| CVE-2025-62043 | 6.5 | — | — | — | — | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPSight WPCa | 203d ago |
| CVE-2025-32223 | 6.5 | — | — | — | — | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorr | 203d ago |
| CVE-2026-27397 | 6.5 | — | — | — | — | Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. | 204d ago |
| CVE-2026-28449 | 6.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid s | 204d ago |
| CVE-2026-32743 | 6.5 | — | — | — | dronecode / px4 drone autopilot | PX4 is an open-source autopilot stack for drones and unmanned vehicles. | 204d ago |
| CVE-2026-33163 | 6.5 | — | — | — | parseplatform / parse-server | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. | 204d ago |
| CVE-2026-25745 | 6.5 | — | — | — | open-emr / openemr | OpenEMR is a free and open source electronic health records and medical practice management application. | 204d ago |
| CVE-2025-55043 | 6.5 | — | — | — | murasoftware / mura cms | MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBu | 204d ago |
| CVE-2026-22320 | 6.5 | — | — | — | — | A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker wi | 204d ago |
| CVE-2026-22316 | 6.5 | — | — | — | — | A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request | 204d ago |
| CVE-2026-33058 | 6.5 | — | — | — | kanboard / kanboard | Kanboard is project management software focused on Kanban methodology. | 205d ago |
| CVE-2026-31865 | 6.5 | — | — | — | elysiajs / elysia | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server | 205d ago |
| CVE-2026-27522 | 6.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.24 contain a local media root bypass vulnerability in sendAttachment and setGrou | 205d ago |
| CVE-2026-22178 | 6.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.19 construct RegExp objects directly from unescaped Feishu mention metadata in t | 205d ago |
| CVE-2026-22170 | 6.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnera | 205d ago |
| CVE-2026-22168 | 6.5 | — | — | — | openclaw / openclaw | OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allow | 205d ago |
| CVE-2026-29057 | 6.5 | — | — | — | vercel / next.js | Next.js is a React framework for building full-stack web applications. | 205d ago |
| CVE-2026-26004 | 6.5 | — | — | — | sentry / sentry | Sentry is a developer-first error tracking and performance monitoring tool. | 205d ago |
| CVE-2026-25937 | 6.5 | — | — | — | teclib-edition / glpi | GLPI is a free Asset and IT management software package. | 205d ago |
| CVE-2026-32842 | 6.5 | — | — | — | edimax / gs-5008pl firmware | Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allo | 205d ago |
| CVE-2026-1267 | 6.5 | — | — | — | ibm / planning analytics local | IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data | 205d ago |
| CVE-2026-25936 | 6.5 | — | — | — | teclib-edition / glpi | GLPI is a free Asset and IT management software package. | 205d ago |
| CVE-2026-4147 | 6.5 | — | — | — | mongodb / mongodb | An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-craft | 205d ago |
| CVE-2026-21886 | 6.5 | — | — | — | citeum / opencti | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | 205d ago |
| CVE-2026-26929 | 6.5 | — | — | — | apache / airflow | Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization fi | 205d ago |
| CVE-2025-68971 | 6.5 | — | — | — | — | In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file | 206d ago |
| CVE-2025-69196 | 6.5 | — | — | — | jlowin / fastmcp | FastMCP is the standard framework for building MCP applications. | 206d ago |
| CVE-2026-28490 | 6.5 | — | — | — | authlib / authlib | Authlib is a Python library which builds OAuth and OpenID Connect servers. | 206d ago |
| CVE-2026-3022 | 6.5 | — | — | — | wakyma / wakyma | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 've | 206d ago |
| CVE-2026-3021 | 6.5 | — | — | — | wakyma / wakyma | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 've | 206d ago |
| CVE-2026-32704 | 6.5 | — | — | — | b3log / siyuan | SiYuan is a personal knowledge management system. | 206d ago |
| CVE-2026-28522 | 6.5 | — | — | — | tuya / arduino-tuyaopen | arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulnerability in the WiFiUDP component. | 206d ago |
| CVE-2026-21005 | 6.5 | — | — | — | samsung / smart switch | Path traversal in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to overwrite arbitrary files w | 206d ago |
| CVE-2026-21004 | 6.5 | — | — | — | samsung / smart switch | Improper authentication in Smart Switch prior to version 3.7.69.15 allows adjacent attackers to trigger a denial o | 206d ago |
| CVE-2025-12736 | 6.5 | — | — | — | openatom / openharmony | in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uni | 206d ago |
| CVE-2026-32598 | 6.5 | — | — | — | hackerbay / oneuptime | OneUptime is a solution for monitoring and managing online services. | 209d ago |
| CVE-2026-32460 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ult | 209d ago |
| CVE-2026-32455 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 M | 209d ago |
| CVE-2026-32454 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion | 209d ago |
| CVE-2026-32451 | 6.5 | — | — | — | — | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Con | 209d ago |
| CVE-2026-32450 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 A | 209d ago |
| CVE-2026-32449 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Th | 209d ago |
| CVE-2026-32448 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert | 209d ago |
| CVE-2026-32443 | 6.5 | — | — | — | — | Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed | 209d ago |
| CVE-2026-32431 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm F | 209d ago |
| CVE-2026-32430 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Crea | 209d ago |
| CVE-2026-32429 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Ma | 209d ago |
| CVE-2026-32424 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Spr | 209d ago |
| CVE-2026-32411 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simpma Embed | 209d ago |
| CVE-2026-32403 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toocheke Too | 209d ago |
| CVE-2026-32398 | 6.5 | — | — | — | — | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subra | 209d ago |
| CVE-2026-32361 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marketing Fi | 209d ago |
| CVE-2026-32359 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Ico | 209d ago |
| CVE-2026-32356 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robosoft Rob | 209d ago |
| CVE-2026-32352 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor El | 209d ago |
| CVE-2026-32320 | 6.5 | — | — | — | ellanetworks / ella core | Ella Core is a 5G core designed for private networks. | 209d ago |
| CVE-2026-31949 | 6.5 | — | — | — | librechat / librechat | LibreChat is a ChatGPT clone with additional features. | 209d ago |
| CVE-2026-31918 | 6.5 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in immonex immo | 209d ago |
| CVE-2026-31885 | 6.5 | — | — | — | freerdp / freerdp | FreeRDP is a free implementation of the Remote Desktop Protocol. | 209d ago |
| CVE-2026-31884 | 6.5 | — | — | — | freerdp / freerdp | FreeRDP is a free implementation of the Remote Desktop Protocol. | 209d ago |
