| CVE-2026-58417 | 7.5 | — | — | — | — | REST API exposes organization membership of private organizations to public | 60d ago |
| CVE-2026-54481 | 7.5 | — | — | — | — | Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | 60d ago |
| CVE-2026-73507 | 7.5 | — | — | — | — | Netty is an asynchronous, event-driven network application framework. | 60d ago |
| CVE-2026-70464 | 7.5 | — | — | — | — | rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote atta | 60d ago |
| CVE-2026-70455 | 7.5 | — | — | — | samba / rsync | rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system | 60d ago |
| CVE-2026-70453 | 7.5 | — | — | — | — | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a re | 60d ago |
| CVE-2026-14456 | 7.5 | — | — | — | — | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown | 60d ago |
| CVE-2026-67991 | 7.5 | — | — | — | — | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression de | 60d ago |
| CVE-2026-66469 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | 60d ago |
| CVE-2026-66466 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct | 60d ago |
| CVE-2026-66463 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. | 60d ago |
| CVE-2026-66462 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions. | 60d ago |
| CVE-2026-66461 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions. | 60d ago |
| CVE-2026-66443zero day | 7.5 | 0.42% | 1/3 | 3d before | — | Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions. | 60d ago |
| CVE-2026-66441zero day | 7.5 | 0.39% | 1/3 | 3d before | — | Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | 60d ago |
| CVE-2026-66432 | 7.5 | — | — | — | — | Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions. | 60d ago |
| CVE-2026-66431 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 ve | 60d ago |
| CVE-2026-61984 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | 60d ago |
| CVE-2026-61980 | 7.5 | — | — | — | — | Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | 60d ago |
| CVE-2026-48702 | 7.5 | — | — | — | — | Rekor is a software supply chain transparency log. | 60d ago |
| CVE-2026-28157 | 7.5 | — | — | — | — | Subscriber Path Traversal in Do Lasso <= 358 versions. | 60d ago |
| CVE-2026-27538 | 7.5 | — | — | — | — | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | 60d ago |
| CVE-2026-27345 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. | 60d ago |
| CVE-2026-73626 | 7.5 | — | — | — | — | JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionMan | 60d ago |
| CVE-2026-73623 | 7.5 | — | — | — | gitpython project / gitpython | GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowin | 60d ago |
| CVE-2026-73622 | 7.5 | — | — | — | gitpython project / gitpython | GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL | 60d ago |
| CVE-2026-19484 | 7.5 | — | — | — | fastify / fastify\/busyboy | @fastify/busboy is a multipart form-data parser. | 60d ago |
| CVE-2026-19481 | 7.5 | — | — | — | fastify / fastify\/busyboy | @fastify/busboy is a multipart form-data parser. | 60d ago |
| CVE-2026-13610 | 7.5 | — | — | — | — | The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated regi | 60d ago |
| CVE-2026-0301 | 7.5 | — | — | — | paloaltonetworks / cloud ngfw | An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables | 61d ago |
| CVE-2026-47717 | 7.5 | — | — | — | — | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. | 61d ago |
| CVE-2026-73493 | 7.5 | — | — | — | — | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. | 61d ago |
| CVE-2026-71469 | 7.5 | — | — | — | — | A flaw was found in search-v2-api. | 61d ago |
| CVE-2026-73418 | 7.5 | — | — | — | — | NextAuth.js provides authentication for Next.js. | 61d ago |
| CVE-2026-65370 | 7.5 | — | — | — | apple / servicetalk | ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attac | 61d ago |
| CVE-2026-19654 | 7.5 | — | — | — | rsyslog / rsyslog | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. | 61d ago |
| CVE-2026-73406 | 7.5 | — | — | — | — | Budibase is an open-source low-code platform. | 61d ago |
| CVE-2026-72801 | 7.5 | — | — | — | — | SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through un | 61d ago |
| CVE-2026-42018exploited | 7.5 | 9.8% | 3/3 | +29d | — | JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access | 61d ago |
| CVE-2026-17271 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation | 61d ago |
| CVE-2026-16931 | 7.5 | — | — | — | ibm / i | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling o | 61d ago |
| CVE-2026-48554 | 7.5 | — | — | — | — | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via | 61d ago |
| CVE-2026-48553 | 7.5 | — | — | — | — | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via | 61d ago |
| CVE-2026-68968 | 7.5 | — | — | — | apache / airflow | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backfill_ | 61d ago |
| CVE-2026-73285 | 7.5 | — | — | — | — | RustFS is a distributed object storage system built in Rust. | 61d ago |
| CVE-2026-68757 | 7.5 | — | — | — | jfrog / artifactory | A user with access to a valid SAML response may impersonate another user under specific conditions. | 61d ago |
| CVE-2025-59322 | 7.5 | — | — | — | — | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encry | 61d ago |
| CVE-2025-59327 | 7.5 | — | — | — | — | In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption | 61d ago |
| CVE-2025-59325 | 7.5 | — | — | — | — | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents, allowing for the o | 61d ago |
| CVE-2026-19566 | 7.5 | — | — | — | — | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 p | 61d ago |
| CVE-2025-41770 | 7.5 | — | — | — | — | An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow | 61d ago |
| CVE-2026-18789 | 7.5 | — | — | — | — | The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functiona | 61d ago |
| CVE-2026-18049 | 7.5 | — | — | — | — | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one o | 61d ago |
| CVE-2026-18048 | 7.5 | — | — | — | — | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to bui | 61d ago |
| CVE-2026-16253 | 7.5 | — | — | — | — | The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup- | 61d ago |
| CVE-2026-14925 | 7.5 | — | — | — | — | The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file d | 61d ago |
| CVE-2026-73249 | 7.5 | — | — | — | — | calibre is an e-book manager. | 62d ago |
| CVE-2026-73246 | 7.5 | — | — | — | — | Kestra is an open-source, event-driven orchestration platform. | 62d ago |
| CVE-2026-29036 | 7.5 | — | — | — | — | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_ | 62d ago |
| CVE-2026-19558 | 7.5 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to | 62d ago |
