{ "day": "2026-07-09", "boundary": "UTC calendar day", "published_count": 276, "by_severity": { "CRITICAL": 33, "HIGH": 103, "MEDIUM": 115, "LOW": 24 }, "kev_count": 0, "exploit_reference_count": 16, "awaiting_enrichment_count": 1, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-59726", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.06883, "epss_percentile": 0.93547, "kev": false, "kev_due_at": null, "vendor": "ruvnet", "product": "ruflo", "cwe": "CWE-78", "title": "Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59726" }, { "rank": 2, "cve_id": "CVE-2026-59208", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.03129, "epss_percentile": 0.86859, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-346", "title": "n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59208" }, { "rank": 3, "cve_id": "CVE-2026-58459", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.01796, "epss_percentile": 0.76741, "kev": false, "kev_due_at": null, "vendor": "ntpsec", "product": "gpsd", "cwe": "CWE-78", "title": "gpsd gpsprof Command Injection via gnuplot plot title subtype field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58459" }, { "rank": 4, "cve_id": "CVE-2026-0286", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.01673, "epss_percentile": 0.75016, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-78", "title": "PAN-OS: Authenticated Command Injection in CLI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0286" }, { "rank": 5, "cve_id": "CVE-2026-58123", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.01339, "epss_percentile": 0.69108, "kev": false, "kev_due_at": null, "vendor": "nesquena", "product": "hermes-webui", "cwe": "CWE-306", "title": "Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58123" }, { "rank": 6, "cve_id": "CVE-2026-8848", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01231, "epss_percentile": 0.66649, "kev": false, "kev_due_at": null, "vendor": "danieliser", "product": "Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder", "cwe": "CWE-862", "title": "Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8848" }, { "rank": 7, "cve_id": "CVE-2026-13080", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.01207, "epss_percentile": 0.65977, "kev": false, "kev_due_at": null, "vendor": "getwpfunnels", "product": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell", "cwe": "CWE-98", "title": "WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13080" }, { "rank": 8, "cve_id": "CVE-2026-15193", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.01083, "epss_percentile": 0.62641, "kev": false, "kev_due_at": null, "vendor": "AidanPark", "product": "openclaw-android", "cwe": "CWE-77", "title": "AidanPark openclaw-android Android WebView Bridge JsBridge.kt os command injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15193" }, { "rank": 9, "cve_id": "CVE-2026-14245", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01071, "epss_percentile": 0.62297, "kev": false, "kev_due_at": null, "vendor": "cyberlord92", "product": "miniOrange OTP Login, Verification and SMS Notifications", "cwe": "CWE-862", "title": "miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14245" }, { "rank": 10, "cve_id": "CVE-2026-15158", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01067, "epss_percentile": 0.6221, "kev": false, "kev_due_at": null, "vendor": "creativethemeshq", "product": "Blocksy Companion", "cwe": "CWE-434", "title": "Blocksy Companion <= 2.1.46 - Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15158" }, { "rank": 11, "cve_id": "CVE-2026-14372", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0106, "epss_percentile": 0.61976, "kev": false, "kev_due_at": null, "vendor": "bitpressadmin", "product": "Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder", "cwe": "CWE-22", "title": "Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14372" }, { "rank": 12, "cve_id": "CVE-2026-14261", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.01035, "epss_percentile": 0.61248, "kev": false, "kev_due_at": null, "vendor": "Xerte", "product": "Xerte Online Tools", "cwe": null, "title": "CVE-2026-14261", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14261" }, { "rank": 13, "cve_id": "CVE-2026-61343", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.01018, "epss_percentile": 0.60703, "kev": false, "kev_due_at": null, "vendor": "LibreBooking", "product": "LibreBooking", "cwe": "CWE-23", "title": "LibreBooking path traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61343" }, { "rank": 14, "cve_id": "CVE-2026-59721", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01009, "epss_percentile": 0.6046, "kev": false, "kev_due_at": null, "vendor": "hoppscotch", "product": "hoppscotch", "cwe": "CWE-77", "title": "Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59721" }, { "rank": 15, "cve_id": "CVE-2026-59827", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00934, "epss_percentile": 0.58058, "kev": false, "kev_due_at": null, "vendor": "metabase", "product": "metabase", "cwe": "CWE-502", "title": "Metabase: Unsafe Deserialization of H2 Query Results", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59827" }, { "rank": 16, "cve_id": "CVE-2026-60109", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00923, "epss_percentile": 0.57665, "kev": false, "kev_due_at": null, "vendor": "zeek", "product": "zeek", "cwe": "CWE-476", "title": "Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60109" }, { "rank": 17, "cve_id": "CVE-2026-54769", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00912, "epss_percentile": 