| CVE-2026-63312 | 7.5 | — | — | — | nltk / nltk | NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pat | 52d ago |
| CVE-2026-62388 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to e | 52d ago |
| CVE-2026-62384 | 7.5 | — | — | — | nltk / nltk | NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers t | 52d ago |
| CVE-2026-2996 | 7.5 | — | — | — | — | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input V | 52d ago |
| CVE-2026-62380 | 7.5 | — | — | — | netty / netty | Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final conta | 52d ago |
| CVE-2026-62243 | 7.5 | — | — | — | — | Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final d | 52d ago |
| CVE-2026-59256 | 7.5 | — | — | — | — | WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens | 52d ago |
| CVE-2026-77781 | 7.5 | — | — | — | — | Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. | 52d ago |
| CVE-2026-76905 | 7.5 | — | — | — | — | kin-openapi is a Go project for handling OpenAPI files. | 52d ago |
| CVE-2026-63421 | 7.5 | — | — | — | — | Keystone is a content management system for Node.js. | 52d ago |
| CVE-2026-30866 | 7.5 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 52d ago |
| CVE-2026-27490 | 7.5 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 52d ago |
| CVE-2026-27462 | 7.5 | — | — | — | — | Combodo iTop is a web based IT service management tool. | 52d ago |
| CVE-2026-63462 | 7.5 | — | — | — | — | Unleash is an open-source feature management platform. | 52d ago |
| CVE-2026-71862 | 7.5 | — | — | — | — | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response time | 52d ago |
| CVE-2026-55241 | 7.5 | — | — | — | — | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response time | 52d ago |
| CVE-2026-54789 | 7.5 | — | — | — | — | mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server tha | 52d ago |
| CVE-2026-77815 | 7.5 | — | — | — | — | to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segmen | 53d ago |
| CVE-2026-77814 | 7.5 | — | — | — | — | is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path. | 53d ago |
| CVE-2026-75501 | 7.5 | — | — | — | — | A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated re | 53d ago |
| CVE-2026-59654 | 7.5 | — | — | — | apache / cloudstack | Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configurat | 53d ago |
| CVE-2026-59279 | 7.5 | — | — | — | — | The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of s | 53d ago |
| CVE-2026-77767 | 7.5 | — | — | — | — | Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated u | 53d ago |
| CVE-2026-47827 | 7.5 | — | — | — | — | Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell | 53d ago |
| CVE-2026-61397 | 7.5 | — | — | — | apache / cloudstack | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authenticat | 53d ago |
| CVE-2026-59780 | 7.5 | — | — | — | apache / cloudstack | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authenticatio | 53d ago |
| CVE-2026-59657 | 7.5 | — | — | — | apache / cloudstack | Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the databas | 53d ago |
| CVE-2026-59655 | 7.5 | — | — | — | apache / cloudstack | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authenticati | 53d ago |
| CVE-2026-50222 | 7.5 | — | — | — | apache / cloudstack | Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudSta | 53d ago |
| CVE-2026-16323 | 7.5 | — | — | — | — | Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin | 53d ago |
| CVE-2026-65644 | 7.5 | — | — | — | rocket.chat / rocket.chat | Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API | 53d ago |
| CVE-2026-77642 | 7.5 | — | — | — | — | tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpec | 53d ago |
| CVE-2026-72818 | 7.5 | — | — | — | — | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetT | 53d ago |
| CVE-2026-64773 | 7.5 | — | — | — | apple / container | An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to | 53d ago |
| CVE-2026-49217 | 7.5 | — | — | — | — | Mailu is a mail server as a set of Docker images. | 53d ago |
| CVE-2026-19446 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP pack | 53d ago |
| CVE-2026-17425 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a | 53d ago |
| CVE-2026-17170 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to im | 53d ago |
| CVE-2026-17165 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a | 53d ago |
| CVE-2026-17163 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to im | 53d ago |
| CVE-2026-17159 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an | 53d ago |
| CVE-2026-17121 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to un | 53d ago |
| CVE-2025-52182 | 7.5 | — | — | — | — | The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability | 53d ago |
| CVE-2026-76020 | 7.5 | — | — | — | google / chrome | Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code | 53d ago |
| CVE-2026-52021 | 7.5 | — | — | — | — | An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information | 53d ago |
| CVE-2026-53587 | 7.5 | — | — | — | — | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, al | 53d ago |
| CVE-2026-76641 | 7.5 | — | — | — | — | Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruptio | 53d ago |
| CVE-2026-63495 | 7.5 | — | — | — | — | Libevent is an event notification library. | 53d ago |
| CVE-2026-69183 | 7.5 | — | — | — | — | Monkeytype is a minimalistic and customizable typing test. | 53d ago |
| CVE-2026-61704 | 7.5 | — | — | — | — | Link Preview JS extracts web links information. | 53d ago |
| CVE-2026-75140 | 7.5 | — | — | — | — | jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlT | 53d ago |
| CVE-2026-63043 | 7.5 | — | — | — | apache / inlong | Relative Path Traversal vulnerability in Apache InLong. | 53d ago |
| CVE-2026-63490 | 7.5 | — | — | — | — | Handlebars.java provides logic-less and semantic Mustache templates with Java. | 54d ago |
| CVE-2026-16928 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a | 54d ago |
| CVE-2026-16924 | 7.5 | — | — | — | ibm / vios | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an | 54d ago |
| CVE-2026-74021 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. | 54d ago |
| CVE-2026-74020 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | 54d ago |
| CVE-2026-73198 | 7.5 | — | — | — | redhat / enterprise linux | A flaw was found in FreeIPA. | 54d ago |
| CVE-2026-73197 | 7.5 | — | — | — | redhat / enterprise linux | A flaw was found in FreeIPA. | 54d ago |
| CVE-2026-14952 | 7.5 | — | — | — | — | An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive | 54d ago |
