{
  "day": "2026-06-25",
  "boundary": "UTC calendar day",
  "published_count": 468,
  "by_severity": {
    "CRITICAL": 42,
    "HIGH": 219,
    "MEDIUM": 172,
    "LOW": 35
  },
  "kev_count": 2,
  "exploit_reference_count": 48,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-20230",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.882,
      "epss_percentile": 0.99754,
      "kev": true,
      "kev_due_at": "2026-06-28",
      "vendor": "Cisco",
      "product": "Cisco Unified Communications Manager",
      "cwe": "CWE-918",
      "title": "Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-20230"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-12569",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.40586,
      "epss_percentile": 0.98539,
      "kev": true,
      "kev_due_at": "2026-06-28",
      "vendor": "PTC",
      "product": "Windchill PDMLink",
      "cwe": "CWE-20",
      "title": "Remote Code Execution (RCE) vulnerability in Windchill PDMlink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12569"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2025-71334",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0436,
      "epss_percentile": 0.90494,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-73",
      "title": "Flowise - Arbitrary File Access via Missing Chat Flow ID Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71334"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-56766",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.02438,
      "epss_percentile": 0.83034,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vanhauser-thc",
      "product": "thc-hydra",
      "cwe": "CWE-121",
      "title": "Hydra - Stack Buffer Overflow in NTLM Authentication Handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56766"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-9717",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.01727,
      "epss_percentile": 0.75784,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schneider Electric",
      "product": "PowerLogic™ P7",
      "cwe": "CWE-78",
      "title": "CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts with a vulnerable network-exposed service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9717"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-9155",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01596,
      "epss_percentile": 0.73842,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Sed Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect Sed Plugin via expression parameter.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9155"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2025-71324",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0157,
      "epss_percentile": 0.73457,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-73",
      "title": "Flowise - Arbitrary File Read via chatId Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71324"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-54836",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01343,
      "epss_percentile": 0.69187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "YMC",
      "product": "YMC Filter",
      "cwe": "CWE-89",
      "title": "WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54836"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-8658",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01291,
      "epss_percentile": 0.68047,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Tcpdump Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8658"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-8659",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01291,
      "epss_percentile": 0.68048,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect SQLmap Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect SQLmap Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8659"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-8664",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01291,
      "epss_percentile": 0.68047,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Finger Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect Finger Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8664"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-8592",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01197,
      "epss_percentile": 0.65728,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect AWK Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect AWK Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8592"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-8660",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01197,
      "epss_percentile": 0.65729,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Ping Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect Ping Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8660"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-8665",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01197,
      "epss_percentile": 0.65728,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect TR Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect Translate Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8665"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-8666",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01197,
      "epss_percentile": 0.65728,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Traceroute Plugin",
      "cwe": "CWE-78",
      "title": "OS Command Injection in Rapid7 InsightConnect Traceroute Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8666"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2025-71336",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01148,
      "epss_percentile": 0.64369,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-78",
      "title": "Flowise - Unsandboxed Remote Code Execution via Custom MCP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71336"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-50548",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01011,
      "epss_percentile": 0.60527,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cursor",
      "product": "cursor",
      "cwe": "CWE-22",
      "title": "Cursor Desktop sandbox escape via agent-controlled working directory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50548"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-50549",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01011,
      "epss_percentile": 0.60527,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cursor",
      "product": "cursor",
      "cwe": "CWE-59",
      "title": "Cursor Desktop sandbox escape via symlink and failed path canonicalization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50549"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2025-71338",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00942,
      "epss_percentile": 0.58326,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-73",
      "title": "Flowise - Arbitrary File Write to Remote Code Execution via document-store API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71338"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2025-71333",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00902,
      "epss_percentile": 0.57006,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-73",
      "title": "Flowise - Arbitrary File Upload via Unauthenticated /api/v1/attachments Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71333"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-43920",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00901,
      "epss_percentile": 0.56993,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FOSSBilling",
      "product": "FOSSBilling",
      "cwe": "CWE-306",
      "title": "FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43920"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-45233",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.009,
      "epss_percentile": 0.5697,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danpros",
      "product": "htmly",
      "cwe": "CWE-22",
      "title": "HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45233"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-49506",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0087,
      "epss_percentile": 0.56061,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Wyse Management Suite",
      "cwe": "CWE-22",
      "title": "Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49506"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-46735",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0082,
      "epss_percentile": 0.54492,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Display and Peripheral Manager",
      "cwe": "CWE-78",
      "title": "Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46735"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-54823",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00789,
      "epss_percentile": 0.53467,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MarketingFire",
      "product": "Widget Options",
      "cwe": "CWE-94",
      "title": "WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54823"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-9086",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00781,
      "epss_percentile": 0.53189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.4",
      "cwe": "CWE-79",
      "title": "Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9086"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-9083",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0078,
      "epss_percentile": 0.53161,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.4",
      "cwe": "CWE-22",
      "title": "Keycloak: keycloak: information disclosure through arbitrary filesystem path probing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9083"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-54088",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00764,
      "epss_percentile": 0.52632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-78",
      "title": "File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54088"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-53176",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00732,
      "epss_percentile": 0.51578,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-191",
      "title": "IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53176"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-53199",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00716,
      "epss_percentile": 0.5099,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53199"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-56768",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00712,
      "epss_percentile": 0.50822,
      "kev": false,
      "kev_due_at": null,
      "vendor": "haiwen",
      "product": "seahub",
      "cwe": "CWE-862",
      "title": "Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56768"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-56786",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00711,
      "epss_percentile": 0.50791,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tomojitakasu",
      "product": "RTKLIB",
      "cwe": "CWE-787",
      "title": "RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56786"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-50176",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00711,
      "epss_percentile": 0.5079,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EVoke",
      "product": "EVoke CSMS",
      "cwe": "CWE-307",
      "title": "EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50176"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-53183",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00684,
      "epss_percentile": 0.49796,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mptcp: allow subflow rcv wnd to shrink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53183"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-53184",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00684,
      "epss_percentile": 0.49797,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "udp: clear skb->dev before running a sockmap verdict",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53184"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2025-71327",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00675,
      "epss_percentile": 0.49434,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-306",
      "title": "Flowise - Authentication Bypass via Unprotected Registration Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71327"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-56091",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00669,
      "epss_percentile": 0.4919,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Shiro",
      "cwe": "CWE-289",
      "title": "Apache Shiro: Authentication bypass in Guice-Web integration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56091"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-40702",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00646,
      "epss_percentile": 0.4818,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EVoke",
      "product": "EVoke CSMS",
      "cwe": "CWE-306",
      "title": "EVoke Systems EVoke CSMS Missing Authentication for Critical Function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40702"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-56445",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0064,
      "epss_percentile": 0.47909,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pydicom",
      "product": "pynetdicom Library",
      "cwe": "CWE-22",
      "title": "pydicom pynetdicom Library Path Traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56445"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-57520",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00639,
      "epss_percentile": 0.47844,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bitwarden",
      "product": "server",
      "cwe": "CWE-862",
      "title": "Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57520"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-9800",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00633,
      "epss_percentile": 0.47623,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.4",
      "cwe": "CWE-1025",
      "title": "Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9800"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-53198",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47456,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53198"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-38637",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47447,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-400",
      "title": "An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-38637"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-38640",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47448,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-400",
      "title": "A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted string.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-38640"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-53229",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47447,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53229"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-53235",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0063,
      "epss_percentile": 0.47448,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: add pskb_may_pull() to skb_gro_receive_list()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53235"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-12053",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00627,
      "epss_percentile": 0.47338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-532",
      "title": "Insertion of Sensitive Information into Log File in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12053"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-55477",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00615,
      "epss_percentile": 0.46767,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MHSanaei",
      "product": "3x-ui",
      "cwe": "CWE-73",
      "title": "Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55477"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-54089",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00612,
      "epss_percentile": 0.46588,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-287",
      "title": "File Browser: Authentication Bypass via Proxy Auth Header Forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54089"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-46601",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00609,
      "epss_percentile": 0.46456,
      "kev": false,
      "kev_due_at": null,
      "vendor": "golang.org/x/image",
      "product": "golang.org/x/image/webp",
      "cwe": null,
      "title": "Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46601"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-46602",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00609,
      "epss_percentile": 0.46456,
      "kev": false,
      "kev_due_at": null,
      "vendor": "golang.org/x/image",
      "product": "golang.org/x/image/tiff",
      "cwe": null,
      "title": "Lack of limit on tile sizes in x/image/tiff in golang.org/x/image",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46602"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-56767",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00597,
      "epss_percentile": 0.45916,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getmaxun",
      "product": "maxun",
      "cwe": "CWE-862",
      "title": "Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56767"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-56770",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00582,
      "epss_percentile": 0.45156,
      "kev": false,
      "kev_due_at": null,
      "vendor": "schwehr",
      "product": "libais",
      "cwe": "CWE-129",
      "title": "libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56770"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-56049",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00582,
      "epss_percentile": 0.45174,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Post Snippets",
      "product": "Post Snippets",
      "cwe": "CWE-94",
      "title": "WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56049"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-53240",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00565,
      "epss_percentile": 0.44334,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53240"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-56787",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00564,
      "epss_percentile": 0.44285,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tomojitakasu",
      "product": "RTKLIB",
      "cwe": "CWE-193",
      "title": "RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56787"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-56122",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00553,
      "epss_percentile": 0.43726,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rickknowles",
