| CVE-2026-13369 | 7.5 | — | — | — | — | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() fu | 101d ago |
| CVE-2026-13251 | 7.5 | — | — | — | — | The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2. | 101d ago |
| CVE-2026-9563 | 7.5 | — | — | — | — | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a defaul | 101d ago |
| CVE-2026-33592 | 7.5 | — | — | — | — | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. | 101d ago |
| CVE-2026-14249 | 7.5 | — | — | — | — | The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 v | 101d ago |
| CVE-2026-14426 | 7.5 | — | — | — | google / chrome | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to eng | 102d ago |
| CVE-2026-14409 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced | 102d ago |
| CVE-2026-52190 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 102d ago |
| CVE-2026-38891 | 7.5 | — | — | — | — | An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers | 102d ago |
| CVE-2026-36912 | 7.5 | — | — | — | — | A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4 | 102d ago |
| CVE-2026-58593 | 7.5 | — | — | — | nodebb / nodebb | NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. | 102d ago |
| CVE-2026-14265 | 7.5 | — | — | — | amazon / advanced jdbc wrapper | Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3 | 102d ago |
| CVE-2026-49119 | 7.5 | — | — | — | gradio project / gradio | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method th | 102d ago |
| CVE-2026-54428 | 7.5 | — | — | — | apache / httpcomponents core | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5. | 102d ago |
| CVE-2026-58454 | 7.5 | — | — | — | — | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability | 102d ago |
| CVE-2026-54399 | 7.5 | — | — | — | apache / httpcomponents core | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4. | 102d ago |
| CVE-2026-20244 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 102d ago |
| CVE-2026-20243 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 102d ago |
| CVE-2026-20217 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to caus | 102d ago |
| CVE-2026-20216 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker | 102d ago |
| CVE-2026-20215 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 102d ago |
| CVE-2026-20214 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 102d ago |
| CVE-2026-20213 | 7.5 | — | — | — | cisco / secure endpoint | A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a | 102d ago |
| CVE-2026-20191 | 7.5 | — | — | — | — | A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files f | 102d ago |
| CVE-2026-58036 | 7.5 | — | — | — | mediawiki / mediawiki | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. | 102d ago |
| CVE-2026-24264 | 7.5 | — | — | — | nvidia / triton inference server | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of | 102d ago |
| CVE-2026-14181 | 7.5 | — | — | — | fastify / fastify\/middie | @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engin | 102d ago |
| CVE-2026-12576 | 7.5 | — | — | — | — | DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerabili | 102d ago |
| CVE-2026-12575 | 7.5 | — | — | — | — | DVP80ES3 with Improper Resource Shutdown or Release vulnerability. | 102d ago |
| CVE-2026-1239 | 7.5 | — | — | — | — | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized a | 102d ago |
| CVE-2026-14193 | 7.5 | — | — | — | — | DVP80ES300T with Improper Validation of Array Index Vulnerability | 102d ago |
| CVE-2026-11823 | 7.5 | — | — | — | — | The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_servic | 102d ago |
| CVE-2026-11568 | 7.5 | — | — | — | — | The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post- | 102d ago |
| CVE-2026-13468 | 7.5 | — | — | — | — | The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authoriz | 102d ago |
| CVE-2026-12923 | 7.5 | — | — | — | — | The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including | 102d ago |
| CVE-2026-20458 | 7.5 | — | — | — | — | In Modem, there is a possible memory corruption due to a missing bounds check. | 103d ago |
| CVE-2026-54592 | 7.5 | — | — | — | — | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. | 103d ago |
| CVE-2026-56300 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_api | 103d ago |
| CVE-2026-56219 | 7.5 | — | — | — | — | Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function th | 103d ago |
| CVE-2026-52198 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 103d ago |
| CVE-2026-52197 | 7.5 | — | — | — | — | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the | 103d ago |
| CVE-2026-52195 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 103d ago |
| CVE-2026-52193 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 103d ago |
| CVE-2026-14115 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attack | 103d ago |
| CVE-2026-14114 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local | 103d ago |
| CVE-2026-14064 | 7.5 | — | — | — | google / chrome | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convin | 103d ago |
| CVE-2026-13968 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at | 103d ago |
| CVE-2026-13925 | 7.5 | — | — | — | google / chrome | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote atta | 103d ago |
| CVE-2026-13891 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote | 103d ago |
| CVE-2026-13856 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a | 103d ago |
| CVE-2026-13855 | 7.5 | — | — | — | google / chrome | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a | 103d ago |
| CVE-2026-13831 | 7.5 | — | — | — | google / chrome | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp | 103d ago |
| CVE-2026-13824 | 7.5 | — | — | — | google / chrome | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker wh | 103d ago |
| CVE-2026-13814 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to | 103d ago |
| CVE-2026-13807 | 7.5 | — | — | — | google / chrome | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a | 103d ago |
| CVE-2026-13802 | 7.5 | — | — | — | google / chrome | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to | 103d ago |
| CVE-2026-13794 | 7.5 | — | — | — | google / chrome | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 al | 103d ago |
| CVE-2026-57585 | 7.5 | — | — | — | msgpack / messagepack | MessagePack is the serializer implementation for Python msgpack.org. | 103d ago |
| CVE-2026-52196 | 7.5 | — | — | — | — | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denia | 103d ago |
| CVE-2026-50254 | 7.5 | — | — | — | — | An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. | 103d ago |
