| CVE-2026-17203 | 7.5 | — | — | — | — | IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive info | 45d ago |
| CVE-2026-82288 | 7.5 | — | — | — | — | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags en | 46d ago |
| CVE-2026-82275 | 7.5 | — | — | — | — | Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict fi | 46d ago |
| CVE-2026-82270 | 7.5 | — | — | — | — | Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route th | 46d ago |
| CVE-2026-82268 | 7.5 | — | — | — | — | Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that t | 46d ago |
| CVE-2026-75124 | 7.5 | — | — | — | — | PLANET GS-4210-16P2S V3 firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability | 46d ago |
| CVE-2026-55584 | 7.5 | — | — | — | — | phpSysInfo is a customizable PHP script that displays system information. | 46d ago |
| CVE-2026-55552 | 7.5 | — | — | — | — | Yamcs is a mission control framework. | 46d ago |
| CVE-2026-55484 | 7.5 | — | — | — | — | ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. | 46d ago |
| CVE-2026-55215 | 7.5 | — | — | — | — | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. | 46d ago |
| CVE-2026-54788 | 7.5 | — | — | — | — | dd-trace-rs provides Datadog application performance monitoring for Rust. | 46d ago |
| CVE-2026-51659 | 7.5 | — | — | — | — | Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 46d ago |
| CVE-2026-51658 | 7.5 | — | — | — | — | Incorrect access control in the getDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att | 46d ago |
| CVE-2026-51650 | 7.5 | — | — | — | — | Incorrect access control in the getRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 46d ago |
| CVE-2026-51648 | 7.5 | — | — | — | — | Incorrect access control in the getWanInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 46d ago |
| CVE-2026-51647 | 7.5 | — | — | — | — | Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 46d ago |
| CVE-2026-51644 | 7.5 | — | — | — | — | Incorrect access control in the getCrpcConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 46d ago |
| CVE-2026-51642 | 7.5 | — | — | — | — | Incorrect access control in the getMeshRoutingTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthent | 46d ago |
| CVE-2026-51641 | 7.5 | — | — | — | — | Incorrect access control in the getWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 46d ago |
| CVE-2026-51627 | 7.5 | — | — | — | — | Incorrect access control in the getIptvCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 46d ago |
| CVE-2026-51625 | 7.5 | — | — | — | — | Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticate | 46d ago |
| CVE-2026-51624 | 7.5 | — | — | — | — | Incorrect access control in the getStationMacByIp function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentic | 46d ago |
| CVE-2026-51623 | 7.5 | — | — | — | — | Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 46d ago |
| CVE-2026-51621 | 7.5 | — | — | — | — | Incorrect access control in the getInitCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at | 46d ago |
| CVE-2026-51620 | 7.5 | — | — | — | — | Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 46d ago |
| CVE-2026-51619 | 7.5 | — | — | — | — | Incorrect access control in the getOnlineClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat | 46d ago |
| CVE-2026-51618 | 7.5 | — | — | — | — | Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated | 46d ago |
| CVE-2026-51617 | 7.5 | — | — | — | — | Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticat | 46d ago |
| CVE-2026-51616 | 7.5 | — | — | — | — | Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a | 46d ago |
| CVE-2026-51615 | 7.5 | — | — | — | — | Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att | 46d ago |
| CVE-2026-81767 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. | 46d ago |
| CVE-2026-81285 | 7.5 | — | — | — | — | Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions. | 46d ago |
| CVE-2026-56854 | 7.5 | — | — | — | — | The source-address critical option in the Permissions returned by an authentication callback was only enforced for | 46d ago |
| CVE-2026-38638 | 7.5 | — | — | — | — | An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of | 46d ago |
| CVE-2026-38636 | 7.5 | — | — | — | — | An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of | 46d ago |
| CVE-2026-37736 | 7.5 | — | — | — | — | An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Deni | 46d ago |
| CVE-2026-37237 | 7.5 | — | — | — | — | vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. | 46d ago |
| CVE-2026-82261 | 7.5 | — | — | — | svelte / sveltekit | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled conta | 46d ago |
| CVE-2026-82260 | 7.5 | — | — | — | svelte / sveltekit | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFu | 46d ago |
| CVE-2026-82259 | 7.5 | — | — | — | svelte / sveltekit | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the e | 46d ago |
| CVE-2026-82254 | 7.5 | — | — | — | — | gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacke | 46d ago |
| CVE-2026-82253 | 7.5 | — | — | — | — | gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. | 46d ago |
| CVE-2026-82252 | 7.5 | — | — | — | — | gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject o | 46d ago |
| CVE-2026-82251 | 7.5 | — | — | — | — | gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal w | 46d ago |
| CVE-2026-82247 | 7.5 | — | — | — | — | gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' | 46d ago |
| CVE-2026-42391 | 7.5 | — | — | — | — | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, | 46d ago |
| CVE-2026-33605 | 7.5 | — | — | — | — | An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before au | 46d ago |
| CVE-2026-27852 | 7.5 | — | — | — | — | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email ad | 46d ago |
| CVE-2026-80720 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bio_set for iomap_split_ | 46d ago |
| CVE-2026-80717 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter | 46d ago |
| CVE-2026-80707 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939_session_fresh_new | 46d ago |
| CVE-2026-80691 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL ch | 46d ago |
| CVE-2026-80646 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in __i | 46d ago |
| CVE-2026-80637 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory acce | 46d ago |
| CVE-2026-80631 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that ove | 46d ago |
| CVE-2026-80614 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in ema | 46d ago |
| CVE-2026-5097 | 7.5 | — | — | — | — | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up | 46d ago |
| CVE-2026-19084 | 7.5 | — | — | — | — | The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featu | 46d ago |
| CVE-2026-18983 | 7.5 | — | — | — | — | The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in al | 46d ago |
| CVE-2026-76945 | 7.5 | — | — | — | — | The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation | 46d ago |
