Security Box Score — Thursday, June 18, 2026

Thursday, June 18, 2026 · all times UTC← 2026-06-17 · archive · 2026-06-19 →

151 CVEs published June 18, 2026: 27 critical, 58 high, 62 medium, 4 low; 1 in KEV; 5 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 126 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	4868	9240	1165	2563
KEV catalog size	1670

430 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	97	1063	84	664	312	1	27	3	0.3	7.8	.0013	-118
google	684	858	83	450	293	29	74	6	0.7	8.1	.0023	+684
microsoft	212	702	53	470	158	4	378	27	3.8	7.8	.0044	+69
red hat	67	131	8	58	59	6	4	0	0.0	7.0	.0027	+62
apple	14	61	0	16	36	2	93	7	11.5	5.7	.0023	+1
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	3	5	0	4	1	0	0	0	0.0	8.5	.0022	+3

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	9	22	4	3	8	0	96	10	45.5	6.8	.0257	+8
netgear	17	17	0	0	16	1	8	0	0.0	4.3	.0024	+17
palo alto networks	9	11	0	1	7	1	14	2	18.2	4.8	.0022	+8
f5	6	9	4	3	1	0	7	1	11.1	8.9	.0221	+5
ivanti	4	9	2	3	0	0	33	5	55.6	8.8	.5187	+3
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	+3
ubiquiti	5	8	4	4	0	0	4	0	0.0	8.9	.0052	+5
fortinet	2	8	1	3	2	0	28	3	37.5	7.3	.0066	+1

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	74	106	18	41	44	2	40	1	0.9	7.3	.0050	+70
mozilla	49	55	11	18	26	0	13	0	0.0	7.3	.0026	+45
gitlab	11	20	0	4	12	2	4	2	10.0	4.8	.0024	+11
docker	4	7	0	5	2	0	1	0	0.0	8.2	.0016	+4
drupal	0	5	1	1	3	0	5	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
jenkins	0	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	243	270	131	116	18	4	40	2	0.7	8.8	.0040	+243
adobe	129	133	4	49	75	2	75	3	2.3	5.5	.0021	+129
ibm	11	60	13	29	18	0	7	0	0.0	7.5	.0028	+11
progress	5	9	1	7	1	0	9	0	0.0	7.5	.0036	+5
solarwinds	3	6	1	2	1	0	11	4	66.7	7.5	.3995	+3
veeam	1	4	2	2	0	0	4	0	0.0	9.0	.0046	+1
zohocorp	0	2	0	1	1	0	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0	0.0	5.6	.0025	+5
d-link	9	12	0	4	2	5	26	1	8.3	5.5	.0058	+9
siemens	7	8	0	4	4	0	1	0	0.0	7.5	.0020	+6
rockwell automation	7	7	1	5	1	0	0	0	0.0	8.7	.0030	+7
abb	5	5	0	4	1	0	0	0	0.0	7.2	.0018	+5
moxa	5	5	0	3	2	0	0	0	0.0	7.0	.0029	+5
dahua	3	3	0	1	1	1	2	0	0.0	6.9	.0036	+3
hitachi energy	0	2	0	0	2	0	0	0	0.0	5.7	.0014	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
spring	71	72	2	30	39	1	0	0	0.0	6.5	.0023	+71
openclaw	61	67	0	35	22	10	0	0	0.0	7.0	.0021	+61
sourcecodester	37	59	0	0	25	34	0	0	0.0	2.1	.0026	+37
themerex	58	58	5	53	0	0	0	0	0.0	8.1	.0043	+58
edimax	0	51	0	32	0	19	1	0	0.0	7.4	.0059	0
concrete cms	2	46	1	11	13	21	0	0	0.0	6.2	.0015	+2
dell	26	44	0	20	23	0	2	1	2.3	6.7	.0016	+26
open ises	0	44	2	21	21	0	0	0	0.0	7.1	.0021	0

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9990	100.0	10.0
CVE-2008-4250	.9875	99.9	—
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-0257	.9391	99.8	—
CVE-2010-0249	.9188	99.8	—
CVE-2026-9082	.8832	99.8	9.8
CVE-2009-3459	.8658	99.7	—
CVE-2025-34291	.8384	99.7	—
CVE-2026-42271	.8301	99.6	—

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9990	KEV
CVE-2026-48907	10.0	.6883	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-45087	10.0	.0147
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-49257	10.0	.0093
CVE-2026-20223	10.0	.0083

Most disclosures (vendor)
Vendor	CVEs
google	852
linux	521
oracle	268
microsoft	238
adobe	130
red hat	103
apache	91
spring	72
openclaw	67
ibm	60

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	10
apple	7
google	6
ivanti	5
solarwinds	4
synacor	4
adobe	3
fortinet	3
linux	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	42
Packagist	22
PyPI	11
npm	4
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2008-4250	Microsoft	0
CVE-2009-1537	Microsoft	0
CVE-2009-3459	Adobe	0
CVE-2010-0249	Microsoft	0
CVE-2010-0806	Microsoft	0
CVE-2022-0492	Linux	0
CVE-2024-21182	Oracle	0
CVE-2025-34291	Langflow	0
CVE-2025-48595	Google	0
CVE-2026-0257	Palo Alto Networks	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1674
CVE-2021-27102	Accellion	2021-11-17	1674
CVE-2021-27101	Accellion	2021-11-17	1674
CVE-2021-27103	Accellion	2021-11-17	1674
CVE-2021-21017	Adobe	2021-11-17	1674
CVE-2021-28550	Adobe	2021-11-17	1674
CVE-2021-42013	Apache	2021-11-17	1674
CVE-2021-41773	Apache	2021-11-17	1674
CVE-2021-30858	Apple	2021-11-17	1674
CVE-2021-30860	Apple	2021-11-17	1674

Transactions

EXPLOIT PUBLISHED — CVE-2026-43994 (coturn). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44663 (AcademySoftwareFoundation openexr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45696 (AcademySoftwareFoundation openexr). Public exploit reference added.

Yesterday's Results

151 CVEs published. 25 box scores, 126 table rows — nothing truncated.

CVE-2026-20253CRITICAL

Splunk Splunk Enterprise — Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9694   99.9   YES

AFFECTED
  Product            Versions  Fixed
  Splunk Enterprise  10.2 –    —

TIMELINE
  Oct 8   Reserved by CNA
  Jun 18  Added to CISA KEV, due Jun 21
  Jun 18  Published (CNA: cisco)

CWE-306 · CNA: cisco · 3 references · NVD status: Analyzed · KEV due June 21, 2026

CVE-2026-38714CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   81.9     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · 1 reference · NVD status: Analyzed

CVE-2026-38715CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   81.9     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · 1 reference · NVD status: Analyzed

CVE-2026-38716CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   81.9     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · 1 reference · NVD status: Analyzed

CVE-2026-38717CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   81.9     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · 1 reference · NVD status: Analyzed

CVE-2026-8461HIGH

FFmpeg FFmpeg — Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0157   73.3     —

AFFECTED
  Product  Versions     Fixed
  FFmpeg   unspecified  —

TIMELINE
  May 13  Reserved by CNA
  Jun 18  Published (CNA: JFROG)

CWE-787 · CNA: JFROG · 5 references · NVD status: Awaiting Analysis

CVE-2025-27511HIGH

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0107   62.1     —

AFFECTED
  Product                         Versions    Fixed
  org.geoserver.extension:gs-db2  < 2.27.0 –  —

TIMELINE
  Feb 26  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-74, CWE-502 · CNA: GitHub_M · 4 references · NVD status: Analyzed

CVE-2025-15661HIGH

libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   L   N   H    8.3   .0103   60.8     —

AFFECTED
  Product  Versions     Fixed
  libssh2  unspecified  2dae3024897e1898d389835151f4e9606227721d

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-125 · CNA: VulnCheck · 4 references · NVD status: Analyzed

CVE-2026-40456HIGH

LMS LMS — OS Command Injection in LMS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   H   H   H    8.6   .0095   58.2     —

AFFECTED
  Product  Versions     Fixed
  LMS      unspecified  —

TIMELINE
  Apr 13  Reserved by CNA
  Jun 18  Published (CNA: CERT-PL)

CWE-78 · CNA: CERT-PL · 3 references · NVD status: Deferred

CVE-2026-49257CRITICAL

startreedata mcp-pinot — mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0093   57.7     —

AFFECTED
  Product    Versions   Fixed
  mcp-pinot  < 3.1.0 –  —

TIMELINE
  May 28  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-306 · CNA: GitHub_M · 4 references · NVD status: Deferred

