| CVE-2026-74316 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4_drop_revoked | 58d ago |
| CVE-2026-74282 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_AC | 58d ago |
| CVE-2026-74281 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer | 58d ago |
| CVE-2026-72502 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoi | 58d ago |
| CVE-2026-72465 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant afte | 58d ago |
| CVE-2026-72464 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed | 58d ago |
| CVE-2026-72438 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes_pending and barrier refe | 58d ago |
| CVE-2026-72418 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: prevent connlimit dro | 58d ago |
| CVE-2026-72409 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: mvneta: re-enable percpu interrupt on res | 58d ago |
| CVE-2026-72378 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs_extract_vl_addrs() | 58d ago |
| CVE-2026-72374 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to p | 58d ago |
| CVE-2026-72373 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afs_bre | 58d ago |
| CVE-2026-72356 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix missing credit release on failure in | 58d ago |
| CVE-2026-72330 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls_sw_ | 58d ago |
| CVE-2026-72254 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: reject fib expression on t | 58d ago |
| CVE-2026-72253 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: validate skb_dst( | 58d ago |
| CVE-2026-72247 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix zone comparison i | 58d ago |
| CVE-2026-72242 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinu | 58d ago |
| CVE-2026-72231 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid request storms during pe | 58d ago |
| CVE-2026-72203 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to | 58d ago |
| CVE-2026-72202 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid heap allocation for free-cluster r | 58d ago |
| CVE-2026-72149 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix burst size calculation C | 58d ago |
| CVE-2026-72141 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: i2c: imx: fix locked bus on SMBus block-read o | 58d ago |
| CVE-2026-16611 | 7.5 | — | — | — | — | The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization | 58d ago |
| CVE-2026-15162 | 7.5 | — | — | — | — | The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type | 59d ago |
| CVE-2026-19910 | 7.5 | — | — | — | — | PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. | 59d ago |
| CVE-2026-19909 | 7.5 | — | — | — | — | PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. | 59d ago |
| CVE-2026-18554 | 7.5 | — | — | — | ibm / db2 mirror for i | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information | 59d ago |
| CVE-2026-17177 | 7.5 | — | — | — | ibm / db2 mirror for i | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrol | 59d ago |
| CVE-2026-17175 | 7.5 | — | — | — | ibm / db2 mirror for i | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information | 59d ago |
| CVE-2026-16915 | 7.5 | — | — | — | ibm / db2 mirror for i | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information | 59d ago |
| CVE-2026-45699 | 7.5 | — | — | — | — | Netatalk is a Free and Open Source file server suite for Unix-like operating systems. | 59d ago |
| CVE-2026-46603 | 7.5 | — | — | — | — | VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L | 59d ago |
| CVE-2026-53970 | 7.5 | — | — | — | — | ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility | 59d ago |
| CVE-2026-73633 | 7.5 | — | — | — | apache / struts | Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. | 59d ago |
| CVE-2026-56864 | 7.5 | — | — | — | — | A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. | 60d ago |
| CVE-2026-56862 | 7.5 | — | — | — | — | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake | 60d ago |
| CVE-2026-56859 | 7.5 | — | — | — | — | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaust | 60d ago |
| CVE-2026-56853 | 7.5 | — | — | — | — | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if | 60d ago |
| CVE-2026-33818 | 7.5 | — | — | — | — | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structure | 60d ago |
| CVE-2026-18077 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffe | 60d ago |
| CVE-2026-17473 | 7.5 | — | — | — | ibm / documentation offline | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to imprope | 60d ago |
| CVE-2026-18846 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. | 60d ago |
| CVE-2026-17229 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop. | 60d ago |
| CVE-2026-17199 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource | 60d ago |
| CVE-2026-17004 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop. | 60d ago |
| CVE-2026-16982 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overf | 60d ago |
| CVE-2026-16887 | 7.5 | — | — | — | ibm / i | IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write. | 60d ago |
| CVE-2026-13460 | 7.5 | — | — | — | ibm / storage scale | IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the sourc | 60d ago |
| CVE-2026-73643 | 7.5 | — | — | — | — | js-yaml is a JavaScript YAML parser and dumper. | 60d ago |
| CVE-2026-73568 | 7.5 | — | — | — | — | py-libp2p is the Python implementation of the libp2p networking stack. | 60d ago |
| CVE-2026-73566 | 7.5 | — | — | — | — | node-tar is a tar archive manipulation library for Node.js. | 60d ago |
| CVE-2026-73561 | 7.5 | — | — | — | — | Hub is a Node.js WebSocket server and client with added features. | 60d ago |
| CVE-2024-58374zero day | 7.5 | 0.74% | 1/3 | same day | — | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that al | 60d ago |
| CVE-2019-25765zero day | 7.5 | 0.74% | 1/3 | same day | — | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote | 60d ago |
| CVE-2026-59765 | 7.5 | — | — | — | — | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | 60d ago |
| CVE-2026-58438 | 7.5 | — | — | — | — | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they c | 60d ago |
| CVE-2026-58436 | 7.5 | — | — | — | — | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | 60d ago |
| CVE-2026-58434 | 7.5 | — | — | — | — | Private Repository Metadata Remains Accessible After Access Revocation | 60d ago |
| CVE-2026-58427 | 7.5 | — | — | — | — | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | 60d ago |
