| CVE-2026-59922 | 7.5 | — | — | — | mistune project / mistune | Mistune is a Python Markdown parser with renderers and plugins. | 95d ago |
| CVE-2026-59892 | 7.5 | — | — | — | — | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. | 95d ago |
| CVE-2026-59887 | 7.5 | — | — | — | markdown-it / linkify-it | linkify-it is a links recognition library with full Unicode support. | 95d ago |
| CVE-2026-59879 | 7.5 | — | — | — | immutable-js / immutable | Immutable.js provides many Persistent Immutable data structures. | 95d ago |
| CVE-2026-29008 | 7.5 | — | — | — | denx / u-boot | U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net | 95d ago |
| CVE-2025-3110 | 7.5 | — | — | — | openvpn / openvpn access server | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remo | 95d ago |
| CVE-2026-59880 | 7.5 | — | — | — | immutable-js / immutable | Immutable.js provides many Persistent Immutable data structures. | 95d ago |
| CVE-2026-59874 | 7.5 | — | — | — | isaacs / tar | node-tar is a tar archive manipulation library for Node.js. | 95d ago |
| CVE-2026-59873 | 7.5 | — | — | — | isaacs / tar | node-tar is a tar archive manipulation library for Node.js. | 95d ago |
| CVE-2026-59869 | 7.5 | — | — | — | nodeca / js-yaml | js-yaml is a JavaScript YAML parser and dumper. | 95d ago |
| CVE-2026-59725 | 7.5 | — | — | — | socket / engine.io | Socket.IO enables bidirectional and low-latency communication for every platform. | 95d ago |
| CVE-2026-59724 | 7.5 | — | — | — | socket / engine.io | Socket.IO enables bidirectional and low-latency communication for every platform. | 95d ago |
| CVE-2026-59703 | 7.5 | — | — | — | — | repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attack | 95d ago |
| CVE-2026-49147 | 7.5 | — | — | — | — | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several ou | 95d ago |
| CVE-2026-49146 | 7.5 | — | — | — | — | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackr | 95d ago |
| CVE-2026-49145 | 7.5 | — | — | — | — | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. | 95d ago |
| CVE-2026-10708 | 7.5 | — | — | — | — | This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. | 95d ago |
| CVE-2026-10706 | 7.5 | — | — | — | — | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user | 95d ago |
| CVE-2026-10699 | 7.5 | — | — | — | progress / moveit transfer | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modul | 95d ago |
| CVE-2026-58656 | 7.5 | — | — | — | — | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Acces | 95d ago |
| CVE-2026-56250 | 7.5 | — | — | — | — | Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through Postg | 95d ago |
| CVE-2026-56226 | 7.5 | — | — | — | — | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), | 95d ago |
| CVE-2026-53482 | 7.5 | — | — | — | dell / data domain operating system | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS | 95d ago |
| CVE-2026-44840 | 7.5 | — | — | — | — | Dgraph is an open source distributed GraphQL database. | 95d ago |
| CVE-2026-15053 | 7.5 | — | — | — | tanium / server | Tanium addressed a denial of service vulnerability in Tanium Server. | 95d ago |
| CVE-2026-5356 | 7.5 | — | — | — | — | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper | 95d ago |
| CVE-2026-6854 | 7.5 | — | — | — | — | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via | 95d ago |
| CVE-2026-6230 | 7.5 | — | — | — | — | The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in a | 95d ago |
| CVE-2026-9700 | 7.5 | — | — | — | — | The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions | 96d ago |
| CVE-2026-9842 | 7.5 | — | — | — | — | The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions u | 96d ago |
| CVE-2026-14244 | 7.5 | — | — | — | — | The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and | 96d ago |
| CVE-2026-51937 | 7.5 | — | — | — | — | An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java | 96d ago |
| CVE-2026-14895 | 7.5 | — | — | — | — | String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. | 96d ago |
| CVE-2026-58469 | 7.5 | — | — | — | gnu / wget | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_meta | 96d ago |
| CVE-2026-59708 | 7.5 | — | — | — | — | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating gr | 96d ago |
| CVE-2026-56812 | 7.5 | — | — | — | phoenixframework / phoenix | Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScrip | 96d ago |
| CVE-2026-56811 | 7.5 | — | — | — | phoenixframework / phoenix | Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket mod | 96d ago |
| CVE-2026-6101 | 7.5 | — | — | — | — | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up | 96d ago |
| CVE-2026-5799 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. | 97d ago |
| CVE-2026-5730 | 7.5 | — | — | — | — | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. | 97d ago |
| CVE-2026-38976 | 7.5 | — | — | — | — | mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a | 97d ago |
| CVE-2026-55727 | 7.5 | — | — | — | — | A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to buil | 97d ago |
| CVE-2026-55574 | 7.5 | — | — | — | vllm / vllm | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. | 97d ago |
| CVE-2026-54234 | 7.5 | — | — | — | vllm / vllm | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. | 97d ago |
| CVE-2026-55380 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 97d ago |
| CVE-2026-55379 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 97d ago |
| CVE-2026-54060 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 97d ago |
| CVE-2026-54059 | 7.5 | — | — | — | python / pillow | Pillow is a Python imaging library. | 97d ago |
| CVE-2026-13753 | 7.5 | — | — | — | — | Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unau | 97d ago |
| CVE-2026-40140 | 7.5 | — | — | — | beyondtrust / privileged remote access | BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability i | 97d ago |
| CVE-2026-13698 | 7.5 | — | — | — | openvpn / openvpn | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows re | 97d ago |
| CVE-2026-13708 | 7.5 | — | — | — | — | Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers | 97d ago |
| CVE-2026-55994 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery | 98d ago |
| CVE-2026-55993 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery | 98d ago |
| CVE-2026-46726 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery | 98d ago |
| CVE-2026-46592 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF | 98d ago |
| CVE-2026-46585 | 7.5 | — | — | — | apache / camel | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene C | 98d ago |
| CVE-2026-46457 | 7.5 | — | — | — | apache / camel | Improper Input Validation vulnerability in Apache Camel NATS component. | 98d ago |
| CVE-2026-24012 | 7.5 | — | — | — | apache / iotdb | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. | 98d ago |
| CVE-2026-14809 | 7.5 | — | — | — | — | Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote at | 98d ago |