0.57342, "kev": false, "kev_due_at": null, "vendor": "langroid", "product": "langroid", "cwe": "CWE-94", "title": "Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54769" }, { "rank": 18, "cve_id": "CVE-2026-15270", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00852, "epss_percentile": 0.55484, "kev": false, "kev_due_at": null, "vendor": "D-link", "product": "DIR-823G", "cwe": "CWE-266", "title": "D-link DIR-823G Web boa.conf least privilege violation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15270" }, { "rank": 19, "cve_id": "CVE-2026-59734", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00811, "epss_percentile": 0.54188, "kev": false, "kev_due_at": null, "vendor": "coollabsio", "product": "coolify", "cwe": "CWE-78", "title": "Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59734" }, { "rank": 20, "cve_id": "CVE-2026-60108", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00793, "epss_percentile": 0.53584, "kev": false, "kev_due_at": null, "vendor": "zeek", "product": "zeek", "cwe": "CWE-770", "title": "Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60108" }, { "rank": 21, "cve_id": "CVE-2026-15192", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00763, "epss_percentile": 0.52597, "kev": false, "kev_due_at": null, "vendor": "mettle", "product": "sendportal", "cwe": "CWE-287", "title": "mettle sendportal APIv1 Webhooks mailjet missing authentication", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15192" }, { "rank": 22, "cve_id": "CVE-2026-60095", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00745, "epss_percentile": 0.51992, "kev": false, "kev_due_at": null, "vendor": "Vinchin", "product": "Backup & Recovery 9.0", "cwe": "CWE-121", "title": "Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60095" }, { "rank": 23, "cve_id": "CVE-2026-54003", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00743, "epss_percentile": 0.51926, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-454", "title": "Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54003" }, { "rank": 24, "cve_id": "CVE-2026-53963", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00735, "epss_percentile": 0.51667, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-79", "title": "Discourse: Stored-XSS in 2FA delete confirmation modal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53963" }, { "rank": 25, "cve_id": "CVE-2026-13450", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00719, "epss_percentile": 0.51073, "kev": false, "kev_due_at": null, "vendor": "rubengc", "product": "GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress", "cwe": "CWE-639", "title": "GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13450" }, { "rank": 26, "cve_id": "CVE-2026-15271", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00706, "epss_percentile": 0.50591, "kev": false, "kev_due_at": null, "vendor": "TOTOLINK", "product": "A3000RU", "cwe": "CWE-266", "title": "TOTOLINK EX200 Web boa.conf least privilege violation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15271" }, { "rank": 27, "cve_id": "CVE-2026-12116", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00702, "epss_percentile": 0.50472, "kev": false, "kev_due_at": null, "vendor": "Xerte", "product": "Xerte Online Tools", "cwe": null, "title": "CVE-2026-12116", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12116" }, { "rank": 28, "cve_id": "CVE-2026-50180", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00686, "epss_percentile": 0.49895, "kev": false, "kev_due_at": null, "vendor": "langroid", "product": "langroid", "cwe": "CWE-22", "title": "Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50180" }, { "rank": 29, "cve_id": "CVE-2026-13492", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00685, "epss_percentile": 0.49816, "kev": false, "kev_due_at": null, "vendor": "stiofansisland", "product": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP", "cwe": "CWE-22", "title": "UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13492" }, { "rank": 30, "cve_id": "CVE-2026-51923", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00683, "epss_percentile": 0.49726, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-639", "title": "An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51923" }, { "rank": 31, "cve_id": "CVE-2026-15204", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00673, "epss_percentile": 0.49346, "kev": false, "kev_due_at": null, "vendor": "TOTOLINK", "product": "X5000R", "cwe": "CWE-22", "title": "TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15204" }, { "rank": 32, "cve_id": "CVE-2026-55207", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00666, "epss_percentile": 0.49033, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-640", "title": "Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55207" }, { "rank": 33, "cve_id": "CVE-2026-59206", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0066, "epss_percentile": 0.48842, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-1321", "title": "n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59206" }, { "rank": 34, "cve_id": "CVE-2026-39246", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00658, "epss_percentile": 0.48739, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-59", "title": "decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39246" }, { "rank": 35, "cve_id": "CVE-2026-54760", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00646, "epss_percentile": 