| CVE-2026-52132 | 7.5 | — | — | — | ggml / llama.cpp | llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denia | 42d ago |
| CVE-2026-52131 | 7.5 | — | — | — | ggml / llama.cpp | llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. | 42d ago |
| CVE-2026-52130 | 7.5 | — | — | — | ggml / llama.cpp | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting | 42d ago |
| CVE-2026-52022 | 7.5 | — | — | — | kamailio / kamailio | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF r | 42d ago |
| CVE-2026-51788 | 7.5 | — | — | — | — | An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verific | 42d ago |
| CVE-2026-51768 | 7.5 | — | — | — | — | Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 42d ago |
| CVE-2026-49329 | 7.5 | — | — | — | — | A flaw was found in openshift/oauth-server. | 42d ago |
| CVE-2026-18771 | 7.5 | — | — | — | — | Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. | 42d ago |
| CVE-2026-51766 | 7.5 | — | — | — | — | Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 42d ago |
| CVE-2026-84145 | 7.5 | — | — | — | mozilla / firefox | Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. | 42d ago |
| CVE-2026-84144 | 7.5 | — | — | — | mozilla / firefox | Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. | 42d ago |
| CVE-2026-84132 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Networking: HTTP component. | 42d ago |
| CVE-2026-84130 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Graphics: WebGPU component. | 42d ago |
| CVE-2026-25706 | 7.5 | — | — | — | — | Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who con | 42d ago |
| CVE-2026-19952 | 7.5 | — | — | — | — | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient | 42d ago |
| CVE-2026-82397 | 7.5 | — | — | — | — | Tornado is a Python web framework and asynchronous networking library. | 42d ago |
| CVE-2026-82393 | 7.5 | — | — | — | — | pnpm is a package manager. | 42d ago |
| CVE-2026-81297 | 7.5 | — | — | — | — | Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | 42d ago |
| CVE-2026-81296 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | 42d ago |
| CVE-2026-79407 | 7.5 | — | — | — | — | A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files vi | 42d ago |
| CVE-2026-54598 | 7.5 | — | — | — | — | Wallos is an open-source, self-hostable personal subscription tracker. | 42d ago |
| CVE-2026-51735 | 7.5 | — | — | — | — | Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 43d ago |
| CVE-2026-17615 | 7.5 | — | — | — | — | A flaw was found in RESTEasy's SourceProvider. | 43d ago |
| CVE-2026-75133 | 7.5 | — | — | — | — | Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that a | 43d ago |
| CVE-2026-51719 | 7.5 | — | — | — | — | Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 43d ago |
| CVE-2026-51716 | 7.5 | — | — | — | — | Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthent | 43d ago |
| CVE-2026-51695 | 7.5 | — | — | — | — | Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 43d ago |
| CVE-2026-51694 | 7.5 | — | — | — | — | Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenti | 43d ago |
| CVE-2026-51688 | 7.5 | — | — | — | — | Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica | 43d ago |
| CVE-2026-76763 | 7.5 | — | — | — | — | A flaw was found in SmallRye GraphQL. | 43d ago |
| CVE-2026-51673 | 7.5 | — | — | — | — | Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att | 43d ago |
| CVE-2026-51671 | 7.5 | — | — | — | — | Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauth | 43d ago |
| CVE-2026-51668 | 7.5 | — | — | — | — | Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate | 43d ago |
| CVE-2026-19616 | 7.5 | — | — | — | — | Missing Authorization vulnerability in TBC Technology Inc. | 43d ago |
| CVE-2026-71257 | 7.5 | — | — | — | apache / wicket | Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request wi | 43d ago |
| CVE-2026-82880 | 7.5 | — | — | — | — | YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and Ope | 43d ago |
| CVE-2026-19873 | 7.5 | — | — | — | — | HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query | 43d ago |
| CVE-2026-82861 | 7.5 | — | — | — | — | @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit | 43d ago |
| CVE-2026-81624 | 7.5 | — | — | — | — | Undertow is a flexible performant web server used in JBoss EAP and WildFly. | 43d ago |
| CVE-2026-56718 | 7.5 | — | — | — | — | AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd w | 43d ago |
| CVE-2026-82657 | 7.5 | — | — | — | — | Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announce | 44d ago |
| CVE-2026-82655 | 7.5 | — | — | — | — | Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_sh | 44d ago |
| CVE-2026-82644 | 7.5 | — | — | — | — | WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), whi | 44d ago |
| CVE-2026-82639 | 7.5 | — | — | — | — | NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoin | 44d ago |
| CVE-2026-82638 | 7.5 | — | — | — | — | jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attac | 44d ago |
| CVE-2026-75807 | 7.5 | — | — | — | — | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, | 45d ago |
| CVE-2026-82472 | 7.5 | — | — | — | — | Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentic | 45d ago |
| CVE-2026-82453 | 7.5 | — | — | — | — | rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. | 45d ago |
| CVE-2026-77007 | 7.5 | — | — | — | — | The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authori | 45d ago |
| CVE-2026-76586 | 7.5 | — | — | — | — | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the am | 45d ago |
| CVE-2026-55841 | 7.5 | — | — | — | — | Graylog is a free and open log management platform. | 45d ago |
| CVE-2026-55784 | 7.5 | — | — | — | — | free5GC is an open-source implementation of the 5G core network. | 45d ago |
| CVE-2026-82333 | 7.5 | — | — | — | expressjs / multer | multer is a middleware for handling multipart/form-data in Node.js. | 45d ago |
| CVE-2026-81520 | 7.5 | — | — | — | — | A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication sessi | 45d ago |
| CVE-2026-81518 | 7.5 | — | — | — | — | When mongosqld is configured with a client certificate authority file, the listener requests a client certificate | 45d ago |
| CVE-2026-81517 | 7.5 | — | — | — | — | An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate en | 45d ago |
| CVE-2026-77078 | 7.5 | — | — | — | expressjs / multer | multer is a middleware for handling multipart/form-data in Node.js. | 45d ago |
| CVE-2026-77037 | 7.5 | — | — | — | expressjs / multer | multer is a middleware for handling multipart/form-data in Node.js. | 45d ago |
| CVE-2026-51662 | 7.5 | — | — | — | — | Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauth | 45d ago |
| CVE-2026-18899 | 7.5 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal. | 45d ago |
