{ "day": "2026-07-03", "boundary": "UTC calendar day", "published_count": 180, "by_severity": { "CRITICAL": 25, "HIGH": 77, "MEDIUM": 70, "LOW": 8 }, "kev_count": 0, "exploit_reference_count": 19, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-20896", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.02755, "epss_percentile": 0.85107, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea Docker image trusts spoofable reverse-proxy headers by default", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20896" }, { "rank": 2, "cve_id": "CVE-2026-49814", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.02003, "epss_percentile": 0.79242, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49814" }, { "rank": 3, "cve_id": "CVE-2026-53478", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.02003, "epss_percentile": 0.79242, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53478" }, { "rank": 4, "cve_id": "CVE-2026-58289", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.01991, "epss_percentile": 0.79121, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58289" }, { "rank": 5, "cve_id": "CVE-2026-26355", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0177, "epss_percentile": 0.76405, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26355" }, { "rank": 6, "cve_id": "CVE-2026-49815", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01712, "epss_percentile": 0.75598, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to execution of arbitrary OS commands.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49815" }, { "rank": 7, "cve_id": "CVE-2026-27771", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.01393, "epss_percentile": 0.70264, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-862", "title": "Gitea Composer package source links use insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27771" }, { "rank": 8, "cve_id": "CVE-2026-9725", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.01166, "epss_percentile": 0.64902, "kev": false, "kev_due_at": null, "vendor": "printcart", "product": "Printcart Web to Print Product Designer for WooCommerce", "cwe": "CWE-22", "title": "Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9725" }, { "rank": 9, "cve_id": "CVE-2026-8925", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0108, "epss_percentile": 0.62541, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-415", "title": "SASL double-free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8925" }, { "rank": 10, "cve_id": "CVE-2026-9079", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01064, "epss_percentile": 0.62103, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-522", "title": "stale proxy password leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9079" }, { "rank": 11, "cve_id": "CVE-2026-57991", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.01036, "epss_percentile": 0.61272, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-59", "title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57991" }, { "rank": 12, "cve_id": "CVE-2026-11352", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0101, "epss_percentile": 0.60507, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-835", "title": "QUIC zero-length UDP datagrams busy-loop", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11352" }, { "rank": 13, "cve_id": "CVE-2026-58291", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00992, "epss_percentile": 0.5989, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-672", "title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58291" }, { "rank": 14, "cve_id": "CVE-2026-14544", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00926, "epss_percentile": 0.57777, "kev": false, "kev_due_at": null, "vendor": "HP", "product": "HPLIP", "cwe": "CWE-190", "title": "Hplip: incomplete fix for cve-2026-8631", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14544" }, { "rank": 15, "cve_id": "CVE-2026-56646", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00922, "epss_percentile": 0.57625, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-200", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56646" }, { "rank": 16, "cve_id": "CVE-2026-10536", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00891, "epss_percentile": 0.56695, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-416", "title": "HTTP/2 stream-dependency tree UAF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10536" }, { "rank": 17, "cve_id": "CVE-2026-57993", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00876, "epss_percentile": 0.56279, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-918", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57993" }, { "rank": 18, "cve_id": "CVE-2026-45489", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00876, "epss_percentile": 0.56279, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-749", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45489" }, { "rank": 19, "cve_id": "CVE-2026-58523", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00876, "epss_percentile": 0.5628, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-284", "title": "Microsoft Edge for Android Security Feature Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58523" }, { "rank": 20, "cve_id": "CVE-2026-57987", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00874, "epss_percentile": 0.562, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-918", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57987" }, { "rank": 21, "cve_id": "CVE-2026-11586", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0086, "epss_percentile": 0.5575, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-770", "title": "WS Auto-PONG memory exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11586" }, { "rank": 22, "cve_id": "CVE-2026-56645", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00819, "epss_percentile": 0.54453, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-122", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56645" }, { "rank": 23, "cve_id": "CVE-2026-57974", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00819, "epss_percentile": 0.54452, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-190", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57974" }, { "rank": 24, "cve_id": "CVE-2026-57981", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00819, "epss_percentile": 0.54454, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57981" }, { "rank": 25, "cve_id": "CVE-2026-47896", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00808, "epss_percentile": 0.54096, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Lucene.Net", "cwe": "CWE-22", "title": "Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47896" }, { "rank": 