{ "day": "2026-06-23", "boundary": "UTC calendar day", "published_count": 257, "by_severity": { "CRITICAL": 28, "HIGH": 98, "MEDIUM": 117, "LOW": 11 }, "kev_count": 3, "exploit_reference_count": 57, "awaiting_enrichment_count": 3, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-34910", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.87468, "epss_percentile": 0.99741, "kev": true, "kev_due_at": "2026-06-26", "vendor": "Ubiquiti Inc", "product": "UniFi OS Server", "cwe": "CWE-20", "title": "Ubiquiti UniFi OS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34910" }, { "rank": 2, "cve_id": "CVE-2026-34908", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.85194, "epss_percentile": 0.99696, "kev": true, "kev_due_at": "2026-06-26", "vendor": "Ubiquiti Inc", "product": "UniFi OS Server", "cwe": "CWE-284", "title": "Ubiquiti UniFi OS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34908" }, { "rank": 3, "cve_id": "CVE-2026-34909", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.63897, "epss_percentile": 0.99157, "kev": true, "kev_due_at": "2026-06-26", "vendor": "Ubiquiti Inc", "product": "UniFi OS Server", "cwe": "CWE-22", "title": "Ubiquiti UniFi OS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34909" }, { "rank": 4, "cve_id": "CVE-2026-56274", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.07521, "epss_percentile": 0.9402, "kev": false, "kev_due_at": null, "vendor": "Flowise", "product": "Flowise", "cwe": "CWE-78", "title": "Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56274" }, { "rank": 5, "cve_id": "CVE-2026-53753", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.029, "epss_percentile": 0.85881, "kev": false, "kev_due_at": null, "vendor": "unclecode", "product": "crawl4ai", "cwe": "CWE-94", "title": "Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53753" }, { "rank": 6, "cve_id": "CVE-2026-11374", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.02523, "epss_percentile": 0.83633, "kev": false, "kev_due_at": null, "vendor": "zohocorp", "product": "manageengine_adselfservice_plus", "cwe": "CWE-287", "title": "Account Takeover via Predictable SSO Ticket Generation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11374" }, { "rank": 7, "cve_id": "CVE-2026-28496", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.01905, "epss_percentile": 0.78132, "kev": false, "kev_due_at": null, "vendor": "FOSSBilling", "product": "FOSSBilling", "cwe": "CWE-1336", "title": "FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28496" }, { "rank": 8, "cve_id": "CVE-2026-54157", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.0183, "epss_percentile": 0.77198, "kev": false, "kev_due_at": null, "vendor": "lobehub", "product": "lobehub", "cwe": "CWE-918", "title": "LobeHub: Unauthenticated SSRF in `/webapi/proxy`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54157" }, { "rank": 9, "cve_id": "CVE-2026-53755", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.01577, "epss_percentile": 0.73565, "kev": false, "kev_due_at": null, "vendor": "unclecode", "product": "crawl4ai", "cwe": "CWE-918", "title": "Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53755" }, { "rank": 10, "cve_id": "CVE-2026-35018", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.01266, "epss_percentile": 0.67501, "kev": false, "kev_due_at": null, "vendor": "NetComm Wireless Pty Ltd", "product": "NF20MESH", "cwe": "CWE-78", "title": "NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35018" }, { "rank": 11, "cve_id": "CVE-2026-55450", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.0119, "epss_percentile": 0.65557, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-200", "title": "Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55450" }, { "rank": 12, "cve_id": "CVE-2026-56315", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.01147, "epss_percentile": 0.64342, "kev": false, "kev_due_at": null, "vendor": "picklescan", "product": "picklescan", "cwe": "CWE-184", "title": "picklescan - Remote Code Execution via Unblocked Standard Library Modules", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56315" }, { "rank": 13, "cve_id": "CVE-2026-54892", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00949, "epss_percentile": 0.58547, "kev": false, "kev_due_at": null, "vendor": "elixir-plug", "product": "plug", "cwe": "CWE-407", "title": "Plug: quadratic-time decoding of nested query/body parameters enables denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54892" }, { "rank": 14, "cve_id": "CVE-2026-56258", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00912, "epss_percentile": 0.57343, "kev": false, "kev_due_at": null, "vendor": "Crawl4AI", "product": "Crawl4AI", "cwe": "CWE-22", "title": "Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56258" }, { "rank": 15, "cve_id": "CVE-2026-54513", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00892, "epss_percentile": 0.56714, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-184", "title": "jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513" }, { "rank": 16, "cve_id": "CVE-2026-56379", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00884, "epss_percentile": 0.56474, "kev": false, "kev_due_at": null, "vendor": "ImageMagick", "product": "ImageMagick", "cwe": "CWE-116", "title": "ImageMagick - Command Injection via SVG Decoder", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56379" }, { "rank": 17, "cve_id": "CVE-2026-54512", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00873, "epss_percentile": 0.56182, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-184", "title": "jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512" }, { "rank": 18, "cve_id": "CVE-2026-12866", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00866, "epss_percentile": 0.5594, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "expr-eval", "cwe": "CWE-94", "title": "All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12866" }, { "rank": 19, "cve_id": "CVE-2026-35019", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00806, "epss_percentile": 0.54016, "kev": false, "kev_due_at": null, "vendor": "NetComm Wireless Pty Ltd", "product": "NF20MESH", "cwe": "CWE-321", "title": "NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35019" }, { "rank": 20, "cve_id": "CVE-2026-48519", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00783, "epss_percentile": 0.53251, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-94", "title": "Langflow: Unauthenticated RCE in Shareable Playgrounds", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48519" }, { "rank": 21, "cve_id": "CVE-2023-54365", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00774, "epss_percentile": 0.52976, "kev": false, "kev_due_at": null, "vendor": "Traefik", "product": "Traefik", "cwe": "CWE-400", "title": "Traefik - Denial of Service via HTTP/2 Request Handling", "url": "https://www.cve.org/CVERecord?id=CVE-2023-54365" }, { "rank": 22, "cve_id": "CVE-2026-48020", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00757, "epss_percentile": 0.52412, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-288", "title": "Traefik StripPrefix Route-Level Auth Bypass via Path Normalization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48020" }, { "rank": 23, "cve_id": "CVE-2026-11940", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0075, "epss_percentile": 0.52174, "kev": false, "kev_due_at": null, "vendor": "Python Software Foundation", "product": "CPython", "cwe": "CWE-22", "title": "tarfile extraction filter bypass allows escaping the destination directory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11940" }, { "rank": 24, "cve_id": "CVE-2026-41862", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00746, "epss_percentile": 0.52028, "kev": false, "kev_due_at": null, "vendor": "Spring", "product": "Spring Statemachine", "cwe": "CWE-502", "title": "Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41862" }, { "rank": 25, "cve_id": "CVE-2026-39253", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00721, "epss_percentile": 0.51151, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-502", "title": "An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39253" }, { "rank": 26, "cve_id": "CVE-2025-61018", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00681, "epss_percentile": 0.49654, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61018" }, { "rank": 27, "cve_id": "CVE-2025-61020", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00681, "epss_percentile": 0.49653, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61020" }, { "rank": 28, "cve_id": "CVE-2025-61023", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00681, "epss_percentile": 0.49653, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61023" }, { "rank": 29, "cve_id": "CVE-2025-61028", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00681, "epss_percentile": 0.49653, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61028" }, { "rank": 30, "cve_id": "CVE-2026-45135", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00676, "epss_percentile": 0.49447, "kev": false, "kev_due_at": null, "vendor": "caddyserver", "product": "caddy", "cwe": "CWE-20", "title": "Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45135" }, { "rank": 31, "cve_id": "CVE-2026-50023", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00665, "epss_percentile": 0.49006, "kev": false, "kev_due_at": null, "vendor": "yt-dlp", "product": "yt-dlp", "cwe": "CWE-641", "title": "yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50023" }, { "rank": 32, "cve_id": "CVE-2026-55447", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00662, "epss_percentile": 0.48922, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-61", "title": "Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55447" }, { "rank": 33, "cve_id": "CVE-2026-34916", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00649, "epss_percentile": 0.48351, "kev": false, "kev_due_at": null, "vendor": "Revive Adserver", "product": "Revive Adserver", "cwe": "CWE-94", "title": "A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34916" }, { "rank": 34, "cve_id": "CVE-2026-52844", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00619, "epss_percentile": 0.46959, "kev": false, "kev_due_at": null, "vendor": "caddyserver", "product": "caddy", "cwe": "CWE-22", "title": "Caddy: Windows `file_server` path authorization bypass via encoded backslash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52844" }, { "rank": 35, "cve_id": "CVE-2026-50193", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00616, "epss_percentile": 0.46815, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-400", "title": "jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50193" }, { "rank": 