| CVE-2026-67432 | 7.5 | — | — | — | — | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. | 74d ago |
| CVE-2026-5491 | 7.5 | — | — | — | — | DriveLock Directory Traversal Information Disclosure Vulnerability. | 74d ago |
| CVE-2026-5487 | 7.5 | — | — | — | — | DriveLock Directory Traversal Information Disclosure Vulnerability. | 74d ago |
| CVE-2026-5057 | 7.5 | — | — | — | — | ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. | 74d ago |
| CVE-2026-15975 | 7.5 | — | — | — | gitlab / gitlab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, | 74d ago |
| CVE-2026-59898 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 75d ago |
| CVE-2026-59901 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 75d ago |
| CVE-2026-59899 | 7.5 | — | — | — | netty / netty | Netty is an asynchronous, event-driven network application framework. | 75d ago |
| CVE-2025-60931 | 7.5 | — | — | — | — | An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10 | 75d ago |
| CVE-2026-65886 | 7.5 | — | — | — | balbooa / gridbox | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - The photo viewer allows | 75d ago |
| CVE-2026-67215 | 7.5 | — | — | — | davegamble / cjson | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 690 | 75d ago |
| CVE-2026-65889 | 7.5 | — | — | — | balbooa / gridbox | Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method | 75d ago |
| CVE-2026-65943 | 7.5 | — | — | — | rolandd / ro csvi | Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0 | 75d ago |
| CVE-2026-58189 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplificati | 75d ago |
| CVE-2026-58186 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. | 75d ago |
| CVE-2026-58181 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. | 75d ago |
| CVE-2026-58180 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. | 75d ago |
| CVE-2026-58178 | 7.5 | — | — | — | apache / traffic server | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. | 75d ago |
| CVE-2026-58175 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server leaks memory when handling HostDB SRV records. | 75d ago |
| CVE-2026-58164 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. | 75d ago |
| CVE-2026-58163 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. | 75d ago |
| CVE-2026-58161 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. | 75d ago |
| CVE-2026-65324 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow c | 75d ago |
| CVE-2026-58151 | 7.5 | — | — | — | apache / traffic server | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. | 75d ago |
| CVE-2026-54719 | 7.5 | — | — | — | — | goshs is a feature-rich single-binary file server for red teamers and developers. | 75d ago |
| CVE-2026-54638 | 7.5 | — | — | — | — | gotd/td is a T Telegram MTProto API client in Go. | 75d ago |
| CVE-2026-47219 | 7.5 | — | — | — | — | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters | 75d ago |
| CVE-2026-55415 | 7.5 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 75d ago |
| CVE-2026-55391 | 7.5 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 75d ago |
| CVE-2026-55390 | 7.5 | — | — | — | — | datamodel-code-generator generates Python data models from schema definitions. | 75d ago |
| CVE-2026-55389 | 7.5 | — | — | — | koxudaxi / datamodel-code-generator | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS | 75d ago |
| CVE-2026-59942 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 75d ago |
| CVE-2026-59941 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 75d ago |
| CVE-2026-15280 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a pat | 75d ago |
| CVE-2026-15057 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to u | 75d ago |
| CVE-2026-14981 | 7.5 | — | — | — | ibm / websphere application server | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0 | 75d ago |
| CVE-2026-13463 | 7.5 | — | — | — | ibm / cloud pak system | IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of | 75d ago |
| CVE-2026-55555 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 75d ago |
| CVE-2026-55554 | 7.5 | — | — | — | dompdf project / dompdf | Dompdf is an HTML to PDF converter for PHP. | 75d ago |
| CVE-2026-66745 | 7.5 | — | — | — | — | Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerabi | 76d ago |
| CVE-2026-59932 | 7.5 | — | — | — | — | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | 76d ago |
| CVE-2026-50737 | 7.5 | — | — | — | enterprisedb / pglogical | When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected t | 76d ago |
| CVE-2026-50736 | 7.5 | — | — | — | enterprisedb / pglogical | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a su | 76d ago |
| CVE-2026-59933 | 7.5 | — | — | — | — | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. | 76d ago |
| CVE-2026-54635 | 7.5 | — | — | — | — | pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. | 76d ago |
| CVE-2026-67185 | 7.5 | — | — | — | — | TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitr | 76d ago |
| CVE-2026-67184 | 7.5 | — | — | — | — | TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attacke | 76d ago |
| CVE-2026-67183 | 7.5 | — | — | — | — | TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust availa | 76d ago |
| CVE-2026-67182 | 7.5 | — | — | — | — | Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypas | 76d ago |
| CVE-2026-54345 | 7.5 | — | — | — | gopacket / gopacket | gopacket provides packet processing capabilities for Go. | 76d ago |
| CVE-2026-54332 | 7.5 | — | — | — | gopacket / gopacket | gopacket provides packet processing capabilities for Go. | 76d ago |
| CVE-2026-61609 | 7.5 | — | — | — | — | Pterodactyl is a free, open-source game server management panel. | 76d ago |
| CVE-2026-47427 | 7.5 | — | — | — | github / mcp server | GitHub MCP Server is GitHub's official MCP Server. | 76d ago |
| CVE-2026-59878 | 7.5 | — | — | — | apache / activemq | Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. | 76d ago |
| CVE-2026-65881 | 7.5 | — | — | — | — | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < | 76d ago |
| CVE-2026-62431 | 7.5 | — | — | — | — | The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, | 76d ago |
| CVE-2026-62430 | 7.5 | — | — | — | — | Accesses to the CMOS memory contents are done using an indirect IO port pair. | 76d ago |
| CVE-2026-42493 | 7.5 | — | — | — | — | Addressing certain issues, in particular related to operations which may take excessively long and therefore would | 76d ago |
| CVE-2026-42492 | 7.5 | — | — | — | — | Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. | 76d ago |
| CVE-2026-15025 | 7.5 | — | — | — | — | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerab | 76d ago |
