| CVE-2026-85147 | 7.5 | — | — | — | — | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. | 39d ago |
| CVE-2026-85450 | 7.5 | — | — | — | — | MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that creates un | 40d ago |
| CVE-2026-85449 | 7.5 | — | — | — | — | MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messag | 40d ago |
| CVE-2026-85448 | 7.5 | — | — | — | — | MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vector | 40d ago |
| CVE-2026-85447 | 7.5 | — | — | — | — | MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration o | 40d ago |
| CVE-2026-85446 | 7.5 | — | — | — | — | MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node | 40d ago |
| CVE-2026-85445 | 7.5 | — | — | — | — | MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that tr | 40d ago |
| CVE-2026-85444 | 7.5 | — | — | — | — | MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() fun | 40d ago |
| CVE-2026-85443 | 7.5 | — | — | — | — | MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the | 40d ago |
| CVE-2026-85442 | 7.5 | — | — | — | — | MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allo | 40d ago |
| CVE-2026-85441 | 7.5 | — | — | — | — | MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::opera | 40d ago |
| CVE-2026-85436 | 7.5 | — | — | — | — | MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() th | 40d ago |
| CVE-2026-85431 | 7.5 | — | — | — | — | MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOS | 40d ago |
| CVE-2026-85429 | 7.5 | — | — | — | — | MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating | 40d ago |
| CVE-2026-8862 | 7.5 | — | — | — | — | IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source | 40d ago |
| CVE-2026-82520 | 7.5 | — | — | — | — | parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompr | 40d ago |
| CVE-2026-77465 | 7.5 | — | — | — | — | toml-node is a TOML parser for Node.js and the browser. | 40d ago |
| CVE-2026-85045 | 7.5 | — | — | — | — | Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code i | 40d ago |
| CVE-2026-82527 | 7.5 | — | — | — | — | R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predi | 40d ago |
| CVE-2026-85396 | 7.5 | — | — | — | — | rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly | 40d ago |
| CVE-2026-85393 | 7.5 | — | — | — | — | node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1. | 40d ago |
| CVE-2026-33630 | 7.5 | — | — | — | — | c-ares is an asynchronous resolver library. | 40d ago |
| CVE-2026-84847 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. | 40d ago |
| CVE-2026-84778 | 7.5 | — | — | — | — | Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. | 40d ago |
| CVE-2026-84776 | 7.5 | — | — | — | — | Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | 40d ago |
| CVE-2026-48486 | 7.5 | — | — | — | — | Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus | 40d ago |
| CVE-2026-85182 | 7.5 | — | — | — | — | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticat | 40d ago |
| CVE-2026-85180 | 7.5 | — | — | — | — | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attacker | 40d ago |
| CVE-2026-85155 | 7.5 | — | — | — | — | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with | 40d ago |
| CVE-2026-85150 | 7.5 | — | — | — | — | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. | 40d ago |
| CVE-2026-85124 | 7.5 | — | — | — | — | @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segm | 40d ago |
| CVE-2026-84851 | 7.5 | — | — | — | — | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthentic | 40d ago |
| CVE-2026-84394 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. | 40d ago |
| CVE-2026-84292 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri serializes the port component of a URI without validating it. | 41d ago |
| CVE-2026-78662 | 7.5 | — | — | — | golang / crypto | Previously, a channel registered in the mux's chanList is not usable until it is established. | 41d ago |
| CVE-2026-56855 | 7.5 | — | — | — | golang / crypto | Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock | 41d ago |
| CVE-2026-84382 | 7.5 | — | — | — | — | HTTPX2 is a next generation HTTP client for Python. | 41d ago |
| CVE-2026-20281 | 7.5 | — | — | — | — | A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 t | 41d ago |
| CVE-2026-78222 | 7.5 | — | — | — | — | A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NG | 41d ago |
| CVE-2026-18058 | 7.5 | — | — | — | — | The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. | 41d ago |
| CVE-2026-81774 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions. | 41d ago |
| CVE-2026-18672 | 7.5 | — | — | — | — | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadIma | 41d ago |
| CVE-2026-77792 | 7.5 | — | — | — | — | The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outpu | 41d ago |
| CVE-2026-14957 | 7.5 | — | — | — | — | In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is | 41d ago |
| CVE-2026-84485 | 7.5 | — | — | — | — | APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, all | 41d ago |
| CVE-2026-84484 | 7.5 | — | — | — | — | ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows u | 41d ago |
| CVE-2026-84702 | 7.5 | — | — | — | — | facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write file | 41d ago |
| CVE-2026-81928 | 7.5 | — | — | — | — | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encodin | 41d ago |
| CVE-2026-84476 | 7.5 | — | — | — | — | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing att | 42d ago |
| CVE-2026-84208 | 7.5 | — | — | — | — | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's | 42d ago |
| CVE-2026-84642 | 7.5 | — | — | — | mozilla / thunderbird | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression with | 42d ago |
| CVE-2026-84641 | 7.5 | — | — | — | mozilla / thunderbird | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. | 42d ago |
| CVE-2026-84640 | 7.5 | — | — | — | mozilla / thunderbird | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. | 42d ago |
| CVE-2026-84375 | 7.5 | — | — | — | — | js-yaml is a JavaScript YAML parser and dumper. | 42d ago |
| CVE-2026-84374 | 7.5 | — | — | — | — | Laravel Excel provides supercharged Excel exports and imports in Laravel. | 42d ago |
| CVE-2026-73773 | 7.5 | — | — | — | hpe / arubaos-cx | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. | 42d ago |
| CVE-2026-73771 | 7.5 | — | — | — | hpe / arubaos-cx | An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authenti | 42d ago |
| CVE-2026-73717 | 7.5 | — | — | — | arubanetworks / fabric composer | A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer t | 42d ago |
| CVE-2026-73716 | 7.5 | — | — | — | arubanetworks / fabric composer | A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer | 42d ago |
| CVE-2026-73715 | 7.5 | — | — | — | arubanetworks / fabric composer | A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to con | 42d ago |
