Security Box Score — Saturday, June 27, 2026

33 CVEs published June 27, 2026: 1 critical, 10 high, 22 medium, 0 low; 0 in KEV; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 8 in the results table.

League
	MTD	YTD	2025 same span	2025 full
CVEs published	7029	11401	1176	2563
KEV catalog size	1670

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	513	1479	119	854	503	1	27	3	0.2	7.8	.0013	+9
google	707	881	85	464	300	29	74	6	0.7	8.1	.0023	+690
microsoft	220	710	55	474	160	4	378	27	3.8	7.8	.0044	+50
red hat	108	172	9	73	82	8	4	0	0.0	6.8	.0026	+87
apple	15	62	0	16	37	2	93	7	11.3	5.5	.0023	-5
canonical	6	20	2	5	8	5	0	0	0.0	5.5	.0011	+6
freebsd	9	16	0	12	4	0	0	0	0.0	7.8	.0015	+2
suse	4	6	1	4	1	0	0	0	0.0	8.6	.0029	+2

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	10	23	4	4	8	0	96	11	47.8	7.0	.0431	+5
netgear	17	17	0	0	16	1	8	0	0.0	4.3	.0024	+17
palo alto networks	9	11	0	1	7	1	14	2	18.2	4.8	.0022	+8
ubiquiti	8	11	7	4	0	0	4	3	27.3	9.9	.0083	+6
f5	6	9	4	3	1	0	7	1	11.1	8.9	.0221	+4
ivanti	4	9	2	3	0	0	33	5	55.6	8.8	.5187	+2
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	-3
fortinet	2	8	1	3	2	0	28	3	37.5	7.3	.0066	+1

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	104	136	22	47	56	10	40	1	0.7	7.0	.0044	+85
mozilla	49	55	11	18	26	0	13	0	0.0	7.3	.0026	+43
gitlab	24	33	0	5	21	5	4	2	6.1	4.4	.0022	+18
docker	4	7	0	5	2	0	1	0	0.0	8.2	.0016	+1
drupal	0	5	1	1	3	0	5	1	20.0	5.1	.0026	-3
github	1	3	1	1	1	0	0	0	0.0	7.0	.0039	-1
jenkins	0	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	243	270	131	116	18	4	40	2	0.7	8.8	.0040	+243
adobe	132	136	4	50	77	2	75	3	2.2	5.5	.0021	+131
ibm	32	81	19	35	27	0	7	0	0.0	7.5	.0028	-17
progress	5	9	1	7	1	0	9	0	0.0	7.5	.0036	+1
solarwinds	3	6	1	2	1	0	11	4	66.7	7.5	.3995	+3
veeam	1	4	2	2	0	0	4	0	0.0	9.0	.0046	+1
zohocorp	1	3	1	1	1	0	0	0	0.0	8.4	.0170	-1
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0	0.0	5.6	.0025	-13
d-link	9	12	0	4	2	5	26	1	8.3	5.5	.0058	+8
siemens	7	8	0	4	4	0	1	0	0.0	7.5	.0020	+6
rockwell automation	7	7	1	5	1	0	0	0	0.0	8.7	.0030	+7
abb	6	6	0	4	2	0	0	0	0.0	7.2	.0018	+6
schneider electric	6	6	0	4	2	0	1	0	0.0	7.8	.0024	+6
moxa	5	5	0	3	2	0	0	0	0.0	7.0	.0029	+5
dahua	3	3	0	1	1	1	2	0	0.0	6.9	.0036	+3

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
spring	72	73	2	31	39	1	0	0	0.0	6.5	.0024	+71
openclaw	61	67	0	35	22	10	0	0	0.0	7.0	.0021	+61
sourcecodester	37	59	0	0	25	34	0	0	0.0	2.1	.0026	+17
themerex	58	58	5	53	0	0	0	0	0.0	8.1	.0043	+58
dell	38	56	1	30	24	0	2	1	1.8	7.2	.0016	+26
edimax	5	56	0	33	0	23	1	0	0.0	7.4	.0070	-39
jenkins project	36	49	0	9	39	1	0	0	0.0	4.8	.0021	+23
capgo	46	46	2	22	21	1	0	0	0.0	7.0	.0034	+46

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9990	100.0	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-0257	.9391	99.8	—
CVE-2026-34910	.8696	99.7	10.0
CVE-2026-34908	.8519	99.7	10.0
CVE-2026-20230	.8321	99.7	8.6
CVE-2026-42271	.8301	99.6	—
CVE-2026-50751	.8255	99.6	9.3
CVE-2026-48907	.6883	99.3	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9990	KEV
CVE-2026-34910	10.0	.8696	KEV
CVE-2026-34908	10.0	.8519	KEV
CVE-2026-48907	10.0	.6883	KEV
CVE-2026-34909	10.0	.6390	KEV
CVE-2026-53576	10.0	.0219
CVE-2026-49777	10.0	.0166
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-49257	10.0	.0093

Most disclosures (vendor)
Vendor	CVEs
google	707
linux	514
oracle	243
microsoft	220
adobe	132
red hat	114
apache	104
spring	72
openclaw	67
themerex	58

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	11
apple	7
google	6
ivanti	5
solarwinds	4
synacor	4
adobe	3
fortinet	3
linux	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	39
Packagist	22
PyPI	9
npm	5

Fastest to KEV
CVE	Vendor	Days
CVE-2022-0492	Linux	0
CVE-2024-21182	Oracle	0
CVE-2025-48595	Google	0
CVE-2025-67038	Lantronix	0
CVE-2026-0257	Palo Alto Networks	0
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-12569	PTC	0
CVE-2026-20230	Cisco	0
CVE-2026-20245	Cisco	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1683
CVE-2021-27102	Accellion	2021-11-17	1683
CVE-2021-27101	Accellion	2021-11-17	1683
CVE-2021-27103	Accellion	2021-11-17	1683
CVE-2021-21017	Adobe	2021-11-17	1683
CVE-2021-28550	Adobe	2021-11-17	1683
CVE-2021-42013	Apache	2021-11-17	1683
CVE-2021-41773	Apache	2021-11-17	1683
CVE-2021-30858	Apple	2021-11-17	1683
CVE-2021-30860	Apple	2021-11-17	1683

Yesterday's Results

33 CVEs published. 25 box scores, 8 table rows — nothing truncated.

CVE-2026-12415CRITICAL

pravel Invoice Generator — Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0066   48.7     —

AFFECTED
  Product            Versions     Fixed
  Invoice Generator  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · 4 references · NVD status: Deferred

CVE-2026-12432MEDIUM

themeisle Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions — Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0054   42.9     —

AFFECTED
  Product                                                                                       Versions     Fixed
  Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-8095HIGH

nmedia Frontend File Manager Plugin — Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  H    8.1   .0040   33.7     —

AFFECTED
  Product                       Versions     Fixed
  Frontend File Manager Plugin  unspecified  —

TIMELINE
  May 7   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-73 · CNA: Wordfence · 3 references · NVD status: Deferred

CVE-2026-11356MEDIUM

vinod-dalvi Ivory Search – WordPress Search Plugin — Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  L  L  N    4.4   .0034   27.4     —

AFFECTED
  Product                                 Versions     Fixed
  Ivory Search – WordPress Search Plugin  unspecified  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-13295MEDIUM

gpriday Page Builder by SiteOrigin — Page Builder by SiteOrigin <= 2.34.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via panels_data Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0034   27.3     —

AFFECTED
  Product                     Versions     Fixed
  Page Builder by SiteOrigin  unspecified  —

TIMELINE
  Jun 24  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-13333MEDIUM

trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation — Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0033   26.3     —

AFFECTED
  Product                                                  Versions     Fixed
  Groundhogg — CRM, Newsletters, and Marketing Automation  unspecified  —

TIMELINE
  Jun 25  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · 6 references · NVD status: Deferred

CVE-2026-13245MEDIUM

maxfoundry MaxButtons – Create buttons — MaxButtons <= 9.8.5 - Reflected Cross-Site Scripting via 'view' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  N    6.1   .0033   26.2     —

AFFECTED
  Product                      Versions     Fixed
  MaxButtons – Create buttons  unspecified  —

TIMELINE
  Jun 24  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 4 references · NVD status: Deferred

CVE-2026-12404MEDIUM

webaways NEX-Forms – Ultimate Forms Plugin for WordPress — NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0031   24.1     —

AFFECTED
  Product                                          Versions     Fixed
  NEX-Forms – Ultimate Forms Plugin for WordPress  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-3462MEDIUM

reepaydenmark Frisbii Pay — Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0027   19.8     —

AFFECTED
  Product      Versions     Fixed
  Frisbii Pay  unspecified  —

TIMELINE
  Mar 3   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 5 references · NVD status: Deferred

CVE-2026-13331MEDIUM

trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation — Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0027   19.6     —

AFFECTED
  Product                                                  Versions     Fixed
  Groundhogg — CRM, Newsletters, and Marketing Automation  unspecified  —

TIMELINE
  Jun 25  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · 7 references · NVD status: Deferred

CVE-2026-9233MEDIUM

expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker — Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0027   19.2     —

AFFECTED
  Product                                                    Versions     Fixed
  Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker  unspecified  —

TIMELINE
  May 21  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 12 references · NVD status: Deferred

CVE-2026-11987MEDIUM

dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy — Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  L  N  N    4.3   .0027   19.1     —

AFFECTED
  Product                                                                                             Versions     Fixed
  Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy  unspecified  —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · 14 references · NVD status: Deferred

CVE-2026-12399MEDIUM

jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor — Gutenverse <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via 'fonts[].font.font.value' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  L  L  N    4.4   .0024   15.8     —

AFFECTED
  Product                                                    Versions     Fixed
  Gutenverse – WordPress Blocks, Page Builder & Site Editor  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 12 references · NVD status: Deferred

CVE-2026-11783MEDIUM

dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy — Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.4 - Authenticated (Custom+) Stored Cross-Site Scripting via Product SKU

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0024   15.5     —

AFFECTED
  Product                                                                                             Versions     Fixed
  Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy  unspecified  —

TIMELINE
  Jun 9   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-9242MEDIUM

metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login — RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0024   14.9     —

AFFECTED
  Product                                                                                    Versions     Fixed
  RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login  unspecified  —

TIMELINE
  May 21  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-345 · CNA: Wordfence · 14 references · NVD status: Deferred

CVE-2026-10820HIGH

Unknown Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content — ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  H    8.1   .0022   13.0     —

AFFECTED
  Product                                                                                                 Versions     Fixed
  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content  unspecified  —

TIMELINE
  Jun 4   Reserved by CNA
  Jun 27  Published (CNA: WPScan)

CNA: WPScan · 1 reference · NVD status: Deferred

CVE-2026-11364MEDIUM

dornaweb Product Specifications for Woocommerce — Product Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0021   11.7     —

AFFECTED
  Product                                 Versions     Fixed
  Product Specifications for Woocommerce  unspecified  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-13335MEDIUM

CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0020   10.7     —

AFFECTED
  Product                              Versions     Fixed
  CodePeople Post Map for Google Maps  unspecified  —

TIMELINE
  Jun 25  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-12471MEDIUM

templatescoderthemes Spexo — Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0019    9.5     —

AFFECTED
  Product  Versions     Fixed
  Spexo    unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 4 references · NVD status: Deferred

CVE-2026-11597MEDIUM

Surbma | Infusionsoft Shortcode <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0019    9.1     —

AFFECTED
  Product                          Versions     Fixed
  Surbma | Infusionsoft Shortcode  unspecified  —

TIMELINE
  Jun 8   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 5 references · NVD status: Deferred

CVE-2026-13422MEDIUM

harmonic_design HD Quiz — HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  L  N    4.3   .0018    7.7     —

AFFECTED
  Product  Versions  Fixed
  HD Quiz  2.2.0 –   —

TIMELINE
  Jun 26  Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-352 · CNA: Wordfence · 16 references · NVD status: Deferred

CVE-2026-45258HIGH

FreeBSD FreeBSD — Multiple vulnerabilities in the sound(4) mmap path

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0015    4.8     —

AFFECTED
  Product  Versions        Fixed
  FreeBSD  15.0-RELEASE –  —

TIMELINE
  May 11  Reserved by CNA
  Jun 27  Published (CNA: freebsd)

CWE-125, CWE-190, CWE-681, CWE-787 · CNA: freebsd · 1 reference · NVD status: Analyzed

CVE-2026-49413HIGH

FreeBSD FreeBSD — Flaw in Linuxulator execution of setugid binaries

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  H  H    7.1   .0015    4.7     —

AFFECTED
  Product  Versions        Fixed
  FreeBSD  15.0-RELEASE –  —

TIMELINE
  May 29  Reserved by CNA
  Jun 27  Published (CNA: freebsd)

CWE-266 · CNA: freebsd · 1 reference · NVD status: Analyzed

CVE-2026-11773MEDIUM

Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0015    4.6     —

AFFECTED
  Product                                                     Versions     Fixed
  Masteriyo LMS – LMS Course Builder, Quizzes & Certificates  unspecified  —

TIMELINE
  Jun 9   Reserved by CNA
  Jun 27  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · 6 references · NVD status: Deferred

CVE-2026-9677MEDIUM

Unknown Shariff for WordPress — Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  C  L  L  N    4.8   .0014    4.3     —

AFFECTED
  Product                Versions     Fixed
  Shariff for WordPress  unspecified  —

TIMELINE
  May 27  Reserved by CNA
  Jun 27  Published (CNA: WPScan)

CNA: WPScan · 1 reference · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-49417	7.0	2.9	FreeBSD	FreeBSD	CWE-416	Multiple vulnerabilities in the sound(4) mmap path
CVE-2026-10643	7.8	2.6	zephyrproject	zephyr	CWE-787	Out-of-bounds heap write in Zephyr `recvmsg()` ancillary-data path (`insert_p…
CVE-2025-59868	5.5	1.4	HCLSoftware	Traveler for Microsoft Outlook	CWE-532	HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data ex…
CVE-2026-49416	7.8	1.3	FreeBSD	FreeBSD	CWE-190	Integer overflow in vt(4) CONS_HISTORY ioctl
CVE-2026-49414	7.8	1.3	FreeBSD	FreeBSD	CWE-179	ASLR bypass for setuid executables via procctl(2)
CVE-2026-49412	7.8	1.2	FreeBSD	FreeBSD	CWE-416	Use-after-free bug in the IPV6_MSFILTER socket option handler
CVE-2023-37524	7.8	1.0	HCLSoftware	Traveler for Microsoft Outlook	CWE-1104	HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities d…
CVE-2026-45259	6.5	0.7	FreeBSD	FreeBSD	CWE-266	sigqueue(2) missing capability mode restriction

Standings

Leaders (trailing 30 days unless noted)

Transactions

Yesterday's Results

Methodology