{
  "day": "2026-07-04",
  "boundary": "UTC calendar day",
  "published_count": 69,
  "by_severity": {
    "CRITICAL": 1,
    "HIGH": 30,
    "MEDIUM": 14,
    "LOW": 24
  },
  "kev_count": 0,
  "exploit_reference_count": 3,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-53359",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00908,
      "epss_percentile": 0.57232,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "KVM: x86: Fix shadow paging use-after-free due to unexpected role",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53359"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-14637",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0083,
      "epss_percentile": 0.54786,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-20",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14637"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2025-71364",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00826,
      "epss_percentile": 0.54679,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71364"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-14628",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00767,
      "epss_percentile": 0.52767,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-22",
      "title": "NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14628"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-14622",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0069,
      "epss_percentile": 0.50016,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jairiidriss",
      "product": "restaurant-website-php-mysql",
      "cwe": "CWE-287",
      "title": "jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14622"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-12195",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00656,
      "epss_percentile": 0.48649,
      "kev": false,
      "kev_due_at": null,
      "vendor": "myvesta",
      "product": "vesta",
      "cwe": "CWE-78",
      "title": "myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12195"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2025-71347",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00638,
      "epss_percentile": 0.47818,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71347"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2025-71366",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00638,
      "epss_percentile": 0.47819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71366"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2025-71367",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00638,
      "epss_percentile": 0.47818,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via _operator.attrgetter Detection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71367"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2025-71369",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00638,
      "epss_percentile": 0.47819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71369"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2025-71373",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00637,
      "epss_percentile": 0.47781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-693",
      "title": "picklescan - Remote Code Execution via operator.methodcaller Detection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71373"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-14635",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00621,
      "epss_percentile": 0.47055,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-22",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14635"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2025-71342",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00613,
      "epss_percentile": 0.4665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71342"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2025-71345",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00613,
      "epss_percentile": 0.46651,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_prof",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71345"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2025-71359",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00613,
      "epss_percentile": 0.4665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71359"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-14534",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00594,
      "epss_percentile": 0.45752,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trailofbits",
      "product": "fickling",
      "cwe": "CWE-184",
      "title": "Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14534"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2025-71380",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00571,
      "epss_percentile": 0.44615,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n8n",
      "product": "n8n",
      "cwe": "CWE-284",
      "title": "n8n - Arbitrary Command Execution via Execute Command Node",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71380"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-14535",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00564,
      "epss_percentile": 0.44312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trailofbits",
      "product": "fickling",
      "cwe": "CWE-693",
      "title": "Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14535"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-14648",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00561,
      "epss_percentile": 0.44077,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Voting System",
      "cwe": "CWE-74",
      "title": "code-projects Online Voting System Login authentication.php test_input sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14648"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-14627",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00554,
      "epss_percentile": 0.43758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-287",
      "title": "NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14627"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-14618",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00545,
      "epss_percentile": 0.43264,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-404",
      "title": "Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14618"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-14623",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00545,
      "epss_percentile": 0.43265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "omec-project",
      "product": "amf",
      "cwe": "CWE-404",
      "title": "omec-project amf NGAP Message RRCInactiveTransitionReport denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14623"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-14624",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00545,
      "epss_percentile": 0.43265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "omec-project",
      "product": "amf",
      "cwe": "CWE-404",
      "title": "omec-project amf NGSetupRequest handler.go denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14624"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2025-71372",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00544,
      "epss_percentile": 0.4323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Picklescan",
      "product": "Picklescan",
      "cwe": "CWE-502",
      "title": "Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71372"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-14629",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00533,
      "epss_percentile": 0.42581,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "RT-Thread",
      "cwe": "CWE-369",
      "title": "RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zero",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14629"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2025-71375",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00523,
      "epss_percentile": 0.42017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Undetected Remote Code Execution via _operator.methodcaller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71375"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-14633",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00486,
      "epss_percentile": 0.3961,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-79",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14633"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-14634",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00486,
      "epss_percentile": 0.39609,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-79",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14634"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-14636",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00476,
      "epss_percentile": 0.38999,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-22",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14636"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-14626",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00471,
      "epss_percentile": 0.38593,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-404",
      "title": "NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14626"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-14656",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0047,
      "epss_percentile": 0.38569,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-79",
      "title": "code-projects Assessment Management remove-user.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14656"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-14632",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0046,
      "epss_percentile": 0.37915,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-601",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14632"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-14641",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00435,
      "epss_percentile": 0.36032,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_course.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14641"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2025-71343",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00431,
      "epss_percentile": 0.35706,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71343"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2025-71353",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00431,
      "epss_percentile": 0.35707,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71353"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2025-71356",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00431,
      "epss_percentile": 0.35706,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71356"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2025-71360",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00431,
      "epss_percentile": 0.35707,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71360"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2025-71362",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00431,
      "epss_percentile": 0.35707,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71362"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-14649",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35663,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Voting System",
      "cwe": "CWE-74",
      "title": "code-projects Online Voting System saveVote.php test_input sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14649"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-14640",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CodeAstro",
      "product": "Apartment Visitor Management System",
      "cwe": "CWE-74",
      "title": "CodeAstro Apartment Visitor Management System Login index.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14640"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-14642",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_class2.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14642"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-14652",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35663,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Simple and Nice Shopping Cart Script",
      "cwe": "CWE-74",
      "title": "SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14652"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-14653",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35663,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Simple and Nice Shopping Cart Script",
      "cwe": "CWE-74",
      "title": "SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14653"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-14654",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.35662,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Simple and Nice Shopping Cart Script",
      "cwe": "CWE-74",
      "title": "SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14654"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-14660",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00431,
      "epss_percentile": 0.3566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Job Portal",
      "cwe": "CWE-74",
      "title": "code-projects Online Job Portal login.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14660"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-14647",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0043,
      "epss_percentile": 0.35586,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "onnx",
      "cwe": "CWE-119",
      "title": "onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14647"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-12196",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00396,
      "epss_percentile": 0.32456,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hestiacp",
      "product": "hestiacp",
      "cwe": "CWE-287",
      "title": "HestiaCP Admin Takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12196"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-14625",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00379,
      "epss_percentile": 0.30608,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-693",
      "title": "NousResearch hermes-agent server.py shell.exec protection mechanism",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14625"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-12194",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00378,
      "epss_percentile": 0.30529,
      "kev": false,
      "kev_due_at": null,
      "vendor": "phpipam",
      "product": "phpipam",
      "cwe": "CWE-98",
      "title": "PHPIPAM Authenticated LFI",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12194"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-14655",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00368,
      "epss_percentile": 0.29475,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-79",
      "title": "code-projects Assessment Management view-users.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14655"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-14621",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00365,
      "epss_percentile": 0.29223,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FederatedAI",
      "product": "FATE",
      "cwe": "CWE-488",
      "title": "FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14621"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-14619",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25667,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System medicine.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14619"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-14638",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25666,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System patient.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14638"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-14639",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25674,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CodeAstro",
      "product": "Ecommerce Website",
      "cwe": "CWE-74",
      "title": "CodeAstro Ecommerce Website my_account.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14639"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-14657",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-74",
      "title": "code-projects Assessment Management Database Query marking-scheme.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14657"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-14658",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-74",
      "title": "code-projects Assessment Management marking-scheme.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14658"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-14659",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25674,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System patientappointment.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14659"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2024-1248",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00303,
      "epss_percentile": 0.22312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WSO2",
      "product": "WSO2 API Manager",
      "cwe": "CWE-298",
      "title": "Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1248"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2025-13475",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00274,
      "epss_percentile": 0.1925,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WSO2",
      "product": "WSO2 Identity Server",
      "cwe": "CWE-288",
      "title": "Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13475"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-53362",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00265,
      "epss_percentile": 0.17959,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: account for fraggap on the paged allocation path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53362"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-12746",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.16552,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BIAFRA",
      "product": "Dancer2::Plugin::Auth::OAuth::Provider",
      "cwe": "CWE-352",
      "title": "Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12746"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-12252",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00235,
      "epss_percentile": 0.14188,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nltk",
      "product": "nltk/nltk",
      "cwe": "CWE-94",
      "title": "Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12252"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-12740",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00234,
      "epss_percentile": 0.14105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CORNELIUS",
      "product": "Plack::Middleware::OAuth",
      "cwe": "CWE-352",
      "title": "Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12740"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-14630",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00233,
      "epss_percentile": 0.1393,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ForceInjection",
      "product": "AI-fundermentals",
      "cwe": "CWE-327",
      "title": "ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14630"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-54424",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00185,
      "epss_percentile": 0.08124,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unity",
      "product": "Parsec",
      "cwe": "CWE-648",
      "title": "An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\\SYSTEM with a user-controlled value of the AppData environment variable.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54424"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-53360",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00173,
      "epss_percentile": 0.06768,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53360"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-14650",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00161,
      "epss_percentile": 0.05486,
      "kev": false,
      "kev_due_at": null,
      "vendor": "connorskees",
      "product": "grass",
      "cwe": "CWE-404",
      "title": "connorskees grass UTF-8 Character raw_to_parse_error denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14650"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-14651",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.0016,
      "epss_percentile": 0.05337,
      "kev": false,
      "kev_due_at": null,
      "vendor": "connorskees",
      "product": "grass",
      "cwe": "CWE-404",
      "title": "connorskees grass visitor denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14651"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-53361",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.02888,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "af_unix: Set gc_in_progress to true in unix_gc().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53361"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-12252",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-12252 (nltk/nltk). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-14534",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-14534 (trailofbits fickling). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-14535",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-14535 (trailofbits fickling). Public exploit reference added."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}