0.48198, "kev": false, "kev_due_at": null, "vendor": "langroid", "product": "langroid", "cwe": "CWE-22", "title": "Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54760" }, { "rank": 36, "cve_id": "CVE-2026-60094", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0064, "epss_percentile": 0.47891, "kev": false, "kev_due_at": null, "vendor": "Vinchin", "product": "Backup & Recovery 9.0", "cwe": "CWE-787", "title": "Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60094" }, { "rank": 37, "cve_id": "CVE-2026-15308", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00637, "epss_percentile": 0.4777, "kev": false, "kev_due_at": null, "vendor": "Python Software Foundation", "product": "CPython", "cwe": "CWE-400", "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15308" }, { "rank": 38, "cve_id": "CVE-2026-45788", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00634, "epss_percentile": 0.47663, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-200", "title": "Discourse: Secure uploads exposed by hotlinked image copying", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45788" }, { "rank": 39, "cve_id": "CVE-2026-0279", "cvss_base": 1.3, "cvss_severity": "LOW", "epss_score": 0.00633, "epss_percentile": 0.47619, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-79", "title": "PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0279" }, { "rank": 40, "cve_id": "CVE-2026-51599", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00631, "epss_percentile": 0.47525, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-20", "title": "An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51599" }, { "rank": 41, "cve_id": "CVE-2026-0287", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.00621, "epss_percentile": 0.47056, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-754", "title": "PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0287" }, { "rank": 42, "cve_id": "CVE-2026-54801", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00619, "epss_percentile": 0.46922, "kev": false, "kev_due_at": null, "vendor": "Siemens", "product": "CPCI85 Central Processing/Communication", "cwe": "CWE-620", "title": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the web API. This could allow an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54801" }, { "rank": 43, "cve_id": "CVE-2026-51926", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00618, "epss_percentile": 0.46902, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-203", "title": "An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identified in the authentication mechanism that allows user enumeration through the login interface. An attacker can differentiate between valid and invalid usernames based on variations in server responses. This information can be leveraged to identify existing accounts and facilitate further attacks, including brute-force or credential stuffing.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51926" }, { "rank": 44, "cve_id": "CVE-2026-38076", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00609, "epss_percentile": 0.46459, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-190", "title": "An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38076" }, { "rank": 45, "cve_id": "CVE-2026-11404", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46384, "kev": false, "kev_due_at": null, "vendor": "Cesanta", "product": "Mongoose", "cwe": "CWE-125", "title": "Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11404" }, { "rank": 46, "cve_id": "CVE-2026-55420", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00603, "epss_percentile": 0.46182, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-78", "title": "Discourse: Remote code execution via pdf uploads", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55420" }, { "rank": 47, "cve_id": "CVE-2026-55605", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00602, "epss_percentile": 0.46149, "kev": false, "kev_due_at": null, "vendor": "arikusi", "product": "deepseek-mcp-server", "cwe": "CWE-306", "title": "@arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55605" }, { "rank": 48, "cve_id": "CVE-2026-59720", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00593, "epss_percentile": 0.45705, "kev": false, "kev_due_at": null, "vendor": "hoppscotch", "product": "hoppscotch", "cwe": "CWE-200", "title": "Hoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock Server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59720" }, { "rank": 49, "cve_id": "CVE-2026-15000", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.0059, "epss_percentile": 0.45575, "kev": false, "kev_due_at": null, "vendor": "rnzo", "product": "Connect Contact Form 7 and Mailchimp", "cwe": "CWE-79", "title": "Connect Contact Form 7 and Mailchimp <= 0.9.78.06 - Unauthenticated Stored Cross-Site Scripting via Mailchimp Merge Field Values", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15000" }, { "rank": 50, "cve_id": "CVE-2026-59692", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00577, "epss_percentile": 0.44943, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-121", "title": "Gstreamer: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59692" }, { "rank": 51, "cve_id": "CVE-2026-51924", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00575, "epss_percentile": 0.44814, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-639", "title": "An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51924" }, { "rank": 52, "cve_id": "CVE-2026-51600", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00573, "epss_percentile": 