| CVE-2026-55620 | 7.5 | — | — | — | — | eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail a | 48d ago |
| CVE-2026-71443 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an applicat | 48d ago |
| CVE-2026-71442 | 7.5 | — | — | — | adobe / c2pa | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result i | 48d ago |
| CVE-2026-71360 | 7.5 | — | — | — | — | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to appli | 48d ago |
| CVE-2026-55553 | 7.5 | — | — | — | — | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features | 48d ago |
| CVE-2026-19913 | 7.5 | — | — | — | — | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper valid | 48d ago |
| CVE-2026-79770 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector t | 48d ago |
| CVE-2023-54354 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which | 48d ago |
| CVE-2022-50998 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected | 48d ago |
| CVE-2021-47996 | 7.5 | — | — | — | nokogiri / nokogiri | Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9 | 48d ago |
| CVE-2026-55525 | 7.5 | — | — | — | — | PraisonAI is a multi-agent teams system. | 49d ago |
| CVE-2026-63076 | 7.5 | — | — | — | — | Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter | 49d ago |
| CVE-2026-63075 | 7.5 | — | — | — | — | Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while n | 49d ago |
| CVE-2026-63072 | 7.5 | — | — | — | — | Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, | 49d ago |
| CVE-2026-54874 | 7.5 | — | — | — | — | Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffe | 49d ago |
| CVE-2026-18798 | 7.5 | — | — | — | — | Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initi | 49d ago |
| CVE-2026-14457 | 7.5 | — | — | — | — | Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the priva | 49d ago |
| CVE-2026-79658 | 7.5 | — | — | — | — | Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n midd | 49d ago |
| CVE-2026-67578 | 7.5 | — | — | — | — | FA-50 all versions miss authentication for some configuration. | 49d ago |
| CVE-2026-78682 | 7.5 | — | — | — | nltk / nltk | NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk. | 49d ago |
| CVE-2026-78681 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declar | 49d ago |
| CVE-2026-78677 | 7.5 | — | — | — | gitpython project / gitpython | GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbit | 49d ago |
| CVE-2026-76846 | 7.5 | — | — | — | — | Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block a | 49d ago |
| CVE-2026-72700 | 7.5 | — | — | — | — | The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account acti | 49d ago |
| CVE-2026-56709 | 7.5 | — | — | — | — | Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing | 49d ago |
| CVE-2026-66766 | 7.5 | — | — | — | — | SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReD | 49d ago |
| CVE-2026-78268 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Cal | 49d ago |
| CVE-2026-77384 | 7.5 | — | — | — | — | libp2p is a JavaScript implementation of the libp2p networking stack. | 49d ago |
| CVE-2026-76098 | 7.5 | — | — | — | — | Mistune is a Python Markdown parser with renderers and plugins. | 49d ago |
| CVE-2026-75368 | 7.5 | — | — | — | — | A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to | 49d ago |
| CVE-2026-75371 | 7.5 | — | — | — | — | An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physi | 49d ago |
| CVE-2026-71922 | 7.5 | — | — | — | — | Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the set | 49d ago |
| CVE-2026-66908 | 7.5 | — | — | — | apache / camel | Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. | 49d ago |
| CVE-2026-66907 | 7.5 | — | — | — | apache / camel | Relative path traversal vulnerability in Apache Camel Google Storage component. | 49d ago |
| CVE-2026-21752 | 7.5 | — | — | — | — | HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized acce | 49d ago |
| CVE-2025-68825 | 7.5 | — | — | — | — | HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, | 49d ago |
| CVE-2026-66585 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | 50d ago |
| CVE-2026-28167 | 7.5 | — | — | — | — | Unauthenticated Arbitrary File Download in Super Forms <= 6.3.315 versions. | 50d ago |
| CVE-2026-28153 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, | 50d ago |
| CVE-2026-76172 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 50d ago |
| CVE-2026-75975 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 50d ago |
| CVE-2026-75931 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 50d ago |
| CVE-2026-75899 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri is a URI parser for Node.js. | 50d ago |
| CVE-2026-78212 | 7.5 | — | — | — | — | 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. | 50d ago |
| CVE-2026-78208 | 7.5 | — | — | — | — | exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to va | 50d ago |
| CVE-2026-78206 | 7.5 | — | — | — | — | exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry siz | 50d ago |
| CVE-2026-9769 | 7.5 | — | — | — | — | justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. | 51d ago |
| CVE-2026-4671 | 7.5 | — | — | — | — | justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkifi | 51d ago |
| CVE-2026-47895 | 7.5 | — | — | — | — | In strongSwan before 6.0.7, identity parsing/cloning is mishandled. | 51d ago |
| CVE-2026-74717 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create err | 51d ago |
| CVE-2026-74696 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reusep | 51d ago |
| CVE-2026-74695 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb ds | 51d ago |
| CVE-2026-74692 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_ou | 51d ago |
| CVE-2026-74678 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: fix skb leak in ax8817 | 51d ago |
| CVE-2026-74626 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: NTB: ntb_netdev: Preserve RX queue depth on al | 51d ago |
| CVE-2026-74625 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non- | 51d ago |
| CVE-2026-74624 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log unt | 51d ago |
| CVE-2026-74621 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix sk_buff leak when the h | 51d ago |
| CVE-2026-74598 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length vali | 51d ago |
| CVE-2026-66393 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that all | 51d ago |
