{ "day": "2026-07-07", "boundary": "UTC calendar day", "published_count": 170, "by_severity": { "CRITICAL": 25, "HIGH": 70, "MEDIUM": 64, "LOW": 11 }, "kev_count": 4, "exploit_reference_count": 7, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-48282", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.42388, "epss_percentile": 0.98595, "kev": true, "kev_due_at": "2026-07-10", "vendor": "Adobe", "product": "ColdFusion", "cwe": "CWE-22", "title": "ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48282" }, { "rank": 2, "cve_id": "CVE-2026-56290", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.30375, "epss_percentile": 0.98085, "kev": true, "kev_due_at": "2026-07-10", "vendor": "joomlack.fr", "product": "JoomlaCK.fr Page Builder CK extension for Joomla", "cwe": "CWE-434", "title": "Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56290" }, { "rank": 3, "cve_id": "CVE-2026-48908", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.14824, "epss_percentile": 0.96419, "kev": true, "kev_due_at": "2026-07-10", "vendor": "joomshaper.net", "product": "SP Page Builder extension for Joomla", "cwe": "CWE-434", "title": "Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48908" }, { "rank": 4, "cve_id": "CVE-2026-55255", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00887, "epss_percentile": 0.56548, "kev": true, "kev_due_at": "2026-07-10", "vendor": "langflow-ai", "product": "langflow", "cwe": "CWE-639", "title": "Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55255" }, { "rank": 5, "cve_id": "CVE-2026-44454", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.02642, "epss_percentile": 0.84418, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-78", "title": "Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44454" }, { "rank": 6, "cve_id": "CVE-2026-59800", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.02043, "epss_percentile": 0.79673, "kev": false, "kev_due_at": null, "vendor": "decolua", "product": "9router", "cwe": "CWE-78", "title": "9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59800" }, { "rank": 7, "cve_id": "CVE-2026-53479", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.0197, "epss_percentile": 0.78875, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to protection mechanism bypass. This is a Critical vulnerability as it allows an attacker to invoke arbitrary command execution with root privileges; so Dell recommends customers to upgrade at the earliest opportunity.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53479" }, { "rank": 8, "cve_id": "CVE-2026-33264", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01649, "epss_percentile": 0.74665, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow", "cwe": "CWE-502", "title": "Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33264" }, { "rank": 9, "cve_id": "CVE-2026-14345", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01392, "epss_percentile": 0.70254, "kev": false, "kev_due_at": null, "vendor": "getwpfunnels", "product": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell", "cwe": "CWE-434", "title": "WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14345" }, { "rank": 10, "cve_id": "CVE-2026-23698", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.01226, "epss_percentile": 0.66535, "kev": false, "kev_due_at": null, "vendor": "Vtiger", "product": "Vtiger CRM", "cwe": "CWE-434", "title": "Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23698" }, { "rank": 11, "cve_id": "CVE-2026-6101", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.01023, "epss_percentile": 0.60864, "kev": false, "kev_due_at": null, "vendor": "mohammed_kaludi", "product": "AMP for WP – Accelerated Mobile Pages", "cwe": "CWE-73", "title": "AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6101" }, { "rank": 12, "cve_id": "CVE-2026-23697", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00999, "epss_percentile": 0.60127, "kev": false, "kev_due_at": null, "vendor": "Vtiger", "product": "Vtiger CRM", "cwe": "CWE-434", "title": "Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23697" }, { "rank": 13, "cve_id": "CVE-2026-42200", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00891, "epss_percentile": 0.56677, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-22", "title": "Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42200" }, { "rank": 14, "cve_id": "CVE-2026-59705", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00804, "epss_percentile": 0.5397, "kev": false, "kev_due_at": null, "vendor": "mem0", "product": "mem0", "cwe": "CWE-306", "title": "mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59705" }, { "rank": 15, "cve_id": "CVE-2026-34048", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00798, "epss_percentile": 0.53737, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-285", "title": "Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34048" }, { "rank": 16, "cve_id": "CVE-2026-55633", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00798, "epss_percentile": 0.53729, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-434", "title": "DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55633" }, { "rank": 17, "cve_id": "CVE-2026-34034", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00785, "epss_percentile": 0.53312, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Host RCE via Sentinel token injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34034" }, { "rank": 18, "cve_id": "CVE-2026-34168", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00785, "epss_percentile": 0.53313, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Command injection via unsanitized persistent storage name in docker volume commands", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34168" }, { "rank": 19, "cve_id": "CVE-2026-42143", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00785, "epss_percentile": 0.53312, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42143" }, { "rank": 20, "cve_id": "CVE-2026-56812", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00778, "epss_percentile": 0.53083, "kev": false, "kev_due_at": null, "vendor": "phoenixframework", "product": "phoenix", "cwe": "CWE-754", "title": "Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56812" }, { "rank": 21, "cve_id": "CVE-2011-10043", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00775, "epss_percentile": 0.53002, "kev": false, "kev_due_at": null, "vendor": "BINGOS", "product": "Module::Load", "cwe": "CWE-145", "title": "Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded", "url": "https://www.cve.org/CVERecord?id=CVE-2011-10043" }, { "rank": 22, "cve_id": "CVE-2026-56811", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00757, "epss_percentile": 0.52406, "kev": false, "kev_due_at": null, "vendor": "phoenixframework", "product": "phoenix", "cwe": "CWE-770", "title": "Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56811" }, { "rank": 23, "cve_id": "CVE-2026-34047", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00711, "epss_percentile": 0.50791, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-863", "title": "Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34047" }, { "rank": 24, "cve_id": "CVE-2026-37270", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00682, "epss_percentile": 0.49686, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-287", "title": "Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-coded credentials in the firmware.