36, "cve_id": "CVE-2025-71341", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00613, "epss_percentile": 0.4665, "kev": false, "kev_due_at": null, "vendor": "picklescan", "product": "picklescan", "cwe": "CWE-502", "title": "picklescan - Remote Code Execution via Undetected profile.Profile.runctx", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71341" }, { "rank": 37, "cve_id": "CVE-2026-13007", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0061, "epss_percentile": 0.46476, "kev": false, "kev_due_at": null, "vendor": "tenable", "product": "Tenable Identity Exposure", "cwe": "CWE-306", "title": "Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13007" }, { "rank": 38, "cve_id": "CVE-2026-52673", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.006, "epss_percentile": 0.46042, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52673" }, { "rank": 39, "cve_id": "CVE-2026-44959", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00585, "epss_percentile": 0.45319, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-94", "title": "A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44959" }, { "rank": 40, "cve_id": "CVE-2025-71382", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00583, "epss_percentile": 0.45254, "kev": false, "kev_due_at": null, "vendor": "ArtifexSoftware", "product": "mupdf", "cwe": "CWE-674", "title": "MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71382" }, { "rank": 41, "cve_id": "CVE-2026-55446", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00581, "epss_percentile": 0.45138, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-400", "title": "Langflow: Unauthenticated DoS through multipart form boundary file upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55446" }, { "rank": 42, "cve_id": "CVE-2026-11772", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00554, "epss_percentile": 0.43767, "kev": false, "kev_due_at": null, "vendor": "DRIMO", "product": "DRIMO CMS", "cwe": "CWE-79", "title": "Reflected XSS in DRIMO CMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11772" }, { "rank": 43, "cve_id": "CVE-2026-55249", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00552, "epss_percentile": 0.43632, "kev": false, "kev_due_at": null, "vendor": "rtk-ai", "product": "rtk", "cwe": "CWE-78", "title": "@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55249" }, { "rank": 44, "cve_id": "CVE-2026-10521", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00551, "epss_percentile": 0.43583, "kev": false, "kev_due_at": null, "vendor": "MB connect line", "product": "mbCONNECT24", "cwe": "CWE-425", "title": "Authenticated unintended access to critical program parameters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10521" }, { "rank": 45, "cve_id": "CVE-2026-54309", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00546, "epss_percentile": 0.43306, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-306", "title": "n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54309" }, { "rank": 46, "cve_id": "CVE-2026-54314", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00546, "epss_percentile": 0.43319, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-409", "title": "n8n: Denial of Service via ZIP decompression in webhook workflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54314" }, { "rank": 47, "cve_id": "CVE-2026-54310", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00545, "epss_percentile": 0.43244, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-89", "title": "n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54310" }, { "rank": 48, "cve_id": "CVE-2025-71370", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00544, "epss_percentile": 0.4323, "kev": false, "kev_due_at": null, "vendor": "picklescan", "product": "picklescan", "cwe": "CWE-502", "title": "picklescan - Remote Code Execution via torch.jit.unsupported_tensor_ops.execWrapper", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71370" }, { "rank": 49, "cve_id": "CVE-2026-54588", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00543, "epss_percentile": 0.43157, "kev": false, "kev_due_at": null, "vendor": "poweradmin", "product": "poweradmin", "cwe": "CWE-20", "title": "Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54588" }, { "rank": 50, "cve_id": "CVE-2026-49465", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.0054, "epss_percentile": 0.43015, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-22", "title": "n8n: Git Node Clone and Push Operations Bypass File Sandbox", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49465" }, { "rank": 51, "cve_id": "CVE-2026-44791", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00537, "epss_percentile": 0.42806, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-1321", "title": "n8n: XML Node Prototype Pollution Patch Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44791" }, { "rank": 52, "cve_id": "CVE-2026-11807", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00531, "epss_percentile": 0.42456, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "cwe": "CWE-862", "title": "Eda-server: websocket missing authorization allows credential theft via activation_id spoofing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11807" }, { "rank": 53, "cve_id": "CVE-2026-44790", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.0053, "epss_percentile": 0.42386, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-88", "title": "n8n: Arbitrary File Read via Git Node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44790" }, { "rank": 54, "cve_id": "CVE-2026-44789", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00529, "epss_percentile": 0.42358, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-1321", "title": "n8n: HTTP Request Node Pagination Prototype Pollution to RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44789" }, { "rank": 55, "cve_id": "CVE-2026-9733", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00522, "epss_percentile": 0.41942, "kev": false, "kev_due_at": null, "vendor": "HAYAJO", "product": "Mojolicious::Plugin::Web::Auth::OAuth2", "cwe": "CWE-338", "title": "Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9733" }, { "rank": 56, "cve_id": "CVE-2026-56222", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.0052, "epss_percentile": 0.41792, "kev": false, "kev_due_at": null, "vendor": "Capgo", "product": "Capgo", "cwe": "CWE-639", "title": "Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /private/role_bindings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56222" }, { "rank": 57, "cve_id": "CVE-2025-55639", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00511, "epss_percentile": 0.41233, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-476", "title": "GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55639" }, { "rank": 58, "cve_id": "CVE-2026-27604", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00509, "epss_percentile": 0.41126, "kev": false, "kev_due_at": null, "vendor": "FOSSBilling", "product": "FOSSBilling", "cwe": "CWE-200", "title": "FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27604" }, { "rank": 59, "cve_id": "CVE-2025-61019", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.4037, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61019" }, { "rank": 60, "cve_id": "CVE-2025-61021", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.4037, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61021" }, { "rank": 61, "cve_id": "CVE-2025-61022", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.4037, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61022" }, { "rank": 62, "cve_id": "CVE-2025-61024", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.4037, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61024" }, { "rank": 63, "cve_id": "CVE-2025-61025", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.40371, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61025" }, { "rank": 64, "cve_id": "CVE-2025-61027", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.40371, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61027" }, { "rank": 65, "cve_id": "CVE-2025-61029", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.40369, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-61029" }, { "rank": 66, "cve_id": "CVE-2026-33760", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00495, "epss_percentile": 0.4021, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-639", "title": "Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33760" }, { "rank": 67, "cve_id": "CVE-2026-56248", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00488, "epss_percentile": 0.39765, "kev": false, "kev_due_at": null, "vendor": "Cap-go", "product": "capgo", "cwe": "CWE-400", "title": "Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56248" }, { "rank": 68, "cve_id": "CVE-2026-42867", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00466, "epss_percentile": 0.38313, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-22", "title": "Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42867" }, { "rank": 69, "cve_id": "CVE-2026-54316", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00466, "epss_percentile": 0.38291, "kev": false, "kev_due_at": null, "vendor": "anthropics", "product": "claude-code", "cwe": "CWE-183", "title": "Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54316" }, { "rank": 70, "cve_id": "CVE-2026-50574", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00465, "epss_percentile": 0.38179, "kev": false, "kev_due_at": null, "vendor": "yt-dlp", "product": "yt-dlp", "cwe": "CWE-74", "title": "yt-dlp: Arbitrary code execution via manifest downloads with aria2c", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50574" }, { "rank": 71, "cve_id": "CVE-2026-56322", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00459, "epss_percentile": 0.37813, "kev": false, "kev_due_at": null, "vendor": "Capgo", "product": "Capgo", "cwe": "CWE-200", "title": "Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56322" }, { "rank": 72, "cve_id": "CVE-2026-54324", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00456, "epss_percentile": 0.37643, "kev": false, "kev_due_at": null, "vendor": "daytonaio", "product": "daytona", "cwe": "CWE-639", "title": "Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54324" }, { "rank": 73, "cve_id": "CVE-2026-56115", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00452, "epss_percentile": 0.37381, "kev": false, "kev_due_at": null, "vendor": "garybowers", "product": "bootimus", "cwe": "CWE-862", "title": "Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56115" }, { "rank": 74, "cve_id": "CVE-2026-54516", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00449, "epss_percentile": 