Security Box Score — Wednesday, May 27, 2026

Wednesday, May 27, 2026 · all times UTC← 2026-05-26 · archive · 2026-05-28 →

715 CVEs published May 27, 2026: 49 critical, 296 high, 357 medium, 12 low; 3 in KEV; 30 with a public exploit reference; 1 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 690 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	2349	3479	1021	2563
KEV catalog size	1670

105 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	504	830	72	549	207	1	27	2	0.2	7.8	.0014	+341
microsoft	170	490	43	328	102	0	378	27	5.5	7.8	.0045	-16
apple	20	47	0	12	27	1	93	7	14.9	6.2	.0034	+20
red hat	21	44	7	22	13	2	4	0	0.0	7.5	.0041	+10
google	17	23	1	13	6	0	74	4	17.4	8.6	.0034	+16
freebsd	7	7	0	5	2	0	0	0	0.0	7.8	.0020	+7
suse	2	2	0	2	0	0	0	0	0.0	8.2	.0020	+2
android	0	0	0	0	0	0	15	0	—	—	—	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	5	13	3	1	2	96	8	61.5	8.6	.1247	+2
checkpoint	6	6	0	3	3	3	0	0.0	6.5	.0338	+6
fortinet	1	6	1	3	0	28	3	50.0	7.9	.4330	-2
ivanti	2	5	0	1	0	33	4	80.0	8.8	.8056	+1
f5	2	3	2	0	0	7	1	33.3	9.2	.0996	+2
ubiquiti	2	3	1	2	0	4	0	0.0	8.8	.0068	+2
broadcom	0	2	0	0	0	4	2	100.0	—	.1990	0
palo alto networks	1	1	0	0	0	14	1	100.0	—	.3207	+1

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	19	30	4	14	11	40	1	3.3	7.4	.0065	+16
gitlab	6	8	0	1	5	4	2	25.0	4.8	.0033	+6
mozilla	6	6	3	2	1	13	0	0.0	8.8	.0042	+6
docker	3	3	0	3	0	1	0	0.0	8.8	.0022	+3
drupal	3	3	1	0	2	5	1	33.3	5.1	.0021	+3
github	2	2	1	1	0	0	0	0.0	8.1	.0347	+2
jenkins	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ibm	49	49	10	24	15	7	0	0.0	7.5	.0028	+49
progress	4	4	0	4	0	9	0	0.0	7.5	.0036	+4
adobe	1	4	0	1	0	75	3	75.0	8.6	.2776	-2
solarwinds	0	3	1	0	0	11	3	100.0	9.8	.8362	0
zohocorp	2	2	0	1	1	0	0	0.0	7.1	.0104	+2
oracle	0	2	0	2	0	40	0	0.0	7.5	.0065	0
atlassian	0	0	0	0	0	13	0	—	—	—	0
sap	0	0	0	0	0	12	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
synology	18	18	2	3	10	3	0	0	0.0	5.6	.0025	+18
hitachi energy	2	2	0	0	2	0	0	0	0.0	5.7	.0014	+2
d-link	1	2	0	1	0	0	26	1	50.0	8.7	.4511	0
siemens	1	1	0	1	0	0	1	0	0.0	8.7	.0032	+1
hikvision	0	1	0	0	0	0	2	1	100.0	—	1.0000	0
dahua	0	0	0	0	0	0	2	0	—	—	—	0
qnap	0	0	0	0	0	0	8	0	—	—	—	0
schneider electric	0	0	0	0	0	0	1	0	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
concrete cms	44	44	1	9	13	21	0	5.7	.0015	+44
edimax	44	44	0	27	0	17	1	7.4	.0059	+44
helmholz	42	42	0	39	3	0	0	7.1	.0026	+42
mb connect line	42	42	0	39	3	0	0	7.1	.0026	+42
open ises	37	37	2	14	21	0	0	6.9	.0021	+37
totolink	34	34	0	25	0	9	0	8.9	.0191	+34
netatalk	33	33	1	13	9	10	0	6.4	.0030	+33
nvidia	33	33	8	18	7	0	0	7.8	.0038	+33

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-31431	.9991	100.0	7.8
CVE-2008-4250	.9875	99.9	—
CVE-2026-41940	.9793	99.9	9.3
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2010-0249	.9188	99.8	—
CVE-2026-20182	.9152	99.8	—
CVE-2026-42208	.8942	99.8	—
CVE-2026-9082	.8832	99.8	9.8
CVE-2024-1708	.8756	99.7	8.4

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-8054	10.0	.0158
CVE-2026-45087	10.0	.0147
CVE-2026-43997	10.0	.0098
CVE-2026-42826	10.0	.0084
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083
CVE-2026-44006	10.0	.0081
CVE-2026-46595	10.0	.0050
CVE-2026-42822	10.0	.0049

Most disclosures (vendor)
Vendor	CVEs
linux	506
microsoft	171
ibm	49
concrete cms	44
edimax	44
helmholz	42
mb connect line	42
open ises	37
totolink	34
netatalk	33

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	8
apple	7
google	4
ivanti	4
synacor	4
adobe	3
fortinet	3
smartertools	3
solarwinds	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	10
PyPI	2
crates.io	2
npm	2

Fastest to KEV
CVE	Vendor	Days
CVE-2008-4250	Microsoft	0
CVE-2009-1537	Microsoft	0
CVE-2009-3459	Adobe	0
CVE-2010-0249	Microsoft	0
CVE-2010-0806	Microsoft	0
CVE-2024-1708	ConnectWise	0
CVE-2025-34291	Langflow	0
CVE-2026-0300	Palo Alto Networks	0
CVE-2026-20182	Cisco	0
CVE-2026-31431	Linux	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1652
CVE-2021-27102	Accellion	2021-11-17	1652
CVE-2021-27101	Accellion	2021-11-17	1652
CVE-2021-27103	Accellion	2021-11-17	1652
CVE-2021-21017	Adobe	2021-11-17	1652
CVE-2021-28550	Adobe	2021-11-17	1652
CVE-2021-42013	Apache	2021-11-17	1652
CVE-2021-41773	Apache	2021-11-17	1652
CVE-2021-30858	Apple	2021-11-17	1652
CVE-2021-30860	Apple	2021-11-17	1652

Transactions

EXPLOIT PUBLISHED — CVE-2026-42081 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42082 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42083 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42184 (tauri-apps tauri). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42459 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44315 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44316 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44317 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44318 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44319 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44320 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44321 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44322 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44323 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44324 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44325 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44326 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44327 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44328 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44329 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44330 (free5gc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44345 (BentoML). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44346 (BentoML). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44353 (streamlink). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44660 (ultrajson). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44681 (authlib). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45104 (MapServer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45136 (cnighswonger claude-code-cache-fix). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-48027 (nrwl nx-console). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-9617 (DALIBO PostgreSQL Anonymizer). Public exploit reference added.

