| CVE-2026-62467 | 7.7 | — | — | — | oracle / hyperion infrastructure technology | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Event | 56d ago |
| CVE-2026-61331 | 7.7 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Compon | 56d ago |
| CVE-2026-61199 | 7.7 | — | — | — | oracle / webcenter portal | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). | 56d ago |
| CVE-2026-60983 | 7.7 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 56d ago |
| CVE-2026-60969 | 7.7 | — | — | — | oracle / unified directory | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). | 56d ago |
| CVE-2026-60733 | 7.7 | — | — | — | oracle / webcenter portal | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). | 56d ago |
| CVE-2026-71307 | 7.7 | — | — | — | — | Lemur manages TLS certificate creation. | 56d ago |
| CVE-2026-71303 | 7.7 | — | — | — | — | Lemur manages TLS certificate creation. | 56d ago |
| CVE-2026-71365 | 7.7 | — | — | — | — | A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. | 56d ago |
| CVE-2026-50575 | 7.7 | — | — | — | — | BetterDesk is a remote desktop management solution. | 56d ago |
| CVE-2026-75842 | 7.7 | — | — | — | — | ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM claus | 56d ago |
| CVE-2026-71567 | 7.7 | — | — | — | — | In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected | 57d ago |
| CVE-2026-74869 | 7.7 | — | — | — | — | stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allow | 57d ago |
| CVE-2026-72487 | 7.7 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr | 60d ago |
| CVE-2026-69101 | 7.7 | — | — | — | — | Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attack | 60d ago |
| CVE-2026-72859 | 7.7 | — | — | — | — | Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint th | 60d ago |
| CVE-2026-72857 | 7.7 | — | — | — | — | Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticate | 61d ago |
| CVE-2026-72849 | 7.7 | — | — | — | — | Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that | 61d ago |
| CVE-2026-73530 | 7.7 | — | — | — | — | Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers | 61d ago |
| CVE-2026-72672 | 7.7 | — | — | — | elastic / kibana | The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts | 61d ago |
| CVE-2026-72670 | 7.7 | — | — | — | elastic / kibana | A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a | 61d ago |
| CVE-2026-58314 | 7.7 | — | — | — | — | Two SSRF findings in Gitea 1.26.2 | 61d ago |
| CVE-2026-66661 | 7.7 | — | — | — | — | Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. | 61d ago |
| CVE-2026-65582 | 7.7 | — | — | — | — | Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions. | 61d ago |
| CVE-2026-73498 | 7.7 | — | — | — | — | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). | 62d ago |
| CVE-2026-14866 | 7.7 | — | — | — | ibm / i access client solutions | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority d | 62d ago |
| CVE-2026-16863 | 7.7 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an | 62d ago |
| CVE-2026-16627 | 7.7 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain c | 62d ago |
| CVE-2026-73122 | 7.7 | — | — | — | — | A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). | 63d ago |
| CVE-2026-66878 | 7.7 | — | — | — | — | A flaw was found in multicloud-operators-subscription. | 63d ago |
| CVE-2026-48447 | 7.7 | — | — | — | adobe / lightroom | Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code exec | 63d ago |
| CVE-2026-48414 | 7.7 | — | — | — | — | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv | 63d ago |
| CVE-2026-48385 | 7.7 | — | — | — | adobe / coldfusion | ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject | 63d ago |
| CVE-2026-18127 | 7.7 | — | — | — | — | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote auth | 63d ago |
| CVE-2026-72773 | 7.7 | — | — | — | n8n / n8n | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search | 63d ago |
| CVE-2026-18941 | 7.7 | — | — | — | — | A flaw was found in Feast and feast-operator. | 64d ago |
| CVE-2026-68340 | 7.7 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor bloc | 64d ago |
| CVE-2026-68255 | 7.7 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the resp | 64d ago |
| CVE-2026-72591 | 7.7 | — | — | — | — | A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to | 64d ago |
| CVE-2026-72566 | 7.7 | — | — | — | — | A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged a | 64d ago |
| CVE-2026-67620 | 7.7 | — | — | — | flowiseai / flowise | Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSe | 66d ago |
| CVE-2026-16589 | 7.7 | — | — | — | — | The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a S | 67d ago |
| CVE-2026-64636 | 7.7 | — | — | — | — | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user | 67d ago |
| CVE-2026-56793 | 7.7 | — | — | — | dell / openmanage server administrator | Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerabilit | 67d ago |
| CVE-2026-8183 | 7.7 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 thro | 69d ago |
| CVE-2026-20313 | 7.7 | — | — | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN enginee | 69d ago |
| CVE-2026-20124 | 7.7 | — | — | — | — | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an | 69d ago |
| CVE-2026-51401 | 7.7 | — | — | — | vim / vim | An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfil | 70d ago |
| CVE-2026-70479 | 7.7 | — | — | — | — | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 70d ago |
| CVE-2026-66310 | 7.7 | — | — | — | microsoft / edge | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose in | 71d ago |
| CVE-2026-69086 | 7.7 | — | — | — | — | SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endp | 71d ago |
| CVE-2026-20483 | 7.7 | — | — | — | mediatek / mt8893 firmware | In Telephony, there is a possible escalation of privilege due to a missing permission check. | 72d ago |
| CVE-2026-14538 | 7.7 | — | — | — | google / mcp toolbox for databases | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of | 75d ago |
| CVE-2026-59931 | 7.7 | — | — | — | — | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | 77d ago |
| CVE-2026-28896 | 7.7 | — | — | — | apple / macos | The issue was addressed with improved memory handling. | 78d ago |
| CVE-2026-17527 | 7.7 | — | — | — | — | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-on | 79d ago |
| CVE-2026-64524 | 7.7 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix | 81d ago |
| CVE-2026-64456 | 7.7 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len | 81d ago |
| CVE-2026-63313 | 7.7 | — | — | — | — | 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. | 82d ago |
| CVE-2026-43820 | 7.7 | — | — | — | apple / swiftnio ssl | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. | 82d ago |