      "product": "Winstone Servlet Container",
      "cwe": "CWE-22",
      "title": "Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56122"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-56123",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00548,
      "epss_percentile": 0.43427,
      "kev": false,
      "kev_due_at": null,
      "vendor": "socat",
      "product": "socat",
      "cwe": "CWE-122",
      "title": "socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56123"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-54092",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00548,
      "epss_percentile": 0.43433,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-400",
      "title": "File Browser: DoS Vulnerability on Public Login API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54092"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-37453",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00541,
      "epss_percentile": 0.43049,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-200",
      "title": "Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSI_SERVICE_2 pipe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-37453"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-37452",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00535,
      "epss_percentile": 0.42731,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-200",
      "title": "Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSIAPService.exe component",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-37452"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-53248",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00528,
      "epss_percentile": 0.42308,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net: airoha: Fix use-after-free in metadata dst teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53248"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-50016",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00527,
      "epss_percentile": 0.42279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-23",
      "title": "pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50016"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-53217",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00524,
      "epss_percentile": 0.42071,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mvpp2: sync RX data at the hardware packet offset",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53217"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-57700",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00522,
      "epss_percentile": 0.41925,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Daan.dev",
      "product": "OMGF Pro",
      "cwe": "CWE-434",
      "title": "WordPress OMGF Pro plugin <= 5.2.6 - Arbitrary File Upload vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57700"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-56053",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00518,
      "epss_percentile": 0.41655,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EventPrime",
      "product": "EventPrime",
      "cwe": "CWE-502",
      "title": "WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56053"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-53224",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00517,
      "epss_percentile": 0.41649,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "sctp: validate embedded INIT chunk and address list lengths in cookie",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53224"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-54091",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00516,
      "epss_percentile": 0.41543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-863",
      "title": "File Browser: Incorrect access control in public directory shares via rule path rebasing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54091"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-6094",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00516,
      "epss_percentile": 0.41535,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-125",
      "title": "Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6094"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-53221",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41436,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53221"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-53228",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41438,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: sit: reload inner IPv6 header after GSO offloads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53228"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-53186",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41437,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/srp: bound SRP_RSP sense copy by the received length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53186"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-53225",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00514,
      "epss_percentile": 0.41436,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53225"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-54037",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00512,
      "epss_percentile": 0.41317,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-770",
      "title": "LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54037"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-5305",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00505,
      "epss_percentile": 0.4081,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Email Address Encoder",
      "cwe": null,
      "title": "Email Address Encoder (Free < 1.0.25, Premium < 0.3.12) - Unauthenticated Stored XSS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5305"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-6679",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00505,
      "epss_percentile": 0.40825,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-787",
      "title": "DTLS 1.3 ACK serialization heap buffer overflow via integer truncation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6679"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-12937",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00505,
      "epss_percentile": 0.40828,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themefic",
      "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin",
      "cwe": "CWE-89",
      "title": "Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12937"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-55439",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00505,
      "epss_percentile": 0.40805,
      "kev": false,
      "kev_due_at": null,
      "vendor": "halo-dev",
      "product": "halo",
      "cwe": "CWE-22",
      "title": "Halo: Path Traversal in Backup Download Leads to Arbitrary File Read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55439"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-54094",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00503,
      "epss_percentile": 0.40685,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-22",
      "title": "File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54094"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-53215",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00502,
      "epss_percentile": 0.40665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mvpp2: refill RX buffers before XDP or skb use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53215"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-53216",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00502,
      "epss_percentile": 0.40664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: mvpp2: limit XDP frame size to the RX buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53216"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-40083",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00502,
      "epss_percentile": 0.40624,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cacti",
      "product": "cacti",
      "cwe": "CWE-89",
      "title": "Cacti: SQL Injection in managers.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40083"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-54573",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00498,
      "epss_percentile": 0.40432,
      "kev": false,
      "kev_due_at": null,
      "vendor": "outline",
      "product": "outline",
      "cwe": "CWE-863",
      "title": "Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54573"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-7531",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00497,
      "epss_percentile": 0.40372,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-416",
      "title": "Use-after-free in PQC hybrid key-share handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7531"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-55667",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00494,
      "epss_percentile": 0.40151,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-22",
      "title": "File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55667"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-22879",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00491,
      "epss_percentile": 0.39941,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vtk",
      "product": "vtk",
      "cwe": "CWE-129",
      "title": "vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22879"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-9099",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0049,
      "epss_percentile": 0.39891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.4",
      "cwe": "CWE-639",
      "title": "Keycloak: group-admin escalation to realm-admin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9099"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-53165",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39761,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "iomap: avoid potential null folio->mapping deref during error reporting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53165"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-53244",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00488,
      "epss_percentile": 0.39765,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "VFS: fix possible failure to unlock in nfsd4_create_file()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53244"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-13351",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00486,
      "epss_percentile": 0.39635,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject-rtos",
      "product": "Zephyr",
      "cwe": "CWE-772",
      "title": "net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13351"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-53180",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00486,
      "epss_percentile": 0.39643,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "timers/migration: Fix livelock in tmigr_handle_remote_up()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53180"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-40084",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00486,
      "epss_percentile": 0.39617,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cacti",
      "product": "cacti",
      "cwe": "CWE-22",
      "title": "Cacti: Arbitrary File Read via Path Traversal in Report `format_file` Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40084"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-46752",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00481,
      "epss_percentile": 0.39301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Kvrocks",
      "cwe": "CWE-122",
      "title": "Apache Kvrocks: Stack buffer overflow in Lua bit.tohex()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46752"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-56774",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00477,
      "epss_percentile": 0.39035,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kanboard",
      "product": "kanboard",
      "cwe": "CWE-639",
      "title": "Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56774"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2025-71328",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00473,
      "epss_percentile": 0.38752,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-620",
      "title": "Flowise - Unverified Password Change via Account Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71328"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-2238",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00472,
      "epss_percentile": 0.38671,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-862",
      "title": "Missing Authorization in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2238"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-56054",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0047,
      "epss_percentile": 0.3852,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Ahmad",
      "product": "JS Help Desk",
      "cwe": "CWE-22",
      "title": "WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56054"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-53247",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00467,
      "epss_percentile": 0.3833,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53247"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-54845",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00467,
      "epss_percentile": 0.38353,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PluginUs.Net",
      "product": "MDTF",
      "cwe": "CWE-98",
      "title": "WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54845"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-9705",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00464,
      "epss_percentile": 0.38167,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.4",
      "cwe": "CWE-613",
      "title": "Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9705"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-12077",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00463,
      "epss_percentile": 0.38061,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wedevs",
      "product": "Dokan Pro",
      "cwe": "CWE-89",
      "title": "Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12077"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-9716",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0046,
      "epss_percentile": 0.37888,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schneider Electric",
      "product": "PowerLogic™ P7",
      "cwe": "CWE-476",
      "title": "CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable when malformed requests are received over exposed network interfaces.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9716"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-57434",
      "cvss_base": 1.7,
      "cvss_severity": "LOW",
      "epss_score": 0.0046,
      "epss_percentile": 0.37884,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-476",
      "title": "Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57434"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-57435",
      "cvss_base": 1.7,
      "cvss_severity": "LOW",
      "epss_score": 0.0046,
      "epss_percentile": 0.37885,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-416",
      "title": "Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57435"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-53151",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00457,
      "epss_percentile": 0.37704,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "rxrpc: Fix the ACK parser to extract the SACK table for parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53151"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-57522",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00455,
      "epss_percentile": 0.37533,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bitwarden",
      "product": "server",
      "cwe": "CWE-74",
      "title": "Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57522"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-9153",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00453,
      "epss_percentile": 0.37399,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Sed Plugin",
      "cwe": "CWE-22",
      "title": "Arbitrary File Read in Rapid7 InsightConnect Sed Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9153"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-10512",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00451,
      "epss_percentile": 0.37265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-682",
      "title": "X25519 x86_64 assembly final reduction leaves non-canonical field element",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10512"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-54097",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0045,
      "epss_percentile": 0.37187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-639",
      "title": "File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54097"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-55699",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0045,
      "epss_percentile": 0.37213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-22",
      "title": "pnpm: reserved bin name deletes PNPM_HOME during global remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55699"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-57587",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00448,
      "epss_percentile": 0.37066,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tenable",
      "product": "Nessus",
      "cwe": "CWE-89",
      "title": "SQL Injection in Nessus via Reverse DNS Lookup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57587"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-54024",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00444,
      "epss_percentile": 0.36765,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-770",
      "title": "LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54024"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-13225",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00444,
      "epss_percentile": 0.36742,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix",
      "cwe": "CWE-80",
      "title": "Stored XSS in ticket confirmation page",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13225"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-55958",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00443,
      "epss_percentile": 0.36719,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-787",
      "title": "Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55958"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-54448",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00443,
      "epss_percentile": 0.3668,
      "kev": false,
      "kev_due_at": null,
      "vendor": "aquasecurity",
      "product": "trivy",
      "cwe": "CWE-770",