0.37135, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-915", "title": "jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54516" }, { "rank": 75, "cve_id": "CVE-2026-11972", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00445, "epss_percentile": 0.36833, "kev": false, "kev_due_at": null, "vendor": "Python Software Foundation", "product": "CPython", "cwe": "CWE-252", "title": "tarfile opened in streaming mode mishandles EOF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11972" }, { "rank": 76, "cve_id": "CVE-2026-49402", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00445, "epss_percentile": 0.36817, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-78", "title": "Deno: Command Injection via spawnSync & spawn on Windows", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49402" }, { "rank": 77, "cve_id": "CVE-2026-47376", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00444, "epss_percentile": 0.36741, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-79", "title": "NocoDB: Reflected Cross-Site Scripting via Password Reset Token", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47376" }, { "rank": 78, "cve_id": "CVE-2026-56371", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0044, "epss_percentile": 0.36412, "kev": false, "kev_due_at": null, "vendor": "ImageMagick", "product": "ImageMagick", "cwe": "CWE-401", "title": "ImageMagick - Memory Leak in TXT File Processing via Texture Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56371" }, { "rank": 79, "cve_id": "CVE-2026-48520", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00437, "epss_percentile": 0.36234, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-73", "title": "Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48520" }, { "rank": 80, "cve_id": "CVE-2026-47385", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00437, "epss_percentile": 0.36202, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-22", "title": "NocoDB: Path Traversal via SQLite Source Filename", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47385" }, { "rank": 81, "cve_id": "CVE-2026-54762", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00434, "epss_percentile": 0.35984, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-636", "title": "Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54762" }, { "rank": 82, "cve_id": "CVE-2026-53754", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00433, "epss_percentile": 0.35886, "kev": false, "kev_due_at": null, "vendor": "unclecode", "product": "crawl4ai", "cwe": "CWE-918", "title": "Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53754" }, { "rank": 83, "cve_id": "CVE-2026-53662", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00431, "epss_percentile": 0.35687, "kev": false, "kev_due_at": null, "vendor": "immich-app", "product": "immich", "cwe": "CWE-79", "title": "immich: One-click account takeover via XSS in login page continue redirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53662" }, { "rank": 84, "cve_id": "CVE-2025-71365", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00431, "epss_percentile": 0.35708, "kev": false, "kev_due_at": null, "vendor": "picklescan", "product": "picklescan", "cwe": "CWE-502", "title": "picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Detection Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71365" }, { "rank": 85, "cve_id": "CVE-2025-71376", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00431, "epss_percentile": 0.35705, "kev": false, "kev_due_at": null, "vendor": "picklescan", "product": "picklescan", "cwe": "CWE-502", "title": "picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.AutoComplete.fetch_completions", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71376" }, { "rank": 86, "cve_id": "CVE-2026-8163", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0043, "epss_percentile": 0.35578, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Infility Global", "cwe": null, "title": "Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8163" }, { "rank": 87, "cve_id": "CVE-2026-47381", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0043, "epss_percentile": 0.35619, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-290", "title": "NocoDB: Cross-Workspace Integration Use in Connection Test", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47381" }, { "rank": 88, "cve_id": "CVE-2026-54257", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00428, "epss_percentile": 0.35422, "kev": false, "kev_due_at": null, "vendor": "electron", "product": "electron", "cwe": "CWE-120", "title": "Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54257" }, { "rank": 89, "cve_id": "CVE-2026-47379", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00428, "epss_percentile": 0.35424, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-200", "title": "NocoDB: Plaintext Password Comparison in Shared Views", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47379" }, { "rank": 90, "cve_id": "CVE-2025-71337", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00422, "epss_percentile": 0.34945, "kev": false, "kev_due_at": null, "vendor": "Flowise", "product": "Flowise", "cwe": "CWE-620", "title": "Flowise - Unverified Email Change via Account Profile Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71337" }, { "rank": 91, "cve_id": "CVE-2026-56785", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00421, "epss_percentile": 0.34859, "kev": false, "kev_due_at": null, "vendor": "FlatPress", "product": "FlatPress", "cwe": "CWE-79", "title": "FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56785" }, { "rank": 92, "cve_id": "CVE-2026-47384", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00421, "epss_percentile": 0.34825, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-89", "title": "NocoDB: SQL Injection via Column Title in Bulk GroupBy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47384" }, { "rank": 93, "cve_id": "CVE-2026-54010", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0042, "epss_percentile": 0.34735, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-284", "title": "Open WebUI: Forged chat-file link allows cross-user file read and deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54010" }, { "rank": 94, "cve_id": "CVE-2026-56762", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00418, "epss_percentile": 0.34539, "kev": false, "kev_due_at": null, "vendor": "Hono", "product": "Hono", "cwe": "CWE-20", "title": "Hono - Missing Cookie Name Validation in setCookie()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56762" }, { "rank": 95, "cve_id": "CVE-2026-55654", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00415, "epss_percentile": 0.34275, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-125", "title": "Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55654" }, { "rank": 96, "cve_id": "CVE-2026-56225", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00412, "epss_percentile": 0.34021, "kev": false, "kev_due_at": null, "vendor": "Capgo", "product": "Capgo", "cwe": "CWE-269", "title": "Capgo - Authorization Bypass in API Key Management via App-Limited Keys", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56225" }, { "rank": 97, "cve_id": "CVE-2026-44961", "cvss_base": 0, "cvss_severity": "NONE", "epss_score": 0.00412, "epss_percentile": 0.3403, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-287", "title": "The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44961" }, { "rank": 98, "cve_id": "CVE-2026-46551", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00411, "epss_percentile": 0.33894, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-770", "title": "NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46551" }, { "rank": 99, "cve_id": "CVE-2026-8379", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00406, "epss_percentile": 0.33515, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Frontend File Manager Plugin", "cwe": null, "title": "Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8379" }, { "rank": 100, "cve_id": "CVE-2026-47279", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00406, "epss_percentile": 0.3341, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-284", "title": "NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47279" }, { "rank": 101, "cve_id": "CVE-2026-47378", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00406, "epss_percentile": 0.33412, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-639", "title": "NocoDB: Hidden Column Exposure in Public Shared View Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47378" }, { "rank": 102, "cve_id": "CVE-2026-53931", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00406, "epss_percentile": 0.3341, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-441", "title": "NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53931" }, { "rank": 103, "cve_id": "CVE-2026-53926", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00406, "epss_percentile": 0.3341, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-613", "title": "NocoDB: OAuth Tokens Persist Through Security Events", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53926" }, { "rank": 104, "cve_id": "CVE-2026-47377", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00406, "epss_percentile": 0.33411, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-601", "title": "NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47377" }, { "rank": 105, "cve_id": "CVE-2026-46553", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00406, "epss_percentile": 0.33425, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-770", "title": "NocoDB: Attachment Size Limit Bypass via Upload-by-URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46553" }, { "rank": 106, "cve_id": "CVE-2026-56695", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00402, "epss_percentile": 0.33005, "kev": false, "kev_due_at": null, "vendor": "HKUDS", "product": "OpenHarness", "cwe": "CWE-862", "title": "OpenHarness - Cross-Session Disclosure via /resume and /summary Commands", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56695" }, { "rank": 107, "cve_id": "CVE-2026-56234", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.004, "epss_percentile": 0.32852, "kev": false, "kev_due_at": null, "vendor": "Capgo", "product": "Capgo", "cwe": "CWE-307", "title": "Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56234" }, { "rank": 108, "cve_id": "CVE-2026-12969", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.004, "epss_percentile": 0.32831, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-125", "title": "Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12969" }, { "rank": 109, "cve_id": "CVE-2026-54321", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00398, "epss_percentile": 