| CVE-2026-75479 | 7.5 | — | — | — | — | JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that all | 56d ago |
| CVE-2026-75111 | 7.5 | — | — | — | — | Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing u | 56d ago |
| CVE-2026-75105 | 7.5 | — | — | — | — | phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token wa | 56d ago |
| CVE-2026-71518 | 7.5 | — | — | — | — | Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows | 56d ago |
| CVE-2026-68005 | 7.5 | — | — | — | — | An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP requ | 56d ago |
| CVE-2026-74238 | 7.5 | — | — | — | — | TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function t | 56d ago |
| CVE-2026-50776 | 7.5 | — | — | — | — | Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote attacker to obtain | 56d ago |
| CVE-2026-45698 | 7.5 | — | — | — | — | Netatalk is a Free and Open Source file server suite for Unix-like operating systems. | 56d ago |
| CVE-2026-73523 | 7.5 | — | — | — | — | COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unaut | 56d ago |
| CVE-2026-73522 | 7.5 | — | — | — | — | COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote at | 56d ago |
| CVE-2026-71980 | 7.5 | — | — | — | — | Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe( | 56d ago |
| CVE-2026-71979 | 7.5 | — | — | — | — | INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a st | 56d ago |
| CVE-2026-59902 | 7.5 | — | — | — | — | Netty is an asynchronous, event-driven network application framework. | 56d ago |
| CVE-2026-59893 | 7.5 | — | — | — | — | sqlparse is a non-validating SQL parser module for Python. | 56d ago |
| CVE-2026-73646 | 7.5 | — | — | — | — | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abs | 56d ago |
| CVE-2026-64868 | 7.5 | — | — | — | — | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. | 56d ago |
| CVE-2026-16471 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not | 56d ago |
| CVE-2026-16467 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality N | 56d ago |
| CVE-2026-74892 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server co | 56d ago |
| CVE-2026-74888 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per | 56d ago |
| CVE-2026-74884 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the | 56d ago |
| CVE-2026-74882 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 pr | 56d ago |
| CVE-2026-74879 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that | 56d ago |
| CVE-2026-74874 | 7.5 | — | — | — | jahlives / openssl encrypt | openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel select | 56d ago |
| CVE-2026-74868 | 7.5 | — | — | — | — | SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth im | 56d ago |
| CVE-2026-74795 | 7.5 | — | — | — | — | Scriban before 6.6.0 contains an uncontrolled recursion vulnerability in its recursive-descent parser. | 57d ago |
| CVE-2026-74794 | 7.5 | — | — | — | — | Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimi | 57d ago |
| CVE-2026-74792 | 7.5 | — | — | — | — | Scriban before 7.0.0 (affected versions <= 6.6.0) contains a stack overflow vulnerability in nested array initiali | 57d ago |
| CVE-2026-74789 | 7.5 | — | — | — | — | Scriban before 7.0.0 (affected <= 6.6.0) applies its LoopLimit constraint only to script loop statements and not t | 57d ago |
| CVE-2026-74788 | 7.5 | — | — | — | — | Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the | 57d ago |
| CVE-2026-74787 | 7.5 | — | — | — | — | Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.to_json builtin function that | 57d ago |
| CVE-2026-74783 | 7.5 | — | — | — | — | Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursi | 57d ago |
| CVE-2026-73062 | 7.5 | — | — | — | — | Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operato | 57d ago |
| CVE-2026-73060 | 7.5 | — | — | — | — | Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply op | 57d ago |
| CVE-2026-73057 | 7.5 | — | — | — | — | stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to caus | 57d ago |
| CVE-2024-58375 | 7.5 | — | — | — | — | OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opte | 57d ago |
| CVE-2026-17087 | 7.5 | — | — | — | — | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authoriz | 57d ago |
| CVE-2026-19728 | 7.5 | — | — | — | — | The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the request | 57d ago |
| CVE-2026-19717 | 7.5 | — | — | — | — | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in | 57d ago |
| CVE-2026-73054 | 7.5 | — | — | — | — | SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by d | 58d ago |
| CVE-2026-73045 | 7.5 | — | — | — | — | SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the aut | 58d ago |
| CVE-2026-19474 | 7.5 | — | — | — | fastify / fastify-multipart | @fastify/multipart is a multipart form-data parser for Fastify. | 58d ago |
| CVE-2026-18549 | 7.5 | — | — | — | fastify / fastify-multipart | @fastify/multipart is a multipart form-data parser for Fastify. | 58d ago |
| CVE-2026-74576 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free p | 58d ago |
| CVE-2026-74572 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata wr | 58d ago |
| CVE-2026-74557 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Fix stale-data leak into the S | 58d ago |
| CVE-2026-74550 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: do not send ICMP/NDISC Redirects when pee | 58d ago |
| CVE-2026-74523 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: qede: sync udp_tunnel ports outside qede_lock | 58d ago |
| CVE-2026-73635 | 7.5 | — | — | — | apache / struts | Allocation of resources without limits or throttling vulnerability in Apache Struts. | 58d ago |
| CVE-2026-73634 | 7.5 | — | — | — | apache / struts | Uncontrolled resource consumption vulnerability in Apache Struts. | 58d ago |
| CVE-2026-15142 | 7.5 | — | — | — | — | The Real Estate Manager Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and | 58d ago |
| CVE-2026-74435 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc_verify_data ensure rx_dec_buffer | 58d ago |
| CVE-2026-74431 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential infinite loop in rxrpc_re | 58d ago |
| CVE-2026-74430 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpc_input_ | 58d ago |
| CVE-2026-74429 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the reception of a reply packet bef | 58d ago |
| CVE-2026-74425 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: afs: handle CB.InitCallBackState3 requests wit | 58d ago |
| CVE-2026-74396 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate | 58d ago |
| CVE-2026-74385 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet_tcp_set | 58d ago |
| CVE-2026-74374 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: fix error-path detection with | 58d ago |
| CVE-2026-74321 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix invalid pointer dereference in __bt | 58d ago |