Yesterday's Results

715 CVEs published. 25 box scores and 375 table rows below; the remaining 315 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-45321CRITICAL

@tanstack arktype-adapter — Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  H  H    9.6   .0234   82.2   YES

AFFECTED
  Product                 Versions    Fixed
  arktype-adapter         1.166.12 –  —
  eslint-plugin-router    1.161.9 –   —
  eslint-plugin-start     0.0.4 –     —
  history                 1.161.9 –   —
  nitro-v2-vite-plugin    1.154.12 –  —
  react-router            1.169.5 –   —
  react-router-devtools   1.166.16 –  —
  react-router-ssr-query  1.166.15 –  —
  react-start             1.167.68 –  —
  react-start-client      1.166.51 –  —
  + 32 more

TIMELINE
  May 11  Reserved by CNA
  May 27  Added to CISA KEV, due Jun 10
  May 27  Published (CNA: GitHub_M)

CWE-506 · CNA: GitHub_M · 5 references · KEV due June 10, 2026

CVE-2026-48027CRITICAL

nrwl nx-console — Compromised Nx Console version 18.95.0

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0185   77.3   YES

AFFECTED
  Product     Versions     Fixed
  nx-console  = 18.95.0 –  —

TIMELINE
  May 20  Reserved by CNA
  May 27  Public exploit reference published
  May 27  Added to CISA KEV, due Jun 10
  May 27  Published (CNA: GitHub_M)

CWE-506 · CNA: GitHub_M · 5 references · NVD status: Analyzed · KEV due June 10, 2026

CVE-2026-8398AWAITING ENRICHMENT

Daemon Daemon Tools Lite

  CVSS   EPSS    %ile   KEV
  —      .0146   71.3   YES

AFFECTED
  Product            Versions     Fixed
  Daemon Tools Lite  unspecified  —

TIMELINE
  May 27  Added to CISA KEV, due May 30
  May 27  Published

0 references · KEV due May 30, 2026

CVE-2026-9312CRITICAL

GitHub Enterprise Server — Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   H   H    9.2   .0655   93.2     —

AFFECTED
  Product            Versions  Fixed
  Enterprise Server  3.16.0 –  3.16.20

TIMELINE
  May 22  Reserved by CNA
  May 27  Published (CNA: GitHub_P)

CWE-918 · CNA: GitHub_P · 5 references · NVD status: Modified

CVE-2025-12686CRITICAL

Synology BeeStation OS — Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Syno…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0276   85.0     —

AFFECTED
  Product        Versions  Fixed
  BeeStation OS  1.3 –     —

TIMELINE
  Nov 4   Reserved by CNA
  May 27  Published (CNA: synology)

CWE-120 · CNA: synology · 1 reference · NVD status: Analyzed

CVE-2026-5509HIGH

TP-Link Systems Inc. Archer BE7200 V1 — Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   H   N   H   H   H    8.5   .0246   83.1     —

AFFECTED
  Product           Versions     Fixed
  Archer BE7200 V1  unspecified  —
  Archer BE450 v1   unspecified  —

TIMELINE
  Apr 3   Reserved by CNA
  May 27  Published (CNA: TPLink)

CWE-77, CWE-20 · CNA: TPLink · 5 references · NVD status: Modified

CVE-2026-8832HIGH

smub WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager — WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0186   77.5     —

AFFECTED
  Product                                                                              Versions     Fixed
  WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager  unspecified  —

TIMELINE
  May 18  Reserved by CNA
  May 27  Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-45322HIGH

microsoft UFO — OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0172   75.6     —

AFFECTED
  Product  Versions    Fixed
  UFO      <= 3.0.0 –  —

TIMELINE
  May 11  Reserved by CNA
  May 27  Published (CNA: GitHub_M)

CWE-78 · CNA: GitHub_M · 1 reference · NVD status: Deferred

CVE-2026-8054CRITICAL

dotCMS dotCMS Core — Unauthenticated SQL Injection in dotCMS Publish Audit API

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0   .0158   73.5     —

AFFECTED
  Product      Versions      Fixed
  dotCMS Core  25.11.04-1 –  26.04.28-03

TIMELINE
  May 6   Reserved by CNA
  May 27  Published (CNA: dotCMS)

CWE-89 · CNA: dotCMS · 2 references · NVD status: Deferred

CVE-2026-45087CRITICAL

hahwul dalfox — Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0147   71.6     —

AFFECTED
  Product  Versions    Fixed
  dalfox   < 2.13.0 –  —

TIMELINE
  May 8   Reserved by CNA
  May 27  Published (CNA: GitHub_M)

CWE-15, CWE-78, CWE-306 · CNA: GitHub_M · 2 references · NVD status: Deferred

CVE-2026-8450CRITICAL

OALDERS HTTP::Daemon — HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0140   70.2     —

AFFECTED
  Product       Versions     Fixed
  HTTP::Daemon  unspecified  —

TIMELINE
  May 12  Reserved by CNA
  May 27  Published (CNA: CPANSec)

CWE-73, CWE-78 · CNA: CPANSec · 11 references · NVD status: Deferred

CVE-2026-36540HIGH

n/a n/a — Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/sk…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  L    7.3   .0132   68.4     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  May 27  Published (CNA: mitre)

CWE-77 · CNA: mitre · 1 reference · NVD status: Deferred

CVE-2026-36045HIGH

n/a n/a — picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/s…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  L    7.3   .0131   68.3     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  May 27  Published (CNA: mitre)

CWE-78 · CNA: mitre · 2 references · NVD status: Deferred

CVE-2026-44590CRITICAL

sherlock-project sherlock — Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  H  N    9.3   .0114   64.0     —

AFFECTED
  Product   Versions    Fixed
  sherlock  < 0.16.1 –  —

TIMELINE
  May 6   Reserved by CNA
  May 27  Published (CNA: GitHub_M)

CWE-78 · CNA: GitHub_M · 1 reference · NVD status: Deferred

CVE-2026-2340MEDIUM

Red Hat Red Hat Enterprise Linux 10 — Samba: vfs_worm does not block directory modification

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0094   58.0     —

AFFECTED
  Product                                                                Versions     Fixed
  Red Hat Enterprise Linux 10                                            unspecified  0:4.23.5-109.el10_2
  Red Hat Enterprise Linux 10.0 Extended Update Support                  unspecified  0:4.21.3-114.el10_0.1
  Red Hat Enterprise Linux 8                                             unspecified  0:4.19.4-16.el8_10
  Red Hat Enterprise Linux 8                                             unspecified  0:4.19.4-16.el8_10
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support  unspecified  0:4.15.5-16.el8_6.1
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On  unspecified  0:4.15.5-16.el8_6.1
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service         unspecified  0:4.17.5-7.el8_8.1
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions         unspecified  0:4.17.5-7.el8_8.1
  Red Hat Enterprise Linux 9                                             unspecified  0:4.23.5-10.el9_8
  Red Hat Enterprise Linux 9                                             unspecified  0:4.23.5-10.el9_8
  + 7 more

TIMELINE
  Feb 11  Reserved by CNA
  May 27  Published (CNA: redhat)

CWE-280 · CNA: redhat · 13 references · NVD status: Modified

CVE-2026-1933MEDIUM

Red Hat Red Hat Enterprise Linux 10 — Samba: missing access check on reparse point operations

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0086   55.6     —

AFFECTED
  Product                                                                Versions     Fixed
  Red Hat Enterprise Linux 10                                            unspecified  0:4.23.5-109.el10_2
  Red Hat Enterprise Linux 10.0 Extended Update Support                  unspecified  0:4.21.3-114.el10_0.1
  Red Hat Enterprise Linux 8                                             unspecified  0:4.19.4-16.el8_10
  Red Hat Enterprise Linux 8                                             unspecified  0:4.19.4-16.el8_10
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support  unspecified  0:4.15.5-16.el8_6.1
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On  unspecified  0:4.15.5-16.el8_6.1
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service         unspecified  0:4.17.5-7.el8_8.1
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions         unspecified  0:4.17.5-7.el8_8.1
  Red Hat Enterprise Linux 9                                             unspecified  0:4.23.5-10.el9_8
  Red Hat Enterprise Linux 9                                             unspecified  0:4.23.5-10.el9_8
  + 10 more

TIMELINE
  Feb 4   Reserved by CNA
  May 27  Published (CNA: redhat)

CWE-284 · CNA: redhat · 17 references · NVD status: Modified

CVE-2025-69600HIGH

n/a n/a — Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversar…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0083   54.4     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jan 9   Reserved by CNA
  May 27  Published (CNA: mitre)

CWE-77 · CNA: mitre · 3 references · NVD status: Awaiting Analysis

CVE-2026-38422HIGH

n/a n/a — Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  L    7.3   .0081   54.0     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  May 27  Published (CNA: mitre)

CWE-121 · CNA: mitre · 3 references · NVD status: Deferred

CVE-2026-38945HIGH

n/a n/a — Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0080   53.5     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  May 27  Published (CNA: mitre)