      "title": "Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54448"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-48944",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00443,
      "epss_percentile": 0.36673,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-22",
      "title": "Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48944"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-53246",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00442,
      "epss_percentile": 0.36622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53246"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-55092",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00442,
      "epss_percentile": 0.36631,
      "kev": false,
      "kev_due_at": null,
      "vendor": "aquasecurity",
      "product": "trivy",
      "cwe": "CWE-22",
      "title": "Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55092"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-54090",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00437,
      "epss_percentile": 0.36228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-77",
      "title": "File Browser: Command Allowlist Bypass via Shell Metacharacter Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54090"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-50017",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00437,
      "epss_percentile": 0.36238,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-200",
      "title": "pnpm binds unscoped user-level npm auth credentials to a repository-selected registry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50017"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-4526",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.36099,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-125",
      "title": "Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4526"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-47145",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.36101,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-617",
      "title": "Color Control hue/saturation assertion abort in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47145"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-47146",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-617",
      "title": "Color Control color-temperature assertion abort in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47146"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-47148",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-125",
      "title": "Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47148"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-47149",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-125",
      "title": "Door Lock GetUserType invalid table index in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47149"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-47152",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.36099,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-369",
      "title": "Level Control Move divide-by-zero in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47152"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-47153",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.36101,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-369",
      "title": "Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47153"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-47154",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.36101,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-125",
      "title": "Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47154"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2025-71340",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00431,
      "epss_percentile": 0.35706,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via idlelib.pyshell.ModifiedInterpreter.runcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71340"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-57521",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0043,
      "epss_percentile": 0.35591,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bitwarden",
      "product": "server",
      "cwe": "CWE-862",
      "title": "Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57521"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-50015",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00428,
      "epss_percentile": 0.3543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-22",
      "title": "pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50015"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-9718",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00426,
      "epss_percentile": 0.35291,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schneider Electric",
      "product": "PowerLogic™ P7",
      "cwe": "CWE-617",
      "title": "CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is sent to a vulnerable network-exposed service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9718"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-12993",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00426,
      "epss_percentile": 0.35289,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Apicurio Registry 3",
      "cwe": "CWE-776",
      "title": "Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12993"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-57235",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00426,
      "epss_percentile": 0.35306,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-125",
      "title": "Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57235"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-53131",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00425,
      "epss_percentile": 0.35199,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: require Ethernet MAC header before using eth_hdr()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53131"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-57532",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00425,
      "epss_percentile": 0.3515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix",
      "cwe": "CWE-80",
      "title": "Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57532"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-10712",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00425,
      "epss_percentile": 0.35168,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-79",
      "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10712"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-57534",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00425,
      "epss_percentile": 0.3515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix-pages",
      "cwe": "CWE-80",
      "title": "Stored XSS in pretix-pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57534"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-13314",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00425,
      "epss_percentile": 0.3515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix-digital",
      "cwe": "CWE-80",
      "title": "Stored XSS in pretix-digital",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13314"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-44622",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00423,
      "epss_percentile": 0.34997,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EVoke",
      "product": "EVoke CSMS",
      "cwe": "CWE-522",
      "title": "EVoke Systems EVoke CSMS Insufficiently Protected Credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44622"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-56789",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00422,
      "epss_percentile": 0.34966,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tomojitakasu",
      "product": "RTKLIB",
      "cwe": "CWE-122",
      "title": "RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56789"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-54479",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0042,
      "epss_percentile": 0.34722,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EVoke",
      "product": "EVoke CSMS",
      "cwe": "CWE-613",
      "title": "EVoke Systems EVoke CSMS Insufficient Session Expiration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54479"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-55700",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00417,
      "epss_percentile": 0.34477,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-22",
      "title": "pnpm: stage download writes outside destination via manifest version traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55700"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-54841",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00416,
      "epss_percentile": 0.34339,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Appsbd",
      "product": "Vitepos",
      "cwe": "CWE-201",
      "title": "WordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54841"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-9222",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00412,
      "epss_percentile": 0.34025,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shenzhen i365-Tech Co. Ltd.",
      "product": "Setracker2 Parental Control App (Android) package com.tgelec.setracker",
      "cwe": "CWE-836",
      "title": "Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9222"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-12975",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00411,
      "epss_percentile": 0.33914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Apicurio Registry 3",
      "cwe": "CWE-611",
      "title": "Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12975"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-9154",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00409,
      "epss_percentile": 0.33754,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Sed Plugin",
      "cwe": "CWE-22",
      "title": "Arbitrary File Write in Rapid7 InsightConnect Sed Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9154"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-9650",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00406,
      "epss_percentile": 0.33515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schneider Electric",
      "product": "EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller",
      "cwe": "CWE-522",
      "title": "CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9650"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-47147",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00404,
      "epss_percentile": 0.33259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-125",
      "title": "OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47147"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-57436",
      "cvss_base": 1.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00402,
      "epss_percentile": 0.3307,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-416",
      "title": "Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57436"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-57437",
      "cvss_base": 1.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00402,
      "epss_percentile": 0.33068,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-416",
      "title": "Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57437"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-46608",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00401,
      "epss_percentile": 0.32914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nicolargo",
      "product": "glances",
      "cwe": "CWE-183",
      "title": "Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46608"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-54843",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.004,
      "epss_percentile": 0.3288,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PluginUs.Net",
      "product": "MDTF",
      "cwe": "CWE-89",
      "title": "WordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54843"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-54849",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.004,
      "epss_percentile": 0.3288,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Premmerce",
      "product": "Premmerce Wishlist for WooCommerce",
      "cwe": "CWE-89",
      "title": "WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54849"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-2508",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00399,
      "epss_percentile": 0.32801,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GravityMore",
      "product": "Gravity Bookings",
      "cwe": "CWE-89",
      "title": "Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2508"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-53232",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00398,
      "epss_percentile": 0.32671,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: phy: clean the sfp upstream if phy probing fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53232"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-12844",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00398,
      "epss_percentile": 0.32638,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DROLSKY",
      "product": "List::SomeUtils::XS",
      "cwe": "CWE-122",
      "title": "List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12844"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-54226",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00397,
      "epss_percentile": 0.32539,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Kvrocks",
      "cwe": "CWE-190",
      "title": "Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54226"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-6432",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00397,
      "epss_percentile": 0.32538,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "SiSDK",
      "cwe": "CWE-130",
      "title": "Improper bounds validation in EmberZNet SDK",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6432"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-55413",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00396,
      "epss_percentile": 0.32458,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ToolJet",
      "product": "ToolJet",
      "cwe": "CWE-94",
      "title": "ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55413"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-53253",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00396,
      "epss_percentile": 0.32413,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "Bluetooth: bnep: reject short frames before parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53253"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-57535",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00396,
      "epss_percentile": 0.32459,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix",
      "cwe": "CWE-80",
      "title": "Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57535"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-9220",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00394,
      "epss_percentile": 0.32192,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shenzhen i365-Tech Co. Ltd.",
      "product": "Setracker2 Parental Control App (Android) package com.tgelec.setracker",
      "cwe": "CWE-321",
      "title": "Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9220"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-5796",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00389,
      "epss_percentile": 0.31706,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-863",
      "title": "Incorrect Authorization in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5796"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-12473",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00388,
      "epss_percentile": 0.31628,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Open Health Imaging Foundation (OHIF)",
      "product": "DICOM Web Viewer Framework",
      "cwe": "CWE-918",
      "title": "OHIF Viewers DICOM Server-Side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12473"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-41120",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00386,
      "epss_percentile": 0.31356,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Wyse Management Suite",
      "cwe": "CWE-349",
      "title": "Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41120"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-42387",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00386,
      "epss_percentile": 0.31345,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-20",
      "title": "Insufficient input validation in ZoneToCache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42387"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-42388",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00386,
      "epss_percentile": 0.31345,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-20",
      "title": "Missing input validation for catalog zones",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42388"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-54917",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00385,
      "epss_percentile": 0.3124,
      "kev": false,
      "kev_due_at": null,
      "vendor": "seaweedfs",
      "product": "seaweedfs",
      "cwe": "CWE-22",
      "title": "SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54917"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-6092",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00384,
      "epss_percentile": 0.31119,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-757",
      "title": "Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6092"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-54036",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00383,
      "epss_percentile": 0.3105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-306",
      "title": "LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54036"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2025-71335",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.0038,
      "epss_percentile": 0.30714,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-613",
      "title": "Flowise - Session Invalidation Failure After Password Change",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71335"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-47150",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0038,
      "epss_percentile": 0.30723,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-787",
      "title": "IAS Zone enroll invalid table index and write in EmberZNet 9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47150"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-47151",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0038,
      "epss_percentile": 0.30723,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "EmberZNet",
      "cwe": "CWE-787",
      "title": "Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47151"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-12079",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00379,