0.44749, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-400", "title": "Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting state, causing the affected TCP connection to become permanently non-functional. The device does not actively close the connection, resulting in a TCP resource leak. This issue can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51600" }, { "rank": 53, "cve_id": "CVE-2026-59220", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00573, "epss_percentile": 0.44733, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-1333", "title": "Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59220" }, { "rank": 54, "cve_id": "CVE-2026-51601", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0057, "epss_percentile": 0.44587, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handshake can send a PLAY request with an excessively long clock= value to cause the RTSP service to crash.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51601" }, { "rank": 55, "cve_id": "CVE-2026-51604", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0057, "epss_percentile": 0.44587, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51604" }, { "rank": 56, "cve_id": "CVE-2026-51605", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0057, "epss_percentile": 0.44587, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51605" }, { "rank": 57, "cve_id": "CVE-2026-12597", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00568, "epss_percentile": 0.44479, "kev": false, "kev_due_at": null, "vendor": "LoginPress", "product": "LoginPress Pro", "cwe": "CWE-287", "title": "LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12597" }, { "rank": 58, "cve_id": "CVE-2026-54695", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00564, "epss_percentile": 0.44281, "kev": false, "kev_due_at": null, "vendor": "pipecat-ai", "product": "pipecat", "cwe": "CWE-862", "title": "Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54695" }, { "rank": 59, "cve_id": "CVE-2026-12406", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00561, "epss_percentile": 0.44129, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration", "cwe": "CWE-862", "title": "User Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12406" }, { "rank": 60, "cve_id": "CVE-2026-51602", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0056, "epss_percentile": 0.4404, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the first SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51602" }, { "rank": 61, "cve_id": "CVE-2026-51603", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0056, "epss_percentile": 0.44039, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted second SETUP request. After completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID, the RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the subsequent SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51603" }, { "rank": 62, "cve_id": "CVE-2026-12595", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00558, "epss_percentile": 0.43972, "kev": false, "kev_due_at": null, "vendor": "LoginPress", "product": "LoginPress Pro", "cwe": "CWE-287", "title": "LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12595" }, { "rank": 63, "cve_id": "CVE-2026-12598", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00558, "epss_percentile": 0.43972, "kev": false, "kev_due_at": null, "vendor": "LoginPress", "product": "LoginPress Pro", "cwe": "CWE-287", "title": "LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12598" }, { "rank": 64, "cve_id": "CVE-2026-54002", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00547, "epss_percentile": 0.43354, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-79", "title": "Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54002" }, { "rank": 65, "cve_id": "CVE-2026-51925", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00547, "epss_percentile": 0.43389, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-639", "title": "A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_report.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51925" }, { "rank": 66, "cve_id": "CVE-2026-47826", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00545, "epss_percentile": 0.43293, "kev": false, "kev_due_at": null, "vendor": "CloudFoundry Foundation", "product": "BOSH CLI tool", "cwe": "CWE-22", "title": "blobs.yaml Path Traversal Allows File Writes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47826" }, { "rank": 67, "cve_id": "CVE-2026-59828", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00545, "epss_percentile": 0.43263, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-200", "title": "Discourse: Hidden post revisions leak through adjacent visible diffs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59828" }, { "rank": 68, "cve_id": "CVE-2026-59826", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.0054, "epss_percentile": 0.42976, "kev": false, "kev_due_at": null, "vendor": "metabase", "product": "metabase", "cwe": "CWE-94", "title": "Metabase: Arbitrary Code Execution via Database Connection Detail Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59826" }, { "rank": 69, "cve_id": "CVE-2026-51597", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00529, "epss_percentile": 0.4233, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-294", "title": "MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51597" }, { "rank": 70, "cve_id": "CVE-2026-59833", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00529, "epss_percentile": 