26, "cve_id": "CVE-2026-57988", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00759, "epss_percentile": 0.52502, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-23", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57988" }, { "rank": 27, "cve_id": "CVE-2026-47897", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00721, "epss_percentile": 0.51169, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Lucene.Net", "cwe": "CWE-22", "title": "Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47897" }, { "rank": 28, "cve_id": "CVE-2026-57985", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0072, "epss_percentile": 0.51133, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-20", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57985" }, { "rank": 29, "cve_id": "CVE-2026-12481", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00719, "epss_percentile": 0.51084, "kev": false, "kev_due_at": null, "vendor": "keras-team", "product": "keras-team/keras", "cwe": "CWE-502", "title": "Deserialization of Untrusted Data in keras-team/keras", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12481" }, { "rank": 30, "cve_id": "CVE-2026-4967", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00706, "epss_percentile": 0.50618, "kev": false, "kev_due_at": null, "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.", "product": "SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T8100/T9100/T8200/T8300", "cwe": null, "title": "In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4967" }, { "rank": 31, "cve_id": "CVE-2026-58597", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00704, "epss_percentile": 0.50544, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-357", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58597" }, { "rank": 32, "cve_id": "CVE-2026-14352", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00675, "epss_percentile": 0.4944, "kev": false, "kev_due_at": null, "vendor": "webandprint", "product": "AR for WooCommerce", "cwe": "CWE-22", "title": "AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14352" }, { "rank": 33, "cve_id": "CVE-2026-26292", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00652, "epss_percentile": 0.48467, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26292" }, { "rank": 34, "cve_id": "CVE-2026-9546", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00652, "epss_percentile": 0.48482, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "sending old referer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9546" }, { "rank": 35, "cve_id": "CVE-2026-57983", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00648, "epss_percentile": 0.48285, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-285", "title": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57983" }, { "rank": 36, "cve_id": "CVE-2026-59234", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00641, "epss_percentile": 0.47943, "kev": false, "kev_due_at": null, "vendor": "Roskus", "product": "Prospero Flow CRM", "cwe": "CWE-639", "title": "Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59234" }, { "rank": 37, "cve_id": "CVE-2026-27780", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00638, "epss_percentile": 0.47803, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea pre-receive hook can miss branch-protection checks after scanner errors", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27780" }, { "rank": 38, "cve_id": "CVE-2026-56015", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00632, "epss_percentile": 0.4756, "kev": false, "kev_due_at": null, "vendor": "TPODER", "product": "Net::IP::LPM", "cwe": "CWE-125", "title": "Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56015" }, { "rank": 39, "cve_id": "CVE-2026-26307", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0063, "epss_percentile": 0.47447, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-400", "title": "Gitea git grep search lacks a timeout", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26307" }, { "rank": 40, "cve_id": "CVE-2026-49813", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00624, "epss_percentile": 0.4719, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49813" }, { "rank": 41, "cve_id": "CVE-2026-54483", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00624, "epss_percentile": 0.4719, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54483" }, { "rank": 42, "cve_id": "CVE-2026-58422", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00621, "epss_percentile": 0.47052, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58422" }, { "rank": 43, "cve_id": "CVE-2026-46464", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.0062, "epss_percentile": 0.46988, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-59", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('Link following') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46464" }, { "rank": 44, "cve_id": "CVE-2026-14327", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00615, "epss_percentile": 0.46778, "kev": false, "kev_due_at": null, "vendor": "webandprint", "product": "AR for WordPress", "cwe": "CWE-22", "title": "AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14327" }, { "rank": 45, "cve_id": "CVE-2026-11564", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.0061, "epss_percentile": 0.46514, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-295", "title": "Native CA trust persist", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11564" }, { "rank": 46, "cve_id": "CVE-2026-58285", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46407, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58285" }, { "rank": 47, "cve_id": "CVE-2026-58287", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46406, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58287" }, { "rank": 48, "cve_id": "CVE-2026-58288", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46405, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58288" }, { "rank": 49, "cve_id": "CVE-2026-57975", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46408, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57975" }, { "rank": 50, "cve_id": "CVE-2026-57984", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46407, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57984" }, { "rank": 51, "cve_id": "CVE-2026-57986", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46408, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57986" }, { "rank": 52, "cve_id": "CVE-2026-57992", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46407, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57992" }, { "rank": 