      "epss_percentile": 0.30701,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wedevs",
      "product": "Dokan Pro",
      "cwe": "CWE-89",
      "title": "Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12079"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-6681",
      "cvss_base": 1,
      "cvss_severity": "LOW",
      "epss_score": 0.00376,
      "epss_percentile": 0.30342,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-120",
      "title": "PKCS#7 decode ignores caller output buffer size, writing past buffer bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6681"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-57619",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0037,
      "epss_percentile": 0.29724,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Elementor",
      "product": "Elementor Website Builder",
      "cwe": "CWE-862",
      "title": "WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57619"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-53260",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00369,
      "epss_percentile": 0.29532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53260"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-56769",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00369,
      "epss_percentile": 0.29542,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hcengineering",
      "product": "platform",
      "cwe": "CWE-918",
      "title": "Huly Platform - Server-Side Request Forgery via /import Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56769"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-55180",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00366,
      "epss_percentile": 0.29285,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-200",
      "title": "pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55180"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-12755",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00365,
      "epss_percentile": 0.29157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Devolutions",
      "product": "Server",
      "cwe": "CWE-1284",
      "title": "Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12755"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-41566",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00364,
      "epss_percentile": 0.29112,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Kvrocks",
      "cwe": "CWE-280",
      "title": "Apache Kvrocks: Improper permission for the APPLYBATCH command",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41566"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-1606",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00362,
      "epss_percentile": 0.28933,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-94",
      "title": "Improper Control of Generation of Code ('Code Injection') in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1606"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-13311",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0036,
      "epss_percentile": 0.28691,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ljharb",
      "product": "shell-quote",
      "cwe": "CWE-407",
      "title": "shell-quote parse() is quadratic in token count, enabling denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13311"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-46607",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0036,
      "epss_percentile": 0.28671,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nicolargo",
      "product": "glances",
      "cwe": "CWE-502",
      "title": "Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46607"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-11703",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00359,
      "epss_percentile": 0.28519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-287",
      "title": "Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11703"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-9702",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00358,
      "epss_percentile": 0.28424,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "InPost PL",
      "cwe": null,
      "title": "InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9702"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-54822",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00357,
      "epss_percentile": 0.28392,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SALESmanago",
      "product": "SALESmanago & Leadoo",
      "cwe": "CWE-89",
      "title": "WordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54822"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-54838",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00357,
      "epss_percentile": 0.28389,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rymera Web Co",
      "product": "WC Vendors Marketplace",
      "cwe": "CWE-89",
      "title": "WordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54838"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-54033",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00352,
      "epss_percentile": 0.27761,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-918",
      "title": "LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54033"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-56771",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00351,
      "epss_percentile": 0.27747,
      "kev": false,
      "kev_due_at": null,
      "vendor": "samuelclay",
      "product": "NewsBlur",
      "cwe": "CWE-918",
      "title": "NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56771"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-54842",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0035,
      "epss_percentile": 0.2756,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Royal Plugins",
      "product": "Royal MCP",
      "cwe": "CWE-862",
      "title": "WordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54842"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-9219",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00349,
      "epss_percentile": 0.27526,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shenzhen i365-Tech Co. Ltd.",
      "product": "Setracker2 Parental Control App (Android) package com.tgelec.setracker",
      "cwe": "CWE-340",
      "title": "Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9219"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-10086",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00349,
      "epss_percentile": 0.27498,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-79",
      "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10086"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-54828",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00346,
      "epss_percentile": 0.272,
      "kev": false,
      "kev_due_at": null,
      "vendor": "StylemixThemes",
      "product": "Motors",
      "cwe": "CWE-862",
      "title": "WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54828"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-54830",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00346,
      "epss_percentile": 0.27204,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Etoile Web Design Incorporated",
      "product": "Five Star Restaurant Reservations",
      "cwe": "CWE-862",
      "title": "WordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54830"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-54844",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00346,
      "epss_percentile": 0.27203,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CheckView",
      "product": "CheckView Automated Testing",
      "cwe": "CWE-862",
      "title": "WordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54844"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-53268",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00344,
      "epss_percentile": 0.26891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "netfilter: conntrack_irc: fix possible out-of-bounds read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53268"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-42005",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00344,
      "epss_percentile": 0.26891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Authoritative",
      "cwe": "CWE-400",
      "title": "Insufficient input validation of internal web server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42005"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-37454",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00343,
      "epss_percentile": 0.26795,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-200",
      "title": "Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-37454"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-57236",
      "cvss_base": 1.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00341,
      "epss_percentile": 0.26577,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-416",
      "title": "Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57236"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-57429",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0034,
      "epss_percentile": 0.26537,
      "kev": false,
      "kev_due_at": null,
      "vendor": "eLightUp",
      "product": "Slim SEO",
      "cwe": "CWE-862",
      "title": "WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57429"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-52690",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00339,
      "epss_percentile": 0.26362,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-290",
      "title": "Spoofed answers can mark an authoritative non-EDNS capable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52690"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-13283",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00338,
      "epss_percentile": 0.26215,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Google",
      "product": "Chrome",
      "cwe": "CWE-416",
      "title": "Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13283"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-5952",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00335,
      "epss_percentile": 0.25947,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-863",
      "title": "Incorrect Authorization in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5952"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-56013",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00332,
      "epss_percentile": 0.25575,
      "kev": false,
      "kev_due_at": null,
      "vendor": "myCred",
      "product": "License Manager for WooCommerce",
      "cwe": "CWE-639",
      "title": "WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56013"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-56050",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00332,
      "epss_percentile": 0.25575,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Themeisle",
      "product": "PPOM for WooCommerce",
      "cwe": "CWE-284",
      "title": "WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56050"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-10833",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.25496,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdevteam",
      "product": "Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns",
      "cwe": "CWE-79",
      "title": "Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10833"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-13222",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.2543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix-oppwa",
      "cwe": "CWE-841",
      "title": "Insufficient validation of payment status in pretix-oppwa",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13222"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-13223",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.2543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix-computop",
      "cwe": "CWE-841",
      "title": "Insufficient validation of payment status in pretix-computop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13223"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-57536",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.25431,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix-mollie",
      "cwe": "CWE-841",
      "title": "Insufficient validation of payment status in pretix-mollie",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57536"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-56772",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.25445,
      "kev": false,
      "kev_due_at": null,
      "vendor": "samuelclay",
      "product": "NewsBlur",
      "cwe": "CWE-639",
      "title": "NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56772"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-48945",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0033,
      "epss_percentile": 0.25317,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-434",
      "title": "Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48945"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-57588",
      "cvss_base": 1.8,
      "cvss_severity": "LOW",
      "epss_score": 0.0033,
      "epss_percentile": 0.25331,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tenable",
      "product": "Nessus",
      "cwe": "CWE-89",
      "title": "SQL Injection in Nessus via Malicious Scan Result File Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57588"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-6450",
      "cvss_base": 1,
      "cvss_severity": "LOW",
      "epss_score": 0.0033,
      "epss_percentile": 0.25342,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "CRL critical extension bypass in ParseCRL_Extensions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6450"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-6678",
      "cvss_base": 1,
      "cvss_severity": "LOW",
      "epss_score": 0.0033,
      "epss_percentile": 0.25292,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-191",
      "title": "Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6678"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-46751",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00326,
      "epss_percentile": 0.24862,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Kvrocks",
      "cwe": null,
      "title": "Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVAL scripts to load crafted, unvalidated bytecode that crashes the server process, resulting in a remote denial of service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46751"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-0934",
      "cvss_base": 3.8,
      "cvss_severity": "LOW",
      "epss_score": 0.00326,
      "epss_percentile": 0.24852,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-863",
      "title": "Incorrect Authorization in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0934"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-12244",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00325,
      "epss_percentile": 0.24838,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NLnet Labs",
      "product": "NSD",
      "cwe": "CWE-122",
      "title": "Heap overflow and crash with crafted SVCB RR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12244"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-54027",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00324,
      "epss_percentile": 0.24686,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-862",
      "title": "LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54027"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-54829",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0032,
      "epss_percentile": 0.24202,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jacob N. Breetvelt",
      "product": "WP Photo Album Plus",
      "cwe": "CWE-89",
      "title": "WordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54829"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-40082",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0032,
      "epss_percentile": 0.24211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cacti",
      "product": "cacti",
      "cwe": "CWE-384",
      "title": "Cacti: Session Fixation via missing session_regenerate_id() after login",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40082"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-12245",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00319,
      "epss_percentile": 0.24124,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NLnet Labs",
      "product": "NSD",
      "cwe": "CWE-416",
      "title": "Denial of DNS over TLS service by any DoT client",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12245"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-55412",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00319,
      "epss_percentile": 0.24141,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ToolJet",
      "product": "ToolJet",
      "cwe": "CWE-918",
      "title": "ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55412"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-54848",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00318,
      "epss_percentile": 0.23942,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Saad Iqbal",
      "product": "APIExperts Square for WooCommerce",
      "cwe": "CWE-201",
      "title": "WordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54848"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-12992",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00318,
      "epss_percentile": 0.24017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Apicurio Registry 3",
      "cwe": "CWE-918",
      "title": "Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12992"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-50014",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00318,
      "epss_percentile": 0.24009,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-88",
      "title": "pnpm: Git Fetch Argument Injection via Lockfile resolution.commit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50014"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-40012",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00318,
      "epss_percentile": 0.2403,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-524",
      "title": "Information about ECS zero scoped answers might leak to clients that use a specific ECS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40012"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-53175",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.23481,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53175"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-27366",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00312,
      "epss_percentile": 0.23416,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MainWP",
      "product": "MainWP Child",
      "cwe": "CWE-862",
      "title": "WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27366"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-53178",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00311,
