| CVE-2026-73264 | 7.6 | — | — | — | — | Prowler is a cloud security platform. | 62d ago |
| CVE-2026-18693 | 7.6 | — | — | — | — | An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privi | 63d ago |
| CVE-2026-48767 | 7.6 | — | — | — | — | TypeBot is a chatbot builder tool. | 63d ago |
| CVE-2026-48415 | 7.6 | — | — | — | — | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature byp | 63d ago |
| CVE-2026-48766 | 7.6 | — | — | — | — | TypeBot is a chatbot builder tool. | 63d ago |
| CVE-2026-44763 | 7.6 | — | — | — | — | SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path vali | 63d ago |
| CVE-2026-18621 | 7.6 | — | — | — | — | A flaw was found in Data Science Pipelines (DSP). | 64d ago |
| CVE-2026-72594 | 7.6 | — | — | — | — | A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged aut | 64d ago |
| CVE-2026-19387 | 7.6 | — | — | — | — | A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding | 64d ago |
| CVE-2026-67621 | 7.6 | — | — | — | — | Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members t | 68d ago |
| CVE-2026-34966 | 7.6 | — | — | — | — | Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to | 69d ago |
| CVE-2026-71294 | 7.6 | — | — | — | — | Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instanti | 69d ago |
| CVE-2026-25292 | 7.6 | — | — | — | qualcomm / sm6225p firmware | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configu | 70d ago |
| CVE-2026-67352 | 7.6 | — | — | — | — | luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that a | 73d ago |
| CVE-2026-10685 | 7.6 | — | — | — | zephyrproject / zephyr | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c i | 74d ago |
| CVE-2026-67527 | 7.6 | — | — | — | — | OpenProject is open-source, web-based project management software. | 75d ago |
| CVE-2026-41703 | 7.6 | — | — | — | — | VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. | 75d ago |
| CVE-2026-18381 | 7.6 | — | — | — | redhat / cost management metrics operator | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. | 75d ago |
| CVE-2026-18378 | 7.6 | — | — | — | redhat / cost management metrics operator | A flaw was found in koku-metrics-operator. | 75d ago |
| CVE-2026-18361 | 7.6 | — | — | — | — | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) | 75d ago |
| CVE-2026-18360 | 7.6 | — | — | — | — | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) | 75d ago |
| CVE-2026-16969 | 7.6 | — | — | — | — | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) | 75d ago |
| CVE-2026-16313 | 7.6 | — | — | — | — | A flaw was found in sg3_utils. | 77d ago |
| CVE-2026-66427 | 7.6 | — | — | — | — | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | 78d ago |
| CVE-2026-59537 | 7.6 | — | — | — | — | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 | 78d ago |
| CVE-2026-65532 | 7.6 | — | — | — | — | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | 82d ago |
| CVE-2026-65462 | 7.6 | — | — | — | — | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | 82d ago |
| CVE-2026-62518 | 7.6 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operatio | 84d ago |
| CVE-2026-62515 | 7.6 | — | — | — | oracle / e-business suite | Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (component: Intern | 84d ago |
| CVE-2026-61325 | 7.6 | — | — | — | oracle / advanced benefits | Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). | 84d ago |
| CVE-2026-61181 | 7.6 | — | — | — | oracle / agile product lifecycle management for process | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (compone | 84d ago |
| CVE-2026-61132 | 7.6 | — | — | — | oracle / commerce platform | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework) | 84d ago |
| CVE-2026-60886 | 7.6 | — | — | — | oracle / work in process | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). | 84d ago |
| CVE-2026-60642 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 84d ago |
| CVE-2026-60641 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 84d ago |
| CVE-2026-60584 | 7.6 | — | — | — | oracle / transportation management | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: CSV Management). | 84d ago |
| CVE-2026-60578 | 7.6 | — | — | — | oracle / enterprise command center framework | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor | 84d ago |
| CVE-2026-60528 | 7.6 | — | — | — | oracle / weblogic server | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). | 84d ago |
| CVE-2026-60522 | 7.6 | — | — | — | oracle / webcenter content | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | 84d ago |
| CVE-2026-10680 | 7.6 | — | — | — | zephyrproject / zephyr | The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host | 84d ago |
| CVE-2026-47414 | 7.6 | — | — | — | — | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. | 84d ago |
| CVE-2026-55544 | 7.6 | — | — | — | — | NextCRM is open-source customer relationship management (CRM) software. | 85d ago |
| CVE-2026-46701 | 7.6 | — | — | — | network-ai / network-ai | Network-AI is a TypeScript/Node.js multi-agent orchestrator. | 85d ago |
| CVE-2026-63869 | 7.6 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index i | 86d ago |
| CVE-2025-71398 | 7.6 | — | — | — | surrealdb / surrealdb | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass | 87d ago |
| CVE-2026-52870 | 7.6 | — | — | — | lfprojects / mcp python sdk | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). | 90d ago |
| CVE-2026-45337 | 7.6 | — | — | — | better-auth / better auth | Better Auth is an authentication and authorization library for TypeScript. | 90d ago |
| CVE-2026-50147 | 7.6 | — | — | — | metabase / metabase | Metabase is an open-source business intelligence and embedded analytics tool. | 90d ago |
| CVE-2026-54560 | 7.6 | — | — | — | — | Cloudreve is a self-hosted file management and sharing system. | 90d ago |
| CVE-2026-58233 | 7.6 | — | — | — | — | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially cra | 91d ago |
| CVE-2026-62186 | 7.6 | — | — | — | openclaw / openclaw | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model ov | 92d ago |
| CVE-2026-62185 | 7.6 | — | — | — | — | Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to ac | 92d ago |
| CVE-2026-61955 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویت | 92d ago |
| CVE-2026-57773 | 7.6 | — | — | — | — | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanc | 92d ago |
| CVE-2026-55405 | 7.6 | — | — | — | — | LangChain4j is a Java library for building LLM-powered applications on the JVM. | 95d ago |
| CVE-2026-57985 | 7.6 | — | — | — | microsoft / edge chromium | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over | 102d ago |
| CVE-2026-13707 | 7.6 | — | — | — | mediawiki / mediawiki | Session fixation vulnerability in Wikimedia Foundation OAuth. | 104d ago |
| CVE-2026-6688 | 7.6 | — | — | — | elm-chan / fatfs | FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename hand | 104d ago |
| CVE-2026-6687 | 7.6 | — | — | — | elm-chan / fatfs | FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is | 104d ago |
| CVE-2026-6682 | 7.6 | — | — | — | elm-chan / fatfs | In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can w | 104d ago |