53, "cve_id": "CVE-2026-58276", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46406, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58276" }, { "rank": 54, "cve_id": "CVE-2026-58293", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46407, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-73", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58293" }, { "rank": 55, "cve_id": "CVE-2026-58294", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46405, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58294" }, { "rank": 56, "cve_id": "CVE-2026-11856", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00604, "epss_percentile": 0.46238, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-294", "title": "cross-origin Digest auth state leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11856" }, { "rank": 57, "cve_id": "CVE-2026-27779", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00582, "epss_percentile": 0.45192, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea forwarded-proto handling allows public URL spoofing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27779" }, { "rank": 58, "cve_id": "CVE-2026-58421", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00582, "epss_percentile": 0.45192, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58421" }, { "rank": 59, "cve_id": "CVE-2026-57977", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00577, "epss_percentile": 0.44943, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-79", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57977" }, { "rank": 60, "cve_id": "CVE-2026-20706", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00565, "epss_percentile": 0.44346, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea repository archive downloads bypass token scope checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20706" }, { "rank": 61, "cve_id": "CVE-2026-25718", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00562, "epss_percentile": 0.44215, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-59", "title": "Gitea template repository generation mishandles symlinked paths", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25718" }, { "rank": 62, "cve_id": "CVE-2026-58284", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00562, "epss_percentile": 0.44209, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-285", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58284" }, { "rank": 63, "cve_id": "CVE-2026-11398", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00561, "epss_percentile": 0.44129, "kev": false, "kev_due_at": null, "vendor": "latepoint", "product": "LatePoint – Calendar Booking Plugin for Appointments and Events", "cwe": "CWE-862", "title": "LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11398" }, { "rank": 64, "cve_id": "CVE-2026-8924", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.0056, "epss_percentile": 0.44059, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "trailing dot domain super cookie", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8924" }, { "rank": 65, "cve_id": "CVE-2026-9180", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00557, "epss_percentile": 0.43896, "kev": false, "kev_due_at": null, "vendor": "jetmonsters", "product": "MotoPress Appointment Booking", "cwe": "CWE-639", "title": "MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9180" }, { "rank": 66, "cve_id": "CVE-2026-28699", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00551, "epss_percentile": 0.43606, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea Basic Auth bypasses OAuth2 access token scopes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28699" }, { "rank": 67, "cve_id": "CVE-2026-8458", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00543, "epss_percentile": 0.43155, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "wrong reuse for different services", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8458" }, { "rank": 68, "cve_id": "CVE-2026-58296", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00541, "epss_percentile": 0.43068, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-359", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58296" }, { "rank": 69, "cve_id": "CVE-2026-58297", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00541, "epss_percentile": 0.43068, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-359", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58297" }, { "rank": 70, "cve_id": "CVE-2026-58423", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00536, "epss_percentile": 0.42799, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-287", "title": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58423" }, { "rank": 71, "cve_id": "CVE-2026-13040", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00527, "epss_percentile": 0.42267, "kev": false, "kev_due_at": null, "vendor": "webaways", "product": "NEX-Forms – Ultimate Forms Plugin for WordPress", "cwe": "CWE-79", "title": "NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13040" }, { "rank": 72, "cve_id": "CVE-2026-27775", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00523, "epss_percentile": 0.42024, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea pre-receive hook permission cache allows full repository write access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27775" }, { "rank": 73, "cve_id": "CVE-2026-22547", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00522, "epss_percentile": 0.41943, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-20", "title": "Gitea repository creation accepts invalid field values", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22547" }, { "rank": 74, "cve_id": "CVE-2026-14620", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00521, "epss_percentile": 0.41868, "kev": false, "kev_due_at": null, "vendor": "webpack-dev-server", "product": "webpack-dev-server", "cwe": "CWE-352", "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14620" }, { "rank": 75, "cve_id": "CVE-2026-14631", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00517, "epss_percentile": 0.41609, "kev": false, "kev_due_at": null, "vendor": "webpack-dev-server", "product": "webpack-dev-server", "cwe": "CWE-20", "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14631" }, { "rank": 76, "cve_id": "CVE-2026-58419", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00508, "epss_percentile": 0.41065, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-200", "title": "Notification API leaks private issue metadata after access revocation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58419" }, { "rank": 