| CVE-2026-54833 | 7.4 | — | — | — | — | Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. | 124d ago |
| CVE-2026-12992 | 7.4 | — | — | — | redhat / build of apicurio registry | A flaw was found in Apicurio Registry. | 125d ago |
| CVE-2026-46608 | 7.4 | — | — | — | — | Glances is an open-source system cross-platform monitoring tool. | 125d ago |
| CVE-2026-54821 | 7.4 | — | — | — | — | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. | 125d ago |
| CVE-2026-57589 | 7.4 | — | — | — | openbsd / openbsd | sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. | 125d ago |
| CVE-2026-55759 | 7.4 | — | — | — | — | Rocket.Chat is an open-source, secure, fully customizable communications platform. | 126d ago |
| CVE-2026-49440 | 7.4 | — | — | — | deno / deno | Deno is a JavaScript, TypeScript, and WebAssembly runtime. | 127d ago |
| CVE-2026-44726 | 7.4 | — | — | — | deno / deno | Deno is a JavaScript, TypeScript, and WebAssembly runtime. | 127d ago |
| CVE-2026-56815 | 7.4 | — | — | — | — | pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handl | 127d ago |
| CVE-2026-48505 | 7.4 | — | — | — | — | Filament is a collection of full-stack components for accelerated Laravel development. | 128d ago |
| CVE-2026-9006 | 7.4 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Pro | 128d ago |
| CVE-2026-8646 | 7.4 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0 | 128d ago |
| CVE-2026-49287 | 7.4 | — | — | — | — | Statamic is a Laravel and Git powered content management system (CMS). | 131d ago |
| CVE-2026-3195 | 7.4 | — | — | — | — | A flaw was found in QEMU. | 131d ago |
| CVE-2026-9697 | 7.4 | — | — | — | nodejs / undici | Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// | 133d ago |
| CVE-2026-49502 | 7.4 | — | — | — | dell / powerflex manager | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability. | 133d ago |
| CVE-2026-52698 | 7.4 | — | — | — | — | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget | 133d ago |
| CVE-2026-48294exploited | 7.4 | 1.9% | 1/3 | +54d | adobe / acrobat | Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data | 133d ago |
| CVE-2026-12348 | 7.4 | — | — | — | — | Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain in the address | 133d ago |
| CVE-2026-10303 | 7.4 | — | — | — | — | In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly valida | 134d ago |
| CVE-2024-39575 | 7.4 | — | — | — | — | update_disk_psu_baseline.sh requires password in plain text | 134d ago |
| CVE-2026-49082 | 7.4 | — | — | — | — | Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk C | 135d ago |
| CVE-2026-45389 | 7.4 | — | — | — | — | In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the c | 135d ago |
| CVE-2026-12068 | 7.4 | — | — | — | — | Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote a | 137d ago |
| CVE-2026-50631 | 7.4 | — | — | — | apache / cxf | A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass si | 138d ago |
| CVE-2026-53782 | 7.4 | — | — | — | — | Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a p | 139d ago |
| CVE-2026-47960 | 7.4 | — | — | — | adobe / coldfusion | ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Ref | 141d ago |
| CVE-2026-34181 | 7.4 | — | — | — | openssl / openssl | Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Passwor | 141d ago |
| CVE-2026-46320 | 7.4 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_ | 141d ago |
| CVE-2026-41720 | 7.4 | — | — | — | — | Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty user | 141d ago |
| CVE-2026-40215 | 7.4 | — | — | — | openvpn / openvpn | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potential | 142d ago |
| CVE-2026-50752exploited | 7.4 | 5.0% | 1/3 | +100d | — | A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated a | 142d ago |
| CVE-2026-45300 | 7.4 | — | — | — | asynchttpclient project / async-http-client | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously proc | 145d ago |
| CVE-2026-10976 | 7.4 | — | — | — | google / chrome | Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially | 145d ago |
| CVE-2026-10973 | 7.4 | — | — | — | google / chrome | Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin d | 145d ago |
| CVE-2026-10968 | 7.4 | — | — | — | google / chrome | Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a re | 145d ago |
| CVE-2026-50292 | 7.4 | — | — | — | freedesktop / libinput | In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev pr | 146d ago |
| CVE-2026-44393 | 7.4 | — | — | — | — | An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. | 146d ago |
| CVE-2025-14774 | 7.4 | — | — | — | abb / t-mac plus | Incorrect Authorization vulnerability in ABB T-MAC Plus. | 147d ago |
| CVE-2025-64390 | 7.4 | — | — | — | — | A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. | 148d ago |
| CVE-2026-10629 | 7.4 | — | — | — | — | SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protecti | 148d ago |
| CVE-2022-4991 | 7.4 | — | — | — | — | Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllab | 149d ago |
| CVE-2026-48555 | 7.4 | — | — | — | — | Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allo | 152d ago |
| CVE-2026-48501 | 7.4 | — | — | — | github / cli | GitHub CLI (gh) is GitHub’s official command line tool. | 152d ago |
| CVE-2026-46579 | 7.4 | — | — | — | redhat / openshift container platform | A flaw was found in the OpenShift Router. | 152d ago |
| CVE-2026-5343 | 7.4 | — | — | — | miniorange / saml sso - service provider | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Pri | 152d ago |
| CVE-2026-46818 | 7.4 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). | 153d ago |
| CVE-2026-45373 | 7.4 | — | — | — | — | CodeWhale is a DeepSeek + MiMo coding agent in terminal. | 153d ago |
| CVE-2026-45310 | 7.4 | — | — | — | — | CodeWhale is a DeepSeek + MiMo coding agent in terminal. | 153d ago |
| CVE-2026-48526 | 7.4 | — | — | — | pyjwt project / pyjwt | PyJWT is a JSON Web Token implementation in Python. | 153d ago |
| CVE-2026-47269 | 7.4 | — | — | — | — | pam_usb provides hardware authentication for Linux using ordinary removable media. | 154d ago |
| CVE-2026-44460 | 7.4 | — | — | — | — | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. | 154d ago |
| CVE-2026-49014 | 7.4 | — | — | — | osgeo / gdal | In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-bas | 154d ago |
| CVE-2026-45575 | 7.4 | — | — | — | — | epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. | 155d ago |
| CVE-2026-48697 | 7.4 | — | — | — | pavel-odintsov / fastnetmon | FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. | 155d ago |
| CVE-2026-44053 | 7.4 | — | — | — | — | Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote att | 160d ago |
| CVE-2026-39850 | 7.4 | — | — | — | — | Yii 2 is a PHP application framework. | 161d ago |
| CVE-2026-3593 | 7.4 | — | — | — | isc / bind | A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. | 161d ago |
| CVE-2026-45245 | 7.4 | — | — | — | steipete / summarize | Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dis | 163d ago |
| CVE-2026-45539 | 7.4 | — | — | — | — | Microsoft APM is an open-source, community-driven dependency manager for AI agents. | 166d ago |
