| CVE-2026-40553 | 7.5 | — | — | — | fossies / gawk | Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). | 90d ago |
| CVE-2026-40467 | 7.5 | — | — | — | fossies / gawk | Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). | 90d ago |
| CVE-2026-15584 | 7.5 | — | — | — | — | A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. | 90d ago |
| CVE-2026-57815 | 7.5 | — | — | — | — | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your Al | 90d ago |
| CVE-2026-57805 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57804 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57803 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57802 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57801 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57800 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57799 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57798 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57796 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57795 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57794 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57793 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57792 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57791 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57790 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57789 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57788 | 7.5 | — | — | — | — | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil | 90d ago |
| CVE-2026-57729 | 7.5 | — | — | — | — | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access | 90d ago |
| CVE-2026-57727 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control | 90d ago |
| CVE-2026-57705 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configure | 90d ago |
| CVE-2026-57697 | 7.5 | — | — | — | — | Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-p | 90d ago |
| CVE-2026-57378 | 7.5 | — | — | — | — | Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Conf | 90d ago |
| CVE-2026-15574 | 7.5 | — | — | — | — | A flaw was found in the vllm-orchestrator-gateway component. | 91d ago |
| CVE-2026-14165 | 7.5 | — | — | — | — | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 th | 91d ago |
| CVE-2026-56238 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endp | 91d ago |
| CVE-2026-61439 | 7.5 | — | — | — | — | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold def | 92d ago |
| CVE-2026-56303 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL func | 92d ago |
| CVE-2026-9282exploited | 7.5 | 2.9% | 1/3 | +3d | — | The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, | 93d ago |
| CVE-2026-4661 | 7.5 | — | — | — | — | The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based bli | 93d ago |
| CVE-2026-15335 | 7.5 | — | — | — | — | The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N | 93d ago |
| CVE-2026-15338 | 7.5 | — | — | — | — | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions | 93d ago |
| CVE-2026-55175 | 7.5 | — | — | — | linuxfoundation / spinnaker | Spinnaker is an open source, multi-cloud continuous delivery platform. | 93d ago |
| CVE-2026-44383 | 7.5 | — | — | — | — | Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker | 93d ago |
| CVE-2026-42952 | 7.5 | — | — | — | — | Previously, there was no throttling on repeated authentication attempts to the charging station backend, which cou | 93d ago |
| CVE-2026-57220 | 7.5 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 93d ago |
| CVE-2026-57219 | 7.5 | — | — | — | broadcom / rabbitmq server | RabbitMQ is a messaging and streaming broker. | 93d ago |
| CVE-2026-55233 | 7.5 | — | — | — | openresty / openresty | OpenResty is a high performance web platform. | 93d ago |
| CVE-2026-55229 | 7.5 | — | — | — | — | Gotenberg is a Docker-powered stateless API for PDF files. | 93d ago |
| CVE-2026-55213 | 7.5 | — | — | — | — | h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. | 93d ago |
| CVE-2026-55827 | 7.5 | — | — | — | freerdp / freerdp | FreeRDP is a free implementation of the Remote Desktop Protocol. | 93d ago |
| CVE-2026-59162 | 7.5 | — | — | — | excelize / excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | 93d ago |
| CVE-2026-59161 | 7.5 | — | — | — | excelize / excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | 93d ago |
| CVE-2026-55687 | 7.5 | — | — | — | — | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. | 93d ago |
| CVE-2026-54063 | 7.5 | — | — | — | excelize / excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. | 93d ago |
| CVE-2026-39244 | 7.5 | — | — | — | — | adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed si | 93d ago |
| CVE-2025-70796 | 7.5 | — | — | — | — | An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology | 93d ago |
| CVE-2026-33382 | 7.5 | — | — | — | grafana / grafana | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before proc | 93d ago |
| CVE-2026-56279 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function tha | 93d ago |
| CVE-2026-38059 | 7.5 | — | — | — | — | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. | 93d ago |
| CVE-2026-40454 | 7.5 | — | — | — | — | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. | 94d ago |
| CVE-2026-40452 | 7.5 | — | — | — | — | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. | 94d ago |
| CVE-2026-40007 | 7.5 | — | — | — | — | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. | 94d ago |
| CVE-2026-40006 | 7.5 | — | — | — | — | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authent | 94d ago |
| CVE-2026-13347 | 7.5 | — | — | — | — | The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 | 94d ago |
| CVE-2026-12685 | 7.5 | — | — | — | — | The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor th | 94d ago |
| CVE-2026-15291 | 7.5 | — | — | — | — | The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure i | 94d ago |
