A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to | 56d ago |
| CVE-2026-84675 | 7.4 | — | — | — | — | OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control bu | 56d ago |
| CVE-2026-84366 | 7.4 | — | — | — | — | Scrapy is a high-level web crawling and scraping framework for Python. | 57d ago |
| CVE-2026-73718 | 7.4 | — | — | — | arubanetworks / fabric composer | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthentic | 57d ago |
| CVE-2026-84059 | 7.4 | — | — | — | — | A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. | 57d ago |
| CVE-2026-82225 | 7.4 | — | — | — | — | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions. | 58d ago |
| CVE-2026-82608 | 7.4 | — | — | — | — | A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. | 58d ago |
| CVE-2026-82597 | 7.4 | — | — | — | — | A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. | 58d ago |
| CVE-2026-82595 | 7.4 | — | — | — | — | A vulnerability was found in D-Link DIR-825M 1.1.8. | 59d ago |
| CVE-2026-82480 | 7.4 | — | — | — | — | A security flaw has been discovered in NASA cFS up to 7.0.1. | 59d ago |
| CVE-2026-82289 | 7.4 | — | — | — | — | Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gi | 61d ago |
| CVE-2026-82281 | 7.4 | — | — | — | — | Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv | 61d ago |
| CVE-2026-81020 | 7.4 | — | — | — | — | wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never i | 61d ago |
| CVE-2026-81019 | 7.4 | — | — | — | — | wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never | 61d ago |
| CVE-2026-73208 | 7.4 | — | — | — | — | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token res | 61d ago |
| CVE-2026-40018 | 7.4 | — | — | — | — | None None None No publicly available exploits are known. | 61d ago |
| CVE-2026-18717 | 7.4 | — | — | — | — | ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an at | 62d ago |
| CVE-2026-59288 | 7.4 | — | — | — | vmware / spring for graphql | The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. | 62d ago |
| CVE-2026-47841 | 7.4 | — | — | — | vmware / spring security | An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a | 63d ago |
| CVE-2026-54550 | 7.4 | — | — | — | — | IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. | 63d ago |
