| CVE-2026-68287 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit | 63d ago |
| CVE-2026-68157 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup | 63d ago |
| CVE-2026-68155 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monit | 63d ago |
| CVE-2026-68141 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callb | 63d ago |
| CVE-2026-68131 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in ob | 63d ago |
| CVE-2026-68129 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When | 63d ago |
| CVE-2026-68120 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: rtase: Workaround for TX hang caused by hardwa | 63d ago |
| CVE-2026-68119 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response pad | 63d ago |
| CVE-2026-68096 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in audit | 63d ago |
| CVE-2026-72586 | 7.5 | — | — | — | — | A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker | 63d ago |
| CVE-2026-72582 | 7.5 | — | — | — | — | A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker t | 63d ago |
| CVE-2026-72579 | 7.5 | — | — | — | — | An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can int | 63d ago |
| CVE-2026-72572 | 7.5 | — | — | — | — | A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read an | 63d ago |
| CVE-2026-72571 | 7.5 | — | — | — | — | A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote atta | 63d ago |
| CVE-2026-65942 | 7.5 | — | — | — | apache / ranger | TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. | 63d ago |
| CVE-2026-61899 | 7.5 | — | — | — | apache / tapestry | Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath as | 63d ago |
| CVE-2026-55814 | 7.5 | — | — | — | apache / ranger | Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. | 63d ago |
| CVE-2026-44630 | 7.5 | — | — | — | — | Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker t | 63d ago |
| CVE-2026-66403 | 7.5 | — | — | — | — | DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. | 63d ago |
| CVE-2026-18946 | 7.5 | — | — | — | — | The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files upload | 63d ago |
| CVE-2026-18470 | 7.5 | — | — | — | — | The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from | 63d ago |
| CVE-2026-17542 | 7.5 | — | — | — | — | The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager co | 63d ago |
| CVE-2026-17541 | 7.5 | — | — | — | — | The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, a | 63d ago |
| CVE-2026-17022 | 7.5 | — | — | — | — | The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token b | 63d ago |
| CVE-2026-14206 | 7.5 | — | — | — | — | The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that re | 63d ago |
| CVE-2026-18464 | 7.5 | — | — | — | — | The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, whic | 64d ago |
| CVE-2026-18357 | 7.5 | — | — | — | — | The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in | 64d ago |
| CVE-2026-18032 | 7.5 | — | — | — | — | The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unau | 64d ago |
| CVE-2026-16988 | 7.5 | — | — | — | — | The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marke | 64d ago |
| CVE-2026-10595 | 7.5 | — | — | — | — | A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route im | 65d ago |
| CVE-2026-17510 | 7.5 | — | — | — | — | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zer | 65d ago |
| CVE-2026-16594 | 7.5 | — | — | — | — | The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its au | 65d ago |
| CVE-2026-16578 | 7.5 | — | — | — | — | The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 | 65d ago |
| CVE-2026-52880 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 66d ago |
| CVE-2026-52879 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 66d ago |
| CVE-2026-52878 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 66d ago |
| CVE-2026-47249 | 7.5 | — | — | — | — | Klever-Go is the Go implementation of the Klever blockchain protocol. | 66d ago |
| CVE-2026-65819 | 7.5 | — | — | — | — | gopacket provides packet processing capabilities for Go. | 66d ago |
| CVE-2026-62296 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 66d ago |
| CVE-2026-62295 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 66d ago |
| CVE-2026-15972 | 7.5 | — | — | — | — | Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of | 66d ago |
| CVE-2025-63235 | 7.5 | — | — | — | — | In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplica | 66d ago |
| CVE-2026-19082 | 7.5 | — | — | — | — | Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero | 66d ago |
| CVE-2026-20348 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 66d ago |
| CVE-2026-20347 | 7.5 | — | — | — | — | A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to caus | 66d ago |
| CVE-2026-20346 | 7.5 | — | — | — | — | A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 66d ago |
| CVE-2026-20345 | 7.5 | — | — | — | — | A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 66d ago |
| CVE-2026-20339 | 7.5 | — | — | — | — | A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to caus | 66d ago |
| CVE-2026-20338 | 7.5 | — | — | — | — | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS | 66d ago |
| CVE-2026-20337 | 7.5 | — | — | — | — | A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS | 66d ago |
| CVE-2026-15816 | 7.5 | — | — | — | — | A flaw was found in dracut. | 66d ago |
| CVE-2026-71559 | 7.5 | — | — | — | apache / fory | Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to caus | 66d ago |
| CVE-2026-49007 | 7.5 | — | — | — | — | By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials | 66d ago |
| CVE-2026-16262 | 7.5 | — | — | — | — | The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the init | 66d ago |
| CVE-2026-16041 | 7.5 | — | — | — | — | The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its R | 66d ago |
| CVE-2026-14943 | 7.5 | — | — | — | — | The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2 | 66d ago |
| CVE-2026-62918 | 7.5 | — | — | — | microsoft / teams | Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spo | 67d ago |
| CVE-2026-71488 | 7.5 | — | — | — | — | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. | 67d ago |
| CVE-2026-70636 | 7.5 | — | — | — | — | Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to acc | 67d ago |
| CVE-2026-70559 | 7.5 | — | — | — | — | Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annota | 67d ago |