0.42373, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-79", "title": "SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59833" }, { "rank": 71, "cve_id": "CVE-2026-59855", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00529, "epss_percentile": 0.42373, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-80", "title": "SiYuan: Store XSS To Rce via Asset.render", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59855" }, { "rank": 72, "cve_id": "CVE-2026-9021", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00516, "epss_percentile": 0.41557, "kev": false, "kev_due_at": null, "vendor": "matrixaddons", "product": "Easy Invoice – Invoice Generator, PDF Quotes & Payments", "cwe": "CWE-862", "title": "Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9021" }, { "rank": 73, "cve_id": "CVE-2026-46413", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00514, "epss_percentile": 0.41372, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-862", "title": "Discourse: Regular users can route multipart uploads into the admin backup store", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46413" }, { "rank": 74, "cve_id": "CVE-2026-15138", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00511, "epss_percentile": 0.41221, "kev": false, "kev_due_at": null, "vendor": "tumf", "product": "mcp-text-editor", "cwe": "CWE-22", "title": "tumf mcp-text-editor text_editor.py _validate_file_path path traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15138" }, { "rank": 75, "cve_id": "CVE-2026-31984", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00509, "epss_percentile": 0.41127, "kev": false, "kev_due_at": null, "vendor": "Nozomi Networks", "product": "Guardian", "cwe": "CWE-770", "title": "DoS through oversized audit log entries in Guardian/CMC before 26.2.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31984" }, { "rank": 76, "cve_id": "CVE-2026-59834", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00508, "epss_percentile": 0.41064, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-89", "title": "SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59834" }, { "rank": 77, "cve_id": "CVE-2026-49256", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00508, "epss_percentile": 0.41064, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-200", "title": "Discourse: Hidden tag names leaked via category serializers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49256" }, { "rank": 78, "cve_id": "CVE-2026-57501", "cvss_base": 0, "cvss_severity": "NONE", "epss_score": 0.00506, "epss_percentile": 0.4086, "kev": false, "kev_due_at": null, "vendor": "zen-browser", "product": "desktop", "cwe": "CWE-266", "title": "Zen: Context-menu \"Open link in glance\" / \"Split link in new tab\" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57501" }, { "rank": 79, "cve_id": "CVE-2026-53987", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00503, "epss_percentile": 0.40689, "kev": false, "kev_due_at": null, "vendor": "Tag plugin", "product": "GLPI 11", "cwe": "CWE-79", "title": "GLPI 11 before 2.14.4 Tag Plugin Stored Cross-Site Scripting in Kanban Badge Rendering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53987" }, { "rank": 80, "cve_id": "CVE-2026-45780", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00497, "epss_percentile": 0.40355, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-200", "title": "Discourse: Private event sample invitees are serialized to non-invited event viewers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45780" }, { "rank": 81, "cve_id": "CVE-2026-54004", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00496, "epss_percentile": 0.40296, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-862", "title": "Kirby: Access to files of top-level drafts is not protected by permissions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54004" }, { "rank": 82, "cve_id": "CVE-2026-13461", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00495, "epss_percentile": 0.40186, "kev": false, "kev_due_at": null, "vendor": "PayRange", "product": "PayRange", "cwe": null, "title": "PayRange version 7.0.7 contains a JavaScript injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13461" }, { "rank": 83, "cve_id": "CVE-2026-55590", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00491, "epss_percentile": 0.3994, "kev": false, "kev_due_at": null, "vendor": "cakephp", "product": "authentication", "cwe": "CWE-601", "title": "CakePHP: Open redirect weakness via backslash bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55590" }, { "rank": 84, "cve_id": "CVE-2026-43752", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.0049, "epss_percentile": 0.39902, "kev": false, "kev_due_at": null, "vendor": "Claris", "product": "FileMaker Server", "cwe": "CWE-434", "title": "An authenticated administrator may be able to achieve arbitrary code execution on the host system by uploading a malicious file through the Open Source LLM setup feature in the Admin Console. This vulnerability has been addressed in FileMaker Server 26.0.1.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43752" }, { "rank": 85, "cve_id": "CVE-2026-59854", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00485, "epss_percentile": 0.39524, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-693", "title": "SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59854" }, { "rank": 86, "cve_id": "CVE-2026-49274", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00484, "epss_percentile": 0.39455, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-862", "title": "Kirby: `pages.access` permission is not checked in the pages picker for parent pages", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49274" }, { "rank": 87, "cve_id": "CVE-2026-59221", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00483, "epss_percentile": 0.39403, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-22", "title": "open-webui terminal proxy path traversal guard bypass via 9x encoded traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59221" }, { "rank": 88, "cve_id": "CVE-2026-59149", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00483, "epss_percentile": 0.3941, "kev": false, "kev_due_at": null, "vendor": "mockoon", "product": "mockoon", "cwe": "CWE-22", "title": "Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59149" }, { "rank": 89, "cve_id": "CVE-2026-8996", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00475, "epss_percentile": 0.38922, "kev": false, "kev_due_at": null, "vendor": "revmakx", "product": "Backup and Staging by WP Time Capsule", "cwe": "CWE-862", "title": "Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8996" }, { "rank": 90, "cve_id": "CVE-2026-12428", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00475, "epss_percentile": 0.38922, "kev": false, "kev_due_at": null, "vendor": "gamaup", "product": "Blocks for ACF Fields — Display Custom Fields in the Block Editor", "cwe": "CWE-862", "title": "Blocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12428" }, { "rank": 91, "cve_id": "CVE-2026-57021", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00474, "epss_percentile": 0.3884, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-787", "title": "Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57021" }, { "rank": 92, "cve_id": "CVE-2026-9028", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00474, "epss_percentile": 0.38831, "kev": false, "kev_due_at": null, "vendor": "corvusinfo", "product": "CorvusPay WooCommerce Payment Gateway", "cwe": "CWE-862", "title": "CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9028" }, { "rank": 93, "cve_id": "CVE-2026-61344", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00473, "epss_percentile": 0.38773, "kev": false, "kev_due_at": null, "vendor": "Superior Court of California, County of Los Angeles", "product": "Hearing Reminder Service", "cwe": "CWE-306", "title": "Superior Court of California Hearing Reminder Service unauthenticated information disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61344" }, { "rank": 94, "cve_id": "CVE-2026-50644", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00469, "epss_percentile": 0.38463, "kev": false, "kev_due_at": null, "vendor": "SOPlanning", "product": "SOPlanning", "cwe": "CWE-89", "title": "SQL Injection in SOPlanning Audit Retention Configuration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50644" }, { "rank": 95, "cve_id": "CVE-2026-5955", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00468, "epss_percentile": 0.38435, "kev": false, "kev_due_at": null, "vendor": "Inrove Software and Internet Services", "product": "BiEticaret", "cwe": "CWE-89", "title": "SQLi in Inrove Software's BiEticaret", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5955" }, { "rank": 96, "cve_id": "CVE-2026-59832", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00465, "epss_percentile": 0.38207, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-22", "title": "SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59832" }, { "rank": 97, "cve_id": "CVE-2026-0284", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00465, "epss_percentile": 0.38185, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-74", "title": "PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0284" }, { "rank": 98, "cve_id": "CVE-2026-1365", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00463, "epss_percentile": 0.38092, "kev": false, "kev_due_at": null, "vendor": "Sayax Energy Technologies Inc.", "product": "OSOS", "cwe": "CWE-201", "title": "Information Disclosure in Sayax's OSOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1365" }, { "rank": 99, "cve_id": "CVE-2026-55615", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00461, "epss_percentile": 0.37957, "kev": false, "kev_due_at": null, "vendor": "langroid", "product": "langroid", "cwe": "CWE-74", "title": "Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55615" }, { "rank": 100, "cve_id": "CVE-2026-44787", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00461, "epss_percentile": 0.37945, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-269", "title": "Discourse: Signup-time primary_group_id assignment grants whisperer access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44787" }, { "rank": 101, "cve_id": "CVE-2026-57023", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0046, "epss_percentile": 0.37885, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-1284", "title": "Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57023" }, { "rank": 102, "cve_id": "CVE-2026-57026", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0046, "epss_percentile": 0.37884, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-1286", "title": "Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57026" }, { "rank": 103, "cve_id": "CVE-2026-51606", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0046, "epss_percentile": 0.37885, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-20", "title": "An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51606" }, { "rank": 