| CVE-2026-67422 | 7.5 | — | — | — | — | pymdown-extensions is a collection of extensions for the Python Markdown library. | 67d ago |
| CVE-2026-5855 | 7.5 | — | — | — | — | Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer | 67d ago |
| CVE-2026-45378 | 7.5 | — | — | — | — | Decidim is a participatory democracy framework. | 67d ago |
| CVE-2026-19176 | 7.5 | — | — | — | google / chrome | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the | 67d ago |
| CVE-2026-19165 | 7.5 | — | — | — | google / chrome | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to | 67d ago |
| CVE-2026-19159 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to | 67d ago |
| CVE-2026-19158 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convince | 67d ago |
| CVE-2026-19156 | 7.5 | — | — | — | google / chrome | Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to | 67d ago |
| CVE-2026-19142 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to | 67d ago |
| CVE-2026-16620 | 7.5 | — | — | — | — | The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allow | 67d ago |
| CVE-2026-16619 | 7.5 | — | — | — | — | The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification | 67d ago |
| CVE-2026-13399 | 7.5 | — | — | — | — | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization check | 67d ago |
| CVE-2026-12584 | 7.5 | — | — | — | — | The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity o | 67d ago |
| CVE-2026-10599 | 7.5 | — | — | — | — | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment tr | 67d ago |
| CVE-2026-10524 | 7.5 | — | — | — | — | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product | 67d ago |
| CVE-2026-68750 | 7.5 | — | — | — | rrrene / htmlsanitizeex | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unau | 67d ago |
| CVE-2026-68749 | 7.5 | — | — | — | rrrene / htmlsanitizeex | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an u | 67d ago |
| CVE-2026-53985 | 7.5 | — | — | — | — | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server' | 67d ago |
| CVE-2026-53977 | 7.5 | — | — | — | — | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to | 67d ago |
| CVE-2026-18427 | 7.5 | — | — | — | fastify / fastify-static | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. | 67d ago |
| CVE-2026-70646 | 7.5 | — | — | — | — | aiosend is a synchronous and asynchronous Crypto Pay API client. | 67d ago |
| CVE-2026-66712 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | 67d ago |
| CVE-2026-65543 | 7.5 | — | — | — | — | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | 67d ago |
| CVE-2026-65523 | 7.5 | — | — | — | — | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation | 67d ago |
| CVE-2026-65504 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. | 67d ago |
| CVE-2026-34502 | 7.5 | — | — | — | apache / apr-util | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Ap | 67d ago |
| CVE-2026-34501 | 7.5 | — | — | — | apache / apr-util | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. | 67d ago |
| CVE-2026-28140 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. | 67d ago |
| CVE-2025-49506 | 7.5 | — | — | — | apache / apr-util | APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashe | 67d ago |
| CVE-2026-66733 | 7.5 | — | — | — | — | Sonic 3 A.I.R. | 67d ago |
| CVE-2026-65551 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control S | 67d ago |
| CVE-2026-68481 | 7.5 | — | — | — | apache / cxf | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenInt | 67d ago |
| CVE-2026-65432 | 7.5 | — | — | — | apache / cxf | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entiti | 67d ago |
| CVE-2026-64958 | 7.5 | — | — | — | apache / cxf | An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apac | 67d ago |
| CVE-2026-57819 | 7.5 | — | — | — | apache / cxf | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCou | 67d ago |
| CVE-2026-54225 | 7.5 | — | — | — | apache / cxf | Apache CXF allows to control the maximum attachment size via the "attachment-max-size". | 67d ago |
| CVE-2026-18649 | 7.5 | — | — | — | — | A flaw was found in the GStreamer gst-plugins-good package. | 67d ago |
| CVE-2026-18050 | 7.5 | — | — | — | — | The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serve | 67d ago |
| CVE-2026-16734 | 7.5 | — | — | — | — | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Str | 67d ago |
| CVE-2026-13154 | 7.5 | — | — | — | — | The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type i | 67d ago |
| CVE-2026-13153 | 7.5 | — | — | — | — | The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST ro | 67d ago |
| CVE-2026-67872 | 7.5 | — | — | — | — | An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-ite | 68d ago |
| CVE-2026-67871 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via th | 68d ago |
| CVE-2026-67869 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Se | 68d ago |
| CVE-2026-67867 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via th | 68d ago |
| CVE-2026-67866 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via th | 68d ago |
| CVE-2026-67863 | 7.5 | — | — | — | — | In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. | 68d ago |
| CVE-2026-71321 | 7.5 | — | — | — | — | Nuxt is an open-source web development framework for Vue.js. | 68d ago |
| CVE-2026-71316 | 7.5 | — | — | — | — | Nuxt is an open-source web development framework for Vue.js. | 68d ago |
| CVE-2026-67865 | 7.5 | — | — | — | — | S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. | 68d ago |
| CVE-2026-67864 | 7.5 | — | — | — | — | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagem | 68d ago |
| CVE-2026-71314 | 7.5 | — | — | — | — | Nuxt is an open-source web development framework for Vue.js. | 68d ago |
| CVE-2026-15996 | 7.5 | — | — | — | github / enterprise server | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attac | 68d ago |
| CVE-2026-69111 | 7.5 | — | — | — | — | Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote att | 68d ago |
| CVE-2026-55524 | 7.5 | — | — | — | — | PraisonAI is a multi-agent teams system. | 68d ago |
| CVE-2026-8446 | 7.5 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol | 68d ago |
| CVE-2026-14587 | 7.5 | — | — | — | neo4j / neo4j | Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bi | 68d ago |
| CVE-2026-7326 | 7.5 | — | — | — | progress / marklogic server | A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 al | 68d ago |
| CVE-2026-70601 | 7.5 | — | — | — | — | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. | 68d ago |
| CVE-2026-60023 | 7.5 | — | — | — | apache / answer | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. | 68d ago |
