| CVE-2026-14785 | 7.5 | — | — | — | — | The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in a | 76d ago |
| CVE-2026-10207 | 7.5 | — | — | — | — | The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and includin | 76d ago |
| CVE-2026-14516 | 7.5 | — | — | — | — | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL | 76d ago |
| CVE-2026-13161 | 7.5 | — | — | — | — | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Inject | 76d ago |
| CVE-2026-12800 | 7.5 | — | — | — | — | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the | 76d ago |
| CVE-2026-12741 | 7.5 | — | — | — | — | The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection | 76d ago |
| CVE-2026-14924 | 7.5 | — | — | — | — | The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce check | 76d ago |
| CVE-2026-14490 | 7.5 | — | — | — | — | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Direc | 76d ago |
| CVE-2026-17524 | 7.5 | — | — | — | — | Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for p | 76d ago |
| CVE-2026-66473 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | 76d ago |
| CVE-2025-63913 | 7.5 | — | — | — | — | An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the | 76d ago |
| CVE-2026-55685 | 7.5 | — | — | — | shopify / react-router | React Router is a router for React. | 77d ago |
| CVE-2026-51078 | 7.5 | — | — | — | — | An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of t | 77d ago |
| CVE-2026-51077 | 7.5 | — | — | — | — | SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the | 77d ago |
| CVE-2026-64545 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_ | 77d ago |
| CVE-2026-43777 | 7.5 | — | — | — | apple / macos | This issue was addressed with improved input validation. | 77d ago |
| CVE-2026-43728 | 7.5 | — | — | — | apple / macos | This issue was addressed through improved state management. | 77d ago |
| CVE-2026-12383 | 7.5 | — | — | — | — | A flaw was found in the Event-Driven Ansible (EDA) server. | 77d ago |
| CVE-2026-64641 | 7.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 77d ago |
| CVE-2026-45623 | 7.5 | — | — | — | postcss / postcss | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abs | 77d ago |
| CVE-2026-66731 | 7.5 | — | — | — | — | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding | 77d ago |
| CVE-2026-66730 | 7.5 | — | — | — | — | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows a | 77d ago |
| CVE-2026-66729 | 7.5 | — | — | — | — | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that al | 77d ago |
| CVE-2026-59251 | 7.5 | — | — | — | erlang / erlang\/otp | Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauth | 77d ago |
| CVE-2026-58227 | 7.5 | — | — | — | erlang / erlang\/otp | The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain dur | 77d ago |
| CVE-2026-55737 | 7.5 | — | — | — | erlang / erlang\/otp | Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker wh | 77d ago |
| CVE-2026-54890 | 7.5 | — | — | — | erlang / erlang\/otp | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (ert | 77d ago |
| CVE-2026-42792 | 7.5 | — | — | — | erlang / erlang\/otp | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remo | 77d ago |
| CVE-2026-66050 | 7.5 | — | — | — | — | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allo | 77d ago |
| CVE-2026-59548 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. | 77d ago |
| CVE-2026-59539 | 7.5 | — | — | — | — | Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions. | 77d ago |
| CVE-2026-59536 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | 77d ago |
| CVE-2026-59534 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | 77d ago |
| CVE-2026-59532 | 7.5 | — | — | — | — | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. | 77d ago |
| CVE-2026-59531 | 7.5 | — | — | — | — | Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. | 77d ago |
| CVE-2026-59530 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | 77d ago |
| CVE-2026-59529 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | 77d ago |
| CVE-2026-59528 | 7.5 | — | — | — | — | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. | 77d ago |
| CVE-2026-58389 | 7.5 | — | — | — | apache / thrift | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. | 77d ago |
| CVE-2026-55969 | 7.5 | — | — | — | apache / thrift | Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. | 77d ago |
| CVE-2026-55968 | 7.5 | — | — | — | apache / thrift | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache T | 77d ago |
| CVE-2026-49158 | 7.5 | — | — | — | apache / thrift | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. | 77d ago |
| CVE-2026-48586 | 7.5 | — | — | — | apache / thrift | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, | 77d ago |
| CVE-2026-48145 | 7.5 | — | — | — | apache / thrift | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. | 77d ago |
| CVE-2026-45112 | 7.5 | — | — | — | apache / thrift | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. | 77d ago |
| CVE-2026-43871 | 7.5 | — | — | — | apache / thrift | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bin | 77d ago |
| CVE-2026-41608 | 7.5 | — | — | — | apache / thrift | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. | 77d ago |
| CVE-2026-14235 | 7.5 | — | — | — | — | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting s | 77d ago |
| CVE-2026-12493 | 7.5 | — | — | — | — | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approv | 77d ago |
| CVE-2026-63720 | 7.5 | — | — | — | — | datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who | 78d ago |
| CVE-2026-64430 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from | 79d ago |
| CVE-2026-64414 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko rep | 79d ago |
| CVE-2026-64395 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicat | 79d ago |
| CVE-2026-64374 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be default off for | 79d ago |
| CVE-2026-64312 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-para | 79d ago |
| CVE-2026-64281 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport cl | 79d ago |
| CVE-2026-66373 | 7.5 | — | — | — | — | Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code ex | 79d ago |
| CVE-2026-66035 | 7.5 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability | 80d ago |
| CVE-2026-66034 | 7.5 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malic | 80d ago |
| CVE-2026-66033 | 7.5 | — | — | — | libssh2 / libssh2 | libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in | 80d ago |