0.32664, "kev": false, "kev_due_at": null, "vendor": "daytonaio", "product": "daytona", "cwe": "CWE-613", "title": "Daytona: Public sandbox previews remain accessible for up to one hour after being made private", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54321" }, { "rank": 110, "cve_id": "CVE-2026-47387", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.32459, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-79", "title": "NocoDB: Stored Cross-Site Scripting via Form View Redirect URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47387" }, { "rank": 111, "cve_id": "CVE-2026-47383", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.32459, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-79", "title": "NocoDB: Stored Cross-Site Scripting via Row Comments", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47383" }, { "rank": 112, "cve_id": "CVE-2026-54312", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.32395, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-1321", "title": "n8n: Microsoft SQL Node Prototype Pollution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54312" }, { "rank": 113, "cve_id": "CVE-2026-56701", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.32398, "kev": false, "kev_due_at": null, "vendor": "Grav", "product": "Grav", "cwe": "CWE-611", "title": "Grav - XML External Entity Injection via SVG Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56701" }, { "rank": 114, "cve_id": "CVE-2026-53929", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00396, "epss_percentile": 0.32459, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-79", "title": "NocoDB: Stored Cross-Site Scripting via Secure Attachment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53929" }, { "rank": 115, "cve_id": "CVE-2026-53622", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00395, "epss_percentile": 0.32334, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-288", "title": "Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53622" }, { "rank": 116, "cve_id": "CVE-2026-11820", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00394, "epss_percentile": 0.32254, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-532", "title": "Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11820" }, { "rank": 117, "cve_id": "CVE-2026-7842", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00391, "epss_percentile": 0.31895, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Infility Global", "cwe": null, "title": "Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7842" }, { "rank": 118, "cve_id": "CVE-2026-54311", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00391, "epss_percentile": 0.3193, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-488", "title": "n8n: Merge Node SQL Mode Prototype Pollution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54311" }, { "rank": 119, "cve_id": "CVE-2026-44956", "cvss_base": 0, "cvss_severity": "NONE", "epss_score": 0.00389, "epss_percentile": 0.31728, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-79", "title": "Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is included in system‑generated emails, whose content is stored in the details field of the userlog table. An admin user viewing the email content through userlog-details.php would have any malicious JavaScript payload executed due to missing output sanitisation. Proper escaping has been added to the userlog details output.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44956" }, { "rank": 120, "cve_id": "CVE-2026-44960", "cvss_base": 0, "cvss_severity": "NONE", "epss_score": 0.00389, "epss_percentile": 0.31728, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-79", "title": "A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation. Proper escaping has been added to the audit log details output.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44960" }, { "rank": 121, "cve_id": "CVE-2026-34914", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00388, "epss_percentile": 0.3157, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-89", "title": "A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34914" }, { "rank": 122, "cve_id": "CVE-2026-53927", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00388, "epss_percentile": 0.31604, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-918", "title": "NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53927" }, { "rank": 123, "cve_id": "CVE-2026-53930", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00388, "epss_percentile": 0.31603, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-918", "title": "NocoDB: Server-Side Request Forgery via Base Migration URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53930" }, { "rank": 124, "cve_id": "CVE-2026-44792", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00387, "epss_percentile": 0.31476, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-89", "title": "n8n: Source Control Pull SQL Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44792" }, { "rank": 125, "cve_id": "CVE-2026-23513", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00387, "epss_percentile": 0.31455, "kev": false, "kev_due_at": null, "vendor": "FOSSBilling", "product": "FOSSBilling", "cwe": "CWE-863", "title": "FOSSBilling: Broken Authorization in Client Transaction and Order Listings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23513" }, { "rank": 126, "cve_id": "CVE-2026-56243", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00386, "epss_percentile": 0.31355, "kev": false, "kev_due_at": null, "vendor": "Capgo", "product": "Capgo", "cwe": "CWE-288", "title": "Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56243" }, { "rank": 127, "cve_id": "CVE-2026-54307", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00386, "epss_percentile": 0.31348, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-863", "title": "n8n: Credential Exfiltration via Permission Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54307" }, { "rank": 128, "cve_id": "CVE-2026-54018", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00386, "epss_percentile": 0.31337, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-918", "title": "Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54018" }, { "rank": 129, "cve_id": "CVE-2026-54019", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00386, "epss_percentile": 0.31337, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-862", "title": "Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54019" }, { "rank": 130, "cve_id": "CVE-2026-49444", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00385, "epss_percentile": 0.31252, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-20", "title": "n8n: Python sandbox escape", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49444" }, { "rank": 131, "cve_id": "CVE-2026-54517", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00384, "epss_percentile": 0.31169, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-863", "title": "jackson-databind: @JsonView bypass for setterless creator properties", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54517" }, { "rank": 132, "cve_id": "CVE-2026-54304", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00382, "epss_percentile": 0.31007, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-200", "title": "n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54304" }, { "rank": 133, "cve_id": "CVE-2026-54009", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00382, "epss_percentile": 0.31002, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-639", "title": "Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54009" }, { "rank": 134, "cve_id": "CVE-2026-34917", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.0038, "epss_percentile": 0.30729, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-287", "title": "Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34917" }, { "rank": 135, "cve_id": "CVE-2026-56402", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00376, "epss_percentile": 0.30322, "kev": false, "kev_due_at": null, "vendor": "nanocoai", "product": "nanoclaw", "cwe": "CWE-862", "title": "NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56402" }, { "rank": 136, "cve_id": "CVE-2026-47375", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00376, "epss_percentile": 0.30298, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-89", "title": "NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47375" }, { "rank": 137, "cve_id": "CVE-2026-47693", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00375, "epss_percentile": 0.30234, "kev": false, "kev_due_at": null, "vendor": "poweradmin", "product": "poweradmin", "cwe": "CWE-1236", "title": "Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47693" }, { "rank": 138, "cve_id": "CVE-2026-10609", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00375, "epss_percentile": 0.30204, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift", "cwe": "CWE-862", "title": "Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10609" }, { "rank": 139, "cve_id": "CVE-2026-54305", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00374, "epss_percentile": 0.30094, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-200", "title": "n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54305" }, { "rank": 140, "cve_id": "CVE-2026-56696", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0037, "epss_percentile": 0.29712, "kev": false, "kev_due_at": null, "vendor": "HKUDS", "product": "OpenHarness", "cwe": "CWE-862", "title": "OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56696" }, { "rank": 141, "cve_id": "CVE-2026-54761", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00369, "epss_percentile": 0.29518, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-284", "title": "Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54761" }, { "rank": 142, "cve_id": "CVE-2026-54514", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00368, "epss_percentile": 0.29446, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-918", "title": "jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54514" }, { "rank": 143, "cve_id": "CVE-2026-55736", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00367, "epss_percentile": 0.29343, "kev": false, "kev_due_at": null, "vendor": "ash-project", "product": "ash", "cwe": "CWE-915", "title": "Private action arguments can be set by user input in Ash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55736" }, { "rank": 144, "cve_id": "CVE-2026-10711", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00366, "epss_percentile": 0.29247, "kev": false, "kev_due_at": null, "vendor": "AKIN Software Computer Import Export Industry