      "epss_percentile": 0.23208,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-191",
      "title": "staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53178"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-28898",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0031,
      "epss_percentile": 0.23177,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apple",
      "product": "swift-nio-http2",
      "cwe": "CWE-116",
      "title": "swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28898"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-56790",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00309,
      "epss_percentile": 0.22983,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canboat",
      "product": "canboat",
      "cwe": "CWE-193",
      "title": "CANBoat - Off-by-One Global Buffer Overflow in searchForPgn()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56790"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-13083",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00303,
      "epss_percentile": 0.22361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Pen Drive Powered by Red Hat Lightspeed",
      "cwe": "CWE-79",
      "title": "Pen-drive: pen-drive: stored xss via unescaped cluster data in html report",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13083"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-48943",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00303,
      "epss_percentile": 0.22399,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-915",
      "title": "Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48943"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-11800",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.2204,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.6",
      "cwe": "CWE-347",
      "title": "Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11800"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-12246",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.21962,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NLnet Labs",
      "product": "NSD",
      "cwe": "CWE-20",
      "title": "Out of bounds stack write with crafted APL RR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12246"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-11379",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.003,
      "epss_percentile": 0.21981,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-863",
      "title": "Incorrect Authorization in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11379"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-49319",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00299,
      "epss_percentile": 0.21943,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Alps Electric Co., Ltd.",
      "product": "Remote Keyless Entry System (RKES) R53R0",
      "cwe": "CWE-294",
      "title": "Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49319"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-42389",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00299,
      "epss_percentile": 0.21902,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-20",
      "title": "Reject more queries with invalid header values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42389"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-56130",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00299,
      "epss_percentile": 0.21884,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Shiro",
      "cwe": "CWE-294",
      "title": "Apache Shiro: Remember-me cookie isn't checked for expiry on the server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56130"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-12340",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00298,
      "epss_percentile": 0.21789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-125",
      "title": "Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12340"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-55698",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00297,
      "epss_percentile": 0.2166,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-345",
      "title": "pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55698"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-40211",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00296,
      "epss_percentile": 0.21623,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "DNSdist",
      "cwe": "CWE-770",
      "title": "Denial of service via crafted DoH3 queries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40211"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-8662",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00295,
      "epss_percentile": 0.21519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "InsightConnect Compression Plugin",
      "cwe": "CWE-22",
      "title": "Path Traversal in Rapid7 InsightConnect Compression Plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8662"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2026-57533",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00295,
      "epss_percentile": 0.21543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "pretix",
      "cwe": "CWE-80",
      "title": "Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57533"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-5309",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00294,
      "epss_percentile": 0.21372,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-639",
      "title": "Authorization Bypass Through User-Controlled Key in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5309"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-56779",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00294,
      "epss_percentile": 0.21373,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "MaxKB",
      "cwe": "CWE-918",
      "title": "MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56779"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-9799",
      "cvss_base": 4.6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00294,
      "epss_percentile": 0.21334,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat build of Keycloak 26.4",
      "cwe": "CWE-639",
      "title": "Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9799"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-6325",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00294,
      "epss_percentile": 0.21386,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6325"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-40209",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0029,
      "epss_percentile": 0.20971,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "DNSdist",
      "cwe": "CWE-772",
      "title": "Denial of service via IXFR queries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40209"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-3176",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0029,
      "epss_percentile": 0.20889,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-862",
      "title": "Missing Authorization in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3176"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-7532",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00288,
      "epss_percentile": 0.20762,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7532"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-56023",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00287,
      "epss_percentile": 0.20666,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Knit Pay",
      "product": "UPI QR Code Payment Gateway for WooCommerce",
      "cwe": "CWE-862",
      "title": "WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56023"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2020-37256",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00287,
      "epss_percentile": 0.20607,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grav",
      "product": "Grav",
      "cwe": "CWE-79",
      "title": "Grav - Cross-Site Scripting in Admin Plugin Page Editor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-37256"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-54821",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00284,
      "epss_percentile": 0.203,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bootstrapped Ventures",
      "product": "Visual Link Preview",
      "cwe": "CWE-201",
      "title": "WordPress Visual Link Preview plugin <= 2.3.1 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54821"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-48946",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00284,
      "epss_percentile": 0.203,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-434",
      "title": "Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48946"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-48940",
      "cvss_base": 3.4,
      "cvss_severity": "LOW",
      "epss_score": 0.00284,
      "epss_percentile": 0.20345,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-79",
      "title": "Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48940"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-10824",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00275,
      "epss_percentile": 0.19323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Masteriyo LMS",
      "cwe": null,
      "title": "Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10824"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-54029",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00272,
      "epss_percentile": 0.19059,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-862",
      "title": "LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54029"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-13350",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00271,
      "epss_percentile": 0.18789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pretix",
      "product": "Venueless",
      "cwe": "CWE-639",
      "title": "Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13350"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-53147",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00268,
      "epss_percentile": 0.18407,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "thunderbolt: Validate XDomain request packet size before type cast",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53147"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-53254",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00268,
      "epss_percentile": 0.18407,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "Bluetooth: RFCOMM: validate skb length in MCC handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53254"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-48941",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00266,
      "epss_percentile": 0.18067,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-862",
      "title": "Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48941"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-40941",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00265,
      "epss_percentile": 0.17961,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cacti",
      "product": "cacti",
      "cwe": "CWE-347",
      "title": "Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40941"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-10097",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.17549,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-697",
      "title": "ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10097"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-13281",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00261,
      "epss_percentile": 0.175,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Google",
      "product": "Chrome",
      "cwe": "CWE-472",
      "title": "Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13281"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-53196",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00261,
      "epss_percentile": 0.17484,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "USB: serial: io_ti: fix heap overflow in get_manuf_info()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53196"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-40210",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00261,
      "epss_percentile": 0.17455,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "DNSdist",
      "cwe": "CWE-126",
      "title": "Out-of-bounds read in SetMacAddrAction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40210"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-9221",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00258,
      "epss_percentile": 0.17139,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shenzhen i365-Tech Co. Ltd.",
      "product": "Setracker2 Parental Control App (Android) package com.tgelec.setracker",
      "cwe": "CWE-327",
      "title": "Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9221"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-54040",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00258,
      "epss_percentile": 0.17082,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-306",
      "title": "LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54040"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-40080",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00257,
      "epss_percentile": 0.17021,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cacti",
      "product": "cacti",
      "cwe": "CWE-601",
      "title": "Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40080"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-7511",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00255,
      "epss_percentile": 0.16758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-347",
      "title": "PKCS7_verify signer confusion allows forged signatures to be accepted",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7511"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-48942",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00253,
      "epss_percentile": 0.16449,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getk2.org",
      "product": "K2 extension for Joomla",
      "cwe": "CWE-79",
      "title": "Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48942"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-2815",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.16181,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Silicon Labs",
      "product": "SiSDK",
      "cwe": "CWE-339",
      "title": "Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2815"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2026-56005",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.16253,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Melapress",
      "product": "WP Activity Log",
      "cwe": "CWE-79",
      "title": "WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56005"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-56006",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.16262,
      "kev": false,
      "kev_due_at": null,
      "vendor": "H5P",
      "product": "H5P",
      "cwe": "CWE-79",
      "title": "WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56006"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-56014",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.16262,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Averta",
      "product": "Master Slider",
      "cwe": "CWE-79",
      "title": "WordPress Master Slider plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56014"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-56042",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.16264,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Algolplus",
      "product": "Advanced Order Export For WooCommerce",
      "cwe": "CWE-79",
      "title": "WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56042"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-56051",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.16254,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TablePress",
      "product": "TablePress",
      "cwe": "CWE-79",
      "title": "WordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56051"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-56071",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00251,
      "epss_percentile": 0.1627,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPMU DEV",
      "product": "Forminator",
      "cwe": "CWE-79",
      "title": "WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56071"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-12635",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00249,
      "epss_percentile": 0.15952,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-350",
      "title": "Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12635"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-53256",
      "cvss_base": 8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00248,
      "epss_percentile": 0.15879,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53256"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-6291",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00243,
      "epss_percentile": 0.1523,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-208",
      "title": "Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6291"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-53146",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00242,
      "epss_percentile": 0.15103,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "thunderbolt: Limit XDomain response copy to actual frame size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53146"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-53264",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.15042,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net/sched: act_api: use RCU with deferred freeing for action lifecycle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53264"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-54025",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00239,
      "epss_percentile": 0.14646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-79",
      "title": "LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54025"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-13318",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00236,
      "epss_percentile": 0.14357,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat OpenShift Virtualization 4",
      "cwe": "CWE-918",
      "title": "Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13318"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-55962",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00235,
      "epss_percentile": 0.14187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-287",
      "title": "TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55962"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-11310",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00234,
      "epss_percentile": 0.14089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11310"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-11999",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00234,
      "epss_percentile": 0.1409,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11999"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-55960",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00234,
      "epss_percentile": 0.1409,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55960"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-53275",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00232,
      "epss_percentile": 0.13844,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ipv6: mcast: Fix use-after-free when processing MLD queries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53275"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-55895",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00226,
      "epss_percentile": 0.13096,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-78",
      "title": "Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55895"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-37149",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00217,
      "epss_percentile": 0.11941,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-89",
      "title": "GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-37149"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-6329",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00213,
      "epss_percentile": 0.11433,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-347",
      "title": "PKCS#12 MAC verification uses attacker-controlled comparison length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6329"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-46606",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00212,
      "epss_percentile": 0.1137,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nicolargo",
      "product": "glances",
      "cwe": "CWE-78",
      "title": "Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46606"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-57453",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00208,
      "epss_percentile": 0.10809,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-77",
      "title": "Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57453"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-42390",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00205,
      "epss_percentile": 0.1038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-20",
      "title": "ZONEMD validation can be bypassed",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42390"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2026-40208",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00205,
      "epss_percentile": 0.10332,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "DNSdist",
      "cwe": "CWE-705",
      "title": "Denial of service via DoH3 queries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40208"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-6731",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00204,
      "epss_percentile": 0.10315,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "X.509 name constraint bypass via Subject CN treated as a DNS name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6731"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-53137",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00201,
      "epss_percentile": 0.09877,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53137"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-53194",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.002,
      "epss_percentile": 0.09728,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "USB: serial: kl5kusb105: fix bulk-out buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53194"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-55411",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00199,
      "epss_percentile": 0.09617,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ToolJet",
      "product": "ToolJet",
      "cwe": "CWE-639",
      "title": "ToolJet: Cross-tenant credential decryption (IDOR) in POST /api/data-sources/decrypt — any authenticated user can decrypt any organization's data-source secrets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55411"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-10592",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00199,
      "epss_percentile": 0.09625,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Wildcard DNS SAN bypasses CA name-constraint checks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10592"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2025-60464",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00198,
      "epss_percentile": 0.09572,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-416",
      "title": "A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-60464"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-57234",
      "cvss_base": 2.6,
      "cvss_severity": "LOW",
      "epss_score": 0.00198,
      "epss_percentile": 0.096,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-178",
      "title": "Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57234"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-6091",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00195,
      "epss_percentile": 0.09213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Partial-chain verification accepts untrusted intermediate as trust anchor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6091"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-54093",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.0897,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-22",
      "title": "File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54093"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-53203",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00192,
      "epss_percentile": 0.08883,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "accel/ivpu: Add buffer overflow check in MS get_info_ioctl",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53203"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-55697",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00191,
      "epss_percentile": 0.08725,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-78",
      "title": "pnpm: Repository-controlled configDependencies can select a pacquet native install engine",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55697"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-53195",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0019,
      "epss_percentile": 0.08657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53195"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-10098",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.08602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10098"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-55964",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.08602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55964"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-6331",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0019,
      "epss_percentile": 0.08662,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-347",
      "title": "HMAC zero-length tag forgery in EVP_DigestVerifyFinal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6331"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-12921",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00187,
      "epss_percentile": 0.08331,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzeoTech",
      "product": "DAQFactory",
      "cwe": "CWE-416",
      "title": "Use after free in AzeoTech DAQFactory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12921"
    },
    {
      "rank": 317,
      "cve_id": "CVE-2025-60465",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00187,
      "epss_percentile": 0.08252,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-416",
      "title": "A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-60465"
    },
    {
      "rank": 318,
      "cve_id": "CVE-2026-53148",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00186,
      "epss_percentile": 0.08172,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "thunderbolt: Clamp XDomain response data copy to allocation size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53148"
    },
    {
      "rank": 319,
      "cve_id": "CVE-2026-53132",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00186,
      "epss_percentile": 0.08155,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "vsock/virtio: fix potential unbounded skb queue",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53132"
    },
    {
      "rank": 320,
      "cve_id": "CVE-2026-53925",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00183,
      "epss_percentile": 0.07908,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nicolargo",
      "product": "glances",
      "cwe": "CWE-22",
      "title": "Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53925"
    },
    {
      "rank": 321,
      "cve_id": "CVE-2026-54096",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00182,
      "epss_percentile": 0.0775,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-863",
      "title": "File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54096"
    },
    {
      "rank": 322,
      "cve_id": "CVE-2026-8330",
      "cvss_base": 4.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00182,
      "epss_percentile": 0.07752,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitLab",
      "product": "GitLab",
      "cwe": "CWE-532",
      "title": "Insertion of Sensitive Information into Log File in GitLab",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8330"
    },
    {
      "rank": 323,
      "cve_id": "CVE-2026-55967",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00182,
      "epss_percentile": 0.07798,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-323",
      "title": "AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55967"
    },
    {
      "rank": 324,
      "cve_id": "CVE-2026-55487",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00181,
      "epss_percentile": 0.07665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-346",
      "title": "pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55487"
    },
    {
      "rank": 325,
      "cve_id": "CVE-2026-50021",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00181,
      "epss_percentile": 0.07664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-354",
      "title": "pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50021"
    },
    {
      "rank": 326,
      "cve_id": "CVE-2021-47986",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0018,
      "epss_percentile": 0.07487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parse-community",
      "product": "parse-server",
      "cwe": "CWE-494",
      "title": "Parse Server - Unreviewed Code Execution via Malicious Version Tags",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47986"
    },
    {
      "rank": 327,
      "cve_id": "CVE-2026-53234",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00179,
      "epss_percentile": 0.07411,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net: ibm: emac: Fix use-after-free during device removal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53234"
    },
    {
      "rank": 328,
      "cve_id": "CVE-2026-4522",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00179,
      "epss_percentile": 0.07421,
      "kev": false,
      "kev_due_at": null,
      "vendor": "HYPR",
      "product": "Passwordless",
      "cwe": "CWE-306",
      "title": "Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception. This issue affects HYPR Passwordless: before 11.1.1.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4522"
    },
    {
      "rank": 329,
      "cve_id": "CVE-2021-47987",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00178,
      "epss_percentile": 0.07301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parse-community",
      "product": "parse-server",
      "cwe": "CWE-494",
      "title": "Parse Server - Arbitrary Code Execution via Malicious Version Tags",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47987"
    },
    {
      "rank": 330,
      "cve_id": "CVE-2026-53133",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07107,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-681",
      "title": "RDMA/umem: Fix truncation for block sizes >= 4G",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53133"
    },
    {
      "rank": 331,
      "cve_id": "CVE-2026-53182",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07103,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: nl80211: reject oversized EMA RNR lists",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53182"
    },
    {
      "rank": 332,
      "cve_id": "CVE-2026-53209",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07104,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53209"
    },
    {
      "rank": 333,
      "cve_id": "CVE-2026-53265",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00176,
      "epss_percentile": 0.07104,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "dm cache policy smq: check allocation under invalidate lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53265"
    },
    {
      "rank": 334,
      "cve_id": "CVE-2026-53159",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00176,
      "epss_percentile": 0.07107,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "misc: fastrpc: fix DMA address corruption due to find_vma misuse",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
    },
    {
      "rank": 335,
      "cve_id": "CVE-2026-53170",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07029,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "accel/ethosu: reject DMA commands with uninitialized length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53170"
    },
    {
      "rank": 336,
      "cve_id": "CVE-2026-53171",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.0703,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/ethosu: fix arithmetic issues in dma_length()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53171"
    },
    {
      "rank": 337,
      "cve_id": "CVE-2026-12897",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07034,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Horner Automation",
      "product": "Cscape",
      "cwe": "CWE-125",
      "title": "Out-of-bounds read in Horner Automation Cscape",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12897"
    },
    {
      "rank": 338,
      "cve_id": "CVE-2026-53191",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07014,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53191"
    },
    {
      "rank": 339,
      "cve_id": "CVE-2026-53193",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07024,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ALSA: timer: Forcibly close timer instances at closing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53193"
    },
    {
      "rank": 340,
      "cve_id": "CVE-2026-53201",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.0703,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53201"
    },
    {
      "rank": 341,
      "cve_id": "CVE-2026-53233",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00175,
      "epss_percentile": 0.07016,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-415",
      "title": "netdev: fix double-free in netdev_nl_bind_rx_doit()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53233"
    },
    {
      "rank": 342,
      "cve_id": "CVE-2026-53188",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06783,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "RDMA/core: Validate the passed in fops for ib_get_ucaps()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53188"
    },
    {
      "rank": 343,
      "cve_id": "CVE-2026-53162",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "memcg: use round-robin victim selection in refill_stock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53162"
    },
    {
      "rank": 344,
      "cve_id": "CVE-2026-56788",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00173,
      "epss_percentile": 0.06734,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tomojitakasu",
      "product": "RTKLIB",
      "cwe": "CWE-125",
      "title": "RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56788"
    },
    {
      "rank": 345,
      "cve_id": "CVE-2026-53274",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00172,
      "epss_percentile": 0.06673,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53274"
    },
    {
      "rank": 346,
      "cve_id": "CVE-2026-53160",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06542,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "misc: fastrpc: fix use-after-free race in fastrpc_map_create",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53160"
    },
    {
      "rank": 347,
      "cve_id": "CVE-2026-53161",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53161"
    },
    {
      "rank": 348,
      "cve_id": "CVE-2026-53239",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00171,
      "epss_percentile": 0.06542,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53239"
    },
    {
      "rank": 349,
      "cve_id": "CVE-2026-48995",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00171,
      "epss_percentile": 0.06547,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-353",
      "title": "pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48995"
    },
    {
      "rank": 350,
      "cve_id": "CVE-2026-53156",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.06458,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "nvmem: core: fix use-after-free bugs in error paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53156"
    },
    {
      "rank": 351,
      "cve_id": "CVE-2026-53192",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.06458,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ALSA: timer: Fix UAF at snd_timer_user_params()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53192"
    },
    {
      "rank": 352,
      "cve_id": "CVE-2026-53272",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0017,
      "epss_percentile": 0.0646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "erofs: fix use-after-free on sbi->sync_decompress",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53272"
    },
    {
      "rank": 353,
      "cve_id": "CVE-2026-55892",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0017,
      "epss_percentile": 0.06453,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-787",
      "title": "Vim: Out-of-bounds Write in Spell File Prefix Dump",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55892"
    },
    {
      "rank": 354,
      "cve_id": "CVE-2026-57452",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0017,
      "epss_percentile": 0.06453,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-125",
      "title": "Vim: Out-of-bounds Read with libsodium-encrypted Files",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57452"
    },
    {
      "rank": 355,
      "cve_id": "CVE-2026-57589",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06369,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenBSD",
