| CVE-2026-80433 | 7.5 | — | — | — | — | Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. | 47d ago |
| CVE-2026-75005 | 7.5 | — | — | — | apache / apisix | Inefficient Algorithmic Complexity vulnerability in Apache APISIX. | 47d ago |
| CVE-2026-74848 | 7.5 | — | — | — | apache / apisix | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. | 47d ago |
| CVE-2026-78137 | 7.5 | — | — | — | — | The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its una | 47d ago |
| CVE-2026-47893 | 7.5 | — | — | — | vmware / spring framework | A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information | 47d ago |
| CVE-2026-47889 | 7.5 | — | — | — | — | A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSi | 47d ago |
| CVE-2026-47888 | 7.5 | — | — | — | — | A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. | 47d ago |
| CVE-2026-47886 | 7.5 | — | — | — | — | Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Deni | 47d ago |
| CVE-2026-47885 | 7.5 | — | — | — | — | The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is se | 47d ago |
| CVE-2026-19715 | 7.5 | — | — | — | — | The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug l | 47d ago |
| CVE-2026-47852 | 7.5 | — | — | — | vmware / spring ai | A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model | 47d ago |
| CVE-2026-47851 | 7.5 | — | — | — | vmware / spring ai | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion t | 47d ago |
| CVE-2026-75333 | 7.5 | — | — | — | — | yx-image-recognition v1.0 is vulnerable to Path Traversal. | 47d ago |
| CVE-2026-75328 | 7.5 | — | — | — | — | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an a | 47d ago |
| CVE-2026-75415 | 7.5 | — | — | — | — | AntFlow V2.0.0 is vulnerable to Incorrect Access Control. | 47d ago |
| CVE-2026-75413 | 7.5 | — | — | — | — | DocSys V2.02.80 is vulnerable to Any File Download. | 47d ago |
| CVE-2025-61480 | 7.5 | — | — | — | — | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate att | 47d ago |
| CVE-2025-61479 | 7.5 | — | — | — | — | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate att | 47d ago |
| CVE-2025-61478 | 7.5 | — | — | — | — | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate att | 47d ago |
| CVE-2025-51675 | 7.5 | — | — | — | — | An issue was discovered in openRISC OR1200 commit 83ac6b. | 47d ago |
| CVE-2026-68863 | 7.5 | — | — | — | dell / powerprotect one | Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. | 47d ago |
| CVE-2026-46369 | 7.5 | — | — | — | — | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. | 47d ago |
| CVE-2026-26449 | 7.5 | — | — | — | — | In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a nu | 47d ago |
| CVE-2026-26447 | 7.5 | — | — | — | — | Stomper 5e2741e is vulnerable to Use-After-Free. | 47d ago |
| CVE-2026-26446 | 7.5 | — | — | — | — | Stomper 5e2741e is vulnerable to Denial of Service. | 47d ago |
| CVE-2026-26445 | 7.5 | — | — | — | — | stomper 5e2741e is vulnerable to Denial of Service. | 47d ago |
| CVE-2026-36851 | 7.5 | — | — | — | — | Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration | 47d ago |
| CVE-2025-61164 | 7.5 | — | — | — | — | Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. | 47d ago |
| CVE-2025-61162 | 7.5 | — | — | — | — | Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a craft | 47d ago |
| CVE-2026-80588 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX | 48d ago |
| CVE-2026-80527 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging __ceph_get_caps() with stale | 48d ago |
| CVE-2026-80520 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missin | 48d ago |
| CVE-2026-74750 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workque | 48d ago |
| CVE-2026-74745 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ a | 48d ago |
| CVE-2026-74742 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer tx | 48d ago |
| CVE-2026-74741 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non | 48d ago |
| CVE-2026-73108 | 7.5 | — | — | — | — | RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. | 48d ago |
| CVE-2026-19271 | 7.5 | — | — | — | — | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLG | 48d ago |
| CVE-2026-15990 | 7.5 | — | — | — | — | The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi | 48d ago |
| CVE-2026-80205 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and Tok | 48d ago |
| CVE-2026-80347 | 7.5 | — | — | — | — | mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal | 48d ago |
| CVE-2026-16444 | 7.5 | — | — | — | — | Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an | 48d ago |
| CVE-2026-18884exploited | 7.5 | 0.32% | 1/3 | +15d | — | The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' G | 48d ago |
| CVE-2026-74928 | 7.5 | — | — | — | — | The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allo | 48d ago |
| CVE-2026-80198 | 7.5 | — | — | — | — | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates | 48d ago |
| CVE-2026-80196 | 7.5 | — | — | — | — | Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after | 48d ago |
| CVE-2026-80191 | 7.5 | — | — | — | — | GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticat | 48d ago |
| CVE-2026-18259 | 7.5 | — | — | — | — | Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. | 48d ago |
| CVE-2026-68763 | 7.5 | — | — | — | apache / tomcat | Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog trac | 48d ago |
| CVE-2026-65927 | 7.5 | — | — | — | apache / tomcat | Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite proces | 48d ago |
| CVE-2026-79216 | 7.5 | — | — | — | google / chrome | Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the | 48d ago |
| CVE-2026-79139 | 7.5 | — | — | — | google / chrome | Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker | 48d ago |
| CVE-2026-79083 | 7.5 | — | — | — | google / chrome | Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote atta | 48d ago |
| CVE-2026-78915 | 7.5 | — | — | — | google / chrome | Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to | 48d ago |
| CVE-2026-78906 | 7.5 | — | — | — | google / chrome | Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute a | 48d ago |
| CVE-2026-78901 | 7.5 | — | — | — | google / chrome | Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code i | 48d ago |
| CVE-2026-75465 | 7.5 | — | — | — | — | The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control iss | 48d ago |
| CVE-2026-65097 | 7.5 | — | — | — | nvidia / nemoclaw | NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a do | 48d ago |
| CVE-2026-74932 | 7.5 | — | — | — | — | The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the | 48d ago |
| CVE-2026-55099 | 7.5 | — | — | — | — | icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. | 48d ago |