77, "cve_id": "CVE-2026-9148", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00508, "epss_percentile": 0.41024, "kev": false, "kev_due_at": null, "vendor": "advancedcoding", "product": "Comments – wpDiscuz", "cwe": "CWE-79", "title": "Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9148" }, { "rank": 78, "cve_id": "CVE-2026-58295", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00507, "epss_percentile": 0.40933, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58295" }, { "rank": 79, "cve_id": "CVE-2026-26232", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00495, "epss_percentile": 0.40211, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-294", "title": "Gitea OAuth2 authorization codes lack expiry and reuse enforcement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26232" }, { "rank": 80, "cve_id": "CVE-2026-26247", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00495, "epss_percentile": 0.40211, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26247" }, { "rank": 81, "cve_id": "CVE-2026-9080", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00494, "epss_percentile": 0.40156, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-416", "title": "UAF after pause in socket callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9080" }, { "rank": 82, "cve_id": "CVE-2026-9230", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00491, "epss_percentile": 0.39951, "kev": false, "kev_due_at": null, "vendor": "expresstech", "product": "Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker", "cwe": "CWE-862", "title": "Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9230" }, { "rank": 83, "cve_id": "CVE-2026-58292", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00483, "epss_percentile": 0.39393, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-20", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58292" }, { "rank": 84, "cve_id": "CVE-2026-12920", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00483, "epss_percentile": 0.39447, "kev": false, "kev_due_at": null, "vendor": "wplegalpages", "product": "Cookie Banner for GDPR / CCPA – WPLP Cookie Consent", "cwe": "CWE-89", "title": "Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12920" }, { "rank": 85, "cve_id": "CVE-2026-24451", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00482, "epss_percentile": 0.39347, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-200", "title": "Gitea fork synchronization can expose private parent repository data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24451" }, { "rank": 86, "cve_id": "CVE-2026-25038", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00482, "epss_percentile": 0.39347, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-200", "title": "Gitea private organization labels are visible to unauthorized users", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25038" }, { "rank": 87, "cve_id": "CVE-2026-25712", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00482, "epss_percentile": 0.39348, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea organization permission APIs expose private visibility information", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25712" }, { "rank": 88, "cve_id": "CVE-2026-20779", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00481, "epss_percentile": 0.39299, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-294", "title": "Gitea TOTP single-use enforcement defect allows OTP replay", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20779" }, { "rank": 89, "cve_id": "CVE-2026-4321", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00468, "epss_percentile": 0.38436, "kev": false, "kev_due_at": null, "vendor": "Raera - Ankara Web Design and Digital Advertising Agency", "product": "Destekz", "cwe": "CWE-89", "title": "SQLi in Raera's Destekz", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4321" }, { "rank": 90, "cve_id": "CVE-2026-47898", "cvss_base": 4, "cvss_severity": "MEDIUM", "epss_score": 0.00468, "epss_percentile": 0.38448, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Lucene.Net", "cwe": "CWE-611", "title": "Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47898" }, { "rank": 91, "cve_id": "CVE-2026-58299", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00466, "epss_percentile": 0.38294, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-367", "title": "Microsoft Edge for Android Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58299" }, { "rank": 92, "cve_id": "CVE-2026-22874", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00464, "epss_percentile": 0.38137, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-918", "title": "Gitea webhook and migration allow-list filtering permits SSRF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22874" }, { "rank": 93, "cve_id": "CVE-2026-11900", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00454, "epss_percentile": 0.37475, "kev": false, "kev_due_at": null, "vendor": "spacetime", "product": "Ad Inserter – Ad Manager & AdSense Ads", "cwe": "CWE-639", "title": "Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11900" }, { "rank": 94, "cve_id": "CVE-2026-24690", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37288, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea pull-request branch updates use insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24690" }, { "rank": 95, "cve_id": "CVE-2026-27657", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37287, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-639", "title": "Gitea email settings allow changing another user's primary email address", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27657" }, { "rank": 96, "cve_id": "CVE-2026-27660", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37287, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea draft releases use insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27660" }, { "rank": 97, "cve_id": "CVE-2026-28705", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00451, "epss_percentile": 0.37306, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-22", "title": "Gitea repository dumps write release assets using unsafe path names", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28705" }, { "rank": 98, "cve_id": "CVE-2026-28744", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00448, "epss_percentile": 0.37054, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea Git smart HTTP bypasses repository token scopes for bearer tokens", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28744" }, { "rank": 99, "cve_id": "CVE-2026-13341", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00446, "epss_percentile": 