CWE-77 · CNA: mitre · 4 references · NVD status: Awaiting Analysis

CVE-2026-7524CRITICAL

IBM Langflow OSS — Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0079   53.1     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  Apr 30  Reserved by CNA
  May 27  Published (CNA: ibm)

CWE-22 · CNA: ibm · 1 reference · NVD status: Analyzed

CVE-2026-45152HIGH

uniget-org cli — uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0072   50.7     —

AFFECTED
  Product  Versions    Fixed
  cli      < 0.27.1 –  —

TIMELINE
  May 8   Reserved by CNA
  May 27  Published (CNA: GitHub_M)

CWE-78 · CNA: GitHub_M · 1 reference · NVD status: Deferred

CVE-2026-45860HIGH

Linux Linux — netfilter: nf_conncount: increase the connection clean up limit to 64

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0069   49.7     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    f106694733c66a48740c25bc4e212e9b2ea364ce –  —
  Linux    5.19 –                                      5.10.252

TIMELINE
  May 13  Reserved by CNA
  May 27  Published (CNA: Linux)

CNA: Linux · 8 references · NVD status: Analyzed

CVE-2026-46402HIGH

Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside the logs directory

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  H    8.1   .0067   49.2     —

AFFECTED
  Product  Versions             Fixed
  UFO      3.0.1-4-ge2626659 –  —

TIMELINE
  May 13  Reserved by CNA
  May 27  Published (CNA: GitHub_M)

CWE-22, CWE-73 · CNA: GitHub_M · 1 reference · NVD status: Deferred

CVE-2026-35087CRITICAL

Slican IPx — Authentication Bypass in Slican telephone exchanges

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0066   48.7     —

AFFECTED
  Product   Versions     Fixed
  IPx       unspecified  —
  CCT-1668  unspecified  —
  MAC-6400  unspecified  —
  CXS-0424  unspecified  —
  NCP       unspecified  —

TIMELINE
  Apr 1   Reserved by CNA
  May 27  Published (CNA: CERT-PL)

CWE-288 · CNA: CERT-PL · 1 reference · NVD status: Deferred

CVE-2026-35090CRITICAL

Slican CCT-1668 — Authentication Bypass in Slican telephone exchanges

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0063   47.1     —

AFFECTED
  Product   Versions     Fixed
  CCT-1668  unspecified  —
  MAC-6400  unspecified  —
  CXS-0424  unspecified  —
  IPL-256   unspecified  —
  IPM-032   unspecified  —

TIMELINE
  Apr 1   Reserved by CNA
  May 27  Published (CNA: CERT-PL)

