| CVE-2026-16384 | 7.5 | — | — | — | mozilla / firefox | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. | 82d ago |
| CVE-2026-16378 | 7.5 | — | — | — | mozilla / firefox | Other issue in the DOM: Copy & Paste and Drag & Drop component. | 82d ago |
| CVE-2026-16376 | 7.5 | — | — | — | mozilla / firefox | Denial-of-service in the Graphics: WebGPU component. | 82d ago |
| CVE-2026-16374 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Framework component in DevTools. | 82d ago |
| CVE-2026-16373 | 7.5 | — | — | — | mozilla / firefox mobile | Information disclosure in the Privacy component in Firefox for Android. | 82d ago |
| CVE-2026-16354 | 7.5 | — | — | — | mozilla / firefox | Information disclosure in the Graphics: ImageLib component. | 82d ago |
| CVE-2026-8082 | 7.5 | — | — | — | — | The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in | 83d ago |
| CVE-2023-37507 | 7.5 | — | — | — | hcltech / devops plan | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks base | 83d ago |
| CVE-2026-55833 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 83d ago |
| CVE-2026-55831 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 83d ago |
| CVE-2026-51031 | 7.5 | — | — | — | — | FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpo | 83d ago |
| CVE-2024-51316 | 7.5 | — | — | — | — | The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the f | 83d ago |
| CVE-2026-56452 | 7.5 | — | — | — | apache / mina sshd | Path traversal in the sshd-scp component of Apache MINA SSHD. | 83d ago |
| CVE-2026-13380 | 7.5 | — | — | — | vsee / clinic | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three una | 83d ago |
| CVE-2026-15788 | 7.5 | — | — | — | mobyproject / buildkit | BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS direct | 83d ago |
| CVE-2026-64619 | 7.5 | — | — | — | — | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthentic | 83d ago |
| CVE-2026-64194 | 7.5 | — | — | — | — | Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. | 83d ago |
| CVE-2026-63770 | 7.5 | — | — | — | — | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unaut | 83d ago |
| CVE-2026-64612 | 7.5 | — | — | — | — | A flaw was found in libcupsfilters and cups-filters. | 83d ago |
| CVE-2026-48812 | 7.5 | — | — | — | — | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. | 83d ago |
| CVE-2026-54538 | 7.5 | — | — | — | neutrinolabs / xrdp | xrdp is an open source RDP server. | 83d ago |
| CVE-2026-32820 | 7.5 | — | — | — | — | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. | 83d ago |
| CVE-2026-32806 | 7.5 | — | — | — | — | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. | 83d ago |
| CVE-2026-45713 | 7.5 | — | — | — | axllent / mailpit | Mailpit is an email testing tool and API for developers. | 83d ago |
| CVE-2026-32807 | 7.5 | — | — | — | — | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. | 83d ago |
| CVE-2026-26197 | 7.5 | — | — | — | hdfgroup / hdf5 | HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. | 83d ago |
| CVE-2026-64622 | 7.5 | — | — | — | — | Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (chec | 83d ago |
| CVE-2026-63760 | 7.5 | — | — | — | surrealdb / surrealdb | SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when pro | 83d ago |
| CVE-2026-63747 | 7.5 | — | — | — | surrealdb / surrealdb | SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when | 83d ago |
| CVE-2026-6656 | 7.5 | — | — | — | — | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. | 84d ago |
| CVE-2026-12592 | 7.5 | — | — | — | — | The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before | 84d ago |
| CVE-2026-42566 | 7.5 | — | — | — | meshtastic / meshtastic firmware | Meshtastic is an open source mesh networking solution. | 84d ago |
| CVE-2026-64175 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware re | 84d ago |
| CVE-2026-64148 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wa | 84d ago |
| CVE-2026-64141 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare | 84d ago |
| CVE-2026-64140 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_sh | 84d ago |
| CVE-2026-64116 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_ho | 84d ago |
| CVE-2026-64048 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an | 84d ago |
| CVE-2026-64020 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We d | 84d ago |
| CVE-2026-64003 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL de | 84d ago |
| CVE-2026-63980 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nv | 84d ago |
| CVE-2026-63972 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-de | 84d ago |
| CVE-2026-63968 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_selec | 84d ago |
| CVE-2026-63955 | 7.5 | — | — | — | — | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG() on BH disable | 84d ago |
| CVE-2026-16221 | 7.5 | — | — | — | openjsf / fast-uri | Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4. | 84d ago |
| CVE-2026-53397 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode fail | 84d ago |
| CVE-2026-53395 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_cre | 84d ago |
| CVE-2026-53394 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on | 84d ago |
| CVE-2026-53392 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle versio | 84d ago |
| CVE-2026-53391 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_ | 84d ago |
| CVE-2026-53383 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound re | 84d ago |
| CVE-2026-53994 | 7.5 | — | — | — | proftpd / proftpd | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. | 85d ago |
| CVE-2024-58368 | 7.5 | — | — | — | surrealdb / surrealdb | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests contai | 85d ago |
| CVE-2026-59173 | 7.5 | — | — | — | apache / traffic server | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. | 85d ago |
| CVE-2026-56741 | 7.5 | — | — | — | jline / jline | JLine is a Java library for handling console input. | 86d ago |
| CVE-2026-56740 | 7.5 | — | — | — | jline / jline | JLine is a Java library for handling console input. | 86d ago |
| CVE-2026-49485 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 86d ago |
| CVE-2026-54466 | 7.5 | — | — | — | faye / websocket-driver | websocket-driver is a WebSocket protocol handler with pluggable I/O. | 86d ago |
| CVE-2026-52203 | 7.5 | — | — | — | — | An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter. | 86d ago |
| CVE-2026-50274 | 7.5 | — | — | — | — | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security | 86d ago |