and Trade Ltd.", "product": "CafePlus", "cwe": "CWE-306", "title": "RCE in Akınsoft's CafePlus", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10711" }, { "rank": 145, "cve_id": "CVE-2025-62180", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00364, "epss_percentile": 0.29109, "kev": false, "kev_due_at": null, "vendor": "Pegasystems", "product": "Pega Infinity", "cwe": "CWE-639", "title": "Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62180" }, { "rank": 146, "cve_id": "CVE-2025-64105", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00364, "epss_percentile": 0.29111, "kev": false, "kev_due_at": null, "vendor": "FOSSBilling", "product": "FOSSBilling", "cwe": "CWE-639", "title": "FOSSBilling: IDOR Vulnerability in Support Ticket Creation", "url": "https://www.cve.org/CVERecord?id=CVE-2025-64105" }, { "rank": 147, "cve_id": "CVE-2026-56784", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00363, "epss_percentile": 0.29019, "kev": false, "kev_due_at": null, "vendor": "openremote", "product": "openremote", "cwe": "CWE-639", "title": "OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56784" }, { "rank": 148, "cve_id": "CVE-2026-54014", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00361, "epss_percentile": 0.28743, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-22", "title": "Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54014" }, { "rank": 149, "cve_id": "CVE-2026-54518", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00354, "epss_percentile": 0.2808, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-863", "title": "jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54518" }, { "rank": 150, "cve_id": "CVE-2026-54320", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00352, "epss_percentile": 0.27805, "kev": false, "kev_due_at": null, "vendor": "daytonaio", "product": "daytona", "cwe": "CWE-287", "title": "Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54320" }, { "rank": 151, "cve_id": "CVE-2026-47382", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00351, "epss_percentile": 0.27653, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-918", "title": "NocoDB: Server-Side Request Forgery via Database Connection Host", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47382" }, { "rank": 152, "cve_id": "CVE-2026-45732", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0035, "epss_percentile": 0.27562, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-639", "title": "n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45732" }, { "rank": 153, "cve_id": "CVE-2026-4610", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27488, "kev": false, "kev_due_at": null, "vendor": "metagauss", "product": "ProfileGrid – User Profiles, Groups and Communities", "cwe": "CWE-79", "title": "ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4610" }, { "rank": 154, "cve_id": "CVE-2026-54022", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00347, "epss_percentile": 0.27296, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-706", "title": "Open WebUI: Any authenticated user can read other users' private notes via Socket.IO", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54022" }, { "rank": 155, "cve_id": "CVE-2026-54515", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.27077, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-databind", "cwe": "CWE-915", "title": "jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54515" }, { "rank": 156, "cve_id": "CVE-2026-56263", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00344, "epss_percentile": 0.26903, "kev": false, "kev_due_at": null, "vendor": "Crawl4AI", "product": "Crawl4AI", "cwe": "CWE-79", "title": "Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56263" }, { "rank": 157, "cve_id": "CVE-2026-54313", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00343, "epss_percentile": 0.26843, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-89", "title": "n8n: NoSQL Injection in MongoDB Node Find And Replace Operation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54313" }, { "rank": 158, "cve_id": "CVE-2026-44958", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00339, "epss_percentile": 0.26395, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-284", "title": "An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44958" }, { "rank": 159, "cve_id": "CVE-2026-54011", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00336, "epss_percentile": 0.2602, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-79", "title": "Open WebUI: Stored XSS in Mermaid Markdown Preview", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54011" }, { "rank": 160, "cve_id": "CVE-2026-48491", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00328, "epss_percentile": 0.25122, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-288", "title": "Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48491" }, { "rank": 161, "cve_id": "CVE-2026-54008", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00326, "epss_percentile": 0.24874, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-918", "title": "Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54008" }, { "rank": 162, "cve_id": "CVE-2026-54012", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00325, "epss_percentile": 0.2474, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-284", "title": "Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54012" }, { "rank": 163, "cve_id": "CVE-2026-56376", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.0032, "epss_percentile": 0.24191, "kev": false, "kev_due_at": null, "vendor": "ImageMagick", "product": "ImageMagick", "cwe": "CWE-416", "title": "ImageMagick - Heap Use-After-Free in Meta Coder", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56376" }, { "rank": 164, "cve_id": "CVE-2026-50019", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00319, "epss_percentile": 0.24145, "kev": false, "kev_due_at": null, "vendor": "yt-dlp", "product": "yt-dlp", "cwe": "CWE-200", "title": "yt-dlp: File Downloader cookie leak with curl", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50019" }, { "rank": 165, "cve_id": "CVE-2026-56275", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00315, "epss_percentile": 0.23635, "kev": false, "kev_due_at": null, "vendor": "Flowise", "product": "Flowise", "cwe": "CWE-918", "title": "Flowise - Server-Side Request Forgery via Execute Flow Base URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56275" }, { "rank": 166, "cve_id": "CVE-2026-55517", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00315, "epss_percentile": 0.23669, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-248", "title": "Deno: Denial of service via non-ASCII bytes in WebSocket response headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55517" }, { "rank": 167, "cve_id": "CVE-2026-47380", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00314, "epss_percentile": 0.2353, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-208", "title": "NocoDB: User Enumeration via Sign-In Timing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47380" }, { "rank": 168, "cve_id": "CVE-2026-53928", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00314, "epss_percentile": 0.2353, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-613", "title": "NocoDB: Refresh Tokens Persist Through Password Recovery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53928" }, { "rank": 169, "cve_id": "CVE-2026-46554", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00314, "epss_percentile": 0.23531, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-613", "title": "NocoDB: Stale Auth Cache After API Token Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46554" }, { "rank": 170, "cve_id": "CVE-2026-46552", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00313, "epss_percentile": 0.23431, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-285", "title": "NocoDB: Shared-base link access can invite arbitrary users as persistent base members", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46552" }, { "rank": 171, "cve_id": "CVE-2026-4983", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.0031, "epss_percentile": 0.23073, "kev": false, "kev_due_at": null, "vendor": "Eclipse Foundation", "product": "Eclipse Open VSX", "cwe": "CWE-79", "title": "Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serves them with Content-Type: image/svg+xml without security headers such as Content-Security-Policy or Content-Disposition: attachment. This allows an attacker to publish an extension with a malicious SVG icon and achieve stored cross-site scripting (XSS) when a user navigates directly to the icon URL. On deployments using local storage, script execution occurs within the Open VSX application origin, enabling session hijacking, authentication token theft, and unauthorized extension publishing. On deployments backed by external storage (such as open-vsx.org with an S3-backed CDN), execution is confined to the storage origin, reducing impact but still permitting phishing attacks and credential harvesting through attacker-crafted pages.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4983" }, { "rank": 172, "cve_id": "CVE-2026-44089", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00309, "epss_percentile": 0.22997, "kev": false, "kev_due_at": null, "vendor": "Totolink", "product": "EX1200L", "cwe": "CWE-121", "title": "Buffer Overflow in Totolink EX1200L router", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44089" }, { "rank": 173, "cve_id": "CVE-2026-54317", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00308, "epss_percentile": 0.22884, "kev": false, "kev_due_at": null, "vendor": "home-assistant", "product": "core", "cwe": "CWE-200", "title": "Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54317" }, { "rank": 174, "cve_id": "CVE-2026-48493", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00306, "epss_percentile": 0.22619, "kev": false, "kev_due_at": null, "vendor": "grokability", "product": "snipe-it", "cwe": "CWE-863", "title": "Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48493" }, { "rank": 175, "cve_id": "CVE-2026-54322", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00304, "epss_percentile": 0.22454, "kev": false, "kev_due_at": null, "vendor": "daytonaio", "product": "daytona", "cwe": "CWE-639", "title": "Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54322" }, { "rank": 176, "cve_id": "CVE-2026-54016", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00304, "epss_percentile": 0.22418, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-639", "title": "Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54016" }, { "rank": 