Security Box Score — Saturday, June 20, 2026

42 CVEs published June 20, 2026: 7 critical, 9 high, 23 medium, 3 low; 0 in KEV; 4 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 17 in the results table.

League
	MTD	YTD	2025 same span	2025 full
CVEs published	5104	9476	1167	2563
KEV catalog size	1670

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	100	1066	84	667	312	1	27	3	0.3	7.8	.0013	-116
google	684	858	83	450	293	29	74	6	0.7	8.1	.0023	+668
microsoft	220	710	55	474	160	4	378	27	3.8	7.8	.0044	+68
red hat	75	139	8	63	62	6	4	0	0.0	7.0	.0028	+66
apple	14	61	0	16	36	2	93	7	11.5	5.7	.0023	+1
canonical	1	15	0	4	6	5	0	0	0.0	5.5	.0009	+1
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	4	6	1	4	1	0	0	0	0.0	8.6	.0029	+2

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	9	22	4	3	8	0	96	10	45.5	6.8	.0257	+4
netgear	17	17	0	0	16	1	8	0	0.0	4.3	.0024	+17
palo alto networks	9	11	0	1	7	1	14	2	18.2	4.8	.0022	+8
f5	6	9	4	3	1	0	7	1	11.1	8.9	.0221	+5
ivanti	4	9	2	3	0	0	33	5	55.6	8.8	.5187	+3
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	+3
ubiquiti	5	8	4	4	0	0	4	0	0.0	8.9	.0052	+5
fortinet	2	8	1	3	2	0	28	3	37.5	7.3	.0066	+1

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	86	118	18	42	50	7	40	1	0.8	7.0	.0048	+82
mozilla	49	55	11	18	26	0	13	0	0.0	7.3	.0026	+44
gitlab	11	20	0	4	12	2	4	2	10.0	4.8	.0024	+11
docker	4	7	0	5	2	0	1	0	0.0	8.2	.0016	+4
drupal	0	5	1	1	3	0	5	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
jenkins	0	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	243	270	131	116	18	4	40	2	0.7	8.8	.0040	+243
adobe	129	133	4	49	75	2	75	3	2.3	5.5	.0021	+128
ibm	11	60	13	29	18	0	7	0	0.0	7.5	.0028	+11
progress	5	9	1	7	1	0	9	0	0.0	7.5	.0036	+1
solarwinds	3	6	1	2	1	0	11	4	66.7	7.5	.3995	+3
veeam	1	4	2	2	0	0	4	0	0.0	9.0	.0046	+1
zohocorp	0	2	0	1	1	0	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0	0.0	5.6	.0025	+5
d-link	9	12	0	4	2	5	26	1	8.3	5.5	.0058	+9
siemens	7	8	0	4	4	0	1	0	0.0	7.5	.0020	+6
rockwell automation	7	7	1	5	1	0	0	0	0.0	8.7	.0030	+7
abb	5	5	0	4	1	0	0	0	0.0	7.2	.0018	+5
moxa	5	5	0	3	2	0	0	0	0.0	7.0	.0029	+5
dahua	3	3	0	1	1	1	2	0	0.0	6.9	.0036	+3
mitsubishi electric	3	3	0	3	0	0	0	0	0.0	8.7	.0064	+3

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
spring	71	72	2	30	39	1	0	0	0.0	6.5	.0023	+71
openclaw	61	67	0	35	22	10	0	0	0.0	7.0	.0021	+61
sourcecodester	37	59	0	0	25	34	0	0	0.0	2.1	.0026	+37
themerex	58	58	5	53	0	0	0	0	0.0	8.1	.0043	+58
edimax	0	51	0	32	0	19	1	0	0.0	7.4	.0059	0
concrete cms	2	46	1	11	13	21	0	0	0.0	6.2	.0015	+2
dell	27	45	0	21	23	0	2	1	2.2	6.7	.0015	+25
open ises	0	44	2	21	21	0	0	0	0.0	7.1	.0021	0

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9990	100.0	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-0257	.9391	99.8	—
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-42271	.8301	99.6	—
CVE-2026-50751	.8255	99.6	9.3
CVE-2026-48907	.6883	99.3	10.0
CVE-2026-49160	.5383	98.9	7.5
CVE-2026-10523	.5187	98.9	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9990	KEV
CVE-2026-48907	10.0	.6883	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-45087	10.0	.0147
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-49257	10.0	.0093
CVE-2026-47140	10.0	.0082

Most disclosures (vendor)
Vendor	CVEs
google	836
linux	516
oracle	268
microsoft	238
adobe	129
red hat	107
apache	101
spring	72
openclaw	67
ibm	60

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	10
apple	7
google	6
ivanti	5
solarwinds	4
synacor	4
adobe	3
fortinet	3
linux	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	42
Packagist	22
PyPI	10
npm	4
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2022-0492	Linux	0
CVE-2024-21182	Oracle	0
CVE-2025-48595	Google	0
CVE-2026-0257	Palo Alto Networks	0
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-20245	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-20262	Cisco	0
CVE-2026-28318	SolarWinds	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1676
CVE-2021-27102	Accellion	2021-11-17	1676
CVE-2021-27101	Accellion	2021-11-17	1676
CVE-2021-27103	Accellion	2021-11-17	1676
CVE-2021-21017	Adobe	2021-11-17	1676
CVE-2021-28550	Adobe	2021-11-17	1676
CVE-2021-42013	Apache	2021-11-17	1676
CVE-2021-41773	Apache	2021-11-17	1676
CVE-2021-30858	Apple	2021-11-17	1676
CVE-2021-30860	Apple	2021-11-17	1676

Yesterday's Results

42 CVEs published. 25 box scores, 17 table rows — nothing truncated.

CVE-2026-48909CRITICAL

joomshaper.net SP LMS extension for Joomla — Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.5   .0764   94.1     —

AFFECTED
  Product                      Versions       Fixed
  SP LMS extension for Joomla  1.0.0-4.1.3 –  —

TIMELINE
  May 26  Reserved by CNA
  Jun 20  Published (CNA: Joomla)

CWE-502 · CNA: Joomla · 1 reference · NVD status: Deferred

CVE-2026-11911HIGH

eemitch Simple File List — Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0117   64.9     —

AFFECTED
  Product           Versions     Fixed
  Simple File List  unspecified  —

TIMELINE
  Jun 10  Reserved by CNA
  Jun 20  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 6 references · NVD status: Deferred

CVE-2022-50972CRITICAL

WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0114   63.9     —

AFFECTED
  Product      Versions  Fixed
  WooCommerce  7.1.0 –   —

TIMELINE
  Jan 11  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · 3 references · NVD status: Deferred

CVE-2026-9843HIGH

crmperks Database for Contact Form 7, WPforms, Elementor forms — Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  H  H    8.1   .0094   58.0     —

AFFECTED
  Product                                                Versions     Fixed
  Database for Contact Form 7, WPforms, Elementor forms  unspecified  —

TIMELINE
  May 28  Reserved by CNA
  Jun 20  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 7 references · NVD status: Deferred

CVE-2024-58351CRITICAL

Flowise - Remote Code Execution via overrideConfig Parameter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.5     —

AFFECTED
  Product  Versions     Fixed
  Flowise  unspecified  2.1.4

TIMELINE
  Jun 8   Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-5366CRITICAL

prefecthq prefecthq/prefect — Git Argument Injection in prefecthq/prefect

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0087   56.0     —

AFFECTED
  Product            Versions       Fixed
  prefecthq/prefect  unspecified –  —

TIMELINE
  Apr 1   Reserved by CNA
  Jun 20  Public exploit reference published
  Jun 20  Published (CNA: @huntr_ai)

CWE-94 · CNA: @huntr_ai · 1 reference · NVD status: Analyzed

CVE-2019-25763CRITICAL

Ultimatebeaver Ultimate Addons for Beaver Builder — WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0080   53.6     —

AFFECTED
  Product                             Versions     Fixed
  Ultimate Addons for Beaver Builder  unspecified  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-288 · CNA: VulnCheck · 3 references · NVD status: Deferred

CVE-2026-9265CRITICAL

JONASBN Crypt::OpenSSL::PKCS12 — Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  H    9.1   .0063   47.4     —

AFFECTED
  Product                 Versions     Fixed
  Crypt::OpenSSL::PKCS12  unspecified  —

TIMELINE
  May 22  Reserved by CNA
  Jun 20  Published (CNA: CPANSec)

CWE-125 · CNA: CPANSec · 3 references · NVD status: Deferred

CVE-2020-37255HIGH

Wptimecapsule Time Capsule Plugin — WordPress Time Capsule Plugin 1.21.16 Authentication Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0063   47.2     —

AFFECTED
  Product              Versions     Fixed
  Time Capsule Plugin  unspecified  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-288 · CNA: VulnCheck · 3 references · NVD status: Deferred

CVE-2026-56346MEDIUM

AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   L    6.9   .0062   46.6     —

AFFECTED
  Product  Versions     Fixed
  AVideo   unspecified  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-11912HIGH

eemitch Simple File List — Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  N    7.5   .0052   41.6     —

AFFECTED
  Product           Versions     Fixed
  Simple File List  unspecified  —

TIMELINE
  Jun 10  Reserved by CNA
  Jun 20  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 7 references · NVD status: Deferred

CVE-2026-56228MEDIUM

Capgo - Denial of Service via Improper Password Policy Length Validation

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   N   N   H    6.9   .0047   38.5     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 19  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-20 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-12119MEDIUM

eemitch Simple File List — Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0047   38.5     —

AFFECTED
  Product           Versions     Fixed
  Simple File List  unspecified  —

TIMELINE
  Jun 12  Reserved by CNA
  Jun 20  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 6 references · NVD status: Deferred

