| CVE-2026-57415 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen | 54d ago |
| CVE-2026-57411 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Vie | 54d ago |
| CVE-2026-57409 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 A | 54d ago |
| CVE-2026-57405 | 7.1 | — | — | — | — | Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Acce | 54d ago |
| CVE-2026-57403 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrov | 54d ago |
| CVE-2026-57399 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proxy & | 54d ago |
| CVE-2026-57398 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPla | 54d ago |
| CVE-2026-57396 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free | 54d ago |
| CVE-2026-57394 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant So | 54d ago |
| CVE-2026-57388 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hyd | 54d ago |
| CVE-2026-57387 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu pi | 54d ago |
| CVE-2026-57383 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSe | 54d ago |
| CVE-2026-57382 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mitchell Ben | 54d ago |
| CVE-2026-57381 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hiv | 54d ago |
| CVE-2026-57380 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Exten | 54d ago |
| CVE-2026-57379 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Formy | 54d ago |
| CVE-2026-57376 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Inva | 54d ago |
| CVE-2026-57369 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Th | 54d ago |
| CVE-2026-57368 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Job | 54d ago |
| CVE-2026-57363 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud | 54d ago |
| CVE-2026-12275 | 7.1 | — | — | — | — | The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform th | 55d ago |
| CVE-2026-61442 | 7.1 | — | — | — | — | PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH route | 56d ago |
| CVE-2026-55880 | 7.1 | — | — | — | — | OpenReplay is a self-hosted session replay suite. | 57d ago |
| CVE-2026-55460 | 7.1 | — | — | — | snipeitapp / snipe-it | Snipe-IT is an IT asset/license management system. | 57d ago |
| CVE-2026-39903 | 7.1 | — | — | — | — | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass | 57d ago |
| CVE-2026-50181 | 7.1 | — | — | — | — | Langroid is a framework for building large-language-model-powered applications. | 58d ago |
| CVE-2026-55212 | 7.1 | — | — | — | — | Pimcore is an Open Source Data & Experience Management Platform. | 58d ago |
| CVE-2026-0281 | 7.1 | — | — | — | paloaltonetworks / pan-os | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker | 58d ago |
| CVE-2026-59219 | 7.1 | — | — | — | openwebui / open webui | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. | 58d ago |
| CVE-2026-59206 | 7.1 | — | — | — | n8n / n8n | n8n is an open source workflow automation platform. | 58d ago |
| CVE-2026-59691 | 7.1 | — | — | — | — | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. | 58d ago |
| CVE-2026-14372 | 7.1 | — | — | — | — | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPres | 58d ago |
| CVE-2026-31982 | 7.1 | — | — | — | nozominetworks / cmc | An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validat | 59d ago |
| CVE-2026-54528 | 7.1 | — | — | — | jupyter / jupyterlab-git | JupyterLab Git is a Git extension for JupyterLab. | 59d ago |
| CVE-2026-35210 | 7.1 | — | — | — | citeum / opencti | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | 59d ago |
| CVE-2026-58213 | 7.1 | — | — | — | linuxfoundation / nats-server | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. | 59d ago |
| CVE-2026-59261 | 7.1 | — | — | — | openclaw / openclaw | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override p | 59d ago |
| CVE-2026-41122 | 7.1 | — | — | — | dell / data domain operating system | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS | 59d ago |
| CVE-2026-59704 | 7.1 | — | — | — | — | Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI | 60d ago |
| CVE-2026-58583 | 7.1 | — | — | — | — | FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privile | 60d ago |
| CVE-2026-7017 | 7.1 | — | — | — | — | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. | 60d ago |
| CVE-2026-21383 | 7.1 | — | — | — | qualcomm / fastconnect 6900 firmware | Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique va | 61d ago |
| CVE-2026-59196 | 7.1 | — | — | — | pnpm / pnpm | pnpm is a package manager. | 61d ago |
| CVE-2026-59194 | 7.1 | — | — | — | pnpm / pnpm | pnpm is a package manager. | 61d ago |
| CVE-2026-13705 | 7.1 | — | — | — | — | Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a | 61d ago |
| CVE-2026-53361 | 7.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc | 63d ago |
| CVE-2026-58297 | 7.1 | — | — | — | microsoft / edge chromium | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthor | 64d ago |
| CVE-2026-58296 | 7.1 | — | — | — | microsoft / edge chromium | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthor | 64d ago |
| CVE-2026-57988 | 7.1 | — | — | — | microsoft / edge chromium | Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a | 64d ago |
| CVE-2026-57977 | 7.1 | — | — | — | microsoft / edge chromium | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-b | 64d ago |
| CVE-2026-28740 | 7.1 | — | — | — | — | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users | 64d ago |
| CVE-2026-20779 | 7.1 | — | — | — | — | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to | 64d ago |
| CVE-2026-57761 | 7.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions. | 65d ago |
| CVE-2026-57758 | 7.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions. | 65d ago |
| CVE-2026-57757 | 7.1 | — | — | — | — | Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions. | 65d ago |
| CVE-2026-57746 | 7.1 | — | — | — | — | Subscriber Broken Access Control in Booked <= 3.0.0 versions. | 65d ago |
| CVE-2026-57686 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions. | 65d ago |
| CVE-2026-57682 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions. | 65d ago |
| CVE-2026-57678 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch S | 65d ago |
| CVE-2026-57675 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions. | 65d ago |