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-37270" }, { "rank": 25, "cve_id": "CVE-2026-55490", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00682, "epss_percentile": 0.49699, "kev": false, "kev_due_at": null, "vendor": "openwrt", "product": "openwrt", "cwe": "CWE-191", "title": "OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55490" }, { "rank": 26, "cve_id": "CVE-2026-14476", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00668, "epss_percentile": 0.49153, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-23", "title": "Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14476" }, { "rank": 27, "cve_id": "CVE-2026-48828", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00664, "epss_percentile": 0.48971, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow", "cwe": "CWE-200", "title": "Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48828" }, { "rank": 28, "cve_id": "CVE-2026-48892", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00664, "epss_percentile": 0.48972, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow", "cwe": "CWE-200", "title": "Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48892" }, { "rank": 29, "cve_id": "CVE-2026-49487", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00664, "epss_percentile": 0.48972, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow", "cwe": "CWE-200", "title": "Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49487" }, { "rank": 30, "cve_id": "CVE-2026-34158", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00651, "epss_percentile": 0.48429, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Command injection via single-quote breakout in Docker Compose custom commands", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34158" }, { "rank": 31, "cve_id": "CVE-2026-34058", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0065, "epss_percentile": 0.48374, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34058" }, { "rank": 32, "cve_id": "CVE-2026-34152", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0065, "epss_percentile": 0.48372, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34152" }, { "rank": 33, "cve_id": "CVE-2026-53729", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00643, "epss_percentile": 0.48037, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-639", "title": "DataEase ExportCenter IDOR allows cross-user export task access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53729" }, { "rank": 34, "cve_id": "CVE-2026-37271", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00642, "epss_percentile": 0.48008, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-287", "title": "Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-37271" }, { "rank": 35, "cve_id": "CVE-2026-48891", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00636, "epss_percentile": 0.47746, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow", "cwe": "CWE-200", "title": "Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48891" }, { "rank": 36, "cve_id": "CVE-2026-53481", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00632, "epss_percentile": 0.47544, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-22", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to the system. This is a critical severity vulnerability as it allows an attacker to take complete control of system; so Dell recommends customers to upgrade at the earliest opportunity.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53481" }, { "rank": 37, "cve_id": "CVE-2026-14895", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0063, "epss_percentile": 0.47444, "kev": false, "kev_due_at": null, "vendor": "BAKERSCOT", "product": "String::Util", "cwe": "CWE-1333", "title": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14895" }, { "rank": 38, "cve_id": "CVE-2026-34035", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00628, "epss_percentile": 0.47382, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Host RCE via Log Drain secret/env command injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34035" }, { "rank": 39, "cve_id": "CVE-2026-34057", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00628, "epss_percentile": 0.47382, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34057" }, { "rank": 40, "cve_id": "CVE-2026-11610", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00627, "epss_percentile": 0.47326, "kev": false, "kev_due_at": null, "vendor": "389ds", "product": "389-ds-base", "cwe": "CWE-122", "title": "389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11610" }, { "rank": 41, "cve_id": "CVE-2026-53483", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00625, "epss_percentile": 0.47269, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-287", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 an improper authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This is a critical severity vulnerability as it allows an attacker to take complete control of system; so Dell recommends customers to upgrade at the earliest opportunity.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53483" }, { "rank": 42, "cve_id": "CVE-2026-55077", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00615, "epss_percentile": 0.46747, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-285", "title": "Coder: User-admin role can reset owner account password", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55077" }, { "rank": 43, "cve_id": "CVE-2026-55079", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00611, "epss_percentile": 0.46528, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-789", "title": "Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55079" }, { "rank": 44, "cve_id": "CVE-2026-55078", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00602, "epss_percentile": 0.46128, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-409", "title": "Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55078" }, { "rank": 45, "cve_id": "CVE-2026-57867", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00599, "epss_percentile": 0.46001, "kev": false, "kev_due_at": null, "vendor": "MicroRealEstate", "product": "MicroRealEstate", "cwe": "CWE-288", "title": "MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting MicroRealEstate deployments to brute-force One-Time Passwords (OTP) to log in as any user. This issue affects MicroRealEstate: through 1.0.0-alpha3.