CWE-288 · CNA: CERT-PL · 1 reference · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-44724	7.8	46.8	sebhildebrandt	systeminformation	CWE-78	systeminformation: Linux command injection in networkInterfaces() via unsanit…
CVE-2026-8760	9.8	46.7	india-web-developer	Login with OTP	CWE-307	Login with OTP <= 1.6 - Unauthenticated Authentication Bypass via OTP Brute F…
CVE-2026-38426	7.3	46.6	n/a	n/a	CWE-120	Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows…
CVE-2026-45859	7.5	46.4	Linux	Linux	—	netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
CVE-2026-6169	7.2	46.0	cservit	affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display	CWE-94	affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution
CVE-2026-3366	7.5	45.7	IBM	InfoSphere Optim Test Data Fabrication	CWE-22	InfoSphere Optim Test Data Fabrication is affected by Arbitrary File Read
CVE-2026-35089	8.7	45.4	Slican	IPx	CWE-1391	Use of Weak Credentials in Slican telephone exchanges
CVE-2026-8175	9.8	45.0	IBM	Aspera High-Speed Transfer Endpoint	CWE-122	Multiple vulnerabilities in Aspera applications.
CVE-2026-44887	9.8	43.2	leiweibau	Pi.Alert	CWE-94	Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)
CVE-2025-13392	9.8	42.5	Synology	DiskStation Manager (DSM)	CWE-754	Improper check for unusual or exceptional conditions vulnerability in SSO in …
CVE-2026-46414	8.8	42.4	microsoft	UFO	CWE-290	Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking
CVE-2026-49009	3.1	41.8	n/a	n/a	CWE-22	Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and…
CVE-2026-46043	9.1	41.4	Linux	Linux	—	RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
CVE-2026-46027	7.5	40.6	Linux	Linux	—	net/smc: avoid early lgr access in smc_clc_wait_msg
CVE-2026-46052	7.5	40.6	Linux	Linux	—	ceph: only d_add() negative dentries when they are unhashed
CVE-2026-46102	7.5	40.6	Linux	Linux	CWE-401	net: strparser: fix skb_head leak in strp_abort_strp()
CVE-2026-4410	7.5	40.6	IBM	WebSphere Application Server - Liberty	CWE-400	IBM WebSphere Application Server and WebSphere Application Server Liberty are…
CVE-2026-9627	7.4	40.4	UTT	HiPER 1200GW	CWE-119	UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow
CVE-2026-9200	7.5	40.3	shazdeh	Query Shortcode	CWE-98	Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion …
CVE-2026-46024	7.5	40.0	Linux	Linux	CWE-476	libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
CVE-2026-47161	8.7	39.9	inducer	relate	CWE-502	RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle D…
CVE-2025-14713	7.5	39.0	Synology	C2 Identity Edge Server	CWE-749	An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity…
CVE-2026-9628	7.4	38.8	UTT	HiPER 1200GW	CWE-119	UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow
CVE-2026-1402	6.5	38.7	GitLab	GitLab	CWE-770	Allocation of Resources Without Limits or Throttling in GitLab
CVE-2026-45898	9.8	38.4	Linux	Linux	CWE-1341	RDMA/iwcm: Fix workqueue list corruption by removing work_list
CVE-2024-56462	8.8	38.3	IBM	QRadar	CWE-552	IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
CVE-2026-9632	7.4	38.2	UTT	HiPER 1250GW	CWE-119	UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow
CVE-2026-38427	7.3	37.9	n/a	n/a	CWE-122	An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 a…
CVE-2026-45988	9.8	37.9	Linux	Linux	—	rxrpc: Fix re-decryption of RESPONSE packets
CVE-2026-44902	7.5	37.7	open-telemetry	opentelemetry-js	CWE-755	opentelemetry-js: Prometheus exporter process crash via malformed HTTP request
CVE-2026-46039	9.8	36.8	Linux	Linux	CWE-190	rxgk: Fix potential integer overflow in length check
CVE-2026-45047	7.5	36.7	xddxdd	bird-lg-go	CWE-400	bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON De…
CVE-2026-46085	7.5	36.7	Linux	Linux	—	rxrpc: Fix rxkad crypto unalignment handling
CVE-2026-9631	7.4	36.5	UTT	HiPER 1250GW	CWE-119	UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based o…
CVE-2026-46037	8.2	36.1	Linux	Linux	—	ipv4: icmp: validate reply type before using icmp_pointers
CVE-2026-46544	5.3	35.3	microsoft	UFO	CWE-639	Microsoft UFO reuses client-supplied WebSocket session IDs and replays stale …
CVE-2026-9208	8.8	35.1	Tanium	Connect	CWE-78	Tanium addressed an unauthorized code execution vulnerability in Connect.
CVE-2026-44660	8.7	35.1	ultrajson	ultrajson	CWE-401	UltraJSON: Memory Leak in ujson.dump() on Write Failure
CVE-2026-4391	6.9	35.0	n/a	TeamSpeak 3 Server	CWE-119	TeamSpeak 3 Server ECC Key heap-based overflow
CVE-2026-44324	6.5	35.0	free5gc	free5gc	CWE-704	free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via …
CVE-2026-45083	9.8	34.1	intranda	goobi-viewer-core	CWE-306	Goobi viewer: Unauthenticated Solr Streaming Expression Proxy
CVE-2026-48544	8.7	34.0	Avaiga	taipy	CWE-22	Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource()
CVE-2025-70116	4.3	33.9	n/a	n/a	CWE-476	A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4…
CVE-2026-44316	7.5	33.6	free5gc	free5gc	CWE-476	free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/…
CVE-2026-44319	7.5	33.6	free5gc	free5gc	CWE-20	free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (a…
CVE-2026-46010	8.1	33.6	Linux	Linux	—	rxrpc: Fix error handling in rxgk_extract_token()
CVE-2026-4392	6.9	33.4	n/a	TeamSpeak 3 Server	CWE-617	TeamSpeak 3 Server clientek Handshake assertion
CVE-2026-3676	6.5	33.4	IBM	Cloud APM, Base Private	CWE-1284	There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Pe…
CVE-2026-8179	8.8	33.3	IBM	Aspera High-Speed Transfer Endpoint	CWE-121	Multiple vulnerabilities in Aspera applications.
CVE-2026-49103	9.4	32.8	Webmin	Webmin	CWE-24	Webmin before 2.640 does not safely construct a filename for saving of an att…
CVE-2026-40850	8.7	32.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in getAccountData function
CVE-2026-44325	7.5	32.5	free5gc	free5gc	CWE-20	free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic f…
CVE-2026-9207	8.8	32.3	Tanium	Connect	CWE-78	Tanium addressed an unauthorized code execution vulnerability in Connect.
CVE-2026-8994	8.1	32.2	learnnearclub	Login with NEAR	CWE-287	Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter
CVE-2026-44322	7.5	32.2	free5gc	free5gc	CWE-476	free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR acc…
CVE-2024-28765	5.3	31.6	IBM	SDI	CWE-209	Security vulnerability was found in IBM Security Directory Integrator
CVE-2026-37711	7.3	31.6	n/a	n/a	CWE-94	An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha all…
CVE-2026-37712	7.3	31.6	n/a	n/a	CWE-94	An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha all…
CVE-2026-37713	7.3	31.6	n/a	n/a	CWE-94	An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha all…
CVE-2026-3001	6.1	30.9	jegstudio	Gutenverse – WordPress Blocks, Page Builder & Site Editor	CWE-79	Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter
CVE-2026-47118	7.1	30.6	3clyp50	agent-zero	CWE-22	Agent Zero < 1.15 Path Traversal File Read via image_get API
CVE-2026-48959	7.5	30.5	PMQS	IO::Uncompress::Unzip	CWE-407	IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via…
CVE-2026-46031	7.5	30.1	Linux	Linux	CWE-667	net: ks8851: Reinstate disabling of BHs around IRQ handler
CVE-2026-40852	7.2	30.1	MB connect line	mbNET/mbNET.rokey	CWE-78	Command injection via malicious configuration
CVE-2025-30028	8.6	29.9	Synology	Active Backup for Business	CWE-89	A vulnerability in Active Backup for Business allows unauthorized remote atta…
CVE-2025-70103	7.3	29.8	n/a	n/a	CWE-122	Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to…
CVE-2026-45570	2.3	29.6	go-git	go-git	CWE-116	go-git: Improper single-quote escaping in go-git SSH transport
CVE-2026-44321	7.5	29.5	free5gc	free5gc	CWE-306	free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlappi…
CVE-2026-1718	7.5	29.3	IBM	Db2	CWE-770	IBM® Db2® is vulnerable to a denial of service with a specially crafted query…
CVE-2026-44635	7.5	29.3	kysely-org	kysely	CWE-22	Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters…
CVE-2024-40684	9.8	29.0	IBM	Operations Analytics - Log Analysis	CWE-521	IBM Operations Analytics - Log Analysis is affected by Weak Password Policy a…
CVE-2026-42757	9.9	29.0	Saleswonder Team: Tobias	WebinarIgnition	CWE-22	WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnera…
CVE-2026-3375	7.2	28.9	litespeedtech	LiteSpeed Cache	CWE-79	LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC…
CVE-2026-42737	8.6	28.9	e4jvikwp	VikBooking Hotel Booking Engine & PMS	CWE-22	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary F…
CVE-2026-36539	7.3	28.9	n/a	n/a	CWE-200	Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.…
CVE-2026-45843	8.2	28.6	Linux	Linux	—	slip: bound decode() reads against the compressed packet length
CVE-2026-8361	7.5	28.1	Gladinet	Triofox	CWE-23	Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll
CVE-2026-48545	7.6	28.1	gradio-app	gradio	CWE-384	Gradio < 6.15.0 Cookie Injection via Shared Proxy Client
CVE-2026-48922	7.5	28.1	Jenkins Project	Jenkins Credentials Binding Plugin	CWE-20	Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not pr…
CVE-2026-44317	6.5	28.1	free5gc	free5gc	CWE-476	free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1…
CVE-2026-44323	6.5	28.1	free5gc	free5gc	CWE-476	free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when U…
CVE-2026-7493	5.3	28.1	croixhaug	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	CWE-400	Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <=…
CVE-2026-44353	6.5	27.5	streamlink	streamlink	CWE-22	Streamlink: Arbitrary local file read via file:// URI in HLS and DASH
CVE-2026-48064	8.1	27.3	mcdope	pam_usb	CWE-863	pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authenti…
CVE-2026-38807	8.8	27.1	n/a	n/a	CWE-639	Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attack…
CVE-2026-4868	8.2	27.1	GitLab	GitLab	CWE-639	Authorization Bypass Through User-Controlled Key in GitLab
CVE-2024-47268	4.9	27.0	Synology	Surveillance Station	CWE-862	Missing authorization vulnerability in AddOns functionality in Synology Surve…
CVE-2024-47271	4.9	27.0	Synology	Surveillance Station	CWE-522	Insufficiently protected credentials vulnerability in IPSpeaker component in …
CVE-2026-42790	7.6	26.8	Erlang	OTP	CWE-295	nameConstraints DNS bypass via subject CommonName fallback in public_key host…
CVE-2026-42756	9.9	26.5	Ludwig You	QuickWebP – Compress / Optimize Images & Convert WebP \| SEO Friendly	CWE-22	WordPress QuickWebP – Compress / Optimize Images & Convert WebP \| SEO Friendl…
CVE-2026-8363	9.8	26.4	Gladinet	Triofox	CWE-121	Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll
CVE-2026-42731	9.8	26.2	miniOrange	miniorange otp verification	CWE-266	WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation …
CVE-2026-45972	9.8	26.2	Linux	Linux	CWE-416	smb: client: fix potential UAF and double free in smb2_open_file()
CVE-2026-44329	10.0	25.9	free5gc	free5gc	CWE-306	free5GC: SMF UPI management interface lacks auth middleware; unauthenticated …
CVE-2026-42789	7.0	25.9	Erlang	OTP	CWE-295	Non-CA certificate accepted as intermediate issuer in public_key path validation
CVE-2026-48128	5.1	25.8	Budibase	budibase	CWE-918	Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
CVE-2026-9035	6.5	25.3	IBM	Aspera High-Speed Transfer Endpoint	CWE-22	Multiple vulnerabilities in Aspera applications.
CVE-2024-47267	2.7	25.4	Synology	Surveillance Station	CWE-22	Improper limitation of a pathname to a restricted directory ('Path Traversal'…
CVE-2026-44328	8.2	25.2	free5gc	free5gc	CWE-306	free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion…
CVE-2026-42459	7.7	25.2	free5gc	free5gc	CWE-20	free5GC: Improper Input Validation and Generation of Error Message Containing…
CVE-2026-40831	7.1	25.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in Easy View
CVE-2026-44378	6.9	25.3	randombit	botan	CWE-407	Botan: Quadratic complexity decoding BER indefinite length encodings
CVE-2026-42083	8.2	25.1	free5gc	free5gc	CWE-862	free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows un…
CVE-2025-71311	5.5	25.2	Linux	Linux	CWE-908	fs/ntfs3: Initialize new folios before use
CVE-2026-49017	7.1	25.0	OpenStack	Swift	CWE-835	In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infin…
CVE-2026-6713	5.3	25.0	GitLab	GitLab	CWE-863	Incorrect Authorization in GitLab
CVE-2026-9689	4.2	25.0	Red Hat	Red Hat build of Keycloak 26.4	CWE-1288	Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redire…
CVE-2026-44346	8.8	24.9	bentoml	BentoML	CWE-78	BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml
CVE-2026-46099	8.1	24.9	Linux	Linux	CWE-911	net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
CVE-2026-42758	9.8	24.8	Saleswonder Team: Tobias	WebinarIgnition	CWE-266	WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability
CVE-2026-9704	8.8	24.8	Red Hat	Red Hat build of Keycloak 26.4	CWE-1284	Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
CVE-2026-40810	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in userinfo Endpoint
CVE-2026-40811	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in ssoabstractservice
CVE-2026-40812	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in getLiveValues function
CVE-2026-40813	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in getLiveValues
CVE-2026-40814	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in _mb24confi_getTagAlarm function
CVE-2026-40815	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in _mb24api_getUserAccount function
CVE-2026-40816	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in _mb24confi_getTagAlarm function
CVE-2026-40817	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in getAlarmProfiles function
CVE-2026-40818	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in _mb24confi_getDevice function function
CVE-2026-40819	8.7	24.7	MB connect line	mbCONNECT24	CWE-89	Unauthenticated SQLi in sync_data24 task
CVE-2026-45104	7.5	24.8	MapServer	MapServer	CWE-476	MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reacha…
CVE-2026-8180	7.5	24.6	IBM	Aspera High-Speed Transfer Endpoint	CWE-476	Multiple vulnerabilities in Aspera applications.
CVE-2026-44345	8.8	24.4	bentoml	BentoML	CWE-78	BentoML: Dockerfile command injection via docker.base_image
CVE-2026-8362	9.8	24.4	Gladinet	Triofox	CWE-121	Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll
CVE-2026-42791	6.3	24.3	Erlang	OTP	CWE-295	OCSP responder certificate validity period not checked in public_key
CVE-2026-44888	9.8	24.1	leiweibau	Pi.Alert	CWE-94	Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Int…
CVE-2026-44315	9.4	24.1	free5gc	free5gc	CWE-862	free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens…
CVE-2026-7876	9.1	23.9	IBM	Aspera HSTS for CP4I	CWE-287	Authentication bypass vulnerability found in Aspera High-Speed Transfer Serve…
CVE-2026-42184	6.1	23.9	tauri-apps	tauri	CWE-918	Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
CVE-2026-44327	10.0	23.8	free5gc	free5gc	CWE-306	free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach…
CVE-2026-44326	9.4	23.8	free5gc	free5gc	CWE-862	free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged…
CVE-2026-42197	8.7	23.6	inducer	relate	CWE-79	RELATE Vulnerable to Stored XSS via Unprivileged User Profile
CVE-2025-3633	8.2	23.7	IBM	Cognos Analytics	CWE-79	IBM Cognos Analytics is affected by multiple security vulnerabilities
CVE-2026-48972	7.5	23.5	SeedProd LLC	SeedProd Pro	CWE-98	WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability
CVE-2026-47269	7.4	23.3	mcdope	pam_usb	CWE-284	pam_usb: deny_remote feature incorrectly classifies IPv4-mapped IPv6 remote c…
CVE-2026-8364	9.8	23.1	Gladinet	Triofox	CWE-306	Gladinet Triofox Missing Authentication for Critical Functions
CVE-2026-49046	8.5	22.9	Arjun Thakur	Duplicate Page and Post	CWE-89	WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability
CVE-2026-42553	7.1	22.8	cinnyapp	cinny	CWE-20	Cinny: Access token disclosure via invalidated emoji pack avatar URL in servi…
CVE-2026-36538	7.3	22.6	n/a	n/a	CWE-798	Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential st…
CVE-2026-48877	6.5	22.4	Tom	GenerateBlocks	CWE-201	WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability
CVE-2026-45571	5.4	22.3	go-git	go-git	CWE-22	go-git: Crafted repositories may modify main and submodule .git directories
CVE-2026-6957	4.9	22.1	Mattermost	Mattermost	CWE-22	Path traversal in Mattermost Legal Hold plugin via unsanitized file name from…
CVE-2026-40827	7.0	22.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in _RemoveRequest function
CVE-2026-40828	7.0	22.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in DeleteSysLogEntry function
CVE-2026-40829	7.0	22.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in UpdateParam function
CVE-2026-40830	7.0	22.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in UpdateParam function
CVE-2026-42727	9.3	21.9	RealMag777	Active Products Tables for WooCommerce	CWE-89	WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Inject…
CVE-2026-7618	4.9	22.0	dattateccom	EnvíaloSimple: Email Marketing y Newsletters	CWE-89	EnvíaloSimple: Email Marketing y Newsletters <= 2.4.5 - Authenticated (Admini…
CVE-2026-49002	9.1	21.8	ZTE	ZXUniPOS NDS-LTE	CWE-284	Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product
CVE-2026-48150	9.0	21.8	Budibase	budibase	CWE-915	Budibase: Workspace-scoped builder escalates to global admin via /api/public/…
CVE-2026-48962	7.3	21.7	PMQS	IO::Compress	CWE-95	IO::Compress versions before 2.220 for Perl can execute arbitrary code in Fil…