177, "cve_id": "CVE-2026-54013", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.003, "epss_percentile": 0.22051, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-79", "title": "Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54013" }, { "rank": 178, "cve_id": "CVE-2026-54308", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00299, "epss_percentile": 0.21903, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-290", "title": "n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54308" }, { "rank": 179, "cve_id": "CVE-2026-54006", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00299, "epss_percentile": 0.21922, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-639", "title": "Open WebUI: Calendar event re-parenting allows writing events into another user's calendar", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54006" }, { "rank": 180, "cve_id": "CVE-2026-56694", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00294, "epss_percentile": 0.21373, "kev": false, "kev_due_at": null, "vendor": "nanocoai", "product": "nanoclaw", "cwe": "CWE-863", "title": "NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56694" }, { "rank": 181, "cve_id": "CVE-2026-46548", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00294, "epss_percentile": 0.21344, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-918", "title": "NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46548" }, { "rank": 182, "cve_id": "CVE-2026-52845", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00291, "epss_percentile": 0.21079, "kev": false, "kev_due_at": null, "vendor": "caddyserver", "product": "caddy", "cwe": "CWE-287", "title": "Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52845" }, { "rank": 183, "cve_id": "CVE-2026-55653", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0029, "epss_percentile": 0.20897, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-415", "title": "Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55653" }, { "rank": 184, "cve_id": "CVE-2026-56116", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00288, "epss_percentile": 0.20747, "kev": false, "kev_due_at": null, "vendor": "NetworkConfiguration", "product": "dhcpcd", "cwe": "CWE-401", "title": "dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56116" }, { "rank": 185, "cve_id": "CVE-2026-56968", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00286, "epss_percentile": 0.20495, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "GNU SASL", "cwe": "CWE-908", "title": "GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56968" }, { "rank": 186, "cve_id": "CVE-2026-54021", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00283, "epss_percentile": 0.20229, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-863", "title": "Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54021" }, { "rank": 187, "cve_id": "CVE-2026-54306", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.0028, "epss_percentile": 0.19893, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-1321", "title": "n8n: Prototype Pollution enables confused-deputy execution via public webhooks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54306" }, { "rank": 188, "cve_id": "CVE-2026-12891", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00272, "epss_percentile": 0.19014, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-125", "title": "Gstreamer1-plugins-bad: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12891" }, { "rank": 189, "cve_id": "CVE-2026-47388", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00271, "epss_percentile": 0.18788, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-639", "title": "NocoDB: Missing Ownership Check in MCP Attachment Read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47388" }, { "rank": 190, "cve_id": "CVE-2026-34912", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.0027, "epss_percentile": 0.18634, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-284", "title": "A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low‑privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34912" }, { "rank": 191, "cve_id": "CVE-2026-34913", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.0027, "epss_percentile": 0.18634, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-284", "title": "A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34913" }, { "rank": 192, "cve_id": "CVE-2026-44957", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.0027, "epss_percentile": 0.18634, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-284", "title": "A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44957" }, { "rank": 193, "cve_id": "CVE-2026-11833", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00269, "epss_percentile": 0.18581, "kev": false, "kev_due_at": null, "vendor": "Yokogawa Electric Corporation", "product": "FAST/TOOLS", "cwe": "CWE-319", "title": "Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This information could be exploited by an attacker for other attacks. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04 CI Server (All packages) R1.01 to R1.04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11833" }, { "rank": 194, "cve_id": "CVE-2026-54015", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00269, "epss_percentile": 0.18567, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-284", "title": "Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54015" }, { "rank": 195, "cve_id": "CVE-2026-56113", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00269, "epss_percentile": 0.18547, "kev": false, "kev_due_at": null, "vendor": "NetworkConfiguration", "product": "dhcpcd", "cwe": "CWE-416", "title": "dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56113" }, { "rank": 196, "cve_id": "CVE-2026-56114", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00269, "epss_percentile": 0.18547, "kev": false, "kev_due_at": null, "vendor": "NetworkConfiguration", "product": "dhcpcd", "cwe": "CWE-787", "title": "dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56114" }, { "rank": 197, "cve_id": "CVE-2026-8172", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00268, "epss_percentile": 0.18497, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Simple Basic Contact Form", "cwe": null, "title": "Simple Basic Contact Form <= 20250114 - Reflected XSS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8172" }, { "rank": 198, "cve_id": "CVE-2026-46547", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00265, "epss_percentile": 0.17926, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-79", "title": "NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46547" }, { "rank": 199, "cve_id": "CVE-2020-9711", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00261, "epss_percentile": 0.17395, "kev": false, "kev_due_at": null, "vendor": "Adobe", "product": "Acrobat Reader", "cwe": "CWE-125", "title": "Acrobat Reader | Out-of-bounds Read (CWE-125)", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9711" }, { "rank": 200, "cve_id": "CVE-2020-9713", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00261, "epss_percentile": 0.17395, "kev": false, "kev_due_at": null, "vendor": "Adobe", "product": "Acrobat Reader", "cwe": "CWE-125", "title": "Acrobat Reader | Out-of-bounds Read (CWE-125)", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9713" }, { "rank": 201, "cve_id": "CVE-2026-34915", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0026, "epss_percentile": 0.1729, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-79", "title": "A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34915" }, { "rank": 202, "cve_id": "CVE-2020-9695", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00259, "epss_percentile": 0.17253, "kev": false, "kev_due_at": null, "vendor": "Adobe", "product": "Acrobat Reader", "cwe": "CWE-787", "title": "Acrobat Reader | Out-of-bounds Write (CWE-787)", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9695" }, { "rank": 203, "cve_id": "CVE-2026-47386", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00256, "epss_percentile": 0.16793, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-362", "title": "NocoDB: OAuth Authorization Code Race Condition", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47386" }, { "rank": 204, "cve_id": "CVE-2026-10857", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16445, "kev": false, "kev_due_at": null, "vendor": "AKIN Software Computer Import Export Industry and Trade Ltd.", "product": "e-Commerce", "cwe": "CWE-79", "title": "Reflected XSS in Akinsoft's e-Commerce", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10857" }, { "rank": 205, "cve_id": "CVE-2026-5818", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00245, "epss_percentile": 0.15493, "kev": false, "kev_due_at": null, "vendor": "Caliptra", "product": "Core Runtime Firmware", "cwe": "CWE-253", "title": "MCU Firmware Update Authentication Bypass on Caliptra Core", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5818" }, { "rank": 206, "cve_id": "CVE-2026-54319", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00243, "epss_percentile": 0.15204, "kev": false, "kev_due_at": null, "vendor": "daytonaio", "product": "daytona", "cwe": "CWE-22", "title": "Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54319" }, { "rank": 207, "cve_id": "CVE-2026-12163", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00242, "epss_percentile": 0.15091, "kev": false, "kev_due_at": null, "vendor": "Fortra", "product": "File Integrity Monitoring (FIM)", "cwe": "CWE-79", "title": "Stored XSS in Fortra File Integrity Monitoring (FIM)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12163" }, { "rank": 208, "cve_id": "CVE-2026-46549", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00241, "epss_percentile": 0.15012, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-863", "title": "NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46549" }, { "rank": 209, "cve_id": "CVE-2026-54301", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00238, "epss_percentile": 0.14593, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-79", "title": "n8n: Same-Origin XSS in Respond to Webhook Node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54301" }, { "rank": 210, "cve_id": "CVE-2026-49440", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00237, "epss_percentile": 0.14487, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-325", "title": "Deno: Miller-Rabin Primality Test Allows Zero Rounds", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49440" }, { "rank": 211, "cve_id": "CVE-2026-44726", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00234, "epss_percentile": 0.14104, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-319", "title": "Deno: TLS retry copies stale upgrade hook, risking plaintext