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57867" }, { "rank": 46, "cve_id": "CVE-2026-53751", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00597, "epss_percentile": 0.4585, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-94", "title": "DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53751" }, { "rank": 47, "cve_id": "CVE-2026-51937", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00597, "epss_percentile": 0.45843, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-306", "title": "An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51937" }, { "rank": 48, "cve_id": "CVE-2026-59708", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00593, "epss_percentile": 0.45705, "kev": false, "kev_due_at": null, "vendor": "ghostfolio", "product": "ghostfolio", "cwe": "CWE-862", "title": "Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59708" }, { "rank": 49, "cve_id": "CVE-2026-14904", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0057, "epss_percentile": 0.44578, "kev": false, "kev_due_at": null, "vendor": "AWS", "product": "res", "cwe": "CWE-59", "title": "RES Auth.GetUserPrivateKey Arbitrary File Read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14904" }, { "rank": 50, "cve_id": "CVE-2026-14474", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00568, "epss_percentile": 0.4446, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-1188", "title": "Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14474" }, { "rank": 51, "cve_id": "CVE-2026-55434", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00552, "epss_percentile": 0.43639, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-770", "title": "Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55434" }, { "rank": 52, "cve_id": "CVE-2026-12375", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00545, "epss_percentile": 0.43286, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "uncanny-automator-pro", "cwe": null, "title": "Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12375" }, { "rank": 53, "cve_id": "CVE-2026-57871", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0054, "epss_percentile": 0.4299, "kev": false, "kev_due_at": null, "vendor": "MicroRealEstate", "product": "MicroRealEstate", "cwe": "CWE-23", "title": "Relative path traversal vulnerability in MicroRealEstate file upload functionality allows attackers to potentially overwrite system files. This issue affects MicroRealEstate: through 1.0.0-alpha3.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57871" }, { "rank": 54, "cve_id": "CVE-2026-54607", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00523, "epss_percentile": 0.42016, "kev": false, "kev_due_at": null, "vendor": "labring", "product": "FastGPT", "cwe": "CWE-918", "title": "FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54607" }, { "rank": 55, "cve_id": "CVE-2026-13696", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00518, "epss_percentile": 0.41681, "kev": false, "kev_due_at": null, "vendor": "HAVELSAN Inc.", "product": "Liman MYS", "cwe": "CWE-90", "title": "LDAP Injection in HAVELSAN's Liman MYS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13696" }, { "rank": 56, "cve_id": "CVE-2026-58473", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00511, "epss_percentile": 0.41226, "kev": false, "kev_due_at": null, "vendor": "topoteretes", "product": "cognee", "cwe": "CWE-306", "title": "Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58473" }, { "rank": 57, "cve_id": "CVE-2026-50529", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00496, "epss_percentile": 0.40259, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-863", "title": "DataEase: Link Token Leakage Prior to Share Password/Ticket Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50529" }, { "rank": 58, "cve_id": "CVE-2026-14940", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00487, "epss_percentile": 0.39717, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Directory Server 11", "cwe": "CWE-122", "title": "389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14940" }, { "rank": 59, "cve_id": "CVE-2026-59707", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00482, "epss_percentile": 0.39348, "kev": false, "kev_due_at": null, "vendor": "LocalAI", "product": "LocalAI", "cwe": "CWE-918", "title": "LocalAI - Server-Side Request Forgery via POST /models/apply", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59707" }, { "rank": 60, "cve_id": "CVE-2026-55418", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00482, "epss_percentile": 0.39347, "kev": false, "kev_due_at": null, "vendor": "labring", "product": "FastGPT", "cwe": "CWE-639", "title": "FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55418" }, { "rank": 61, "cve_id": "CVE-2026-14380", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00479, "epss_percentile": 0.39207, "kev": false, "kev_due_at": null, "vendor": "HMBRAND", "product": "DBI", "cwe": "CWE-95", "title": "DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14380" }, { "rank": 62, "cve_id": "CVE-2026-55075", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00479, "epss_percentile": 0.39153, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-287", "title": "Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55075" }, { "rank": 63, "cve_id": "CVE-2026-55076", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00479, "epss_percentile": 0.39153, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-287", "title": "Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55076" }, { "rank": 64, "cve_id": "CVE-2026-55647", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00467, "epss_percentile": 0.38384, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-79", "title": "DataEase: authenticated stored XSS in the dashboard text components", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55647" }, { "rank": 65, "cve_id": "CVE-2026-55427", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00466, "epss_percentile": 0.38313, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-74", "title": "Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55427" }, { "rank": 66, "cve_id": "CVE-2026-48958", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00461, "epss_percentile": 0.37924, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-284", "title": "Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48958" }, { "rank": 67, "cve_id": "CVE-2026-44877", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0046, "epss_percentile": 0.37863, "kev": false, "kev_due_at": null, "vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Networking Instant On", "cwe": "CWE-200", "title": "Unauthenticated Remote Disclosure of Cryptographic Secrets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44877" }, { "rank": 68, "cve_id": "CVE-2026-55631", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00459, "epss_percentile": 0.37796, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-22", "title": "DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55631" }, { "rank": 69, "cve_id": "CVE-2026-57172", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00447, "epss_percentile": 0.3702, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-321", "title": "DataEase: Hardcoded JWT Signing Secret in ShareLink", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57172" }, { "rank": 70, "cve_id": "CVE-2026-42147", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00444, "epss_percentile": 0.36803, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-918", "title": "Coolify: SSRF via S3 Storage Endpoint in testConnection()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42147" }, { "rank": 71, "cve_id": "CVE-2026-59706", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00442, "epss_percentile": 0.36604, "kev": false, "kev_due_at": null, "vendor": "mem0", "product": "mem0", "cwe": "CWE-306", "title": "mem0 - Unauthenticated Config API Exposure and SSRF via ollama_base_url", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59706" }, { "rank": 72, "cve_id": "CVE-2026-44938", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00442, "epss_percentile": 0.36629, "kev": false, "kev_due_at": null, "vendor": "SUSE", "product": "Rancher", "cwe": "CWE-522", "title": "Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44938" }, { "rank": 73, "cve_id": "CVE-2026-34037", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00441, "epss_percentile": 0.36531, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-639", "title": "Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34037" }, { "rank": 74, "cve_id": "CVE-2026-49229", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00441, "epss_percentile": 0.3653, "kev": false, "kev_due_at": null, "vendor": "actualbudget", "product": "actual", "cwe": "CWE-613", "title": "Actual: Disabled OpenID users keep access through existing session tokens", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49229" }, { "rank": 75, "cve_id": "CVE-2026-53877", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00437, "epss_percentile": 0.3621, "kev": false, "kev_due_at": null, "vendor": "djangoproject", "product": "Django", "cwe": "CWE-805", "title": "Heap buffer over-read in GDALRaster", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53877" }, { "rank": 76, "cve_id": "CVE-2026-13019", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00434, "epss_percentile": 0.3592, "kev": false, "kev_due_at": null, "vendor": "Esri", "product": "Portal for ArcGIS", "cwe": "CWE-640", "title": "Missing Authentication", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13019" }, { "rank": 77, "cve_id": "CVE-2026-45796", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0043, "epss_percentile": 0.35598, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-918", "title": "Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45796" }, { "rank": 78, "cve_id": "CVE-2026-48588", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00429, "epss_percentile": 0.3548, "kev": false, "kev_due_at": null, "vendor": "djangoproject", "product": "Django", "cwe": "CWE-524", "title": "Potential exposure of private data via cached Set-Cookie response", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48588" }, { "rank": 79, "cve_id": "CVE-2026-50007", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00427, "epss_percentile": 0.35383, "kev": false, "kev_due_at": null, "vendor": "actualbudget", "product": "actual", "cwe": "CWE-862", "title": "Actual: Shared users can perform owner-only file management actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50007" }, { "rank": 80, "cve_id": "CVE-2026-48948", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00423, "epss_percentile": 0.35074, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-284", "title": "Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48948" }, { "rank": 81, "cve_id": "CVE-2026-48957", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00423, "epss_percentile": 0.35074, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-284", "title": "Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48957" }, { "rank": 82, "cve_id": "CVE-2026-4375", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00421, "epss_percentile": 0.34848, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "DoLeads Integrator", "cwe": null, "title": "DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4375" }, { "rank": 83, "cve_id": "CVE-2026-55417", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00421, "epss_percentile": 0.34907, "kev": false, "kev_due_at": null, "vendor": "chevereto", "product": "chevereto", "cwe": "CWE-862", "title": "Chevereto private profile setting leaks username on /json endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55417" }, { "rank": 84, "cve_id": "CVE-2026-5730", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00418, "epss_percentile": 0.3454, "kev": false, "kev_due_at": null, "vendor": "Idvlabs Software and Consulting Services Inc.", "product": "Ontime", "cwe": "CWE-639", "title": "IDOR in Idvlabs' Ontime", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5730" }, { "rank": 85, "cve_id": "CVE-2026-5799", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00418, "epss_percentile": 0.3454, "kev": false, "kev_due_at": null, "vendor": "Idvlabs Software and Consulting Services Inc.", "product": "Ontime", "cwe": "CWE-639", "title": "IDOR in Idvlabs' Ontime", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5799" }, { "rank": 86, "cve_id": "CVE-2026-12948", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00418, "epss_percentile": 0.34511, "kev": false, "kev_due_at": null, "vendor": "Digi International", "product": "Digi PortServer TS", "cwe": "CWE-79", "title": "Stored Cross-Site Scripting (XSS)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12948" }, { "rank": 87, "cve_id": "CVE-2026-50530", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00414, "epss_percentile": 0.34149, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-639", "title": "DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50530" }, { "rank": 88, "cve_id": "CVE-2026-14739", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00413, "epss_percentile": 0.34107, "kev": false, "kev_due_at": null, "vendor": "HMBRAND", "product": "DBI", "cwe": "CWE-787", "title": "DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14739" }, { "rank": 89, "cve_id": "CVE-2026-55635", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00412, "epss_percentile": 0.33978, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-89", "title": "DataEase: Authenticated SQL Injection in Chart Quota Filters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55635" }, { "rank": 90, "cve_id": "CVE-2025-12799", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00408, "epss_percentile": 0.3362, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1.7.GA", "cwe": "CWE-79", "title": "Jastow: jastow cross-site scripting attack due to unsanitized uri", "url": "https://www.cve.org/CVERecord?id=CVE-2025-12799" }, { "rank": 91, "cve_id": "CVE-2026-55428", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00405, "epss_percentile": 0.33339, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-285", "title": "Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55428" }, { "rank": 92, "cve_id": "CVE-2026-54601", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00405, "epss_percentile": 0.33329, "kev": false, "kev_due_at": null, "vendor": "labring", "product": "FastGPT", "cwe": "CWE-915", "title": "FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54601" }, { "rank": 93, "cve_id": "CVE-2026-7017", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00403, "epss_percentile": 0.33124, "kev": false, "kev_due_at": null, "vendor": "HAARG", "product": "HTTP::Tiny", "cwe": "CWE-522", "title": "HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7017" }, { "rank": 94, "cve_id": "CVE-2026-34044", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00402, "epss_percentile": 0.33006, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-639", "title": "Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34044" }, { "rank": 95, "cve_id": "CVE-2026-12352", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.004, "epss_percentile": 0.32856, "kev": false, "kev_due_at": null, "vendor": "Digi International", "product": "PortServer TS 1/2/4", "cwe": "CWE-863", "title": "Incorrect Authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12352" }, { "rank": 96, "cve_id": "CVE-2026-49296", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00399, "epss_percentile": 0.32718, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow", "cwe": "CWE-639", "title": "Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49296" }, { "rank": 97, "cve_id": "CVE-2026-42145", "cvss_base": 3.1, "cvss_severity": "LOW", "epss_score": 0.00394, "epss_percentile": 0.32265, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-434", "title": "Coolify: File Upload Without Type or Size Validation in Database Backup Restore", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42145" }, { "rank": 98, "cve_id": "CVE-2026-12277", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00392, "epss_percentile": 0.31942, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Frontend File Manager Plugin", "cwe": null, "title": "Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12277" }, { "rank": 99, "cve_id": "CVE-2026-14740", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00387, "epss_percentile": 0.31464, "kev": false, "kev_due_at": null, "vendor": "HMBRAND", "product": "DBI", "cwe": "CWE-125", "title": "DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14740" }, { "rank": 100, "cve_id": "CVE-2026-27790", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00385, "epss_percentile": 0.31251, "kev": false, "kev_due_at": null, "vendor": "Gallagher", "product": "T-20 Readers", "cwe": "CWE-248", "title": "Uncaught Exception (CWE-248) in the T20 Readers allows an authenticated and authorized operator to trigger a restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27790" }, { "rank": 101, "cve_id": "CVE-2026-27844", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00385, "epss_percentile": 0.31251, "kev": false, "kev_due_at": null, "vendor": "Gallagher", "product": "Controller 7000 and 6000", "cwe": "CWE-248", "title": "Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized operator to trigger a Controller restart by sending specific requests, resulting in a temporary denial of service. Version of Command Centre affected: * 9.50 prior to vCR9.50.260616a (distributed in 9.50.1587(MR1)) * 9.40 prior to vCR9.40.260616a (distributed in 9.40.3130(MR3)) * 9.30 prior to vCR9.30.260616a (distributed in 9.30.3983(MR5)) * 9.20 prior to vCR9.20.260616a (distributed in 9.20.4349(MR7)) * all versions of 9.10 and prior.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27844" }, { "rank": 102, "cve_id": "CVE-2026-49471", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00373, "epss_percentile": 0.29993, "kev": false, "kev_due_at": null, "vendor": "oraios", "product": "serena", "cwe": "CWE-306", "title": "Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49471" }, { "rank": 103, "cve_id": "CVE-2026-59704", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00369, "epss_percentile": 0.29541, "kev": false, "kev_due_at": null, "vendor": "Cap", "product": "Cap", "cwe": "CWE-862", "title": "Cap - Missing Access Control in Video AI Metadata Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59704" }, { "rank": 104, "cve_id": "CVE-2026-53730", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00364, "epss_percentile": 0.29109, "kev": false, "kev_due_at": null, "vendor": "dataease", "product": "dataease", "cwe": "CWE-862", "title": "DataEase: Unauthorized Access to Engine Database via previewSql Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53730" }, { "rank": 105, "cve_id": "CVE-2026-54602", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00364, "epss_percentile": 0.29111, "kev": false, "kev_due_at": null, "vendor": "labring", "product": "FastGPT", "cwe": "CWE-639", "title": "FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54602" }, { "rank": 106, "cve_id": "CVE-2026-57868", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00364, "epss_percentile": 0.29112, "kev": false, "kev_due_at": null, "vendor": "MicroRealEstate", "product": "MicroRealEstate", "cwe": "CWE-639", "title": "MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57868" }, { "rank": 107, "cve_id": "CVE-2026-57869", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00364, "epss_percentile": 0.29107, "kev": false, "kev_due_at": null, "vendor": "MicroRealEstate", "product": "MicroRealEstate", "cwe": "CWE-639", "title": "Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents uploaded by landlords or tenants without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57869" }, { "rank": 108, "cve_id": "CVE-2026-57870", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00364, "epss_percentile": 0.29112, "kev": false, "kev_due_at": null, "vendor": "MicroRealEstate", "product": "MicroRealEstate", "cwe": "CWE-639", "title": "Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without authorization. This issue affects MicroRealEstate: through 1.0.0-alpha3.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57870" }, { "rank": 109, "cve_id": "CVE-2026-34149", "cvss_base": 3.3, "cvss_severity": "LOW", "epss_score": 0.00358, "epss_percentile": 0.28441, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34149" }, { "rank": 110, "cve_id": "CVE-2026-58469", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00351, "epss_percentile": 0.2769, "kev": false, "kev_due_at": null, "vendor": "gnuwget", "product": "wget", "cwe": "CWE-125", "title": "GNU Wget 1.25.0 Heap Buffer Underread via Metalink URL Parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58469" }, { "rank": 111, "cve_id": "CVE-2026-11340", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0035, "epss_percentile": 0.27625, "kev": false, "kev_due_at": null, "vendor": "HAVELSAN Inc.", "product": "Liman MYS", "cwe": "CWE-862", "title": "Authorization Bypass in HAVELSAN's Open Source Project Liman MYS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11340" }, { "rank": 112, "cve_id": "CVE-2026-48955", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.27087, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-284", "title": "Joomla! Core - [20260709] - Incorrect Access Control in com_workflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48955" }, { "rank": 113, "cve_id": "CVE-2026-46700", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.26741, "kev": false, "kev_due_at": null, "vendor": "actualbudget", "product": "actual", "cwe": "CWE-285", "title": "Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46700" }, { "rank": 114, "cve_id": "CVE-2026-53935", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0034, "epss_percentile": 0.26528, "kev": false, "kev_due_at": null, "vendor": "cilium", "product": "cilium", "cwe": "CWE-863", "title": "CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53935" }, { "rank": 115, "cve_id": "CVE-2026-58468", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00337, "epss_percentile": 0.2607, "kev": false, "kev_due_at": null, "vendor": "nocobase", "product": "nocobase", "cwe": "CWE-918", "title": "NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58468" }, { "rank": 116, "cve_id": "CVE-2026-59709", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00336, "epss_percentile": 0.26033, "kev": false, "kev_due_at": null, "vendor": "Ghostfolio", "product": "Ghostfolio", "cwe": "CWE-862", "title": "Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59709" }, { "rank": 117, "cve_id": "CVE-2026-8377", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00335, "epss_percentile": 0.25954, "kev": false, "kev_due_at": null, "vendor": "Armiya Information Technologies Ltd. Co.", "product": "Access Control System (GKS)", "cwe": "CWE-862", "title": "Improper Authorization in Armiya Technologies' Access Control System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8377" }, { "rank": 118, "cve_id": "CVE-2026-48947", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00331, "epss_percentile": 0.255, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-284", "title": "Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48947" }, { "rank": 119, "cve_id": "CVE-2026-53878", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00327, "epss_percentile": 0.24996, "kev": false, "kev_due_at": null, "vendor": "djangoproject", "product": "Django", "cwe": "CWE-144", "title": "Header injection possibility since DomainNameValidator accepted newlines in input", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53878" }, { "rank": 120, "cve_id": "CVE-2026-58384", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00324, "epss_percentile": 0.24632, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "cwe": "CWE-190", "title": "Gimp: gimp: integer overflow in read_rle_channel()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58384" }, { "rank": 121, "cve_id": "CVE-2026-11328", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00321, "epss_percentile": 0.24287, "kev": false, "kev_due_at": null, "vendor": "timstrifler", "product": "Exclusive Addons for Elementor", "cwe": "CWE-79", "title": "Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11328" }, { "rank": 122, "cve_id": "CVE-2026-46354", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00318, "epss_percentile": 0.23987, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-347", "title": "Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46354" }, { "rank": 123, "cve_id": "CVE-2026-55435", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00315, "epss_percentile": 0.2368, "kev": false, "kev_due_at": null, "vendor": "coder", "product": "coder", "cwe": "CWE-863", "title": "Suspended Coder users retain access to AI Bridge LLM proxy endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55435" }, { "rank": 124, "cve_id": "CVE-2026-42201", "cvss_base": 3.3, "cvss_severity": "LOW", "epss_score": 0.00311, "epss_percentile": 0.23192, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42201" }, { "rank": 125, "cve_id": "CVE-2026-42172", "cvss_base": 3.1, "cvss_severity": "LOW", "epss_score": 0.00299, "epss_percentile": 0.21932, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-613", "title": "Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42172" }, { "rank": 126, "cve_id": "CVE-2026-50179", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00286, "epss_percentile": 0.20526, "kev": false, "kev_due_at": null, "vendor": "actualbudget", "product": "actual", "cwe": "CWE-1236", "title": "Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50179" }, { "rank": 127, "cve_id": "CVE-2026-55592", "cvss_base": 3.9, "cvss_severity": "LOW", "epss_score": 0.00284, "epss_percentile": 0.20378, "kev": false, "kev_due_at": null, "vendor": "lissy93", "product": "dashy", "cwe": "CWE-79", "title": "Dashy: XSS in workspace url parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55592" }, { "rank": 128, "cve_id": "CVE-2026-50811", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00278, "epss_percentile": 0.19743, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-125", "title": "An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/truetype/ttgxvar.c, in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50811" }, { "rank": 129, "cve_id": "CVE-2026-48956", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00274, "epss_percentile": 0.19252, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-284", "title": "Joomla! Core - [20260710] - Incorrect Access Control in com_modules", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48956" }, { "rank": 130, "cve_id": "CVE-2026-34170", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.0027, "epss_percentile": 0.18689, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-918", "title": "Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34170" }, { "rank": 131, "cve_id": "CVE-2026-13020", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00266, "epss_percentile": 0.18028, "kev": false, "kev_due_at": null, "vendor": "Esri", "product": "Portal for ArcGIS", "cwe": "CWE-640", "title": "Weak Password Recovery Mechanism in Portal for ArcGIS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13020" }, { "rank": 132, "cve_id": "CVE-2026-59153", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00264, "epss_percentile": 0.17904, "kev": false, "kev_due_at": null, "vendor": "ankitects", "product": "anki", "cwe": "CWE-346", "title": "Anki's local HTTP server does not sufficiently validate requests", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59153" }, { "rank": 133, "cve_id": "CVE-2026-11348", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00254, "epss_percentile": 0.16538, "kev": false, "kev_due_at": null, "vendor": "HAVELSAN Inc.", "product": "Liman MYS", "cwe": "CWE-347", "title": "Authentication Bypass in HAVELSAN's Open Source Project Liman MYS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11348" }, { "rank": 134, "cve_id": "CVE-2026-7380", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16444, "kev": false, "kev_due_at": null, "vendor": "Armiya Information Technologies Ltd. Co.", "product": "Access Control System (GKS)", "cwe": "CWE-80", "title": "HTML Injection in Armiya Technologies' Access Control System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7380" }, { "rank": 135, "cve_id": "CVE-2026-8306", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16448, "kev": false, "kev_due_at": null, "vendor": "Armiya Information Technologies Ltd. Co.", "product": "Access Control System (GKS)", "cwe": "CWE-79", "title": "Stored XSS in Armiya Technologies' Access Control System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8306" }, { "rank": 136, "cve_id": "CVE-2026-58470", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00247, "epss_percentile": 0.15736, "kev": false, "kev_due_at": null, "vendor": "gnuwget", "product": "wget", "cwe": "CWE-190", "title": "GNU Wget 1.25.0 Integer Overflow via Content-Range Header Parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58470" }, { "rank": 137, "cve_id": "CVE-2026-26053", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00247, "epss_percentile": 0.157, "kev": false, "kev_due_at": null, "vendor": "Gallagher", "product": "Command Centre Server", "cwe": "CWE-266", "title": "An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26053" }, { "rank": 138, "cve_id": "CVE-2026-55408", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00246, "epss_percentile": 0.15642, "kev": false, "kev_due_at": null, "vendor": "koodo-reader", "product": "koodo-reader", "cwe": "CWE-94", "title": "Koodo Reader: Remote code execution via malicious epub file", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55408" }, { "rank": 139, "cve_id": "CVE-2026-10834", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00245, "epss_percentile": 0.15521, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WP Travel Engine", "cwe": null, "title": "WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10834" }, { "rank": 140, "cve_id": "CVE-2026-48949", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15372, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-79", "title": "Joomla! Core - [20260703] - XSS in MFA method management", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48949" }, { "rank": 141, "cve_id": "CVE-2026-48950", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15371, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-79", "title": "Joomla! Core - [20260704] - XSS in com_templates", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48950" }, { "rank": 142, "cve_id": "CVE-2026-48951", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15371, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-79", "title": "Joomla! Core - [20260705] - XSS in various modalreturn layouts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48951" }, { "rank": 143, "cve_id": "CVE-2026-48952", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15372, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-79", "title": "Joomla! Core - [20260706] - XSS in com_installer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48952" }, { "rank": 144, "cve_id": "CVE-2026-48953", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15373, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-79", "title": "Joomla! Core - [20260707] - XSS in the generic image output layout", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48953" }, { "rank": 145, "cve_id": "CVE-2026-48954", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15372, "kev": false, "kev_due_at": null, "vendor": "Joomla! Project", "product": "Joomla! CMS", "cwe": "CWE-79", "title": "Joomla! Core - [20260708] - XSS through language overrides", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48954" }, { "rank": 146, "cve_id": "CVE-2026-36162", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00235, "epss_percentile": 0.14158, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-79", "title": "An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36162" }, { "rank": 147, "cve_id": "CVE-2026-36163", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00235, "epss_percentile": 0.14162, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-79", "title": "An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36163" }, { "rank": 148, "cve_id": "CVE-2026-14935", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00233, "epss_percentile": 0.13909, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-670", "title": "Gstreamer: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14935" }, { "rank": 149, "cve_id": "CVE-2026-28378", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00227, "epss_percentile": 0.13211, "kev": false, "kev_due_at": null, "vendor": "Grafana", "product": "Grafana Enterprise", "cwe": "CWE-284", "title": "Cross-Organization Public Dashboard Deletion via Missing Org Isolation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28378" }, { "rank": 150, "cve_id": "CVE-2026-8309", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13072, "kev": false, "kev_due_at": null, "vendor": "Armiya Information Technologies Ltd. Co.", "product": "Access Control System (GKS)", "cwe": "CWE-79", "title": "Reflected XSS in Armiya Technologies' Access Control System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8309" }, { "rank": 151, "cve_id": "CVE-2026-58266", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00221, "epss_percentile": 0.12389, "kev": false, "kev_due_at": null, "vendor": "ankitects", "product": "anki", "cwe": "CWE-346", "title": "Anki: User scripts in iframes have access to the internal Anki API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58266" }, { "rank": 152, "cve_id": "CVE-2026-58471", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00221, "epss_percentile": 0.12441, "kev": false, "kev_due_at": null, "vendor": "gnuwget", "product": "wget", "cwe": "CWE-122", "title": "GNU Wget 1.25.0 Heap Buffer Overflow via convert_fname() in url.c", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58471" }, { "rank": 153, "cve_id": "CVE-2026-58472", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00221, "epss_percentile": 0.12441, "kev": false, "kev_due_at": null, "vendor": "gnuwget", "product": "wget", "cwe": "CWE-190", "title": "GNU Wget 1.25.0 Heap Buffer Overflow via HTML Attribute Encoding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58472" }, { "rank": 154, "cve_id": "CVE-2026-34171", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00202, "epss_percentile": 0.10038, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-352", "title": "Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34171" }, { "rank": 155, "cve_id": "CVE-2026-34198", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.09888, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-346", "title": "Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34198" }, { "rank": 156, "cve_id": "CVE-2026-46672", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00187, "epss_percentile": 0.08316, "kev": false, "kev_due_at": null, "vendor": "actualbudget", "product": "actual", "cwe": "CWE-1236", "title": "Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46672" }, { "rank": 157, "cve_id": "CVE-2026-42958", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00185, "epss_percentile": 0.08098, "kev": false, "kev_due_at": null, "vendor": "Labcenter", "product": "Proteus", "cwe": "CWE-416", "title": "Use After Free in Labcenter Proteus", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42958" }, { "rank": 158, "cve_id": "CVE-2026-42953", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00184, "epss_percentile": 0.08001, "kev": false, "kev_due_at": null, "vendor": "Labcenter", "product": "Proteus", "cwe": "CWE-787", "title": "Out-of-bounds write in Labcenter Proteus", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42953" }, { "rank": 159, "cve_id": "CVE-2026-49033", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00184, "epss_percentile": 0.08003, "kev": false, "kev_due_at": null, "vendor": "Labcenter", "product": "Proteus", "cwe": "CWE-121", "title": "Stack-Based Buffer Overflow in Labcenter Proteus", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49033" }, { "rank": 160, "cve_id": "CVE-2026-54698", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00172, "epss_percentile": 0.06631, "kev": false, "kev_due_at": null, "vendor": "hasura", "product": "graphql-engine", "cwe": "CWE-863", "title": "Hasura: Row-level authorization bypass on table computed fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54698" }, { "rank": 161, "cve_id": "CVE-2026-50810", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.0017, "epss_percentile": 0.06453, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-476", "title": "A NULL pointer dereference in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 allows attackers to cause a denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50810" }, { "rank": 162, "cve_id": "CVE-2026-57851", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00166, "epss_percentile": 0.06069, "kev": false, "kev_due_at": null, "vendor": "Micro-Star International (MSI)", "product": "KernCoreLib64.sys", "cwe": "CWE-782", "title": "MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57851" }, { "rank": 163, "cve_id": "CVE-2026-13199", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00164, "epss_percentile": 0.05729, "kev": false, "kev_due_at": null, "vendor": "Raspberry Pi", "product": "Raspberry Pi 5 and Compute Module 5", "cwe": "CWE-331", "title": "Insufficient Entropy in Raspberry Pi 5 and Compute Module 5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13199" }, { "rank": 164, "cve_id": "CVE-2026-53511", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00151, "epss_percentile": 0.04524, "kev": false, "kev_due_at": null, "vendor": "kovidgoyal", "product": "calibre", "cwe": "CWE-94", "title": "calibre: Arbitrary Code Execution in Template Formatter via Book Metadata", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53511" }, { "rank": 165, "cve_id": "CVE-2026-58315", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00148, "epss_percentile": 0.04257, "kev": false, "kev_due_at": null, "vendor": "SEIKO EPSON CORPORATION", "product": "Web Config", "cwe": "CWE-352", "title": "Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58315" }, { "rank": 166, "cve_id": "CVE-2026-58583", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00145, "epss_percentile": 0.04046, "kev": false, "kev_due_at": null, "vendor": "FluxInk", "product": "Color Management Driver", "cwe": "CWE-269", "title": "FluxInk Color Management Driver local privilege escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58583" }, { "rank": 167, "cve_id": "CVE-2026-10659", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00133, "epss_percentile": 0.0308, "kev": false, "kev_due_at": null, "vendor": "zephyrproject", "product": "zephyr", "cwe": "CWE-476", "title": "NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10659" }, { "rank": 168, "cve_id": "CVE-2026-14867", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00132, "epss_percentile": 0.02975, "kev": false, "kev_due_at": null, "vendor": "arcinfo", "product": "PcVue", "cwe": "CWE-256", "title": "Insecure password storage in User directory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14867" }, { "rank": 169, "cve_id": "CVE-2026-14969", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00106, "epss_percentile": 0.01208, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Directory Server 11", "cwe": "CWE-329", "title": "389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14969" }, { "rank": 170, "cve_id": "CVE-2026-14868", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00064, "epss_percentile": 0.00014, "kev": false, "kev_due_at": null, "vendor": "arcinfo", "product": "PcVue", "cwe": "CWE-326", "title": "Weak encryption mechanism for User directory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14868" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-10659", "detail": "EXPLOIT PUBLISHED — CVE-2026-10659 (zephyrproject zephyr). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-49471", "detail": "EXPLOIT PUBLISHED — CVE-2026-49471 (oraios serena). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55255", "detail": "EXPLOIT PUBLISHED — CVE-2026-55255 (langflow-ai langflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-55490", "detail": "EXPLOIT PUBLISHED — CVE-2026-55490 (openwrt). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56290", "detail": "EXPLOIT PUBLISHED — CVE-2026-56290 (JoomlaCK.fr Page Builder CK extension for Joomla). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56812", "detail": "EXPLOIT PUBLISHED — CVE-2026-56812 (phoenixframework phoenix). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58384", "detail": "EXPLOIT PUBLISHED — CVE-2026-58384 (Red Hat Enterprise Linux 9). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58583", "detail": "EXPLOIT PUBLISHED — CVE-2026-58583 (FluxInk Color Management Driver). Public exploit reference added." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }