| CVE-2026-35505 | 7.5 | — | — | — | — | An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. | 103d ago |
| CVE-2026-44628 | 7.5 | — | — | — | — | An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid | 103d ago |
| CVE-2026-13207 | 7.5 | — | — | — | — | FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in | 103d ago |
| CVE-2026-13772 | 7.5 | — | — | — | ibm / websphere extreme scale | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied cla | 103d ago |
| CVE-2026-13759 | 7.5 | — | — | — | ibm / websphere extreme scale | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, | 103d ago |
| CVE-2026-58375 | 7.5 | — | — | — | — | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is an | 103d ago |
| CVE-2026-58169 | 7.5 | — | — | — | — | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows remote attacke | 103d ago |
| CVE-2026-49451 | 7.5 | — | — | — | — | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to | 103d ago |
| CVE-2026-8451exploited | 7.5 | 0.50% | 1/3 | +1d | citrix / netscaler application delivery controller | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or | 103d ago |
| CVE-2026-58016 | 7.5 | — | — | — | gnome / glib | A flaw was found in GLib. | 103d ago |
| CVE-2026-53433 | 7.5 | — | — | — | junegunn / fzf | fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to | 103d ago |
| CVE-2026-53432 | 7.5 | — | — | — | junegunn / fzf | fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. | 103d ago |
| CVE-2026-13474 | 7.5 | — | — | — | citrix / netscaler application delivery controller | Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTT | 103d ago |
| CVE-2026-10817 | 7.5 | — | — | — | citrix / netscaler application delivery controller | Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeSta | 103d ago |
| CVE-2026-10816 | 7.5 | — | — | — | citrix / netscaler application delivery controller | Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Manage | 103d ago |
| CVE-2026-57081 | 7.5 | — | — | — | — | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. | 103d ago |
| CVE-2026-57080 | 7.5 | — | — | — | — | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-l | 103d ago |
| CVE-2026-14161 | 7.5 | — | — | — | — | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthent | 103d ago |
| CVE-2026-54475 | 7.5 | — | — | — | apache / activemq | Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. | 103d ago |
| CVE-2026-53917 | 7.5 | — | — | — | apache / activemq | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ | 103d ago |
| CVE-2026-53916 | 7.5 | — | — | — | apache / activemq | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ | 103d ago |
| CVE-2026-50750 | 7.5 | — | — | — | apache / activemq | Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. | 103d ago |
| CVE-2026-50734 | 7.5 | — | — | — | apache / activemq | Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache Activ | 103d ago |
| CVE-2026-49434 | 7.5 | — | — | — | apache / activemq | Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. | 103d ago |
| CVE-2026-49432 | 7.5 | — | — | — | apache / activemq | Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. | 103d ago |
| CVE-2026-14164 | 7.5 | — | — | — | — | A double free issue has been identified in libarchive's RAR5 reader. | 103d ago |
| CVE-2026-8023 | 7.5 | — | — | — | zephyrproject / zephyr | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS | 104d ago |
| CVE-2026-51219 | 7.5 | — | — | — | — | A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 | 104d ago |
| CVE-2026-51218 | 7.5 | — | — | — | — | A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 all | 104d ago |
| CVE-2026-51221 | 7.5 | — | — | — | — | A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cau | 104d ago |
| CVE-2026-41896 | 7.5 | — | — | — | — | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | 104d ago |
| CVE-2026-56018 | 7.5 | — | — | — | — | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded m | 104d ago |
| CVE-2026-56017 | 7.5 | — | — | — | — | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meanin | 104d ago |
| CVE-2026-56780 | 7.5 | — | — | — | — | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/p | 104d ago |
| CVE-2026-36848 | 7.5 | — | — | — | gigamon / gigavue-os | Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem. | 104d ago |
| CVE-2026-56124 | 7.5 | — | — | — | — | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attac | 104d ago |
| CVE-2026-55844 | 7.5 | — | — | — | — | Home Assistant is open source home automation software that puts local control and privacy first. | 104d ago |
| CVE-2026-49049exploited | 7.5 | 0.99% | 2/3 | +11d | ollyo / helix3 | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitra | 104d ago |
| CVE-2026-13676 | 7.5 | — | — | — | openjsf / fast-uri | fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. | 104d ago |
| CVE-2026-41992 | 7.5 | — | — | — | gnu / gzip | GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse o | 104d ago |
| CVE-2026-10083 | 7.5 | — | — | — | — | The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an | 104d ago |
| CVE-2026-36478 | 7.5 | — | — | — | — | An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the | 107d ago |
| CVE-2026-46604 | 7.5 | — | — | — | golang / tiff | The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset. | 107d ago |
| CVE-2026-38641 | 7.5 | — | — | — | — | An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service | 107d ago |
| CVE-2026-38639 | 7.5 | — | — | — | — | An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denia | 107d ago |
| CVE-2026-53284 | 7.5 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree af | 107d ago |
| CVE-2026-47193 | 7.5 | — | — | — | — | OpenProject is open-source, web-based project management software. | 107d ago |
| CVE-2026-47220 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 107d ago |
| CVE-2026-54341 | 7.5 | — | — | — | — | Dragonfly is an in-memory data store built for modern application workloads. | 107d ago |
| CVE-2026-48743 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 107d ago |
| CVE-2026-48044 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 107d ago |
| CVE-2026-48042 | 7.5 | — | — | — | envoyproxy / envoy | Envoy is an open source edge and service proxy designed for cloud-native applications. | 107d ago |
| CVE-2026-57231 | 7.5 | — | — | — | podman project / podman | Podman is a tool for managing OCI containers and pods. | 107d ago |
| CVE-2026-55677 | 7.5 | — | — | — | — | Echo is a Go web framework. | 107d ago |
| CVE-2026-5757 | 7.5 | — | — | — | ollama / ollama | Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacke | 107d ago |
| CVE-2026-0828 | 7.5 | — | — | — | — | Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows | 107d ago |
| CVE-2026-57647 | 7.5 | — | — | — | — | Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions. | 107d ago |
| CVE-2026-56069 | 7.5 | — | — | — | — | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions. | 107d ago |
| CVE-2026-56061 | 7.5 | — | — | — | — | Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions. | 107d ago |
| CVE-2026-56060 | 7.5 | — | — | — | — | Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions. | 107d ago |
