| CVE-2024-6228 | 7.5 | — | — | — | — | The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value | 97d ago |
| CVE-2026-14570 | 7.5 | — | — | — | — | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator | 99d ago |
| CVE-2026-58421 | 7.5 | — | — | — | — | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | 100d ago |
| CVE-2026-58419 | 7.5 | — | — | — | — | Notification API leaks private issue metadata after access revocation | 100d ago |
| CVE-2026-58299 | 7.5 | — | — | — | microsoft / edge chromium | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to | 100d ago |
| CVE-2026-58294 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 100d ago |
| CVE-2026-58292 | 7.5 | — | — | — | microsoft / edge chromium | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over | 100d ago |
| CVE-2026-58290 | 7.5 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 100d ago |
| CVE-2026-58276 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 100d ago |
| CVE-2026-57992 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 100d ago |
| CVE-2026-57986 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 100d ago |
| CVE-2026-57984 | 7.5 | — | — | — | microsoft / edge chromium | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 100d ago |
| CVE-2026-57975 | 7.5 | — | — | — | microsoft / edge chromium | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho | 100d ago |
| CVE-2026-27779 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allow | 100d ago |
| CVE-2026-27660 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write per | 100d ago |
| CVE-2026-27657 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 allow a user to change another user's primary email address. | 100d ago |
| CVE-2026-26307 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume | 100d ago |
| CVE-2026-25712 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden member | 100d ago |
| CVE-2026-25038 | 7.5 | — | — | — | — | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | 100d ago |
| CVE-2026-24690 | 7.5 | — | — | — | — | Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches. | 100d ago |
| CVE-2026-24451 | 7.5 | — | — | — | — | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exp | 100d ago |
| CVE-2026-47896 | 7.5 | — | — | — | apache / lucene.net | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net | 100d ago |
| CVE-2026-47897 | 7.5 | — | — | — | apache / lucene.net | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net | 100d ago |
| CVE-2026-9546 | 7.5 | — | — | — | haxx / curl | A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. | 100d ago |
| CVE-2026-9545 | 7.5 | — | — | — | haxx / curl | In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second t | 100d ago |
| CVE-2026-8932 | 7.5 | — | — | — | haxx / curl | libcurl would reuse a previously created connection even when some mTLS config related option had been changed that | 100d ago |
| CVE-2026-4967 | 7.5 | — | — | — | — | In IMS, there is a possible out of bounds read due to a missing bounds check. | 100d ago |
| CVE-2026-12064 | 7.5 | — | — | — | haxx / curl | When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs | 100d ago |
| CVE-2026-11586 | 7.5 | — | — | — | haxx / curl | By default, curl automatically responds to WebSocket PING frames. | 100d ago |
| CVE-2026-11352 | 7.5 | — | — | — | haxx / curl | An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of servic | 100d ago |
| CVE-2026-14352 | 7.5 | — | — | — | — | The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ | 100d ago |
| CVE-2026-14327 | 7.5 | — | — | — | — | The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includin | 101d ago |
| CVE-2026-13084 | 7.5 | — | — | — | watchguard / fireware | A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to | 101d ago |
| CVE-2026-12413 | 7.5 | — | — | — | libreswan / libreswan | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. | 101d ago |
| CVE-2026-52192 | 7.5 | — | — | — | — | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the | 101d ago |
| CVE-2026-52191 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 101d ago |
| CVE-2026-52189 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 101d ago |
| CVE-2026-38970 | 7.5 | — | — | — | — | pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. | 101d ago |
| CVE-2026-59096 | 7.5 | — | — | — | — | Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration doc | 101d ago |
| CVE-2026-59094 | 7.5 | — | — | — | — | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed | 101d ago |
| CVE-2026-58467 | 7.5 | — | — | — | — | Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenti | 101d ago |
| CVE-2026-52187 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 101d ago |
| CVE-2026-58465 | 7.5 | — | — | — | — | Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block | 101d ago |
| CVE-2026-55952 | 7.5 | — | — | — | erlang / erlang\/otp | The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 C | 101d ago |
| CVE-2024-58352zero day | 7.5 | 0.90% | 1/3 | same day | — | Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query | 101d ago |
| CVE-2026-56842 | 7.5 | — | — | — | ui / unifi network application | A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization | 101d ago |
| CVE-2026-55113 | 7.5 | — | — | — | ui / unifi talk application | A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability foun | 101d ago |
| CVE-2026-55112 | 7.5 | — | — | — | ui / unifi dream machine pro firmware | A malicious actor with access to the network and low privileges and under certain conditions could exploit an Impr | 101d ago |
| CVE-2026-55111 | 7.5 | — | — | — | ui / protect floodlight firmware | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect F | 101d ago |
| CVE-2026-55110 | 7.5 | — | — | — | ui / unifi os server | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharin | 101d ago |
| CVE-2026-54409 | 7.5 | — | — | — | ui / unifi protect | A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization | 101d ago |
| CVE-2026-54405 | 7.5 | — | — | — | ui / unifi network application | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni | 101d ago |
| CVE-2026-58652 | 7.5 | — | — | — | — | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding | 101d ago |
| CVE-2026-57749 | 7.5 | — | — | — | — | Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions. | 101d ago |
| CVE-2026-57748 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Shopify <= 1.0.0 versions. | 101d ago |
| CVE-2026-39448 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. | 101d ago |
| CVE-2026-11946 | 7.5 | — | — | — | — | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. | 101d ago |
| CVE-2025-69134 | 7.5 | — | — | — | — | Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. | 101d ago |
| CVE-2025-69133 | 7.5 | — | — | — | — | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. | 101d ago |
| CVE-2026-8441 | 7.5 | — | — | — | — | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the | 101d ago |
