| CVE-2026-15290 | 7.5 | — | — | — | — | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 93d ago |
| CVE-2026-15288 | 7.5 | — | — | — | — | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Vali | 93d ago |
| CVE-2026-59834 | 7.5 | — | — | — | — | SiYuan is an open-source personal knowledge management system. | 94d ago |
| CVE-2026-57026 | 7.5 | — | — | — | juniper / junos | An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos | 94d ago |
| CVE-2026-57023 | 7.5 | — | — | — | juniper / junos | An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Ju | 94d ago |
| CVE-2026-49256 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 94d ago |
| CVE-2026-45788 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 94d ago |
| CVE-2026-39246 | 7.5 | — | — | — | decompress project / decompress | decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. | 94d ago |
| CVE-2026-38076 | 7.5 | — | — | — | — | An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause | 94d ago |
| CVE-2026-15271 | 7.5 | — | — | — | — | A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and E | 94d ago |
| CVE-2026-51926 | 7.5 | — | — | — | — | An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the log | 94d ago |
| CVE-2026-15270 | 7.5 | — | — | — | dlink / dir-823g firmware | A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. | 94d ago |
| CVE-2026-54695 | 7.5 | — | — | — | pipecat / pipecat | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. | 94d ago |
| CVE-2026-0287 | 7.5 | — | — | — | paloaltonetworks / cloud ngfw | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker | 94d ago |
| CVE-2025-63579 | 7.5 | — | — | — | — | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. | 94d ago |
| CVE-2026-59720 | 7.5 | — | — | — | — | Hoppscotch is an open source API development ecosystem. | 94d ago |
| CVE-2026-55420 | 7.5 | — | — | — | discourse / discourse | Discourse is an open-source discussion platform. | 94d ago |
| CVE-2026-51606 | 7.5 | — | — | — | — | An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the de | 94d ago |
| CVE-2026-51605 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an | 94d ago |
| CVE-2026-51604 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an | 94d ago |
| CVE-2026-51603 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an | 94d ago |
| CVE-2026-51602 | 7.5 | — | — | — | — | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an | 94d ago |
| CVE-2026-51601 | 7.5 | — | — | — | — | Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. | 94d ago |
| CVE-2026-51600 | 7.5 | — | — | — | — | Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including D | 94d ago |
| CVE-2026-15308 | 7.5 | — | — | — | python / python | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminate | 94d ago |
| CVE-2026-13462 | 7.5 | — | — | — | — | PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificat | 94d ago |
| CVE-2026-11404 | 7.5 | — | — | — | — | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv | 94d ago |
| CVE-2026-60109 | 7.5 | — | — | — | zeek / zeek | Zeek before 8.0.9 contains a null pointer dereference vulnerability in its Kerberos protocol analyzer that allows | 94d ago |
| CVE-2026-60108 | 7.5 | — | — | — | zeek / zeek | Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauth | 94d ago |
| CVE-2026-56292 | 7.5 | — | — | — | acymailing / acymailing | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyM | 94d ago |
| CVE-2026-59692 | 7.5 | — | — | — | — | A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. | 94d ago |
| CVE-2026-1989 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. | 94d ago |
| CVE-2026-57111 | 7.5 | — | — | — | apache / helix | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters. | 94d ago |
| CVE-2026-31984 | 7.5 | — | — | — | nozominetworks / cmc | A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging func | 94d ago |
| CVE-2026-47840 | 7.5 | — | — | — | — | A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certifica | 94d ago |
| CVE-2026-47831 | 7.5 | — | — | — | — | Use of a cryptographically weak random number generator in the GenerateRandomPassword function in bosh-windows-ste | 94d ago |
| CVE-2026-11571 | 7.5 | — | — | — | — | The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during emai | 94d ago |
| CVE-2026-54772 | 7.5 | — | — | — | — | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. | 95d ago |
| CVE-2026-54499 | 7.5 | — | — | — | stanford / stanza | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human la | 95d ago |
| CVE-2026-15117 | 7.5 | — | — | — | google / chrome | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user | 95d ago |
| CVE-2026-15111 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to | 95d ago |
| CVE-2026-55470 | 7.5 | — | — | — | hapifhir / hl7 fhir core | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. | 95d ago |
| CVE-2026-51535 | 7.5 | — | — | — | — | In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network pr | 95d ago |
| CVE-2026-44160 | 7.5 | — | — | — | fluentd / fluentd | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and s | 95d ago |
| CVE-2026-44025 | 7.5 | — | — | — | fluentd / fluentd | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and s | 95d ago |
| CVE-2026-56669 | 7.5 | — | — | — | — | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server | 95d ago |
| CVE-2026-49866 | 7.5 | — | — | — | — | libp2p is a JavaScript Implementation of libp2p networking stack. | 95d ago |
| CVE-2026-15167 | 7.5 | — | — | — | wireshark / wireshark | DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 95d ago |
| CVE-2026-0288 | 7.5 | — | — | — | paloaltonetworks / pan-os | Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks | 95d ago |
| CVE-2026-59939 | 7.5 | — | — | — | httplib2 project / httplib2 | httplib2 is a comprehensive HTTP client library for Python. | 95d ago |
| CVE-2026-59936 | 7.5 | — | — | — | pypdf project / pypdf | pypdf is a free and open-source pure-python PDF library. | 95d ago |
| CVE-2026-59935 | 7.5 | — | — | — | pypdf project / pypdf | pypdf is a free and open-source pure-python PDF library. | 95d ago |
| CVE-2026-59803 | 7.5 | — | — | — | — | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol.Message.Decode | 95d ago |
| CVE-2026-58250 | 7.5 | — | — | — | linuxfoundation / nats-server | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. | 95d ago |
| CVE-2026-58210 | 7.5 | — | — | — | linuxfoundation / nats-server | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. | 95d ago |
| CVE-2026-55760 | 7.5 | — | — | — | — | Handlebars.java provides logic-less and semantic Mustache templates with Java. | 95d ago |
| CVE-2026-55404 | 7.5 | — | — | — | yt-dlp project / yt-dlp | yt-dlp and youtube-dl are command-line audio/video downloaders. | 95d ago |
| CVE-2026-59937 | 7.5 | — | — | — | pypdf project / pypdf | pypdf is a free and open-source pure-python PDF library. | 95d ago |
| CVE-2026-59928 | 7.5 | — | — | — | mistune project / mistune | Mistune is a Python Markdown parser with renderers and plugins. | 95d ago |
| CVE-2026-59925 | 7.5 | — | — | — | mistune project / mistune | Mistune is a Python Markdown parser with renderers and plugins. | 95d ago |