CVE-2026-12046CRITICAL

pgadmin.org pgAdmin 4 — pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.5   .0092   57.3     —

AFFECTED
  Product    Versions  Fixed
  pgAdmin 4  6.9 –     —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: PostgreSQL)

CWE-306, CWE-502 · CNA: PostgreSQL · 2 references · NVD status: Analyzed

CVE-2026-56078HIGH

PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0092   57.2     —

AFFECTED
  Product    Versions     Fixed
  PraisonAI  unspecified  1.5.115

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · 3 references · NVD status: Deferred

CVE-2026-40624CRITICAL

AVer PTC cameras Files or Directories Accessible to External Parties

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0083   54.7     —

AFFECTED
  Product  Versions     Fixed
  PTC500S  unspecified  —
  PTC115   unspecified  —
  PTC500+  unspecified  —
  PTC115+  unspecified  —

TIMELINE
  May 7   Reserved by CNA
  Jun 18  Published (CNA: icscert)

CWE-552 · CNA: icscert · 2 references · NVD status: Awaiting Analysis

CVE-2026-47647CRITICAL

Microsoft Microsoft Dynamics 365 — Dynamics 365 Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0078   52.9     —

AFFECTED
  Product                 Versions  Fixed
  Microsoft Dynamics 365  - –       —

TIMELINE
  May 19  Reserved by CNA
  Jun 18  Published (CNA: microsoft)

CWE-284 · CNA: microsoft · 1 reference · NVD status: Analyzed

CVE-2026-54103CRITICAL

Government Accountability Office Electronic Protest Docketing System (EPDS) — U.S. GAO EPDS and CBCA EDS unauthenticated password change

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0077   52.7     —

AFFECTED
  Product                                     Versions     Fixed
  Electronic Protest Docketing System (EPDS)  unspecified  2026-02-22
  Electronic Docketing System (EDS)           unspecified  2026-03-19

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: cisa-cg)

CWE-306 · CNA: cisa-cg · 4 references · NVD status: Awaiting Analysis

CVE-2026-56076HIGH

PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   N    8.6   .0074   51.7     —

AFFECTED
  Product    Versions     Fixed
  PraisonAI  unspecified  1.5.128

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-942 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-54104HIGH

Government Accountability Office Electronic Protest Docketing System (EPDS) — U.S. GAO EPDS and CBCA EDS client-based privilege escalation

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0072   51.0     —

AFFECTED
  Product                                     Versions     Fixed
  Electronic Protest Docketing System (EPDS)  unspecified  2026-02-22
  Electronic Docketing System (EDS)           unspecified  2026-03-19

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: cisa-cg)

CWE-602 · CNA: cisa-cg · 4 references · NVD status: Awaiting Analysis

CVE-2026-12044HIGH

pgadmin.org pgAdmin 4 — pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0071   50.5     —

AFFECTED
  Product    Versions  Fixed
  pgAdmin 4  1.0 –     —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: PostgreSQL)

CWE-89, CWE-116 · CNA: PostgreSQL · 3 references · NVD status: Analyzed

CVE-2026-56075HIGH

PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0071   50.4     —

AFFECTED
  Product    Versions     Fixed
  PraisonAI  unspecified  4.5.128

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2025-53114HIGH

CometD has acknowledgement extension out of memory

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0068   49.6     —

AFFECTED
  Product  Versions              Fixed
  cometd   >= 5.0.0, < 5.0.23 –  —

TIMELINE
  Jun 25  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-400 · CNA: GitHub_M · 6 references · NVD status: Deferred

CVE-2026-54223HIGH

UBB Systems UBB.threads — Remote Code Execution via arbitrary file read and write in UBB.threads

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    8.6   .0063   47.2     —

AFFECTED
  Product      Versions     Fixed
  UBB.threads  unspecified  —

TIMELINE
  Jun 12  Reserved by CNA
  Jun 18  Published (CNA: CERT-PL)

CWE-22 · CNA: CERT-PL · 2 references · NVD status: Deferred

CVE-2025-52465HIGH

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0062   46.7     —

AFFECTED
  Product                            Versions    Fixed
  org.geoserver.web:gs-web-app       < 2.26.4 –  —
  org.geoserver.web:gs-web-sec-core  < 2.26.4 –  —

TIMELINE
  Jun 17  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-73 · CNA: GitHub_M · 4 references · NVD status: Analyzed

CVE-2026-54390CRITICAL

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0060   46.1     —

AFFECTED
  Product   Versions  Fixed
  JTL Shop  5.2.0 –   5.0.0

TIMELINE
  Jun 12  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-1336 · CNA: VulnCheck · 3 references · NVD status: Deferred

CVE-2026-54130HIGH

Microsoft Microsoft 365 Copilot — M365 Copilot Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0058   44.9     —

AFFECTED
  Product                Versions  Fixed
  Microsoft 365 Copilot  - –       —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: microsoft)

CWE-306 · CNA: microsoft · 1 reference · NVD status: Analyzed

CVE-2026-49248HIGH

theonedev onedev — OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   H   N    8.3   .0057   44.5     —

AFFECTED
  Product  Versions    Fixed
  onedev   < 15.0.7 –  —

TIMELINE
  May 28  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-61 · CNA: GitHub_M · 2 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-47633	7.5	44.5	Microsoft	Microsoft Cost Management	CWE-200	Microsoft Cost Management Information Disclosure Vulnerability
CVE-2026-9860	8.8	44.0	vanyukov	Offload, AI & Optimize with Cloudflare Images	CWE-434	Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Auth…
CVE-2026-56022	6.9	43.7	Webmin	Webmin	CWE-308	Webmin MFA bypass
CVE-2026-8024	9.3	43.6	iba	ibaPDA	CWE-502	Deserialization vulnerability in ibaPDA and ibaDatCoordinator
CVE-2026-8100	8.6	43.4	Progress Chef	Chef360	CWE-23	Impact A security issue has been identified in Chef 360 that could allow unau…
CVE-2026-48937	7.5	42.6	nodejs	node	CWE-400	A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data …
CVE-2025-32392	8.7	42.4	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in LoopVideoBlock
CVE-2026-55205	6.9	42.0	nesquena	hermes-webui	CWE-770	Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow …
CVE-2026-54017	7.7	41.9	open-webui	open-webui	CWE-22	Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path t…
CVE-2026-44688	8.4	41.0	Eclipse Foundation	Eclipse Theia	CWE-829	In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed worksp…
CVE-2026-46580	8.4	41.0	Eclipse Foundation	Eclipse Theia	CWE-829	In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompt…
CVE-2026-54105	6.9	40.8	Government Accountability Office	Electronic Protest Docketing System (EPDS)	CWE-639	U.S. GAO EPDS and CBCA EDS user information disclosure
CVE-2026-56020	9.2	40.3	Webmin	Webmin	CWE-290	Webmin HTTP header authentication bypass
CVE-2026-54106	5.1	40.0	Government Accountability Office	Electronic Protest Docketing System (EPDS)	CWE-940	U.S. GAO EPDS and CBCA EDS network access control bypass
CVE-2026-10736	4.9	39.9	themeum	Tutor LMS – eLearning and online course solution	CWE-89	Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data'…
CVE-2026-55204	8.7	39.6	haproxy	haproxy	CWE-476	HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
CVE-2026-47846	9.8	39.5	Bitnami	bitnami/cassandra	CWE-798	Bitnami Cassandra container images are affected by a retained default superus…
CVE-2026-12045	9.4	39.5	pgadmin.org	pgAdmin 4	CWE-77	pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writ…
CVE-2026-56021	6.9	39.1	Webmin	Webmin	CWE-185	Webmin information disclosure via regex pattern
CVE-2026-11982	5.1	39.0	Grav	grav-plugin-api	CWE-79	Stored XSS via missing XSS safety check in Admin2 Pages API partial validation
CVE-2026-11360	4.9	39.0	algolplus	Advanced Order Export For WooCommerce	CWE-89	Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager…
CVE-2026-49252	9.9	38.7	deepstreamIO	deepstream.io	CWE-1321	deepstream is vulnerable to prototype pollution
CVE-2026-38718	7.5	37.9	n/a	n/a	CWE-120	InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlie…
CVE-2026-43994	9.8	37.4	coturn	coturn	CWE-120	Coturn: Stack buffer overflow in decode_oauth_token_gcm()
CVE-2026-56077	7.1	37.0	PraisonAI	PraisonAI	CWE-668	PraisonAI - Information Disclosure via Shared MultiAgentLedger State
CVE-2026-54419	9.3	36.8	claudiopizzillo	PIAF-HMS	CWE-89	PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query
CVE-2025-32422	8.7	35.7	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock
CVE-2025-32424	8.7	35.7	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock
CVE-2025-32437	8.7	35.7	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in MediaDurationBlock
CVE-2026-50141	7.1	35.6	woodpecker-ci	woodpecker	CWE-290	Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent imperson…
CVE-2026-56099	6.9	35.3	openbsd	src	CWE-125	OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input
CVE-2026-48716	8.7	35.2	HKUDS	nanobot	CWE-22	nanobot: Path traversal via unsanitized WhatsApp document fileName enables ar…
CVE-2026-9692	5.3	35.0	HAYAJO	Mojolicious::Sessions::Storable	CWE-338	Mojolicious::Sessions::Storable versions through 0.05 for Perl generate sessi…
CVE-2026-44942	6.5	34.8	SUSE	libzypp	CWE-24	libzypp .repo files can have an optional path which can lead to path traversa…
CVE-2026-32174	8.8	34.2	Microsoft	Azure AI Bot Service	CWE-287	Azure Bot Service Elevation of Privilege Vulnerability
CVE-2026-44691	8.4	34.0	Eclipse Foundation	Eclipse Theia	CWE-829	In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspa…
CVE-2025-10560	9.3	32.0	Silver Leaf Technologies, Inc.	Worksnaps.net Worksnaps	CWE-798	Hardcoded cloud credentials in Worksnaps client application binaries expose p…
CVE-2026-49205	6.5	31.6	thorsten	phpMyFAQ	CWE-862	phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-2442…
CVE-2025-32436	7.1	31.3	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in AddAudioToVideoBlock
CVE-2026-12407	8.8	30.7	oleksandrz	E2Pdf – Export Pdf Tool for WordPress	CWE-862	E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary…
CVE-2026-56012	8.5	28.8	David Lingren	Media LIbrary Assistant	CWE-89	WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability
CVE-2026-42488	8.1	28.4	Xen	Xen	CWE-119	x86: mismatched mapcache metadata
CVE-2026-12093	5.3	28.2	wpinsider-1	Simple Membership	CWE-862	Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitra…
CVE-2026-52866	7.1	27.8	Apollo Pharmacy	Blood Glucose Monitoring System (Model No. APG-01 BT)	CWE-862	Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization
CVE-2026-55203	9.0	27.8	haproxy	haproxy	CWE-190	HAProxy - Integer Overflow in FCGI Demux Record Length Field
CVE-2026-11776	4.9	27.5	10web	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	CWE-89	Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection…
CVE-2026-11777	4.9	27.5	10web	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	CWE-89	Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection…
CVE-2026-12120	5.3	26.0	fireplugins	FireBox Popups – Increase Sales and Grow Your Email List	CWE-200	FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in '…
CVE-2026-46699	7.6	25.9	conda-forge	conda-smithy	CWE-284	conda-smithy vulnerable to misrouted repository invitation by conda-forge-web…
CVE-2026-12050	5.3	25.0	pgadmin.org	pgAdmin 4	CWE-89	pgAdmin 4: SQL injection in named restore point endpoint
CVE-2026-11357	4.3	25.0	stellarwp	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor	CWE-200	Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information …
CVE-2026-55237	8.8	24.6	Significant-Gravitas	AutoGPT	CWE-87	AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
CVE-2026-8811	7.1	24.6	SEPPmail AG	Secure Email Gateway	CWE-22	Path traversal in PDF generation module
CVE-2026-40457	2.1	24.6	LMS	LMS	CWE-79	Reflected XSS in LMS
CVE-2026-47847	5.3	24.0	Bitnami	bitnami/mariadb-galera	CWE-798	Bitnami MariaDB Galera container images and Helm chart are affected by a hard…
CVE-2026-22551	6.7	23.9	Eclipse Foundation	Eclipse Theia	CWE-201	In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown imag…
CVE-2026-10029	5.3	23.7	eventkoi	Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets	CWE-862	Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensiti…
CVE-2026-22674	4.8	23.6	hashgraph	guardian	CWE-79	Hashgraph Guardian Stored XSS via branding companyName field
CVE-2026-54222	8.6	23.1	UBB Systems	UBB.threads	CWE-89	Blind SQL Injection in UBB.threads
CVE-2026-9158	5.2	23.0	Eclipse Foundation	Eclipse 4diac	CWE-416	In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE co…
CVE-2026-54219	5.1	21.9	UBB Systems	UBB.threads	CWE-79	Stored XSS in UBB.threads
CVE-2026-54221	5.1	21.8	UBB Systems	UBB.threads	CWE-79	Reflected XSS in UBB.threads
CVE-2026-45696	8.3	21.8	AcademySoftwareFoundation	openexr	CWE-122	OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)
CVE-2026-11395	7.2	21.4	mariovalney	CF7 to Webhook	CWE-918	CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7…
CVE-2025-58175	8.2	21.2	geoserver	org.geoserver.web:gs-web-app	CWE-20	GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML E…
CVE-2026-55740	9.3	20.6	Nur-Alam39	bus-ticket	CWE-89	SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter
CVE-2026-12111	4.3	20.1	codepeople	Appointment Booking Calendar	CWE-200	Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensiti…
CVE-2026-54224	7.1	19.6	UBB Systems	UBB.threads	CWE-405	Denial of Service in UBB.threads
CVE-2026-12102	2.7	19.6	stiofansisland	UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP	CWE-639	UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor…
CVE-2026-8668	2.3	19.3	Progress Chef	Chef360	CWE-523	Hardcoded credentials in embedded content
CVE-2026-11358	4.4	18.4	themeisle	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More	CWE-79	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fon…
CVE-2026-10623	4.3	16.9	pressprimer	PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin	CWE-639	PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated…
CVE-2026-12527	6.0	15.7	Shenzhen Liandian Communication Technology LTD	V380 IP Camera / AppFHE1_V1.0.6.0	CWE-306	A broken authorization boundary in the RTSP media delivery pipeline of Shenzh…
CVE-2026-10023	4.3	15.7	dokaninc	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy	CWE-639	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Ins…
CVE-2026-43915	5.4	15.3	coturn	coturn	CWE-79	Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN use…
CVE-2026-48617	1.8	15.4	nodejs	node	CWE-284	A flaw in Node.js Permission Model enforcement allows Bypass via `process.rep…
CVE-2026-9199	4.3	15.1	equalizedigital	Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance	CWE-862	Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to A…
CVE-2026-11784	4.3	13.8	optimole	Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization	CWE-352	Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Op…
CVE-2026-49454	9.1	13.5	szTheory	relyra	CWE-287	Relyra SAML SignatureValue not cryptographically verified -> authentication b…
CVE-2026-12049	5.3	12.5	pgadmin.org	pgAdmin 4	CWE-601	pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated …
CVE-2026-40455	8.6	12.3	LMS	LMS	CWE-89	SQL Injection in LMS
CVE-2026-9815	6.5	12.2	Unknown	MagicForm	—	MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
CVE-2026-11791	5.0	11.8	Red Hat	Red Hat Directory Server 11	CWE-416	389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swa…
CVE-2026-12137	6.1	11.6	phppoet	SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager	CWE-79	SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Sit…
CVE-2026-12048	9.3	11.5	pgadmin.org	pgAdmin 4	CWE-79	pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through…
CVE-2026-50034	7.1	11.3	Apollo Pharmacy	Blood Glucose Monitoring System (Model No. APG-01 BT)	CWE-319	Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmiss…
CVE-2026-11402	6.4	10.9	bplugins	Services Section Block – Showcase Service Details in Grid or Columns	CWE-79	Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-S…
CVE-2026-42490	6.5	10.2	Xen	Xen	CWE-667	domctl lock open to abuse
CVE-2026-44663	7.1	10.1	AcademySoftwareFoundation	openexr	CWE-190	OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow
CVE-2026-2021	6.4	10.1	contrid	Slideshow Gallery LITE	CWE-79	Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-S…
CVE-2026-25865	8.5	9.9	Yandex	Punto Switcher	CWE-428	Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
CVE-2026-12098	6.4	9.7	blubrry	PowerPress Podcasting plugin by Blubrry	CWE-79	PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) …
CVE-2026-12136	6.4	8.7	phppoet	SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager	CWE-79	SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Cont…
CVE-2026-54220	8.6	8.6	UBB Systems	UBB.threads	CWE-352	Cross-Site Request Forgery in UBB.threads
CVE-2026-11718	9.3	8.3	Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	CWE-287	An authentication bypass vulnerability exists in the generic opaque token val…
CVE-2026-8039	6.4	8.0	dijitul	Fancy Testimonials	CWE-79	Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
CVE-2026-11717	9.3	7.5	Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	CWE-287	An authentication bypass vulnerability exists in the generic opaque token val…
CVE-2026-56024	6.5	7.4	Saad Iqbal	WP EasyPay	CWE-352	WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vuln…
CVE-2026-48980	6.3	7.3	mcdope	pam_usb	CWE-454	pam_usb: getenv() used in PAM context allows environment variable injection i…
CVE-2026-55746	7.0	6.9	Cotonti	Cotonti	CWE-79	Cotonti stored XSS via PFS folder title
CVE-2026-47833	6.9	6.4	Cloud Foundry Foundation	bpm-release	CWE-59	setupBpmLogs follows symlink for bpm.log open and chown — container-to-host p…
CVE-2026-56074	6.8	6.3	PraisonAI	PraisonAI	CWE-863	PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching
CVE-2026-48985	5.5	6.0	mcdope	pam_usb	CWE-476	pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Retur…
CVE-2026-12505	7.8	5.3	Red Hat	Red Hat Enterprise Linux 10	CWE-250	Cifs-utils: local privilege escalation via forged cifs.spnego key description…
CVE-2026-48981	6.7	5.1	mcdope	pam_usb	CWE-611	pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c
CVE-2026-55742	9.4	4.8	Cotonti	Cotonti	CWE-352	Cotonti CSRF in admin.rights.php allows privilege escalation
CVE-2026-55392	6.7	4.8	nilfs-dev	nilfs-utils	CWE-1284	NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_…
CVE-2026-55741	8.7	4.5	Cotonti	Cotonti	CWE-352	Cotonti CSRF in admin.config.php allows unauthorized configuration changes
CVE-2026-55744	8.6	4.6	Cotonti	Cotonti	CWE-352	Cotonti CSRF in PFS allows forced arbitrary file upload
CVE-2026-12039	5.7	4.5	Docker	Docker Sandboxes	CWE-923	Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
CVE-2026-48984	4.7	4.4	mcdope	pam_usb	CWE-14	pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic mater…
CVE-2026-11719	8.6	4.3	Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	CWE-862	An authenticated authorization bypass vulnerability exists in MCP Toolbox for…
CVE-2026-48986	4.7	3.9	mcdope	pam_usb	CWE-835	pam_usb: Infinite loop DoS in process-tree walk when parent process exits dur…
CVE-2026-12539	5.7	3.8	Docker	Docker Sandboxes	CWE-665	Docker Sandboxes ICMP egress restriction bypass after daemon restart
CVE-2026-28573	10.0	3.7	Google	Android	CWE-862	In AndroidManifest.xml, there is a possible persistent denial of service due …
CVE-2026-56007	5.9	3.7	OceanWP	Ocean Product Sharing	CWE-79	WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) …
CVE-2026-50643	5.1	3.7	rui314	8cc	CWE-125	Out‑of‑Bounds Read in 8cc
CVE-2026-12047	4.8	3.6	pgadmin.org	pgAdmin 4	CWE-79	pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via …
CVE-2026-56009	5.9	3.5	Bricksable	Bricksable for Bricks Builder	CWE-79	WordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripti…
CVE-2026-12390	8.4	3.5	AzeoTech	DAQFactory	CWE-843	Access of resource using incompatible type ('type confusion') in AzeoTech DAQ…
CVE-2026-48982	5.8	2.0	mcdope	pam_usb	CWE-362	pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race
CVE-2026-48983	5.8	1.3	mcdope	pam_usb	CWE-367	pam_usb: TOCTOU race condition in pad directory creation allows symlink subst…
CVE-2026-11958	7.3	1.1	ANSSI	DFIR-ORC	CWE-427	Local privilege escalation in ANSSI’s DFIR-ORC
CVE-2026-55745	5.3	0.9	Cotonti	Cotonti	CWE-352	Cotonti CSRF in PFS folder edit allows unauthorized folder modification
CVE-2026-42487	7.9	0.8	Xen	Xen	CWE-362	x86 HVM I/O port list traversal
CVE-2026-42489	5.3	0.2	Xen	Xen	CWE-667	domctl lock open to abuse

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-18 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.