CVE-2026-42760	7.5	21.6	revmakx	Backup and Staging by WP Time Capsule	CWE-288	WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Au…
CVE-2026-48921	7.5	21.4	Jenkins Project	Jenkins Pipeline: Groovy Libraries Plugin	CWE-59	Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier d…
CVE-2026-48920	8.8	21.3	Jenkins Project	Jenkins Email Extension Plugin	CWE-73	Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining…
CVE-2026-38808	5.3	21.3	n/a	n/a	CWE-89	SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker t…
CVE-2025-14481	4.3	21.3	yoast	Yoast SEO – Advanced SEO with real-time guidance and built-in AI	CWE-862	Yoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contri…
CVE-2026-44330	10.0	21.2	free5gc	free5gc	CWE-863	free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens …
CVE-2026-46425	9.9	21.1	Budibase	budibase	CWE-862	Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tena…
CVE-2026-8787	8.8	20.8	devsabbirahmed	Firebase Support & Chat Management	CWE-269	Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authen…
CVE-2026-7528	7.5	20.8	IBM	Langflow OSS	CWE-400	Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Pa…
CVE-2026-31266	7.3	20.8	n/a	n/a	CWE-862	Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in…
CVE-2026-40821	6.9	20.6	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getAccountByID function
CVE-2026-40822	6.9	20.6	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in DevSerialReset function
CVE-2026-40826	6.9	20.6	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in dsgvo_contracts view
CVE-2025-0898	6.5	20.6	WPXpro	Xpro Elementor Addons - Pro	CWE-73	Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary…
CVE-2026-9739	9.4	20.4	Google	MCP Toolbox for Databases	CWE-942	Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). Duri…
CVE-2026-3279	6.5	20.2	clorith	Enable jQuery Migrate Helper	CWE-862	Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticate…
CVE-2026-42748	9.9	20.1	WPify	WPify Woo Czech	CWE-434	WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability
CVE-2026-46416	6.3	20.1	microsoft	UFO	CWE-284	Microsoft UFO shared WebSocket handler state causes cross-client response hij…
CVE-2026-8359	7.5	19.9	Gladinet	Triofox	CWE-476	Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS
CVE-2026-8360	7.5	19.9	Gladinet	Triofox	CWE-476	Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS
CVE-2026-48916	6.6	19.9	Jenkins Project	Jenkins LDAP Plugin	CWE-918	Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.
CVE-2026-4888	4.3	19.9	wpeverest	Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder	CWE-862	Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builde…
CVE-2026-42725	6.5	19.7	WP Wham	Checkout Files Upload for WooCommerce	CWE-639	WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.5 - Insecure Di…
CVE-2026-47273	6.5	19.6	mcdope	pam_usb	CWE-91	pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuratio…
CVE-2026-44483	8.2	19.4	airjp73	rvf	CWE-1321	RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFo…
CVE-2026-9014	5.3	19.0	rahulbhangale	WP Promoter	CWE-862	WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Rese…
CVE-2026-44318	5.3	19.0	free5gc	free5gc	CWE-362	free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes…
CVE-2026-48906	9.3	18.9	tassos.gr	Novarain/Tassos Framework (plg_system_nrframework)	CWE-284	Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework …
CVE-2026-45102	9.9	18.8	OneUptime	oneuptime	CWE-693	OneUptime: RCE due to Node.js' vm module escape via error objects and infinit…
CVE-2026-42081	7.1	18.8	free5gc	free5gc	CWE-358	free5GC: UE Security Capability bypass on NGAP PathSwitchRequest
CVE-2026-44460	7.4	18.4	error311	FileRise	CWE-200	FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
CVE-2025-10466	5.9	18.4	Synology	Safe Access	CWE-79	Improper neutralization of input during web page generation ('Cross-site Scri…
CVE-2026-45061	7.7	18.2	Budibase	budibase	CWE-918	Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`…
CVE-2026-45719	6.5	18.2	Budibase	budibase	CWE-94	Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V…
CVE-2026-46056	8.8	18.1	Linux	Linux	CWE-416	Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
CVE-2026-42730	8.5	18.1	Stylemix	MasterStudy LMS	CWE-89	WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability
CVE-2026-48961	7.3	18.1	PMQS	IO::Compress	CWE-755	IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI …
CVE-2026-40832	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getDevicegroups function
CVE-2026-40835	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in saveObjectFromData function
CVE-2026-40837	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getProjectScalings function
CVE-2026-40838	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getDeviceScalings function
CVE-2026-40839	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getComponentScalings function
CVE-2026-40840	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in VerifyCreateLicences function
CVE-2026-40841	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getProjectTags function
CVE-2026-40842	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in getWidgetTags function
CVE-2026-40843	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in alarming view
CVE-2026-40844	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in dashboard view
CVE-2026-40845	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in devices_configuration view
CVE-2026-40846	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in system view
CVE-2026-40847	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in system_tag view
CVE-2026-40848	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in tag view
CVE-2026-40849	7.1	18.1	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in user_alarmprofile view
CVE-2026-45716	8.8	18.0	Budibase	budibase	CWE-269	Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Wit…
CVE-2026-3012	6.8	18.0	Red Hat	Red Hat Enterprise Linux 10	CWE-345	Samba: group policy certificate enrollment uses http:// without validation
CVE-2026-48917	6.6	17.9	Jenkins Project	Jenkins LDAP Plugin	CWE-502	Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP…
CVE-2026-48919	6.6	17.9	Jenkins Project	Jenkins Active Directory Plugin	CWE-502	Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP …
CVE-2026-4390	5.3	17.8	n/a	TeamSpeak 3 Server	CWE-119	TeamSpeak 3 Server Connection State Management process_resend_queue use after…
CVE-2026-44886	8.7	17.6	leiweibau	Pi.Alert	CWE-89	Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
CVE-2026-45548	7.7	17.6	Budibase	budibase	CWE-918	Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Va…
CVE-2026-45715	7.7	17.6	Budibase	budibase	CWE-918	Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
CVE-2026-48152	8.1	17.5	Budibase	budibase	CWE-863	Budibase: Basic app users can exfiltrate stored REST datasource auth by rewri…
CVE-2026-42736	7.5	17.3	wordplus	BP Better Messages	CWE-639	WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object Refer…
CVE-2026-3349	6.1	17.4	minhnhut	MinhNhut Link Gateway	CWE-79	MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Par…
CVE-2026-42735	8.2	17.2	Iqonic Design	KiviCare	CWE-288	WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability
CVE-2025-13167	5.4	17.1	Synology	Synology Contacts	CWE-79	Improper neutralization of input during web page generation ('Cross-site Scri…
CVE-2026-42749	7.1	16.9	Themeisle	Disable Comments for Any Post Types (Remove comments)	CWE-288	WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3…
CVE-2026-45717	8.8	16.7	Budibase	budibase	CWE-862	Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/RE…
CVE-2026-45088	7.5	16.7	hahwul	dalfox	CWE-73	Dalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via…
CVE-2026-42082	5.4	16.7	free5gc	free5gc	CWE-358	free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover
CVE-2026-33552	3.7	16.8	n/a	n/a	CWE-269	Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Cont…
CVE-2026-9617	8.8	16.6	DALIBO	PostgreSQL Anonymizer	CWE-89	PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_…
CVE-2026-38930	6.5	16.6	n/a	n/a	CWE-89	OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass …
CVE-2026-44838	5.3	16.6	rabbitmq	rabbitmq-server	CWE-863	RabbitMQ MQTT Topic Permission Authorization Bypass
CVE-2026-44681	6.1	16.5	authlib	authlib	CWE-601	Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
CVE-2024-47270	2.7	16.5	Synology	Surveillance Station	CWE-281	Improper preservation of permissions vulnerability in Archiving Push function…
CVE-2024-47272	2.7	16.5	Synology	Surveillance Station	CWE-863	Incorrect authorization vulnerability in IO Module functionality in Synology …
CVE-2026-42732	6.5	16.3	Ads by WPQuads	Ads by WPQuads	CWE-1284	WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability
CVE-2026-45108	8.4	16.1	himmelblau-idm	himmelblau	CWE-863	Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation …
CVE-2026-45137	8.2	16.1	solana-foundation	anchor	CWE-20	Anchor: Program<'info, System> is not properly validated
CVE-2026-42740	9.3	16.0	tainacan	Tainacan	CWE-89	WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability
CVE-2026-42747	9.3	16.0	hassantafreshi	Easy Form Builder	CWE-89	WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability
CVE-2026-44521	8.8	15.7	Studio-42	elFinder	CWE-89	elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)
CVE-2026-45089	8.2	15.7	hahwul	dalfox	CWE-73	Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in D…
CVE-2026-6052	7.5	15.7	IBM	Db2	CWE-400	IBM® Db2® is vulnerable to running out of memory when executing certain queri…
CVE-2026-2601	4.3	15.7	GitLab	GitLab	CWE-862	Missing Authorization in GitLab
CVE-2026-44988	8.8	15.6	LibVNC	libvncserver	CWE-787	LibVNCClient Tight Gradient decoding allows malicious server-triggered heap/s…
CVE-2026-42726	6.5	15.6	Strategy11 Team	AWP Classifieds	CWE-862	WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability
CVE-2026-44320	7.3	15.4	free5gc	free5gc	CWE-306	free5GC: NEF nnef-callback route group is unauthenticated; forged callback re…
CVE-2026-6936	6.5	15.3	IBM	i	CWE-674	IBM i is Affected by a Denial of Service Vulnerability []
CVE-2026-42878	5.3	15.4	NeoRazorX	facturascripts	CWE-200	FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint i…
CVE-2026-40823	7.0	15.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in DevSerialReset function
CVE-2026-40824	7.0	15.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in accountstatus view
CVE-2026-40825	7.0	15.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in accountstatus view
CVE-2026-42745	7.3	15.0	ZAYTECH	Smart Online Order for Clover	CWE-288	WordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authenticati…
CVE-2026-7254	5.3	15.0	IBM	OPENBMC	CWE-1284	Open BMC Denial of Service
CVE-2026-3348	4.4	15.0	minhnhut	MinhNhut Link Gateway	CWE-79	MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scr…
CVE-2026-42755	9.3	14.9	RealMag777	TableOn	CWE-89	WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability
CVE-2026-47119	5.3	14.8	3clyp50	agent-zero	CWE-79	Agent Zero < 1.15 Stored XSS via image_get API Endpoint
CVE-2026-9156	7.5	14.6	Tanium	Tanium Server	CWE-772	Tanium addressed a denial of service vulnerability in Tanium Server.
CVE-2026-2030	6.4	14.7	livemesh	WPBakery Page Builder Addons by Livemesh	CWE-79	WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Authenticated (Contributo…
CVE-2026-8866	6.4	14.7	bradyholt	jQuery googleslides	CWE-79	jQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site S…
CVE-2026-8868	6.4	14.7	jonathan-robrecht	Single Mailchimp	CWE-79	Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-8869	6.4	14.7	mutualfunddata	Mutual Funds Data	CWE-79	Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site S…
CVE-2026-8877	6.4	14.7	esiteq	Responsive Video Embedder	CWE-79	Responsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-…
CVE-2026-8887	6.4	14.7	konforti	Listen Shortcode	CWE-79	Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-8897	6.4	14.7	vincentastolfi	Shortcode Buddy	CWE-79	Shortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site S…
CVE-2026-8898	6.4	14.7	ruchit47	Events In City	CWE-79	Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Script…
CVE-2026-45090	7.5	14.2	hahwul	dalfox	CWE-362	Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnal…
CVE-2026-49059	4.7	14.2	Facebook	Facebook for WooCommerce	CWE-601	WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnera…
CVE-2026-48971	4.3	14.2	WebToffee	Product Import Export for WooCommerce	CWE-862	WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Acce…
CVE-2024-47269	4.9	14.1	Synology	Surveillance Station	CWE-319	Cleartext transmission of sensitive information vulnerability in Export Key f…
CVE-2026-2280	4.8	14.1	larsdrasmussen	rexCrawler	CWE-79	rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scrip…
CVE-2026-2288	4.8	14.1	silvercover	myLinksDump	CWE-79	myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripti…
CVE-2026-42761	9.3	14.0	RealMag777	Active Products Tables for WooCommerce	CWE-89	WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Inject…
CVE-2026-42879	6.3	14.0	NeoRazorX	facturascripts	CWE-94	FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Uploa…
CVE-2026-8405	6.5	13.8	IBM	Guardium Data Protection	CWE-200	IBM Guardium Data Protection is affected by Exposure of Sensitive Information…
CVE-2026-48149	8.1	13.5	Budibase	budibase	CWE-79	Budibase: Stored XSS in Text component: BASIC users execute JS in admin sessi…
CVE-2026-48148	5.3	13.6	Budibase	budibase	CWE-918	Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
CVE-2026-46538	5.9	13.4	microsoft	UFO	CWE-294	Microsoft UFO accepts cross-device TASK_END messages by session_id only, allo…
CVE-2026-48151	7.5	13.3	Budibase	budibase	CWE-862	Budibase: Webhook schema endpoint authorization bypass allows unauthenticated…
CVE-2026-46427	7.7	13.2	Budibase	budibase	CWE-200	Budibase: Snowflake private key returned unmasked from datasource API to BASI…
CVE-2026-40833	7.1	13.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in saveDashboardLayout function
CVE-2026-40834	7.1	13.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in saveDashboardLayout function
CVE-2026-40836	7.1	13.2	MB connect line	mbCONNECT24	CWE-89	Authenticated SQLi in inmessage model
CVE-2026-48918	6.6	13.1	Jenkins Project	Jenkins Active Directory Plugin	CWE-918	Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by de…
CVE-2026-3895	6.4	13.1	livemesh	WPBakery Page Builder Addons by Livemesh	CWE-862	WPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to …
CVE-2026-3896	6.4	13.1	livemesh	Livemesh SiteOrigin Widgets	CWE-862	Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated…
CVE-2026-3897	6.4	13.1	livemesh	Livemesh Addons for Beaver Builder	CWE-862	Livemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Sto…
CVE-2026-9609	2.0	13.1	QianFox	FoxCMS	CWE-640	QianFox FoxCMS Admin.php edit password recovery
CVE-2026-49051	4.3	12.8	Prasad Kirpekar	WP Meta and Date Remover	CWE-862	WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vu…
CVE-2026-1248	4.3	12.7	IBM	Business Automation Workflow containers and traditional	CWE-209	IBM Business Automation Workflow information leak
CVE-2026-9712	3.8	12.6	pretix	pretix	CWE-639	Insecure direct object reference
CVE-2025-41669	8.7	12.5	Phoenix Contact	AXC F 1152	CWE-347	Insufficient Verification of Data Authenticity
CVE-2022-41656	4.3	12.6	Bizswoop	Account Manager for WooCommerce	CWE-862	WordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Con…
CVE-2026-48146	7.7	12.3	Budibase	budibase	CWE-918	Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Prot…
CVE-2026-8884	6.4	12.4	neilmccutcheon	Instant-Quote.co Quotation Page	CWE-79	Instant-Quote.co Quotation Page <= 1.3.4 - Authenticated (Contributor+) Store…
CVE-2026-49102	6.1	12.3	Webmin	Webmin	CWE-79	Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attac…
CVE-2026-44830	8.7	12.1	Dataojitori	nocturne_memory	CWE-306	Empty API_TOKEN disables authentication on network-reachable HTTP/SSE transport
CVE-2026-5516	5.9	11.9	IBM	WebSphere Application Server - Liberty	CWE-362	IBM WebSphere Application Server Liberty is affected by a security bypass vul…
CVE-2026-49045	4.3	11.8	WP Media	Adminimize	CWE-862	WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability
CVE-2026-49054	4.3	11.8	Mamunur Rashid	The Post Grid	CWE-862	WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability
CVE-2026-42280	7.1	11.6	auth0	auth0.js	CWE-863	Improper Permission Checking in Auth.js SDK
CVE-2026-8707	6.1	11.6	nsthemes	NS Product icon badge	CWE-79	NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF
CVE-2026-48924	4.3	11.2	Jenkins Project	Jenkins Bitbucket OAuth Plugin	CWE-601	Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirec…
CVE-2026-44720	6.9	11.1	th30d4y	OpenLearnX	CWE-287	OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Dis…
CVE-2026-42744	6.5	11.1	Ads by WPQuads	Ads by WPQuads	CWE-1284	WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability
CVE-2026-9608	1.9	11.0	QianFox	FoxCMS	CWE-79	QianFox FoxCMS Administrator Backend edit cross site scripting
CVE-2026-8844	6.4	10.7	kevin1804	Responsive Check	CWE-79	Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Sc…
CVE-2026-42754	7.1	10.6	phbernard	Favicon	CWE-79	WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability
CVE-2026-2253	7.7	10.3	Hitachi Vantara	Pentaho Data Integration and Analytics	CWE-611	Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction o…
CVE-2026-45081	6.5	10.3	frappe	hrms	CWE-863	Frappe HR: Permission Bypass in HRMS Leave Details API
CVE-2026-48973	4.3	10.2	Benbodhi	SVG Support	CWE-862	WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability
CVE-2026-45134	7.1	10.1	langchain-ai	langsmith-sdk	CWE-502	LangSmith Client SDK: Public prompt pull deserializes untrusted manifests wit…
CVE-2026-44971	8.2	9.9	DataDog	guarddog	CWE-918	GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and…
CVE-2026-8842	6.4	9.9	morettolss	Google+ Link Name	CWE-79	Google+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scr…
CVE-2026-8847	6.4	9.9	mshomali	Dideo	CWE-79	Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via S…
CVE-2026-8867	6.4	9.9	fides-it	Post Categories Gallery	CWE-79	Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-…
CVE-2026-8886	6.4	9.9	huankong	hk_shortcode	CWE-79	hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptin…
CVE-2026-8899	6.4	9.9	gapgag55	Auto Thumbnails	CWE-79	Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scrip…
CVE-2026-9022	6.4	9.8	dkjensen	Splide Carousel Block	CWE-79	Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Si…
CVE-2026-6287	5.4	9.8	devitemsllc	ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin	CWE-79	ShopLentor - WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authent…
CVE-2026-5296	4.3	9.6	GitLab	GitLab	CWE-862	Missing Authorization in GitLab
CVE-2026-42746	7.3	9.5	ZAYTECH	Smart Online Order for Clover	CWE-201	WordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Expo…
CVE-2026-8872	6.4	9.3	fides-it	Animate Your Content	CWE-79	Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Sit…
CVE-2026-8891	6.4	9.3	bitform	BitForm – Data management solution for WordPress	CWE-79	BitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting v…
CVE-2026-9607	2.1	9.2	itsourcecode	Courier Management System	CWE-74	itsourcecode Courier Management System parcel_list.php sql injection
CVE-2026-8042	6.4	9.1	octalmage	Github Shortcode	CWE-79	Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-5065	8.8	9.0	IBM	Controller	CWE-798	IBM Controller is affected by vulnerabilities
CVE-2025-41670	8.7	8.9	Phoenix Contact	AXC F 1152	CWE-427	Untrusted Search Path
CVE-2026-8143	7.2	9.0	omnivo	Booking Calendar – Event Calendar	CWE-79	Booking Calendar – Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Sit…
CVE-2026-8870	6.4	9.0	adnanmoqsood	Team Master – A Modern WordPress Team Showcase	CWE-79	Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripti…
CVE-2026-45136	8.6	8.7	cnighswonger	claude-code-cache-fix	CWE-78	claude-code-cache-fix: Local code execution via Python triple-quote injection…
CVE-2026-8040	6.4	8.6	yehudah	faq shortocde	CWE-79	faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripti…
CVE-2026-8048	6.4	8.6	paulpela	My Email Shortcode	CWE-79	My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Pag…
CVE-2026-8698	6.4	8.6	cryptoprijzen	Cryptocurrency Prijsvergelijking Widget	CWE-79	Cryptocurrency Prijsvergelijking Widget <= 1.0 - Authenticated (Contributor+)…
CVE-2026-8701	6.4	8.6	golzarrahman	GNTT Post Title Ticker	CWE-79	GNTT Post Title Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Sit…
CVE-2026-8703	6.4	8.6	codycave	Endless Scroll	CWE-79	Endless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page G…
CVE-2026-8837	6.4	8.6	ektorcaba	WP Iframe Geo Style for Amazon affiliates	CWE-79	WP Iframe Geo Style for Amazon affiliates <= 1.1 - Authenticated (Contributor…
CVE-2026-8845	6.4	8.6	samiullah-kaifi	Islamic Database	CWE-79	Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-8846	6.4	8.6	eldougo	Tuxquote	CWE-79	Tuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vi…
CVE-2026-8871	6.4	8.6	thomstark	Formidable Kinetic	CWE-79	Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site…
CVE-2026-8873	6.4	8.6	celloexpressions	Content Slideshow	CWE-79	Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site S…
CVE-2026-8875	6.4	8.6	cuamckuy	Easy Prism Syntax Highlighter	CWE-79	Easy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored …
CVE-2026-8894	6.4	8.6	vinaysankhyan	iWR Tooltip	CWE-79	iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting…
CVE-2026-49053	5.3	8.6	Wpmet	ElementsKit Elementor addons Lite	CWE-862	WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access C…
CVE-2026-8716	4.3	8.7	GitLab	GitLab	CWE-706	Use of Incorrectly-Resolved Name or Reference in GitLab
CVE-2026-6938	7.5	8.3	IBM	Db2	CWE-285	IBM® Db2® is vulnerable to authorization bypass when uploading to a remote ob…
CVE-2026-45984	7.8	8.3	Linux	Linux	CWE-416	gfs2: Fix use-after-free in iomap inline data write path
CVE-2026-42753	7.3	8.3	WC Lovers	WCFM Membership	CWE-862	WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerabi…
CVE-2026-23679	6.9	8.3	libusb	libusb	CWE-125	libusb < 1.0.30 NULL Pointer Dereference in parse_interface()
CVE-2025-67903	5.3	8.1	n/a	n/a	CWE-347	Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature v…
CVE-2026-45878	7.8	8.0	Linux	Linux	—	drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
CVE-2026-48968	6.5	8.0	Averta	Master Slider	CWE-79	WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnera…
CVE-2026-49044	6.5	8.0	Justin Kruit	Advanced Custom Fields: Font Awesome Field	CWE-79	WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross …
CVE-2026-42728	7.1	8.0	HT Plugins	HT Contact Form 7	CWE-79	WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vuln…
CVE-2026-42729	7.1	8.0	Property Hive	PropertyHive	CWE-79	WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabi…
CVE-2025-22741	7.1	7.8	RiceTheme	Felan Framework	CWE-79	WordPress Felan Framework plugin <= 1.1.3 - Reflected Cross Site Scripting (X…
CVE-2025-52747	7.1	7.8	Jthemes	Themebox - Digital Products Ecommerce	CWE-79	WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site S…
CVE-2026-42733	7.1	7.8	RealMag777	WPCS	CWE-79	WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-42734	7.1	7.8	Dylan Kuhn	Geo Mashup	CWE-79	WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-44839	5.6	7.9	rabbitmq	rabbitmq-server	CWE-80	RabbitMQ: Unsanitized vhost names allow for XSS in management UI
CVE-2026-48923	4.3	7.9	Jenkins Project	Jenkins AppSpider Plugin	CWE-269	Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission che…
CVE-2026-44710	4.6	7.6	mcdope	pam_usb	CWE-476	pam_usb: NULL pointer dereference from UDisks device fields causes PAM crash …
CVE-2026-45933	7.8	7.5	Linux	Linux	—	bpf: Preserve id of register in sync_linked_regs()
CVE-2026-6051	7.5	7.6	IBM	Db2	CWE-400	IBM® Db2® is vulnerable to a denial of service when executing a specially cra…
CVE-2026-46018	5.5	7.6	Linux	Linux	—	ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
CVE-2026-48927	5.5	7.4	Jenkins Project	Jenkins buildgraph-view Plugin	CWE-79	Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the build URL,…
CVE-2026-48153	8.5	7.2	Budibase	budibase	CWE-918	Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud…
CVE-2026-45852	7.8	7.2	Linux	Linux	CWE-415	RDMA/rxe: Fix double free in rxe_srq_from_init
CVE-2026-46426	7.6	7.3	Budibase	budibase	CWE-79	Budibase: Unrestricted Upload of File with Dangerous Type
CVE-2026-45931	7.8	7.1	Linux	Linux	—	accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()
CVE-2026-44247	7.4	7.0	volcano-sh	volcano	CWE-400	Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body …
CVE-2026-48926	4.3	6.8	Jenkins Project	Jenkins Job Import Plugin	CWE-269	Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a …
CVE-2026-45991	7.8	6.6	Linux	Linux	CWE-787	udf: fix partition descriptor append bookkeeping
CVE-2026-48999	5.7	6.6	ZTE	ZXUniPOS NDS-LTE	CWE-79	Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product
CVE-2026-44711	7.9	6.3	mcdope	pam_usb	CWE-59	pam_usb: Symlink attacks on pad directory and pad files enable authentication…
CVE-2026-46081	7.8	6.3	Linux	Linux	CWE-787	crypto: acomp - fix wrong pointer stored by acomp_save_req()
CVE-2026-44473	7.1	6.3	ellanetworks	core	CWE-358	Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse
CVE-2026-45872	5.5	6.3	Linux	Linux	CWE-401	scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()
CVE-2026-45875	5.5	6.3	Linux	Linux	CWE-401	mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() f…
CVE-2026-45856	7.1	6.1	Linux	Linux	CWE-125	RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send
CVE-2026-42877	5.4	6.2	NeoRazorX	facturascripts	CWE-79	FacturaScripts: Stored XSS via product reference in sales/purchases
CVE-2026-2255	4.3	6.2	Hitachi Vantara	Pentaho Data Integration and Analytics	CWE-522	Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protect…

Results continue: ranks 401–715.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-27 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.