0.36919, "kev": false, "kev_due_at": null, "vendor": "KongHQ", "product": "mcp-konnect", "cwe": "CWE-20", "title": "Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13341" }, { "rank": 100, "cve_id": "CVE-2026-58300", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00446, "epss_percentile": 0.36897, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-36", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58300" }, { "rank": 101, "cve_id": "CVE-2026-5137", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00445, "epss_percentile": 0.36887, "kev": false, "kev_due_at": null, "vendor": "rometheme", "product": "RTMKit", "cwe": "CWE-98", "title": "RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5137" }, { "rank": 102, "cve_id": "CVE-2026-58283", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00442, "epss_percentile": 0.36618, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58283" }, { "rank": 103, "cve_id": "CVE-2026-8927", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.0044, "epss_percentile": 0.36424, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-294", "title": "env-set cross-proxy Digest auth state leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8927" }, { "rank": 104, "cve_id": "CVE-2026-58522", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00435, "epss_percentile": 0.36083, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-23", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58522" }, { "rank": 105, "cve_id": "CVE-2026-58290", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00431, "epss_percentile": 0.35688, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58290" }, { "rank": 106, "cve_id": "CVE-2026-28737", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0043, "epss_percentile": 0.35596, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-79", "title": "Gitea 3D file viewer allows stored XSS through glTF extensionsRequired", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28737" }, { "rank": 107, "cve_id": "CVE-2026-14611", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0043, "epss_percentile": 0.35587, "kev": false, "kev_due_at": null, "vendor": "DeepMyst", "product": "Mysti", "cwe": "CWE-200", "title": "DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14611" }, { "rank": 108, "cve_id": "CVE-2026-22555", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00426, "epss_percentile": 0.353, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea organization forks can expose organization secrets without create permission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22555" }, { "rank": 109, "cve_id": "CVE-2026-58282", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00419, "epss_percentile": 0.34665, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-284", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58282" }, { "rank": 110, "cve_id": "CVE-2026-58286", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00419, "epss_percentile": 0.34665, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-284", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58286" }, { "rank": 111, "cve_id": "CVE-2026-8489", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00419, "epss_percentile": 0.34625, "kev": false, "kev_due_at": null, "vendor": "ultimatemember", "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "cwe": "CWE-79", "title": "Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8489" }, { "rank": 112, "cve_id": "CVE-2026-11778", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00419, "epss_percentile": 0.34694, "kev": false, "kev_due_at": null, "vendor": "villatheme", "product": "CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x", "cwe": "CWE-94", "title": "CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11778" }, { "rank": 113, "cve_id": "CVE-2026-58418", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00415, "epss_percentile": 0.34288, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-918", "title": "SSRF via HTTP Redirect in Repository Migration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58418" }, { "rank": 114, "cve_id": "CVE-2026-58298", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00413, "epss_percentile": 0.34128, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-79", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58298" }, { "rank": 115, "cve_id": "CVE-2026-58524", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00413, "epss_percentile": 0.34128, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-79", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58524" }, { "rank": 116, "cve_id": "CVE-2026-9545", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00408, "epss_percentile": 0.33637, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "exposing HTTP/3 early data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9545" }, { "rank": 117, "cve_id": "CVE-2026-8351", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00408, "epss_percentile": 0.33607, "kev": false, "kev_due_at": null, "vendor": "rometheme", "product": "RTMKit", "cwe": "CWE-79", "title": "RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8351" }, { "rank": 118, "cve_id": "CVE-2026-46465", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00408, "epss_percentile": 0.33641, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-134", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46465" }, { "rank": 119, "cve_id": "CVE-2026-58278", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.004, "epss_percentile": 0.3282, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-918", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58278" }, { "rank": 120, "cve_id": "CVE-2026-14609", "cvss_base": 2.9, "cvss_severity": "LOW", "epss_score": 0.004, "epss_percentile": 0.3287, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "CET Automated Grading System with AI Predictive Analytics", "cwe": "CWE-384", "title": "SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14609" }, { "rank": 121, "cve_id": "CVE-2026-10055", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00399, "epss_percentile": 0.32775, "kev": false, "kev_due_at": null, "vendor": "Eclipse Foundation", "product": "Eclipse Theia", "cwe": "CWE-200", "title": "In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses, exposing internal administrative endpoints, cloud instance metadata services, and other resources that are intentionally outside the browser network boundary. The vulnerability affects deployments where the Theia service connection is reachable by untrusted users (for example, multi-tenant or publicly-reachable Theia deployments).", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10055" }, { "rank": 