      "product": "OpenBSD",
      "cwe": "CWE-416",
      "title": "sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57589"
    },
    {
      "rank": 356,
      "cve_id": "CVE-2026-57454",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00169,
      "epss_percentile": 0.06325,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-125",
      "title": "Vim: Out-of-bounds Read with Text Properties",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57454"
    },
    {
      "rank": 357,
      "cve_id": "CVE-2026-6330",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00169,
      "epss_percentile": 0.0632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-327",
      "title": "ML-KEM ARM64 NEON ciphertext comparison only compares half of the input",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6330"
    },
    {
      "rank": 358,
      "cve_id": "CVE-2026-54030",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00168,
      "epss_percentile": 0.06171,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danny-avila",
      "product": "LibreChat",
      "cwe": "CWE-346",
      "title": "LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54030"
    },
    {
      "rank": 359,
      "cve_id": "CVE-2026-50573",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06171,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-345",
      "title": "pnpm: Unsafe default behavior breaks integrity check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50573"
    },
    {
      "rank": 360,
      "cve_id": "CVE-2026-53259",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00168,
      "epss_percentile": 0.06283,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "ipv6: anycast: insert aca into global hash under idev->lock",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53259"
    },
    {
      "rank": 361,
      "cve_id": "CVE-2026-53223",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00167,
      "epss_percentile": 0.06076,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net: guard timestamp cmsgs to real error queue skbs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53223"
    },
    {
      "rank": 362,
      "cve_id": "CVE-2026-54250",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00167,
      "epss_percentile": 0.06142,
      "kev": false,
      "kev_due_at": null,
      "vendor": "k3s-io",
      "product": "k3s",
      "cwe": "CWE-22",
      "title": "K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54250"
    },
    {
      "rank": 363,
      "cve_id": "CVE-2026-53230",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00166,
      "epss_percentile": 0.05995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53230"
    },
    {
      "rank": 364,
      "cve_id": "CVE-2026-53179",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00166,
      "epss_percentile": 0.05995,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "staging: rtl8723bs: fix buffer over-read in rtw_update_protection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53179"
    },
    {
      "rank": 365,
      "cve_id": "CVE-2026-53205",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00166,
      "epss_percentile": 0.05994,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "accel/ivpu: Add bounds checks for firmware log indices",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53205"
    },
    {
      "rank": 366,
      "cve_id": "CVE-2026-46611",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00166,
      "epss_percentile": 0.06035,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nicolargo",
      "product": "glances",
      "cwe": "CWE-346",
      "title": "Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46611"
    },
    {
      "rank": 367,
      "cve_id": "CVE-2026-53200",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05888,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53200"
    },
    {
      "rank": 368,
      "cve_id": "CVE-2026-53172",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05887,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "accel/ethosu: fix IFM region index out-of-bounds in command stream parser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53172"
    },
    {
      "rank": 369,
      "cve_id": "CVE-2026-53173",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05887,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53173"
    },
    {
      "rank": 370,
      "cve_id": "CVE-2026-53174",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05887,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ovl: keep err zero after successful ovl_cache_get()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53174"
    },
    {
      "rank": 371,
      "cve_id": "CVE-2026-53276",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00165,
      "epss_percentile": 0.05888,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53276"
    },
    {
      "rank": 372,
      "cve_id": "CVE-2026-56129",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00165,
      "epss_percentile": 0.05936,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dynabook Inc.",
      "product": "Generic IO & Memory Access driver",
      "cwe": "CWE-782",
      "title": "Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56129"
    },
    {
      "rank": 373,
      "cve_id": "CVE-2026-53187",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.05774,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53187"
    },
    {
      "rank": 374,
      "cve_id": "CVE-2026-53135",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.0563,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53135"
    },
    {
      "rank": 375,
      "cve_id": "CVE-2026-53140",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53140"
    },
    {
      "rank": 376,
      "cve_id": "CVE-2026-53142",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05546,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "drm/xe/display: fix oops in suspend/shutdown without display",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53142"
    },
    {
      "rank": 377,
      "cve_id": "CVE-2026-53144",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "drm/amdkfd: fix NULL dereference in get_queue_ids()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53144"
    },
    {
      "rank": 378,
      "cve_id": "CVE-2026-53150",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05631,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-191",
      "title": "thunderbolt: Reject zero-length property entries in validator",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53150"
    },
    {
      "rank": 379,
      "cve_id": "CVE-2026-53152",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "mmc: dw_mmc-rockchip: Add missing private data for very old controllers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53152"
    },
    {
      "rank": 380,
      "cve_id": "CVE-2026-53154",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-772",
      "title": "mm/hugetlb: restore reservation on error in hugetlb folio copy paths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53154"
    },
    {
      "rank": 381,
      "cve_id": "CVE-2026-53168",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05631,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "fuse: reject fuse_notify() pagecache ops on directories",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53168"
    },
    {
      "rank": 382,
      "cve_id": "CVE-2026-53177",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05625,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "bnxt_en: Fix NULL pointer dereference",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53177"
    },
    {
      "rank": 383,
      "cve_id": "CVE-2026-53190",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53190"
    },
    {
      "rank": 384,
      "cve_id": "CVE-2026-53210",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05547,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "tee: shm: fix shm leak in register_shm_helper()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53210"
    },
    {
      "rank": 385,
      "cve_id": "CVE-2026-53214",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05543,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ipv6: Fix a potential NPD in cleanup_prefix_route()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53214"
    },
    {
      "rank": 386,
      "cve_id": "CVE-2026-53219",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05621,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: x_tables: avoid leaking percpu counter pointers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53219"
    },
    {
      "rank": 387,
      "cve_id": "CVE-2026-53220",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05546,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "netfilter: revalidate bridge ports",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53220"
    },
    {
      "rank": 388,
      "cve_id": "CVE-2026-53237",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "gpio: mvebu: fix NULL pointer dereference in suspend/resume",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53237"
    },
    {
      "rank": 389,
      "cve_id": "CVE-2026-53238",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.0562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netlabel: validate unlabeled address and mask attribute lengths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53238"
    },
    {
      "rank": 390,
      "cve_id": "CVE-2026-53241",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05547,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ALSA: seq: dummy: fix UMP event stack overread",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53241"
    },
    {
      "rank": 391,
      "cve_id": "CVE-2026-53251",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05541,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-772",
      "title": "Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53251"
    },
    {
      "rank": 392,
      "cve_id": "CVE-2026-53261",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05541,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "devlink: Release nested relation on devlink free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53261"
    },
    {
      "rank": 393,
      "cve_id": "CVE-2026-53263",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05619,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-193",
      "title": "6lowpan: fix off-by-one in multicast context address compression",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53263"
    },
    {
      "rank": 394,
      "cve_id": "CVE-2026-53269",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05627,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: synproxy: add mutex to guard hook reference counting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53269"
    },
    {
      "rank": 395,
      "cve_id": "CVE-2026-53271",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05546,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53271"
    },
    {
      "rank": 396,
      "cve_id": "CVE-2026-57451",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00161,
      "epss_percentile": 0.05469,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-125",
      "title": "Vim: Out-of-bounds Read in Text Property Count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57451"
    },
    {
      "rank": 397,
      "cve_id": "CVE-2026-53141",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05358,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/v3d: Fix global performance monitor reference counting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53141"
    },
    {
      "rank": 398,
      "cve_id": "CVE-2026-53164",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05362,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "iommu/dma: Do not try to iommu_map a 0 length region in swiotlb",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53164"
    },
    {
      "rank": 399,
      "cve_id": "CVE-2026-53211",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05357,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53211"
    },
    {
      "rank": 400,
      "cve_id": "CVE-2026-53258",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.05357,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "wifi: fix leak if split 6 GHz scanning fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53258"
    },
    {
      "rank": 401,
      "cve_id": "CVE-2026-8720",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00158,
      "epss_percentile": 0.05191,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-354",
      "title": "HMAC-BLAKE2 final discards message when key length exceeds block size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8720"
    },
    {
      "rank": 402,
      "cve_id": "CVE-2026-12490",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00156,
      "epss_percentile": 0.04969,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NLnet Labs",
      "product": "NSD",
      "cwe": "CWE-284",
      "title": "Bypass of client certificate verification with transfer over TLS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12490"
    },
    {
      "rank": 403,
      "cve_id": "CVE-2026-53202",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00156,
      "epss_percentile": 0.04984,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "accel/ivpu: Fix signed integer truncation in IPC receive",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53202"
    },
    {
      "rank": 404,
      "cve_id": "CVE-2026-9651",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04989,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Schneider Electric",
      "product": "EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller",
      "cwe": "CWE-732",
      "title": "CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an attacker with privileged local access reads improperly protected system files.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9651"
    },
    {
      "rank": 405,
      "cve_id": "CVE-2026-42004",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00156,
      "epss_percentile": 0.04933,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "DNSdist",
      "cwe": "CWE-115",
      "title": "EDNS options smuggling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42004"
    },
    {
      "rank": 406,
      "cve_id": "CVE-2026-45188",
      "cvss_base": 2.4,
      "cvss_severity": "LOW",
      "epss_score": 0.00154,
      "epss_percentile": 0.04744,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Kvrocks",
      "cwe": "CWE-23",
      "title": "Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45188"
    },
    {
      "rank": 407,
      "cve_id": "CVE-2026-53277",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00153,
      "epss_percentile": 0.04646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-662",
      "title": "KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53277"
    },
    {
      "rank": 408,
      "cve_id": "CVE-2026-53143",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00153,
      "epss_percentile": 0.04662,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53143"
    },
    {
      "rank": 409,
      "cve_id": "CVE-2026-40011",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00153,
      "epss_percentile": 0.04642,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "DNSdist",
      "cwe": "CWE-116",
      "title": "Prometheus denial of service via crafted DNS queries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40011"
    },
    {
      "rank": 410,
      "cve_id": "CVE-2026-53212",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00151,
      "epss_percentile": 0.04471,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "netfilter: nft_tunnel: fix use-after-free on object destroy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53212"
    },
    {
      "rank": 411,
      "cve_id": "CVE-2026-13282",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00151,
      "epss_percentile": 0.04495,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Google",
      "product": "Chrome",
      "cwe": "CWE-416",
      "title": "Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a local attacker to potentially exploit heap corruption via physical access to the device. (Chromium security severity: High)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13282"
    },
    {
      "rank": 412,
      "cve_id": "CVE-2026-46733",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00149,
      "epss_percentile": 0.0435,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Display and Peripheral Manager",
      "cwe": "CWE-284",
      "title": "Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46733"
    },
    {
      "rank": 413,
      "cve_id": "CVE-2026-49839",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00148,
      "epss_percentile": 0.0428,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jqlang",
      "product": "jq",
      "cwe": "CWE-787",
      "title": "jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49839"
    },
    {
      "rank": 414,
      "cve_id": "CVE-2026-47770",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00147,
      "epss_percentile": 0.04198,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jqlang",
      "product": "jq",
      "cwe": "CWE-674",
      "title": "jq: stack overflow in deep structural equality",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47770"
    },
    {
      "rank": 415,
      "cve_id": "CVE-2026-55961",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00146,
      "epss_percentile": 0.04111,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-347",
      "title": "wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55961"
    },
    {
      "rank": 416,
      "cve_id": "CVE-2026-57456",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00145,
      "epss_percentile": 0.04015,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-94",
      "title": "Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
    },
    {
      "rank": 417,
      "cve_id": "CVE-2026-53155",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03841,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/huge_memory: use correct flags for device private PMD entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53155"
    },
    {
      "rank": 418,
      "cve_id": "CVE-2026-53169",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03837,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-617",
      "title": "accel/ethosu: reject NPU_OP_RESIZE commands from userspace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53169"
    },
    {
      "rank": 419,
      "cve_id": "CVE-2026-53204",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.0384,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "firmware: stratix10-rsu: Fix NULL deref on rsu_send_msg() timeout in probe",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53204"
    },
    {
      "rank": 420,
      "cve_id": "CVE-2026-53206",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03845,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "accel/ivpu: Add bounds check for firmware runtime memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53206"
    },
    {
      "rank": 421,
      "cve_id": "CVE-2026-53222",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03841,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "ptp: ocp: fix resource freeing order",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53222"
    },
    {
      "rank": 422,
      "cve_id": "CVE-2026-53243",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03842,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53243"
    },
    {
      "rank": 423,
      "cve_id": "CVE-2026-53257",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00143,
      "epss_percentile": 0.03838,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "wifi: cfg80211: enforce HE/EHT cap/oper consistency",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53257"
    },
    {
      "rank": 424,
      "cve_id": "CVE-2026-4930",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00139,
      "epss_percentile": 0.03495,
      "kev": false,
      "kev_due_at": null,
      "vendor": "silabs.com",
      "product": "Simplicity SDK",
      "cwe": "CWE-331",
      "title": "DPA Countermeasures weakening on Series 3 devices",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4930"
    },
    {
      "rank": 425,
      "cve_id": "CVE-2026-13218",
      "cvss_base": 4.2,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00139,
      "epss_percentile": 0.03477,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat OpenShift Virtualization 4",
      "cwe": "CWE-61",
      "title": "Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13218"
    },
    {
      "rank": 426,
      "cve_id": "CVE-2026-53145",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.03272,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-367",
      "title": "drm/gem: Try to fix change_handle ioctl, attempt 4",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53145"
    },
    {
      "rank": 427,
      "cve_id": "CVE-2026-53153",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.03272,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-820",
      "title": "mm/list_lru: drain before clearing xarray entry on reparent",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53153"
    },
    {
      "rank": 428,
      "cve_id": "CVE-2026-53185",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.02941,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "zram: fix use-after-free in zram_bvec_write_partial()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53185"
    },
    {
      "rank": 429,
      "cve_id": "CVE-2026-53227",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0013,
      "epss_percentile": 0.02845,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "net: openvswitch: fix possible kfree_skb of ERR_PTR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53227"
    },
    {
      "rank": 430,
      "cve_id": "CVE-2026-53252",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0013,
      "epss_percentile": 0.02866,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "Bluetooth: fix memory leak in error path of hci_alloc_dev()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53252"
    },
    {
      "rank": 431,
      "cve_id": "CVE-2026-53136",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02784,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-787",
      "title": "drm/amd/display: Clamp VBIOS HDMI retimer register count to array size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53136"
    },
    {
      "rank": 432,
      "cve_id": "CVE-2026-53189",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "mm/huge_memory: update file PMD counter before folio_put()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53189"
    },
    {
      "rank": 433,
      "cve_id": "CVE-2026-53242",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00129,
      "epss_percentile": 0.02789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53242"
    },
    {
      "rank": 434,
      "cve_id": "CVE-2026-53157",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "net: phonet: free phonet_device after RCU grace period",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
    },
    {
      "rank": 435,
      "cve_id": "CVE-2026-53138",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02487,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "drm/amd/display: Bound VBIOS record-chain walk loops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
    },
    {
      "rank": 436,
      "cve_id": "CVE-2026-53149",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00126,
      "epss_percentile": 0.02489,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "thunderbolt: Bound root directory content to block size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53149"
    },
    {
      "rank": 437,
      "cve_id": "CVE-2026-53167",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00125,
      "epss_percentile": 0.02454,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
    },
    {
      "rank": 438,
      "cve_id": "CVE-2026-53207",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00125,
      "epss_percentile": 0.02463,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53207"
    },
    {
      "rank": 439,
      "cve_id": "CVE-2026-57438",
      "cvss_base": 2.2,
      "cvss_severity": "LOW",
      "epss_score": 0.00125,
      "epss_percentile": 0.02411,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sparklemotion",
      "product": "nokogiri",
      "cwe": "CWE-416",
      "title": "Nokogiri: Possible Use-After-Free in XInclude Processing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57438"
    },
    {
      "rank": 440,
      "cve_id": "CVE-2026-55693",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00124,
      "epss_percentile": 0.02381,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-787",
      "title": "Vim: Out-of-bounds Write in Spell File Word Count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
    },
    {
      "rank": 441,
      "cve_id": "CVE-2026-53197",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00124,
      "epss_percentile": 0.02337,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53197"
    },
    {
      "rank": 442,
      "cve_id": "CVE-2026-53134",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02266,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "netfilter: nft_fib: fix stale stack leak via the OIFNAME register",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53134"
    },
    {
      "rank": 443,
      "cve_id": "CVE-2026-53139",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02261,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "drm/v3d: Skip CSD when it has zeroed workgroups",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53139"
    },
    {
      "rank": 444,
      "cve_id": "CVE-2026-53158",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "misc: fastrpc: Fix NULL pointer dereference in rpmsg callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
    },
    {
      "rank": 445,
      "cve_id": "CVE-2026-53163",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02234,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-476",
      "title": "locking/rtmutex: Skip remove_waiter() when waiter is not enqueued",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53163"
    },
    {
      "rank": 446,
      "cve_id": "CVE-2026-53181",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02264,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "vsock/vmci: fix sk_ack_backlog leak on failed handshake",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53181"
    },
    {
      "rank": 447,
      "cve_id": "CVE-2026-53208",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.0226,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53208"
    },
    {
      "rank": 448,
      "cve_id": "CVE-2026-53213",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02248,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "drm/vc4: fix krealloc() memory leak",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53213"
    },
    {
      "rank": 449,
      "cve_id": "CVE-2026-53218",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.0227,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-908",
      "title": "netfilter: nft_exthdr: fix register tracking for F_PRESENT flag",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53218"
    },
    {
      "rank": 450,
      "cve_id": "CVE-2026-53236",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "tcp: restrict SO_ATTACH_FILTER to priv users",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53236"
    },
    {
      "rank": 451,
      "cve_id": "CVE-2026-53245",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53245"
    },
    {
      "rank": 452,
      "cve_id": "CVE-2026-53249",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.02265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53249"
    },
    {
      "rank": 453,
      "cve_id": "CVE-2026-53266",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00121,
      "epss_percentile": 0.02104,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: bridge: make ebt_snat ARP rewrite writable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53266"
    },
    {
      "rank": 454,
      "cve_id": "CVE-2026-53270",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00121,
      "epss_percentile": 0.02104,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipvs: clear the svc scheduler ptr early on edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53270"
    },
    {
      "rank": 455,
      "cve_id": "CVE-2026-53267",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.02003,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-674",
      "title": "netfilter: nft_ct: bail out on template ct in get eval",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53267"
    },
    {
      "rank": 456,
      "cve_id": "CVE-2026-2299",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0012,
      "epss_percentile": 0.02028,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Mattermost",
      "product": "Mattermost Google Drive Plugin",
      "cwe": "CWE-862",
      "title": "Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2299"
    },
    {
      "rank": 457,
      "cve_id": "CVE-2026-53262",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00119,
      "epss_percentile": 0.01948,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53262"
    },
    {
      "rank": 458,
      "cve_id": "CVE-2026-53226",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00119,
      "epss_percentile": 0.01927,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-401",
      "title": "gpio: rockchip: fix generic IRQ chip leak on remove",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53226"
    },
    {
      "rank": 459,
      "cve_id": "CVE-2026-57455",
      "cvss_base": 4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00118,
      "epss_percentile": 0.01903,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vim",
      "product": "vim",
      "cwe": "CWE-787",
      "title": "Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
    },
    {
      "rank": 460,
      "cve_id": "CVE-2026-53273",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00117,
      "epss_percentile": 0.01858,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "tee: optee: prevent use-after-free when the client exits before the supplicant",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53273"
    },
    {
      "rank": 461,
      "cve_id": "CVE-2026-53255",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00117,
      "epss_percentile": 0.01839,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "Bluetooth: MGMT: validate advertising TLV before type checks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53255"
    },
    {
      "rank": 462,
      "cve_id": "CVE-2026-33612",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00115,
      "epss_percentile": 0.01713,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PowerDNS",
      "product": "Recursor",
      "cwe": "CWE-349",
      "title": "ZoneToCache can poison the cache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33612"
    },
    {
      "rank": 463,
      "cve_id": "CVE-2026-53231",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00111,
      "epss_percentile": 0.01431,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-667",
      "title": "net: phy: don't try to setup PHY-driven SFP cages when using genphy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53231"
    },
    {
      "rank": 464,
      "cve_id": "CVE-2026-6412",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.0011,
      "epss_percentile": 0.01384,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-327",
      "title": "Continued acceptance of SHA-1/MD5 digests in certificate processing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6412"
    },
    {
      "rank": 465,
      "cve_id": "CVE-2026-53250",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00104,
      "epss_percentile": 0.01137,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-367",
      "title": "xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53250"
    },
    {
      "rank": 466,
      "cve_id": "CVE-2026-54679",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00103,
      "epss_percentile": 0.01056,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jqlang",
      "product": "jq",
      "cwe": "CWE-190",
      "title": "jq: potential integer overflow in jvp_string_append",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54679"
    },
    {
      "rank": 467,
      "cve_id": "CVE-2026-46732",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00102,
      "epss_percentile": 0.01004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Display and Peripheral Manager",
      "cwe": "CWE-362",
      "title": "Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46732"
    },
    {
      "rank": 468,
      "cve_id": "CVE-2026-46734",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0009,
      "epss_percentile": 0.00499,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Display and Peripheral Manager",
      "cwe": "CWE-295",
      "title": "Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46734"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-60464",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-60464. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-60465",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-60465. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71324",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71324 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71327",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71327 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71328",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71328 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71333",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71333 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71334",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71334 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71335",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71335 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71336",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71336 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-71338",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-71338 (Flowise). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-13351",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-13351 (zephyrproject-rtos Zephyr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-40080",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-40080 (cacti). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-40082",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-40082 (cacti). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-40083",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-40083 (cacti). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-40084",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-40084 (cacti). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-47770",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-47770 (jqlang jq). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-48995",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-48995 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-49839",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-49839 (jqlang jq). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-50014",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-50014 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-50015",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-50015 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-50016",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-50016 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-50017",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-50017 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-50021",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-50021 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-50573",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-50573 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54024",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54024 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54025",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54025 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54027",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54027 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54029",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54029 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54030",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54030 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54033",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54033 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54036",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54036 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54037",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54037 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54040",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54040 (danny-avila LibreChat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54917",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54917 (seaweedfs). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55180",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55180 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55487",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55487 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55697",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55697 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55698",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55698 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55699",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55699 (pnpm). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55700",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55700 (pnpm). Public exploit reference added."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}