| CVE-2026-50272 | 7.5 | — | — | — | — | dd-trace is the Datadog APM client for Node.js. | 86d ago |
| CVE-2026-50271 | 7.5 | — | — | — | — | Datadog dd-trace-py is the Datadog Python APM client. | 86d ago |
| CVE-2026-44891 | 7.5 | — | — | — | netty / netty | Netty is a network application framework for development of protocol servers and clients. | 86d ago |
| CVE-2026-7872 | 7.5 | — | — | — | langflow / langflow | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT si | 86d ago |
| CVE-2026-54465 | 7.5 | — | — | — | faye / websocket-driver | websocket-driver is a WebSocket protocol handler with pluggable I/O. | 86d ago |
| CVE-2026-54463 | 7.5 | — | — | — | faye / websocket-driver | websocket-driver is a WebSocket protocol handler with pluggable I/O. | 86d ago |
| CVE-2026-51833 | 7.5 | — | — | — | — | Xenforo 2.3.8 is vulnerable to SSRF. | 86d ago |
| CVE-2026-50151 | 7.5 | — | — | — | linuxfoundation / oras | oras-go is a Go library for managing OCI artifacts. | 86d ago |
| CVE-2026-45799 | 7.5 | — | — | — | squareup / wire | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. | 86d ago |
| CVE-2026-15322 | 7.5 | — | — | — | ibm / engineering ai hub | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due t | 86d ago |
| CVE-2025-51678 | 7.5 | — | — | — | — | An issue was discovered in RISC-V PicoRV32 commit 87c89a. | 86d ago |
| CVE-2026-9171 | 7.5 | — | — | — | ibm / powervm novalink | IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, ca | 86d ago |
| CVE-2026-52746 | 7.5 | — | — | — | jsonata / jsonata | JSONata is a JSON query and transformation language. | 86d ago |
| CVE-2026-45309 | 7.5 | — | — | — | asyncssh project / asyncssh | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol | 86d ago |
| CVE-2026-50273 | 7.5 | — | — | — | — | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. | 86d ago |
| CVE-2026-63101 | 7.5 | — | — | — | — | Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attac | 86d ago |
| CVE-2026-49212 | 7.5 | — | — | — | symfony / ux | Symfony UX is a JavaScript ecosystem for Symfony. | 86d ago |
| CVE-2026-49211 | 7.5 | — | — | — | symfony / ux | Symfony UX is a JavaScript ecosystem for Symfony. | 86d ago |
| CVE-2026-12691 | 7.5 | — | — | — | — | Missing authentication for critical function vulnerability in Vimesoft Inc. | 86d ago |
| CVE-2026-14741 | 7.5 | — | — | — | — | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. | 86d ago |
| CVE-2026-7488 | 7.5 | — | — | — | — | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. | 86d ago |
| CVE-2026-8396 | 7.5 | — | — | — | — | Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. | 86d ago |
| CVE-2026-7189 | 7.5 | — | — | — | — | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. | 86d ago |
| CVE-2026-11575 | 7.5 | — | — | — | — | The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming | 87d ago |
| CVE-2026-13765 | 7.5 | — | — | — | — | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sen | 87d ago |
| CVE-2026-62386 | 7.5 | — | — | — | — | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL | 87d ago |
| CVE-2026-62230 | 7.5 | — | — | — | — | Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking ac | 87d ago |
| CVE-2026-54340 | 7.5 | — | — | — | h2o / h2o | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. | 87d ago |
| CVE-2026-39359 | 7.5 | — | — | — | wazuh / wazuh | Wazuh is a free and open source platform used for threat prevention, detection, and response. | 87d ago |
| CVE-2026-34150 | 7.5 | — | — | — | wazuh / wazuh | Wazuh is a free and open source platform used for threat prevention, detection, and response. | 87d ago |
| CVE-2026-44453 | 7.5 | — | — | — | h2o / h2o | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. | 87d ago |
| CVE-2026-44436 | 7.5 | — | — | — | h2o / quicly | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. | 87d ago |
| CVE-2026-44435 | 7.5 | — | — | — | h2o / quicly | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. | 87d ago |
| CVE-2026-43977 | 7.5 | — | — | — | — | wger is a free, open-source workout and fitness manager. | 87d ago |
| CVE-2026-59117 | 7.5 | — | — | — | microsoft / terminal | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network. | 87d ago |
| CVE-2026-33692 | 7.5 | — | — | — | — | WWBN AVideo is an open source video platform. | 87d ago |
| CVE-2026-62309 | 7.5 | — | — | — | coredns.io / coredns | CoreDNS is a DNS server written in Go. | 87d ago |
| CVE-2026-15352 | 7.5 | — | — | — | — | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). | 87d ago |
| CVE-2026-45576 | 7.5 | — | — | — | netfoundry / zrok | zrok is software for sharing web services, files, and network resources. | 87d ago |
| CVE-2026-45367 | 7.5 | — | — | — | — | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 87d ago |
| CVE-2026-13401 | 7.5 | — | — | — | — | XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. | 87d ago |
| CVE-2026-13397 | 7.5 | — | — | — | — | HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. | 87d ago |
| CVE-2026-53598 | 7.5 | — | — | — | — | Prompty is a markdown file format (.prompty) for LLM prompts. | 87d ago |
| CVE-2026-59862 | 7.5 | — | — | — | — | Kiota is an OpenAPI based HTTP Client code generator. | 87d ago |
| CVE-2026-59861 | 7.5 | — | — | — | — | Kiota is an OpenAPI based HTTP Client code generator. | 87d ago |
| CVE-2026-21729 | 7.5 | — | — | — | — | Loki queries with large limits can cause large memory allocations which can impact the availability of the service | 88d ago |
| CVE-2026-12753 | 7.5 | — | — | — | — | The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL | 88d ago |
| CVE-2026-48863 | 7.5 | — | — | — | — | A flaw was found in libsolv. | 88d ago |
| CVE-2026-23538 | 7.5 | — | — | — | — | A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to e | 88d ago |
| CVE-2026-36590 | 7.5 | — | — | — | emqx / nanomq | An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set funct | 88d ago |
| CVE-2026-49353 | 7.5 | — | — | — | — | 9Router is an AI router & token saver. | 88d ago |
| CVE-2026-40957 | 7.5 | — | — | — | absolute / secure access | o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. | 88d ago |
| CVE-2026-62351 | 7.5 | — | — | — | — | TDengine is a time-series database optimized for Internet of Things devices. | 88d ago |
| CVE-2026-12997 | 7.5 | — | — | — | — | The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | 88d ago |
| CVE-2026-59955 | 7.5 | — | — | — | — | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. | 88d ago |
| CVE-2026-59954 | 7.5 | — | — | — | — | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. | 88d ago |
| CVE-2026-45804 | 7.5 | — | — | — | huggingface / diffusers | Diffusers is the a library for pretrained diffusion models. | 88d ago |
| CVE-2026-45793 | 7.5 | — | — | — | — | Composer is a dependency Manager for the PHP language. | 88d ago |
| CVE-2026-20187 | 7.5 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 88d ago |
| CVE-2026-20158 | 7.5 | — | — | — | cisco / roomos | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team | 88d ago |
