| CVE-2026-48911 | 7.5 | — | — | — | apache / answer | Insufficient Verification of Data Authenticity vulnerability in Apache Answer. | 68d ago |
| CVE-2026-48834 | 7.5 | — | — | — | apache / answer | Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. | 68d ago |
| CVE-2026-54876 | 7.5 | — | — | — | — | Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response check | 68d ago |
| CVE-2026-17613 | 7.5 | — | — | — | — | Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenti | 68d ago |
| CVE-2026-7529 | 7.5 | — | — | — | — | The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modificatio | 68d ago |
| CVE-2025-70962 | 7.5 | — | — | — | — | Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. | 68d ago |
| CVE-2026-71265 | 7.5 | — | — | — | — | Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received | 68d ago |
| CVE-2026-61891 | 7.5 | — | — | — | eclipse / theia | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download e | 68d ago |
| CVE-2026-46581 | 7.5 | — | — | — | eclipse / mojarra | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize a | 68d ago |
| CVE-2026-71241 | 7.5 | — | — | — | — | Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book | 68d ago |
| CVE-2026-71234 | 7.5 | — | — | — | — | Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via A | 68d ago |
| CVE-2026-12609 | 7.5 | — | — | — | eclipse / theia | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/host | 68d ago |
| CVE-2026-71215 | 7.5 | — | — | — | — | art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include a | 68d ago |
| CVE-2026-71209 | 7.5 | — | — | — | — | audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET route | 68d ago |
| CVE-2026-71202 | 7.5 | — | — | — | — | The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but o | 68d ago |
| CVE-2026-70378 | 7.5 | — | — | — | — | imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is | 68d ago |
| CVE-2026-70377 | 7.5 | — | — | — | — | imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 | 68d ago |
| CVE-2026-6639 | 7.5 | — | — | — | — | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure i | 68d ago |
| CVE-2026-64577 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_sen | 68d ago |
| CVE-2026-61483 | 7.5 | — | — | — | apache / lucy | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. | 68d ago |
| CVE-2026-59675 | 7.5 | — | — | — | — | When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing | 68d ago |
| CVE-2026-18881 | 7.5 | — | — | — | — | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the ` | 68d ago |
| CVE-2026-12000 | 7.5 | — | — | — | — | The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up | 68d ago |
| CVE-2026-68073 | 7.5 | — | — | — | apache / qpid broker-j | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 68d ago |
| CVE-2026-67592 | 7.5 | — | — | — | apache / qpid protonj2 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticat | 68d ago |
| CVE-2026-67590 | 7.5 | — | — | — | apache / qpid protonj2 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 68d ago |
| CVE-2026-67552 | 7.5 | — | — | — | apache / qpid proton-dotnet | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 68d ago |
| CVE-2026-66274 | 7.5 | — | — | — | apache / qpid proton-j | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to den | 68d ago |
| CVE-2026-16736 | 7.5 | — | — | — | — | The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled | 68d ago |
| CVE-2026-16604 | 7.5 | — | — | — | — | The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response be | 68d ago |
| CVE-2026-16603 | 7.5 | — | — | — | — | The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress | 68d ago |
| CVE-2026-16602 | 7.5 | — | — | — | — | The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from | 68d ago |
| CVE-2026-16573 | 7.5 | — | — | — | — | The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowi | 68d ago |
| CVE-2026-16561 | 7.5 | — | — | — | — | The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX a | 68d ago |
| CVE-2026-16055 | 7.5 | — | — | — | — | The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPre | 68d ago |
| CVE-2026-16036 | 7.5 | — | — | — | — | The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-l | 68d ago |
| CVE-2026-15372 | 7.5 | — | — | — | — | The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its suppor | 68d ago |
| CVE-2026-68074 | 7.5 | — | — | — | apache / qpid broker-j | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 68d ago |
| CVE-2026-68060 | 7.5 | — | — | — | apache / qpid broker-j | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to pot | 68d ago |
| CVE-2026-67589 | 7.5 | — | — | — | apache / qpid protonj2 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to pot | 68d ago |
| CVE-2026-67588 | 7.5 | — | — | — | apache / qpid protonj2 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 68d ago |
| CVE-2026-67551 | 7.5 | — | — | — | apache / qpid proton-dotnet | pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to poten | 68d ago |
| CVE-2026-67465 | 7.5 | — | — | — | apache / qpid proton-dotnet | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 68d ago |
| CVE-2026-66273 | 7.5 | — | — | — | apache / qpid proton-j | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to pot | 68d ago |
| CVE-2026-66257 | 7.5 | — | — | — | apache / qpid proton-j | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading t | 68d ago |
| CVE-2026-15918 | 7.5 | — | — | — | — | VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to on | 68d ago |
| CVE-2026-18907 | 7.5 | — | — | — | — | Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via | 69d ago |
| CVE-2026-67862 | 7.5 | — | — | — | — | open62541 1.5.5 contains a buffer-overflow in the high-level attribute reading logic in src/client/ua_client_highl | 69d ago |
| CVE-2026-67861 | 7.5 | — | — | — | — | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UA_Client_g | 69d ago |
| CVE-2026-67860 | 7.5 | — | — | — | — | open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history dat | 69d ago |
| CVE-2026-67859 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Di | 69d ago |
| CVE-2026-67858 | 7.5 | — | — | — | — | Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server (LDS) is built with multic | 69d ago |
| CVE-2026-67857 | 7.5 | — | — | — | — | open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray() in src/cl | 69d ago |
| CVE-2026-67856 | 7.5 | — | — | — | — | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateS | 69d ago |
| CVE-2026-67855 | 7.5 | — | — | — | — | open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_ | 69d ago |
| CVE-2026-45103 | 7.5 | — | — | — | — | OpenSIPS is a Session Initiation Protocol (SIP) server implementation. | 69d ago |
| CVE-2026-66901 | 7.5 | — | — | — | — | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unval | 69d ago |
| CVE-2026-47618 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attacker could caus | 69d ago |
| CVE-2026-47617 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause serve | 69d ago |
| CVE-2026-47616 | 7.5 | — | — | — | nvidia / dynamo | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker may cause serve | 69d ago |