traffic", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44726" }, { "rank": 212, "cve_id": "CVE-2026-54007", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00231, "epss_percentile": 0.13765, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-346", "title": "Open WebUI: Cross-origin postMessage confirmation bypass via action:submit", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54007" }, { "rank": 213, "cve_id": "CVE-2026-54302", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00231, "epss_percentile": 0.13703, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-79", "title": "n8n: Stored XSS in Chat Trigger Node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54302" }, { "rank": 214, "cve_id": "CVE-2026-54303", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00231, "epss_percentile": 0.13704, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-79", "title": "n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54303" }, { "rank": 215, "cve_id": "CVE-2026-55766", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00229, "epss_percentile": 0.13501, "kev": false, "kev_due_at": null, "vendor": "guzzle", "product": "psr7", "cwe": "CWE-93", "title": "guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55766" }, { "rank": 216, "cve_id": "CVE-2026-8378", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13072, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Frontend File Manager Plugin", "cwe": null, "title": "Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8378" }, { "rank": 217, "cve_id": "CVE-2026-55423", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12501, "kev": false, "kev_due_at": null, "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-613", "title": "Langflow: Logout button does not clear session", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55423" }, { "rank": 218, "cve_id": "CVE-2026-12112", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00216, "epss_percentile": 0.11834, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Satellite 6.18", "cwe": "CWE-287", "title": "Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12112" }, { "rank": 219, "cve_id": "CVE-2026-55767", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00211, "epss_percentile": 0.11259, "kev": false, "kev_due_at": null, "vendor": "guzzle", "product": "guzzle", "cwe": "CWE-346", "title": "Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55767" }, { "rank": 220, "cve_id": "CVE-2026-9073", "cvss_base": 6.2, "cvss_severity": "MEDIUM", "epss_score": 0.00208, "epss_percentile": 0.10848, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Satellite 6.18", "cwe": "CWE-532", "title": "Foreman-mcp-server: mcp server: insecure sensitive http header sanitization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9073" }, { "rank": 221, "cve_id": "CVE-2026-49401", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00197, "epss_percentile": 0.094, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-41", "title": "Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49401" }, { "rank": 222, "cve_id": "CVE-2026-6458", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00197, "epss_percentile": 0.09447, "kev": false, "kev_due_at": null, "vendor": "Caliptra", "product": "Core Runtime Firmware", "cwe": "CWE-325", "title": "AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6458" }, { "rank": 223, "cve_id": "CVE-2026-54555", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00196, "epss_percentile": 0.0934, "kev": false, "kev_due_at": null, "vendor": "rtk-ai", "product": "rtk", "cwe": "CWE-863", "title": "rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54555" }, { "rank": 224, "cve_id": "CVE-2026-12958", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00191, "epss_percentile": 0.08765, "kev": false, "kev_due_at": null, "vendor": "Amazon Web Services", "product": "Language Servers for AWS", "cwe": "CWE-61", "title": "Arbitrary file write in Language Servers for AWS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12958" }, { "rank": 225, "cve_id": "CVE-2026-52846", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00189, "epss_percentile": 0.08485, "kev": false, "kev_due_at": null, "vendor": "caddyserver", "product": "caddy", "cwe": "CWE-116", "title": "Caddy: stripHTML template function bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52846" }, { "rank": 226, "cve_id": "CVE-2026-54323", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00185, "epss_percentile": 0.08062, "kev": false, "kev_due_at": null, "vendor": "daytonaio", "product": "daytona", "cwe": "CWE-295", "title": "Daytona: Git credential leak via git clone with TLS verification disabled", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54323" }, { "rank": 227, "cve_id": "CVE-2026-49406", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.07085, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-22", "title": "Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49406" }, { "rank": 228, "cve_id": "CVE-2026-56815", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00173, "epss_percentile": 0.06698, "kev": false, "kev_due_at": null, "vendor": "rasta-mouse", "product": "pwnlift", "cwe": "CWE-61", "title": "pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56815" }, { "rank": 229, "cve_id": "CVE-2026-54326", "cvss_base": 2.5, "cvss_severity": "LOW", "epss_score": 0.00172, "epss_percentile": 0.06674, "kev": false, "kev_due_at": null, "vendor": "earendil-works", "product": "pi", "cwe": "CWE-79", "title": "Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54326" }, { "rank": 230, "cve_id": "CVE-2026-12957", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00171, "epss_percentile": 0.06536, "kev": false, "kev_due_at": null, "vendor": "Amazon Web Services", "product": "Language Servers for AWS", "cwe": "CWE-732", "title": "Arbitrary Code Execution in Language Servers for AWS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12957" }, { "rank": 231, "cve_id": "CVE-2026-54318", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00168, "epss_percentile": 0.06294, "kev": false, "kev_due_at": null, "vendor": "home-assistant", "product": "core", "cwe": "CWE-926", "title": "Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54318" }, { "rank": 232, "cve_id": "CVE-2026-45692", "cvss_base": 3.8, "cvss_severity": "LOW", "epss_score": 0.00167, "epss_percentile": 0.06089, "kev": false, "kev_due_at": null, "vendor": "caddyserver", "product": "caddy", "cwe": "CWE-187", "title": "Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45692" }, { "rank": 233, "cve_id": "CVE-2026-56692", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00166, "epss_percentile": 0.05987, "kev": false, "kev_due_at": null, "vendor": "nanocoai", "product": "nanoclaw", "cwe": "CWE-59", "title": "NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56692" }, { "rank": 234, "cve_id": "CVE-2026-56693", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00165, "epss_percentile": 0.05936, "kev": false, "kev_due_at": null, "vendor": "nanocoai", "product": "nanoclaw", "cwe": "CWE-602", "title": "NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56693" }, { "rank": 235, "cve_id": "CVE-2026-54325", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00165, "epss_percentile": 0.05856, "kev": false, "kev_due_at": null, "vendor": "earendil-works", "product": "pi", "cwe": "CWE-829", "title": "Pi loads project-local extensions without approval", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54325" }, { "rank": 236, "cve_id": "CVE-2026-54328", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00164, "epss_percentile": 0.05775, "kev": false, "kev_due_at": null, "vendor": "earendil-works", "product": "pi", "cwe": "CWE-379", "title": "Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54328" }, { "rank": 237, "cve_id": "CVE-2026-11819", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00161, "epss_percentile": 0.05467, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-532", "title": "Community.general: community.general keyring_info — os keyring passphrase returned in plaintext", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11819" }, { "rank": 238, "cve_id": "CVE-2026-46550", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00159, "epss_percentile": 0.05247, "kev": false, "kev_due_at": null, "vendor": "nocodb", "product": "nocodb", "cwe": "CWE-614", "title": "NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46550" }, { "rank": 239, "cve_id": "CVE-2026-49411", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00158, "epss_percentile": 0.05117, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-284", "title": "Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49411" }, { "rank": 240, "cve_id": "CVE-2025-15619", "cvss_base": 3.5, "cvss_severity": "LOW", "epss_score": 0.00158, "epss_percentile": 0.05147, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Connections", "cwe": "CWE-284", "title": "HCL Connections is vulnerable to broken access control", "url": "https://www.cve.org/CVERecord?id=CVE-2025-15619" }, { "rank": 241, "cve_id": "CVE-2026-56301", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00149, "epss_percentile": 0.04319, "kev": false, "kev_due_at": null, "vendor": "Nuxt", "product": "Nuxt", "cwe": "CWE-276", "title": "Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56301" }, { "rank": 242, "cve_id": "CVE-2026-57053", "cvss_base": 2.5, "cvss_severity": "LOW", "epss_score": 0.00149, "epss_percentile": 0.04312, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "libidn", "cwe": "CWE-1284", "title": "GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57053" }, { "rank": 243, "cve_id": "CVE-2026-55568", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00148, "epss_percentile": 0.0422, "kev": false, "kev_due_at": null, "vendor": "guzzle", "product": "guzzle", "cwe": "CWE-311", "title": "Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55568" }, { "rank": 244, "cve_id": "CVE-2026-12164", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00145, "epss_percentile": 0.03969, "kev": false, "kev_due_at": null, "vendor": "Fortra", "product": "File Integrity Monitoring (FIM)", "cwe": "CWE-266", "title": "Privilege Escalation in Fortra File Integrity Monitoring (FIM)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12164" }, { "rank": 245, "cve_id": "CVE-2026-50221", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00144, "epss_percentile": 0.03929, "kev": false, "kev_due_at": null, "vendor": "OpenStack", "product": "Swift", "cwe": "CWE-918", "title": "In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause \"ghost listings\" in arbitrary containers via the shard-range redirect mechanism.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50221" }, { "rank": 246, "cve_id": "CVE-2026-57062", "cvss_base": 2.9, "cvss_severity": "LOW", "epss_score": 0.00142, "epss_percentile": 0.03764, "kev": false, "kev_due_at": null, "vendor": "GnuPG", "product": "GnuPG", "cwe": "CWE-1284", "title": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57062" }, { "rank": 247, "cve_id": "CVE-2026-49859", "cvss_base": 5.2, "cvss_severity": "MEDIUM", "epss_score": 0.00141, "epss_percentile": 0.03638, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-693", "title": "Deno: `fetch()` API sandbox bypass via missing DNS resolution check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49859" }, { "rank": 248, "cve_id": "CVE-2026-49860", "cvss_base": 5.2, "cvss_severity": "MEDIUM", "epss_score": 0.00141, "epss_percentile": 0.03638, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-918", "title": "Deno: WebSocket API sandbox bypass via missing post-DNS check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49860" }, { "rank": 249, "cve_id": "CVE-2026-49983", "cvss_base": 5.2, "cvss_severity": "MEDIUM", "epss_score": 0.0014, "epss_percentile": 0.03547, "kev": false, "kev_due_at": null, "vendor": "denoland", "product": "deno", "cwe": "CWE-863", "title": "Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49983" }, { "rank": 250, "cve_id": "CVE-2026-56117", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": 0.00135, "epss_percentile": 0.03202, "kev": false, "kev_due_at": null, "vendor": "NetworkConfiguration", "product": "dhcpcd", "cwe": "CWE-416", "title": "dhcpcd Heap Use-After-Free via Control Socket Handling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56117" }, { "rank": 251, "cve_id": "CVE-2026-0864", "cvss_base": 4.1, "cvss_severity": "MEDIUM", "epss_score": 0.00126, "epss_percentile": 0.02522, "kev": false, "kev_due_at": null, "vendor": "Python Software Foundation", "product": "CPython", "cwe": "CWE-74", "title": "Configuration Injection via Carriage Return (\\r) in write() method", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0864" }, { "rank": 252, "cve_id": "CVE-2026-12892", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00117, "epss_percentile": 0.01866, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-125", "title": "Gstreamer1-plugins-bad: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12892" }, { "rank": 253, "cve_id": "CVE-2025-13162", "cvss_base": 4.1, "cvss_severity": "MEDIUM", "epss_score": 0.00117, "epss_percentile": 0.01804, "kev": false, "kev_due_at": null, "vendor": "ABB", "product": "Control Builder A", "cwe": "CWE-427", "title": "Advant Master Online Builder DLL vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2025-13162" }, { "rank": 254, "cve_id": "CVE-2026-7574", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00115, "epss_percentile": 0.01728, "kev": false, "kev_due_at": null, "vendor": "Anthropic", "product": "Claude Desktop Cowork", "cwe": "CWE-353", "title": "Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7574" }, { "rank": 255, "cve_id": "CVE-2026-45792", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0011, "epss_percentile": 0.01377, "kev": false, "kev_due_at": null, "vendor": "rtk-ai", "product": "rtk", "cwe": "CWE-345", "title": "RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45792" }, { "rank": 256, "cve_id": "CVE-2026-54327", "cvss_base": 2.2, "cvss_severity": "LOW", "epss_score": 0.00093, "epss_percentile": 0.0062, "kev": false, "kev_due_at": null, "vendor": "earendil-works", "product": "pi", "cwe": "CWE-367", "title": "Pi: Race condition in auth.json writes could expose stored credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54327" }, { "rank": 257, "cve_id": "CVE-2026-55655", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00086, "epss_percentile": 0.00378, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-923", "title": "Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55655" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2025-55639", "detail": "EXPLOIT PUBLISHED — CVE-2025-55639. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2025-71337", "detail": "EXPLOIT PUBLISHED — CVE-2025-71337 (Flowise). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-33760", "detail": "EXPLOIT PUBLISHED — CVE-2026-33760 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-34908", "detail": "EXPLOIT PUBLISHED — CVE-2026-34908 (Ubiquiti Inc UniFi OS Server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-34909", "detail": "EXPLOIT PUBLISHED — CVE-2026-34909 (Ubiquiti Inc UniFi OS Server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-34910", "detail": "EXPLOIT PUBLISHED — CVE-2026-34910 (Ubiquiti Inc UniFi OS Server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-42867", "detail": "EXPLOIT PUBLISHED — CVE-2026-42867 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-44726", "detail": "EXPLOIT PUBLISHED — CVE-2026-44726 (denoland deno). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45135", "detail": "EXPLOIT PUBLISHED — CVE-2026-45135 (caddyserver caddy). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45692", "detail": "EXPLOIT PUBLISHED — CVE-2026-45692 (caddyserver caddy). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-48020", "detail": "EXPLOIT PUBLISHED — CVE-2026-48020 (traefik). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-48491", "detail": "EXPLOIT PUBLISHED — CVE-2026-48491 (traefik). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-48519", "detail": "EXPLOIT PUBLISHED — CVE-2026-48519 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-48520", "detail": "EXPLOIT PUBLISHED — CVE-2026-48520 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-49401", "detail": "EXPLOIT PUBLISHED — CVE-2026-49401 (denoland deno). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-49402", "detail": "EXPLOIT PUBLISHED — CVE-2026-49402 (denoland deno). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-49406", "detail": "EXPLOIT PUBLISHED — CVE-2026-49406 (denoland deno). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-49411", "detail": "EXPLOIT PUBLISHED — CVE-2026-49411 (denoland deno). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-4983", "detail": "EXPLOIT PUBLISHED — CVE-2026-4983 (Eclipse Foundation Eclipse Open VSX). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-50023", "detail": "EXPLOIT PUBLISHED — CVE-2026-50023 (yt-dlp). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-50193", "detail": "EXPLOIT PUBLISHED — CVE-2026-50193 (FasterXML jackson-databind). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-50221", "detail": "EXPLOIT PUBLISHED — CVE-2026-50221 (OpenStack Swift). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-52844", "detail": "EXPLOIT PUBLISHED — CVE-2026-52844 (caddyserver caddy). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-52845", "detail": "EXPLOIT PUBLISHED — CVE-2026-52845 (caddyserver caddy). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-52846", "detail": "EXPLOIT PUBLISHED — CVE-2026-52846 (caddyserver caddy). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-53622", "detail": "EXPLOIT PUBLISHED — CVE-2026-53622 (traefik). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54006", "detail": "EXPLOIT PUBLISHED — CVE-2026-54006 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54007", "detail": "EXPLOIT PUBLISHED — CVE-2026-54007 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54008", "detail": "EXPLOIT PUBLISHED — CVE-2026-54008 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54009", "detail": "EXPLOIT PUBLISHED — CVE-2026-54009 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54010", "detail": "EXPLOIT PUBLISHED — CVE-2026-54010 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54011", "detail": "EXPLOIT PUBLISHED — CVE-2026-54011 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54012", "detail": "EXPLOIT PUBLISHED — CVE-2026-54012 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54013", "detail": "EXPLOIT PUBLISHED — CVE-2026-54013 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54014", "detail": "EXPLOIT PUBLISHED — CVE-2026-54014 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54015", "detail": "EXPLOIT PUBLISHED — CVE-2026-54015 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54016", "detail": "EXPLOIT PUBLISHED — CVE-2026-54016 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54018", "detail": "EXPLOIT PUBLISHED — CVE-2026-54018 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54019", "detail": "EXPLOIT PUBLISHED — CVE-2026-54019 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54022", "detail": "EXPLOIT PUBLISHED — CVE-2026-54022 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54317", "detail": "EXPLOIT PUBLISHED — CVE-2026-54317 (home-assistant core). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54318", "detail": "EXPLOIT PUBLISHED — CVE-2026-54318 (home-assistant core). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54512", "detail": "EXPLOIT PUBLISHED — CVE-2026-54512 (FasterXML jackson-databind). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54761", "detail": "EXPLOIT PUBLISHED — CVE-2026-54761 (traefik). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54762", "detail": "EXPLOIT PUBLISHED — CVE-2026-54762 (traefik). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55249", "detail": "EXPLOIT PUBLISHED — CVE-2026-55249 (rtk-ai rtk). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55423", "detail": "EXPLOIT PUBLISHED — CVE-2026-55423 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55446", "detail": "EXPLOIT PUBLISHED — CVE-2026-55446 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55447", "detail": "EXPLOIT PUBLISHED — CVE-2026-55447 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55450", "detail": "EXPLOIT PUBLISHED — CVE-2026-55450 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55653", "detail": "EXPLOIT PUBLISHED — CVE-2026-55653 (Red Hat Enterprise Linux 10). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55654", "detail": "EXPLOIT PUBLISHED — CVE-2026-55654 (Red Hat Enterprise Linux 10). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56274", "detail": "EXPLOIT PUBLISHED — CVE-2026-56274 (Flowise). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56275", "detail": "EXPLOIT PUBLISHED — CVE-2026-56275 (Flowise). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56968", "detail": "EXPLOIT PUBLISHED — CVE-2026-56968 (GNU SASL). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-57053", "detail": "EXPLOIT PUBLISHED — CVE-2026-57053 (GNU libidn). Public exploit reference added." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-42271", "detail": "DUE DATE PASSED — CVE-2026-42271 (BerriAI LiteLLM). CISA remediation deadline was June 22, 2026; still in catalog." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }