Security Box Score — Saturday, June 6, 2026

39 CVEs published June 6, 2026: 0 critical, 7 high, 26 medium, 6 low; 0 in KEV; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 14 in the results table.

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1584	5956	1047	2563
KEV catalog size	1670

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	34	1000	81	630	286	1	27	3	0.3	7.8	.0013	-112
google	488	662	58	331	255	15	74	5	0.8	7.8	.0023	+488
microsoft	7	497	44	333	103	0	378	27	5.4	7.8	.0046	+7
red hat	19	83	8	40	30	5	4	0	0.0	7.4	.0033	+17
apple	0	47	0	12	27	1	93	7	14.9	6.2	.0034	0
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	0	2	0	2	0	0	0	0	0.0	8.2	.0020	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	2	15	3	1	4	96	8	53.3	7.0	.0694	+2
ivanti	1	6	0	2	0	33	4	66.7	8.8	.5751	+1
checkpoint	0	6	0	3	3	3	0	0.0	6.5	.0338	0
fortinet	0	6	1	3	0	28	3	50.0	7.9	.4330	0
zyxel	2	3	0	0	3	11	0	0.0	6.5	.0017	+2
f5	0	3	2	0	0	7	1	33.3	9.2	.0996	0
ubiquiti	0	3	1	2	0	4	0	0.0	8.8	.0068	0
broadcom	0	2	0	0	0	4	2	100.0	—	.1990	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	32	64	8	26	27	2	40	1	1.6	7.2	.0053	+28
mozilla	4	10	3	3	4	0	13	0	0.0	7.4	.0035	+4
gitlab	0	9	0	1	6	0	4	2	22.2	4.3	.0032	0
docker	2	5	0	5	0	0	1	0	0.0	8.8	.0021	+2
drupal	0	5	1	1	3	0	5	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
jenkins	0	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ibm	5	54	13	26	15	7	0	0.0	7.5	.0031	+5
oracle	1	28	8	15	4	40	1	3.6	8.1	.0027	+1
progress	5	9	1	7	1	9	0	0.0	7.5	.0036	+5
solarwinds	2	5	1	2	0	11	4	80.0	7.5	.7155	+2
adobe	0	4	0	1	0	75	3	75.0	8.6	.2776	0
veeam	0	3	1	2	0	4	0	0.0	8.6	.0040	0
zohocorp	0	2	0	1	1	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0	0.0	5.6	.0025	+5
d-link	5	8	0	3	1	3	26	1	12.5	6.0	.0087	+5
abb	4	4	0	4	0	0	0	0	0.0	7.3	.0024	+4
siemens	1	2	0	1	1	0	1	0	0.0	7.3	.0026	+1
hitachi energy	0	2	0	0	2	0	0	0	0.0	5.7	.0014	0
hikvision	0	1	0	0	0	0	2	1	100.0	—	1.0000	0
dahua	0	0	0	0	0	0	2	0	—	—	—	0
qnap	0	0	0	0	0	0	8	0	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
edimax	0	51	0	32	0	19	1	7.4	.0059	0
concrete cms	1	45	1	10	13	21	0	6.0	.0015	+1
open ises	0	44	2	21	21	0	0	7.1	.0021	0
sourcecodester	21	43	0	0	14	29	0	2.1	.0025	+21
helmholz	0	42	0	39	3	0	0	7.1	.0026	0
mb connect line	0	42	0	39	3	0	0	7.1	.0026	0
acer	26	36	11	19	6	0	0	8.7	.0024	+26
nvidia	2	35	8	20	7	0	0	7.8	.0029	+2

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2008-4250	.9875	99.9	—
CVE-2026-0257	.9391	99.8	—
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2010-0249	.9188	99.8	—
CVE-2026-20182	.9152	99.8	—
CVE-2026-42208	.8942	99.8	—
CVE-2026-9082	.8832	99.8	9.8
CVE-2009-3459	.8658	99.7	—
CVE-2025-34291	.8384	99.7	—

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-45087	10.0	.0147
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-43997	10.0	.0098
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083
CVE-2026-44006	10.0	.0081

Most disclosures (vendor)
Vendor	CVEs
google	656
linux	528
microsoft	165
red hat	56
ibm	54
edimax	51
apache	49
concrete cms	45
open ises	44
sourcecodester	43

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	8
apple	7
google	5
ivanti	4
solarwinds	4
synacor	4
adobe	3
fortinet	3
linux	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	24
PyPI	10
Packagist	7
crates.io	2
npm	2

Fastest to KEV
CVE	Vendor	Days
CVE-2008-4250	Microsoft	0
CVE-2009-1537	Microsoft	0
CVE-2009-3459	Adobe	0
CVE-2010-0249	Microsoft	0
CVE-2010-0806	Microsoft	0
CVE-2022-0492	Linux	0
CVE-2024-21182	Oracle	0
CVE-2025-34291	Langflow	0
CVE-2025-48595	Google	0
CVE-2026-0257	Palo Alto Networks	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1662
CVE-2021-27102	Accellion	2021-11-17	1662
CVE-2021-27101	Accellion	2021-11-17	1662
CVE-2021-27103	Accellion	2021-11-17	1662
CVE-2021-21017	Adobe	2021-11-17	1662
CVE-2021-28550	Adobe	2021-11-17	1662
CVE-2021-42013	Apache	2021-11-17	1662
CVE-2021-41773	Apache	2021-11-17	1662
CVE-2021-30858	Apple	2021-11-17	1662
CVE-2021-30860	Apple	2021-11-17	1662

Yesterday's Results

39 CVEs published. 25 box scores, 14 table rows — nothing truncated.

CVE-2026-7665MEDIUM

wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets — Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0724   93.8     —

AFFECTED
  Product                                                                 Versions     Fixed
  Essential Addons for Elementor – Popular Elementor Templates & Widgets  unspecified  —

TIMELINE
  May 1   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · 14 references · NVD status: Deferred

CVE-2026-11406LOW

GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0123   66.4     —

AFFECTED
  Product  Versions  Fixed
  MT3000   4.4.0 –   4.9.0_beta3-1012-0513-1778656146

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred

CVE-2026-11408LOW

vertex-app vertex Log Viewer Endpoint LogMod.js os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0111   63.3     —

AFFECTED
  Product  Versions     Fixed
  vertex   2026.02.0 –  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 8 references · NVD status: Deferred

CVE-2026-8839MEDIUM

chrisvrichardson MapPress Maps for WordPress — MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0102   60.5     —

AFFECTED
  Product                      Versions     Fixed
  MapPress Maps for WordPress  unspecified  —

TIMELINE
  May 18  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · 24 references · NVD status: Deferred

CVE-2026-7537HIGH

MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0066   48.6     —

AFFECTED
  Product                Versions     Fixed
  MDJM Event Management  unspecified  —

TIMELINE
  Apr 30  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-7565MEDIUM

thimpress LearnPress – Backup & Migration Tool — LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0065   48.0     —

AFFECTED
  Product                               Versions     Fixed
  LearnPress – Backup & Migration Tool  unspecified  —

TIMELINE
  Apr 30  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-9197MEDIUM

nextendweb Smart Slider 3 — Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0060   45.9     —

AFFECTED
  Product         Versions     Fixed
  Smart Slider 3  unspecified  —

TIMELINE
  May 21  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 5 references · NVD status: Deferred

CVE-2026-8502MEDIUM

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0053   42.2     —

AFFECTED
  Product                                                               Versions     Fixed
  LearnPress – WordPress LMS Plugin for Create and Sell Online Courses  unspecified  —

TIMELINE
  May 13  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 14 references · NVD status: Deferred

CVE-2026-8438HIGH

davidanderson All-In-One Security (AIOS) – Security and Firewall — All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0049   39.7     —

AFFECTED
  Product                                             Versions     Fixed
  All-In-One Security (AIOS) – Security and Firewall  unspecified  —

TIMELINE
  May 12  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-11413HIGH

JingDong JD Cloud Box AX6600 jdcweb_rpc set_macfilter stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0048   39.4     —

AFFECTED
  Product              Versions       Fixed
  JD Cloud Box AX6600  4.5.3.r4546 –  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-9829MEDIUM

10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery — Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0047   38.6     —

AFFECTED
  Product                                                 Versions     Fixed
  Photo Gallery by 10Web – Mobile-Friendly Image Gallery  unspecified  —

TIMELINE
  May 28  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · 12 references · NVD status: Deferred

CVE-2026-7566MEDIUM

thimpress LearnPress – Backup & Migration Tool — LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  H  H    6.6   .0045   37.4     —

AFFECTED
  Product                               Versions     Fixed
  LearnPress – Backup & Migration Tool  unspecified  —

TIMELINE
  Apr 30  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-10725HIGH

CRUX Protocol::HTTP2 — Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0041   34.5     —

AFFECTED
  Product          Versions     Fixed
  Protocol::HTTP2  unspecified  —

TIMELINE
  Jun 3   Reserved by CNA
  Jun 6   Published (CNA: CPANSec)

CWE-409 · CNA: CPANSec · 6 references · NVD status: Analyzed

CVE-2026-11437MEDIUM

perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.0     —

AFFECTED
  Product         Versions  Fixed
  go-fastdfs-web  1.3.0 –   —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-7795MEDIUM

holithemes Click to Chat – HoliThemes — Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0041   33.9     —

AFFECTED
  Product                     Versions     Fixed
  Click to Chat – HoliThemes  unspecified  —

TIMELINE
  May 4   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 11 references · NVD status: Deferred

CVE-2026-9280MEDIUM

spacetime Ad Inserter – Ad Manager & AdSense Ads — Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  N    6.1   .0036   29.1     —

AFFECTED
  Product                                 Versions     Fixed
  Ad Inserter – Ad Manager & AdSense Ads  unspecified  —

TIMELINE
  May 22  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-9851HIGH

masaakitanaka Booking Package — Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0036   28.9     —

AFFECTED
  Product          Versions     Fixed
  Booking Package  unspecified  —

TIMELINE
  May 28  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · 5 references · NVD status: Deferred

CVE-2026-7796MEDIUM

wpdevteam EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more — EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0033   26.0     —

AFFECTED
  Product                                                                                        Versions     Fixed
  EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more  unspecified  —

TIMELINE
  May 4   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 11 references · NVD status: Deferred

CVE-2026-2500MEDIUM

davidfcarr Quick Playground — Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  N  N    4.4   .0032   24.3     —

AFFECTED
  Product           Versions     Fixed
  Quick Playground  unspecified  —

TIMELINE
  Feb 13  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 4 references · NVD status: Deferred

CVE-2026-8901HIGH

plugcrux Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More — Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0031   24.1     —

AFFECTED
  Product                                                                                  Versions     Fixed
  Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More  unspecified  —

TIMELINE
  May 18  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-8991MEDIUM

glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 — Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  L  L  N    4.4   .0031   23.9     —

AFFECTED
  Product                                                Versions     Fixed
  Drag and Drop Multiple File Upload for Contact Form 7  unspecified  —

TIMELINE
  May 19  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-7792MEDIUM

smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More — WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0030   22.7     —

AFFECTED
  Product                                                                                    Versions     Fixed
  WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More  unspecified  —

TIMELINE
  May 4   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-345 · CNA: Wordfence · 14 references · NVD status: Deferred

CVE-2026-7624MEDIUM

cifi SEO Plugin by Squirrly SEO — SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0030   22.2     —

AFFECTED
  Product                     Versions     Fixed
  SEO Plugin by Squirrly SEO  unspecified  —

TIMELINE
  May 1   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 14 references · NVD status: Deferred

CVE-2026-9594MEDIUM

flippercode WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters — WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  L  L  N    4.4   .0029   21.9     —

AFFECTED
  Product                                                                               Versions     Fixed
  WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters  unspecified  —

TIMELINE
  May 26  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 6 references · NVD status: Deferred

CVE-2026-11434LOW

n/a FluentCMS — FluentCMS Blocks Plugin blocks cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   P   N   L   N    1.9   .0027   19.9     —

AFFECTED
  Product    Versions  Fixed
  FluentCMS  0.0.5 –   —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · 7 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-11436	2.1	18.3	n/a	Mage AI	CWE-79	Mage AI Sign-in Flow index.tsx useMutation cross site scripting
CVE-2026-9016	5.3	18.0	qriouslad	Debug Log Manager – Conveniently Monitor and Inspect Errors	CWE-117	Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization f…
CVE-2026-11435	5.5	17.8	Jinher	OA	CWE-74	Jinher OA nextselectplan.aspx sql injection
CVE-2026-8978	4.9	17.7	crafium	OptinCraft – Drag & Drop Optins & Popup Builder for WordPress	CWE-89	OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order…
CVE-2026-8611	4.3	14.5	klamra22	Klamra Paycal for Aspaclaria	CWE-639	Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to A…
CVE-2026-9008	4.3	13.2	webvitaly	Page-list	CWE-862	Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sens…
CVE-2026-9281	6.4	12.1	litonice13	Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits	CWE-79	Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-S…
CVE-2026-11438	5.3	12.0	theonedev	onedev	CWE-266	theonedev projects improper authorization
CVE-2026-11439	5.3	12.0	theonedev	onedev	CWE-266	theonedev Parent Project projects improper authorization
CVE-2026-11440	5.3	12.0	theonedev	onedev	CWE-266	theonedev REST API default-branch improper authorization
CVE-2026-11441	5.3	12.0	theonedev	onedev	CWE-266	theonedev Pull Request issues canAccessIssue improper authorization
CVE-2026-11412	2.1	9.7	Jinher	OA	CWE-74	Jinher OA GetFormSn.aspx sql injection
CVE-2026-11411	1.9	6.8	iAI Lab	PDF AI App	CWE-22	iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal
CVE-2026-26422	8.4	6.0	Clash Verge Rev	clash-verge-service-ipc	CWE-732	clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, lead…

Standings

Leaders (trailing 30 days unless noted)

Transactions

Yesterday's Results

Methodology