122, "cve_id": "CVE-2026-14604", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00399, "epss_percentile": 0.32712, "kev": false, "kev_due_at": null, "vendor": "Open Asset Import Library", "product": "Assimp", "cwe": "CWE-119", "title": "Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14604" }, { "rank": 123, "cve_id": "CVE-2026-8932", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.3247, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "incomplete mTLS config matching in conn reuse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8932" }, { "rank": 124, "cve_id": "CVE-2026-20909", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0039, "epss_percentile": 0.31803, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea tracked-time list endpoint has insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20909" }, { "rank": 125, "cve_id": "CVE-2026-25782", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0039, "epss_percentile": 0.31803, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-639", "title": "Gitea tracked-time deletion can target entries from another issue", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25782" }, { "rank": 126, "cve_id": "CVE-2026-11397", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00385, "epss_percentile": 0.3131, "kev": false, "kev_due_at": null, "vendor": "vjinfotech", "product": "WP Import Export Lite", "cwe": "CWE-918", "title": "WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11397" }, { "rank": 127, "cve_id": "CVE-2026-8926", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00376, "epss_percentile": 0.30355, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-522", "title": "password leak with netrc and user in URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8926" }, { "rank": 128, "cve_id": "CVE-2026-9626", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00375, "epss_percentile": 0.30193, "kev": false, "kev_due_at": null, "vendor": "parorrey", "product": "JSON API User", "cwe": "CWE-79", "title": "JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9626" }, { "rank": 129, "cve_id": "CVE-2026-14608", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00374, "epss_percentile": 0.3014, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "CET Automated Grading System with AI Predictive Analytics", "cwe": "CWE-285", "title": "SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14608" }, { "rank": 130, "cve_id": "CVE-2026-14617", "cvss_base": 1.3, "cvss_severity": "LOW", "epss_score": 0.00374, "epss_percentile": 0.30119, "kev": false, "kev_due_at": null, "vendor": "NousResearch", "product": "hermes-agent", "cwe": "CWE-178", "title": "NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14617" }, { "rank": 131, "cve_id": "CVE-2026-58424", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.0037, "epss_percentile": 0.29735, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-285", "title": "Permanent Fork PR Workflow Approval Gate Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58424" }, { "rank": 132, "cve_id": "CVE-2026-27761", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00367, "epss_percentile": 0.29401, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea repository feeds bypass API token scope enforcement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27761" }, { "rank": 133, "cve_id": "CVE-2026-45488", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00362, "epss_percentile": 0.28934, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-451", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45488" }, { "rank": 134, "cve_id": "CVE-2026-9756", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00357, "epss_percentile": 0.28368, "kev": false, "kev_due_at": null, "vendor": "edge22", "product": "GenerateBlocks", "cwe": "CWE-79", "title": "GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9756" }, { "rank": 135, "cve_id": "CVE-2026-12729", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00354, "epss_percentile": 0.28027, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot", "cwe": "CWE-862", "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12729" }, { "rank": 136, "cve_id": "CVE-2026-12557", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00353, "epss_percentile": 0.27866, "kev": false, "kev_due_at": null, "vendor": "SaturdayDrive", "product": "Ninja Forms - File Uploads", "cwe": "CWE-862", "title": "Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12557" }, { "rank": 137, "cve_id": "CVE-2026-26231", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00351, "epss_percentile": 0.27748, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea maintainer-edit permissions allow unauthorized commits to readable repositories", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26231" }, { "rank": 138, "cve_id": "CVE-2026-8892", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27487, "kev": false, "kev_due_at": null, "vendor": "creativemindssolutions", "product": "CM Business Directory – Optimise and showcase local business", "cwe": "CWE-79", "title": "CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8892" }, { "rank": 139, "cve_id": "CVE-2026-25779", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00344, "epss_percentile": 0.26901, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-601", "title": "Gitea redirect handling permits open redirects through backslash paths", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25779" }, { "rank": 140, "cve_id": "CVE-2026-25714", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.26741, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-862", "title": "Gitea user organization API bypasses public-only token filtering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25714" }, { "rank": 141, "cve_id": "CVE-2026-27783", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.26741, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-862", "title": "Gitea issue-template APIs bypass repository unit authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27783" }, { "rank": 142, "cve_id": "CVE-2026-12064", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00339, "epss_percentile": 0.26336, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-295", "title": "proto-default skips SSH verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064" }, { "rank": 143, "cve_id": "CVE-2026-46463", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00332, "epss_percentile": 0.25593, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-190", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46463" }, { "rank": 144, "cve_id": "CVE-2026-12731", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00331, "epss_percentile": 0.25494, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot", "cwe": "CWE-79", "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12731" }, { "rank": 145, "cve_id": "CVE-2026-12734", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00331, "epss_percentile": 0.25495, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot", "cwe": "CWE-79", "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12734" }, { "rank": 146, "cve_id": "CVE-2026-14613", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.0033, "epss_percentile": 0.25284, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.6", "cwe": "CWE-284", "title": "Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14613" }, { "rank": 147, "cve_id": "CVE-2026-9547", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00325, "epss_percentile": 0.24817, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "SSH improper host validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9547" }, { "rank": 148, "cve_id": "CVE-2026-28740", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00323, "epss_percentile": 0.2451, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-639", "title": "Gitea LFS object reuse bypasses Code-unit authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28740" }, { "rank": 149, "cve_id": "CVE-2026-14615", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00317, "epss_percentile": 0.23841, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "cwe": "CWE-1220", "title": "Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14615" }, { "rank": 150, "cve_id": "CVE-2026-14614", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00315, "epss_percentile": 0.2368, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "cwe": "CWE-639", "title": "Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14614" }, { "rank": 151, "cve_id": "CVE-2026-8286", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00309, "epss_percentile": 0.23059, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-295", "title": "wrong STARTTLS connection reuse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286" }, { "rank": 152, "cve_id": "CVE-2026-58426", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00301, "epss_percentile": 0.22119, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-347", "title": "Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58426" }, { "rank": 153, "cve_id": "CVE-2026-4804", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00283, "epss_percentile": 0.20247, "kev": false, "kev_due_at": null, "vendor": "themegrill", "product": "Zakra", "cwe": "CWE-79", "title": "Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4804" }, { "rank": 154, "cve_id": "CVE-2026-14355", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00279, "epss_percentile": 0.19809, "kev": false, "kev_due_at": null, "vendor": "php", "product": "php", "cwe": "CWE-122", "title": "ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14355" }, { "rank": 155, "cve_id": "CVE-2026-41123", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00254, "epss_percentile": 0.16624, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-284", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in the RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41123" }, { "rank": 156, "cve_id": "CVE-2026-4322", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16446, "kev": false, "kev_due_at": null, "vendor": "Raera - Ankara Web Design and Digital Advertising Agency", "product": "Destekz", "cwe": "CWE-79", "title": "XSS in Raera's Destekz", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4322" }, { "rank": 157, "cve_id": "CVE-2026-58379", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00233, "epss_percentile": 0.13947, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "cwe": "CWE-122", "title": "Gimp: gimp: heap buffer overflow in read_channel_data()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58379" }, { "rank": 158, "cve_id": "CVE-2026-14612", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13099, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14612" }, { "rank": 159, "cve_id": "CVE-2026-10054", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00219, "epss_percentile": 0.12223, "kev": false, "kev_due_at": null, "vendor": "Eclipse Foundation", "product": "Eclipse Theia", "cwe": "CWE-306", "title": "In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication. A fix is in development that enforces same-origin validation by default, removes trust in the fix-origin header, gates HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10054" }, { "rank": 160, "cve_id": "CVE-2026-14459", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00208, "epss_percentile": 0.1083, "kev": false, "kev_due_at": null, "vendor": "TUBITAK BILGEM Software Technologies Research Institute", "product": "pardus-software", "cwe": "CWE-88", "title": "Argument Injection in TUBITAK BILGEM's pardus-software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14459" }, { "rank": 161, "cve_id": "CVE-2026-35159", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.10482, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "Inspiron 15 3520", "cwe": "CWE-305", "title": "Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35159" }, { "rank": 162, "cve_id": "CVE-2026-14605", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00197, "epss_percentile": 0.09462, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "RT-Thread", "cwe": "CWE-119", "title": "RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14605" }, { "rank": 163, "cve_id": "CVE-2026-14606", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00197, "epss_percentile": 0.09461, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "RT-Thread", "cwe": "CWE-119", "title": "RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14606" }, { "rank": 164, "cve_id": "CVE-2026-55945", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00186, "epss_percentile": 0.0817, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-362", "title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55945" }, { "rank": 165, "cve_id": "CVE-2026-44269", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00174, "epss_percentile": 0.06824, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-59", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('link following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44269" }, { "rank": 166, "cve_id": "CVE-2026-46468", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00174, "epss_percentile": 0.06825, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-59", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('Link following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46468" }, { "rank": 167, "cve_id": "CVE-2026-14610", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.00173, "epss_percentile": 0.06755, "kev": false, "kev_due_at": null, "vendor": "Open Asset Import Library", "product": "Assimp", "cwe": "CWE-119", "title": "Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14610" }, { "rank": 168, "cve_id": "CVE-2026-46730", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00172, "epss_percentile": 0.06667, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-863", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect authorization vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46730" }, { "rank": 169, "cve_id": "CVE-2026-41124", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00169, "epss_percentile": 0.06307, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-22", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41124" }, { "rank": 170, "cve_id": "CVE-2026-14607", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00167, "epss_percentile": 0.06078, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "RT-Thread", "cwe": "CWE-119", "title": "RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14607" }, { "rank": 171, "cve_id": "CVE-2026-14460", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00163, "epss_percentile": 0.05684, "kev": false, "kev_due_at": null, "vendor": "TUBITAK BILGEM Software Technologies Research Institute", "product": "pardus-software", "cwe": "CWE-862", "title": "Missing Authorization in TUBITAK BILGEM's pardus-software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14460" }, { "rank": 172, "cve_id": "CVE-2026-12960", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00159, "epss_percentile": 0.05261, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "Router app", "cwe": "CWE-926", "title": "An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12960" }, { "rank": 173, "cve_id": "CVE-2026-8921", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00155, "epss_percentile": 0.04895, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "ASUS Business Manager", "cwe": "CWE-73", "title": "External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8921" }, { "rank": 174, "cve_id": "CVE-2026-46466", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00152, "epss_percentile": 0.04608, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-348", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of less trusted source vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46466" }, { "rank": 175, "cve_id": "CVE-2026-44268", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04098, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-732", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect permission Assignment for critical resource vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44268" }, { "rank": 176, "cve_id": "CVE-2022-4989", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00142, "epss_percentile": 0.03718, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "AI Suite 3", "cwe": "CWE-1284", "title": "** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4989" }, { "rank": 177, "cve_id": "CVE-2026-56085", "cvss_base": 3.3, "cvss_severity": "LOW", "epss_score": 0.00136, "epss_percentile": 0.03251, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-908", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of uninitialized resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56085" }, { "rank": 178, "cve_id": "CVE-2022-4990", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00131, "epss_percentile": 0.02887, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "AI Suite 3", "cwe": "CWE-1284", "title": "** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4990" }, { "rank": 179, "cve_id": "CVE-2026-46467", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00113, "epss_percentile": 0.01593, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-532", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46467" }, { "rank": 180, "cve_id": "CVE-2026-8804", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00107, "epss_percentile": 0.01248, "kev": false, "kev_due_at": null, "vendor": "Perforce", "product": "Puppet Core", "cwe": "CWE-312", "title": "Cleartext Storage of Sensitive Information for Puppet Resource API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8804" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-10536", "detail": "EXPLOIT PUBLISHED — CVE-2026-10536 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11352", "detail": "EXPLOIT PUBLISHED — CVE-2026-11352 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11564", "detail": "EXPLOIT PUBLISHED — CVE-2026-11564 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11586", "detail": "EXPLOIT PUBLISHED — CVE-2026-11586 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11856", "detail": "EXPLOIT PUBLISHED — CVE-2026-11856 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-12064", "detail": "EXPLOIT PUBLISHED — CVE-2026-12064 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-12481", "detail": "EXPLOIT PUBLISHED — CVE-2026-12481 (keras-team/keras). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8286", "detail": "EXPLOIT PUBLISHED — CVE-2026-8286 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8458", "detail": "EXPLOIT PUBLISHED — CVE-2026-8458 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8924", "detail": "EXPLOIT PUBLISHED — CVE-2026-8924 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8925", "detail": "EXPLOIT PUBLISHED — CVE-2026-8925 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8926", "detail": "EXPLOIT PUBLISHED — CVE-2026-8926 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8927", "detail": "EXPLOIT PUBLISHED — CVE-2026-8927 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8932", "detail": "EXPLOIT PUBLISHED — CVE-2026-8932 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9079", "detail": "EXPLOIT PUBLISHED — CVE-2026-9079 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9080", "detail": "EXPLOIT PUBLISHED — CVE-2026-9080 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9545", "detail": "EXPLOIT PUBLISHED — CVE-2026-9545 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9546", "detail": "EXPLOIT PUBLISHED — CVE-2026-9546 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9547", "detail": "EXPLOIT PUBLISHED — CVE-2026-9547 (curl). Public exploit reference added." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-48558", "detail": "DUE DATE PASSED — CVE-2026-48558 (SimpleHelp). CISA remediation deadline was July 2, 2026; still in catalog." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }