| CVE-2026-18990 | 7.3 | — | — | — | — | A vulnerability was detected in letta-ai LettaBot 0.2.0. | 83d ago |
| CVE-2026-18973 | 7.3 | — | — | — | — | A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. | 83d ago |
| CVE-2026-18970 | 7.3 | — | — | — | — | A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. | 83d ago |
| CVE-2026-18969 | 7.3 | — | — | — | — | A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. | 83d ago |
| CVE-2026-18958 | 7.3 | — | — | — | — | A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/ | 84d ago |
| CVE-2026-71226 | 7.3 | — | — | — | redhat / hardened images | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before al | 84d ago |
| CVE-2026-25703 | 7.3 | — | — | — | — | NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authent | 84d ago |
| CVE-2026-6079 | 7.3 | — | — | — | — | The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to mi | 84d ago |
| CVE-2026-18859 | 7.3 | — | — | — | — | A vulnerability was identified in ESAFENET CDG up to 20260615. | 84d ago |
| CVE-2026-18854 | 7.3 | — | — | — | — | A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. | 84d ago |
| CVE-2026-18810 | 7.3 | — | — | — | — | A security vulnerability has been detected in H3C NX15 V100R017. | 85d ago |
| CVE-2026-18788 | 7.3 | — | — | — | — | A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. | 85d ago |
| CVE-2026-18770 | 7.3 | — | — | — | — | A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. | 85d ago |
| CVE-2026-18755 | 7.3 | — | — | — | — | A DLL hijacking vulnerability in GeoVision GV-ASManager allows a local attacker with write access to an unsafe sea | 85d ago |
| CVE-2026-42169 | 7.3 | — | — | — | — | A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. | 85d ago |
| CVE-2026-18647 | 7.3 | — | — | — | — | A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. | 85d ago |
| CVE-2026-18641 | 7.3 | — | — | — | — | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. | 86d ago |
| CVE-2026-4793 | 7.3 | — | — | — | synology / assistant | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read | 86d ago |
| CVE-2026-18481 | 7.3 | — | — | — | — | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authent | 89d ago |
| CVE-2026-54737 | 7.3 | — | — | — | — | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. | 89d ago |
| CVE-2026-11980 | 7.3 | — | — | — | ibm / aspera | IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | 90d ago |
| CVE-2026-16527 | 7.3 | — | — | — | — | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /stor | 90d ago |
| CVE-2025-69949 | 7.3 | — | — | — | — | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the paramet | 90d ago |
| CVE-2025-69945 | 7.3 | — | — | — | — | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. | 90d ago |
| CVE-2025-69944 | 7.3 | — | — | — | — | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via t | 90d ago |
| CVE-2025-67408 | 7.3 | — | — | — | — | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the para | 90d ago |
| CVE-2025-67407 | 7.3 | — | — | — | — | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via para | 90d ago |
| CVE-2025-67406 | 7.3 | — | — | — | — | https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. | 90d ago |
| CVE-2025-67405 | 7.3 | — | — | — | — | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the | 90d ago |
| CVE-2026-15144 | 7.3 | — | — | — | fastify / fastify\/rate-limit | @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.i | 91d ago |
| CVE-2026-65947 | 7.3 | — | — | — | balbooa / gridbox | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 | 91d ago |
| CVE-2026-23904 | 7.3 | — | — | — | apache / kyuubi | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination | 91d ago |
| CVE-2026-14893 | 7.3 | — | — | — | — | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana | 91d ago |
| CVE-2026-8164 | 7.3 | — | — | — | — | Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. | 92d ago |
| CVE-2026-62433 | 7.3 | — | — | — | — | Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given oper | 92d ago |
| CVE-2026-62432 | 7.3 | — | — | — | — | The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the co | 92d ago |
| CVE-2026-64550 | 7.3 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame lengt | 92d ago |
| CVE-2026-59535 | 7.3 | — | — | — | — | Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | 93d ago |
| CVE-2026-10033 | 7.3 | — | — | — | — | The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl | 96d ago |
| CVE-2026-16519 | 7.3 | — | — | — | — | A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. | 96d ago |
| CVE-2026-16765 | 7.3 | — | — | — | — | A vulnerability was determined in CodeAstro Online Classroom 1.0. | 96d ago |
| CVE-2026-16796 | 7.3 | — | — | — | — | Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SD | 96d ago |
| CVE-2026-16632 | 7.3 | — | — | — | — | A flaw has been found in boazsegev facil.io up to 0.7.4. | 97d ago |
| CVE-2026-61271 | 7.3 | — | — | — | oracle / document management and collaboration | Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: A | 98d ago |
| CVE-2026-61267 | 7.3 | — | — | — | oracle / human capital management configuration workbench | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet | 98d ago |
| CVE-2026-61136 | 7.3 | — | — | — | oracle / commerce platform | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework) | 98d ago |
| CVE-2026-60945 | 7.3 | — | — | — | oracle / learning management | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Internal Operations | 98d ago |
| CVE-2026-60143 | 7.3 | — | — | — | oracle / workflow | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). | 98d ago |
| CVE-2026-47007 | 7.3 | — | — | — | oracle / communications pricing design center | Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications (component: On-p | 98d ago |
| CVE-2026-46990 | 7.3 | — | — | — | oracle / enterprise manager base platform | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Ente | 98d ago |
| CVE-2026-16484 | 7.3 | — | — | — | — | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. | 98d ago |
| CVE-2026-63358 | 7.3 | — | — | — | filegator / filegator | FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directl | 98d ago |
| CVE-2026-47687 | 7.3 | — | — | — | fogproject / fogproject | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. | 98d ago |
| CVE-2026-47685 | 7.3 | — | — | — | fogproject / fogproject | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. | 98d ago |
| CVE-2026-16447 | 7.3 | — | — | — | — | A vulnerability has been found in D-Link DNS-320 1.0.2. | 99d ago |
| CVE-2026-60080 | 7.3 | — | — | — | apache / fory | Use After Free vulnerability in the Rust deserialization logic of Apache Fory. | 99d ago |
| CVE-2026-16332 | 7.3 | — | — | — | — | A vulnerability was detected in D-Link DNS-320 1.0.2. | 99d ago |
| CVE-2026-16331 | 7.3 | — | — | — | — | A security vulnerability has been detected in D-Link DNS-320 1.0.2. | 99d ago |
| CVE-2026-16330 | 7.3 | — | — | — | — | A weakness has been identified in D-Link DNS-320 1.0.2. | 99d ago |
| CVE-2026-16329 | 7.3 | — | — | — | — | A vulnerability was identified in D-Link DNS-320 1.0.2. | 99d ago |
