| CVE-2026-64210 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ | 80d ago |
| CVE-2026-64208 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pr | 80d ago |
| CVE-2026-66144 | 7.5 | — | — | — | apache / neethi | Although remote policy references are not retrieved during policy normalization, if they are manually retrieved vi | 80d ago |
| CVE-2026-66143 | 7.5 | — | — | — | apache / neethi | It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi | 80d ago |
| CVE-2026-66142 | 7.5 | — | — | — | apache / neethi | Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply ne | 80d ago |
| CVE-2026-45816 | 7.5 | — | — | — | apache / nimble | NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. | 80d ago |
| CVE-2026-45815 | 7.5 | — | — | — | apache / nimble | Reachable Assertion vulnerability in Apache NimBLE. | 80d ago |
| CVE-2026-45811 | 7.5 | — | — | — | apache / nimble | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. | 80d ago |
| CVE-2026-14603 | 7.5 | — | — | — | — | The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST end | 80d ago |
| CVE-2026-12981 | 7.5 | — | — | — | — | The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating us | 80d ago |
| CVE-2026-12497 | 7.5 | — | — | — | — | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPre | 80d ago |
| CVE-2026-40430 | 7.5 | — | — | — | — | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could exp | 80d ago |
| CVE-2026-65694 | 7.5 | — | — | — | — | Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows un | 80d ago |
| CVE-2026-50039 | 7.5 | — | — | — | — | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory | 80d ago |
| CVE-2026-50032 | 7.5 | — | — | — | — | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attack | 80d ago |
| CVE-2026-15967 | 7.5 | — | — | — | progress / moveit transfer | Insufficient session expiration vulnerability in Progress MOVEit Transfer. | 80d ago |
| CVE-2026-15966 | 7.5 | — | — | — | progress / moveit transfer | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. | 80d ago |
| CVE-2026-10697 | 7.5 | — | — | — | progress / moveit transfer | Improper Authentication vulnerability in Progress MOVEit Transfer. | 80d ago |
| CVE-2026-25800 | 7.5 | — | — | — | — | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. | 80d ago |
| CVE-2026-16756 | 7.5 | — | — | — | — | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() | 80d ago |
| CVE-2026-65919 | 7.5 | — | — | — | — | Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView an | 81d ago |
| CVE-2026-44909 | 7.5 | — | — | — | — | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. | 81d ago |
| CVE-2026-15615 | 7.5 | — | — | — | — | Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restriction | 81d ago |
| CVE-2026-15614 | 7.5 | — | — | — | — | Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s | 81d ago |
| CVE-2026-43823 | 7.5 | — | — | — | apple / swift-crypto | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in | 81d ago |
| CVE-2026-14257 | 7.5 | — | — | — | juliangruber / brace-expansion | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. | 81d ago |
| CVE-2026-65500 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5 | 81d ago |
| CVE-2026-65495 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. | 81d ago |
| CVE-2026-65493 | 7.5 | — | — | — | — | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. | 81d ago |
| CVE-2026-65481 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Vino <= 1.9 versions. | 81d ago |
| CVE-2026-65477 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions. | 81d ago |
| CVE-2026-61954 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | 81d ago |
| CVE-2026-61943 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. | 81d ago |
| CVE-2026-59554 | 7.5 | — | — | — | — | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. | 81d ago |
| CVE-2026-59547 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. | 81d ago |
| CVE-2026-64611 | 7.5 | — | — | — | — | A flaw was found in libcupsfilters. | 81d ago |
| CVE-2026-65755 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere ex | 81d ago |
| CVE-2026-65754 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include p | 81d ago |
| CVE-2026-65430 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where lea | 81d ago |
| CVE-2026-64799 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere exten | 81d ago |
| CVE-2026-52688 | 7.5 | — | — | — | — | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | 81d ago |
| CVE-2024-58330 | 7.5 | — | — | — | — | A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker | 81d ago |
| CVE-2026-9713 | 7.5 | — | — | — | — | The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 't | 81d ago |
| CVE-2026-14291 | 7.5 | — | — | — | — | The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one o | 81d ago |
| CVE-2026-12082 | 7.5 | — | — | — | — | The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API | 81d ago |
| CVE-2026-15074 | 7.5 | — | — | — | fastify / fastify-static | @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames befo | 81d ago |
| CVE-2026-60370 | 7.5 | — | — | — | oracle / platform security for java | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized | 81d ago |
| CVE-2026-64797 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded | 81d ago |
| CVE-2026-64792 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs ext | 81d ago |
| CVE-2026-63683 | 7.5 | — | — | — | — | Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and | 81d ago |
| CVE-2026-13089 | 7.5 | — | — | — | — | OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled al | 81d ago |
| CVE-2026-14899 | 7.5 | — | — | — | mozilla / thunderbird | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabl | 81d ago |
| CVE-2026-64834 | 7.5 | — | — | — | ffmpeg / ffmpeg | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavform | 82d ago |
| CVE-2026-13204 | 7.5 | — | — | — | — | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG | 82d ago |
| CVE-2026-12617 | 7.5 | — | — | — | — | The issue is unexpected program termination based on ordering and/or specific content in responses to queries for | 82d ago |
| CVE-2026-11721 | 7.5 | — | — | — | — | It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than | 82d ago |
| CVE-2026-11622 | 7.5 | — | — | — | — | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from | 82d ago |
| CVE-2026-11605 | 7.5 | — | — | — | — | The issue is a resource exhaustion vulnerability associated with DNSSEC validation. | 82d ago |
| CVE-2026-11331 | 7.5 | — | — | — | — | An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names lon | 82d ago |
| CVE-2026-62145 | 7.5 | — | — | — | — | A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges | 82d ago |