CVE-2026-56267MEDIUM

Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   L   N   N    6.9   .0046   38.3     —

AFFECTED
  Product  Versions     Fixed
  Flowise  unspecified  3.0.13

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56214HIGH

Capgo - Unauthenticated Organization Enumeration and Billing Status Disclosure via Supabase RPC

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0046   38.0     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 19  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56341HIGH

AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0046   38.0     —

AFFECTED
  Product  Versions     Fixed
  AVideo   unspecified  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-862 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56345CRITICAL

AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   H   H    9.2   .0045   37.6     —

AFFECTED
  Product  Versions     Fixed
  AVideo   unspecified  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-287 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56304MEDIUM

picklescan - Arbitrary File Creation via logging.FileHandler Deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    6.9   .0044   36.8     —

AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  1.0.1

TIMELINE
  Jun 20  Public exploit reference published
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-502 · CNA: VulnCheck · 2 references · NVD status: Modified

CVE-2026-56216HIGH

Capgo - Scope Escalation via API Key Creation in /functions/v1/apikey

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0044   36.8     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 19  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-269 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56355LOW

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  L  N  N    3.7   .0040   33.6     —

AFFECTED
  Product  Versions  Fixed
  Savane   3.14 –    —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: mitre)

CWE-696 · CNA: mitre · 6 references · NVD status: Deferred

CVE-2026-12673MEDIUM

Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privi…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   H   N   L   N   H    5.9   .0040   33.6     —

AFFECTED
  Product      Versions     Fixed
  liquidfiles  unspecified  —

TIMELINE
  Jun 19  Reserved by CNA
  Jun 20  Published (CNA: PRJBLK)

CWE-285 · CNA: PRJBLK · 2 references · NVD status: Deferred

CVE-2026-56282MEDIUM

Capgo - Information Disclosure via Unauthenticated /replication Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    6.9   .0040   32.8     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56342MEDIUM

AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   N   N   N    6.1   .0039   32.3     —

AFFECTED
  Product  Versions     Fixed
  AVideo   unspecified  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-918 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56235MEDIUM

Cap-go capgo — Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    6.9   .0039   32.0     —

AFFECTED
  Product  Versions     Fixed
  capgo    unspecified  12.128.2

TIMELINE
  Jun 19  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-56215HIGH

Capgo - Account Merge via Poisoned public.users.email in SSO Provisioning

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   L    8.7   .0039   32.0     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.12

TIMELINE
  Jun 19  Reserved by CNA
  Jun 20  Published (CNA: VulnCheck)

CWE-639 · CNA: VulnCheck · 2 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-56307	5.3	30.5	Cap-go	capgo	CWE-670	Cap-go - Broken Cursor Pagination in /private/devices Endpoint
CVE-2026-56276	6.0	29.7	Flowise	Flowise	CWE-915	Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override
CVE-2026-56213	6.9	28.3	Capgo	Capgo	CWE-862	Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_met…
CVE-2026-56340	8.7	28.2	vLLM	vLLM	CWE-20	vLLM - Denial of Service via Unvalidated Multimodal Embeddings
CVE-2026-56218	6.9	27.3	Capgo	Capgo	CWE-200	Capgo - EXIF Metadata Exposure via Image Upload
CVE-2026-56212	5.1	27.2	Capgo	Capgo	CWE-269	Capgo - Improper 2FA Enforcement Logic via Team Security Settings
CVE-2026-56325	2.3	26.6	Capgo	Capgo	CWE-20	Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup
CVE-2025-71379	5.3	24.9	vllm	vllm	CWE-1333	vllm - Regular Expression Denial of Service in Multiple Components
CVE-2026-56295	5.3	23.9	Capgo	Capgo	CWE-285	Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Exp…
CVE-2026-56319	5.3	23.2	Capgo	Capgo	CWE-203	Capgo - App Existence Oracle via GET /statistics/app/:app_id
CVE-2026-56332	5.1	22.5	Capgo	Capgo	CWE-601	Capgo - Open Redirect via confirmation_url Parameter
CVE-2026-56347	5.3	18.2	WWBN	AVideo	CWE-79	AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item F…
CVE-2026-56227	5.3	17.9	Capgo	Capgo	CWE-918	Capgo - Server-Side Request Forgery via Webhook URL Validation
CVE-2026-56330	4.8	16.9	Capgo	Capgo	CWE-601	Capgo - Open Redirect via Unvalidated Stripe Billing URLs
CVE-2025-71331	5.1	13.0	Flowise	Flowise	CWE-80	Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows
CVE-2026-56294	4.3	12.4	capacitor-native-biometric	capacitor-native-biometric	CWE-287	capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObje…
CVE-2026-56317	2.3	11.3	Nuxt	Nuxt	CWE-79	Nuxt - Cross-Site Scripting via NoScript Component Slot Content

Standings

Leaders (trailing 30 days unless noted)

Transactions

Yesterday's Results

Methodology