104, "cve_id": "CVE-2026-15195", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00457, "epss_percentile": 0.37688, "kev": false, "kev_due_at": null, "vendor": "apidevtools", "product": "json-schema-ref-parser", "cwe": "CWE-94", "title": "apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15195" }, { "rank": 105, "cve_id": "CVE-2026-59219", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00456, "epss_percentile": 0.37648, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-613", "title": "Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59219" }, { "rank": 106, "cve_id": "CVE-2026-7558", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00455, "epss_percentile": 0.3755, "kev": false, "kev_due_at": null, "vendor": "tokenoftrust", "product": "Age Verification & Identity Verification by Token of Trust", "cwe": "CWE-862", "title": "Age Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7558" }, { "rank": 107, "cve_id": "CVE-2026-12433", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00454, "epss_percentile": 0.37475, "kev": false, "kev_due_at": null, "vendor": "themefic", "product": "Hydra Booking — Appointment Scheduling & Booking Calendar", "cwe": "CWE-639", "title": "Hydra Booking <= 1.2.1 - Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12433" }, { "rank": 108, "cve_id": "CVE-2026-55865", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.3727, "kev": false, "kev_due_at": null, "vendor": "jg-rp", "product": "liquid", "cwe": "CWE-835", "title": "Python Liquid: Infinite loop when parsing malformed `{% case %}` tags", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55865" }, { "rank": 109, "cve_id": "CVE-2026-13011", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00451, "epss_percentile": 0.37301, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce", "cwe": "CWE-89", "title": "ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13011" }, { "rank": 110, "cve_id": "CVE-2026-15202", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00449, "epss_percentile": 0.37113, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "YzmCMS", "cwe": "CWE-79", "title": "YzmCMS Header yzmphp.php get_url cross site scripting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15202" }, { "rank": 111, "cve_id": "CVE-2025-45422", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00448, "epss_percentile": 0.37054, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-284", "title": "Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-45422" }, { "rank": 112, "cve_id": "CVE-2026-59207", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00448, "epss_percentile": 0.37045, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-693", "title": "n8n: \"Allowed HTTP Request Domains\" Restriction Bypass via AI Agents MCP Connector", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59207" }, { "rank": 113, "cve_id": "CVE-2026-56292", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00444, "epss_percentile": 0.36762, "kev": false, "kev_due_at": null, "vendor": "acymailing.com", "product": "acymailing.com AcyMailing extension for Joomla", "cwe": "CWE-89", "title": "Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56292" }, { "rank": 114, "cve_id": "CVE-2026-50188", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00443, "epss_percentile": 0.36696, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-93", "title": "Kirby: Request header injection in `Http\\Remote`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50188" }, { "rank": 115, "cve_id": "CVE-2026-5523", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00442, "epss_percentile": 0.36628, "kev": false, "kev_due_at": null, "vendor": "Divi Engine", "product": "Divi Form Builder", "cwe": "CWE-639", "title": "Divi Form Builder <= 5.1.8 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5523" }, { "rank": 116, "cve_id": "CVE-2026-58378", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00442, "epss_percentile": 0.36615, "kev": false, "kev_due_at": null, "vendor": "Allwinner", "product": "H616", "cwe": "CWE-489", "title": "Allwinner TV Box TV98 ADB exposed on network", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58378" }, { "rank": 117, "cve_id": "CVE-2026-33655", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00442, "epss_percentile": 0.36588, "kev": false, "kev_due_at": null, "vendor": "QuantumNous", "product": "new-api", "cwe": "CWE-918", "title": "New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33655" }, { "rank": 118, "cve_id": "CVE-2026-14342", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00442, "epss_percentile": 0.36619, "kev": false, "kev_due_at": null, "vendor": "getwpfunnels", "product": "Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails", "cwe": "CWE-89", "title": "Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14342" }, { "rank": 119, "cve_id": "CVE-2026-12593", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00435, "epss_percentile": 0.36072, "kev": false, "kev_due_at": null, "vendor": "Qt", "product": "Axivion", "cwe": "CWE-862", "title": "Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12593" }, { "rank": 120, "cve_id": "CVE-2026-11571", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00434, "epss_percentile": 0.35972, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Everest Forms", "cwe": null, "title": "Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11571" }, { "rank": 121, "cve_id": "CVE-2026-49276", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00432, "epss_percentile": 0.358, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-83", "title": "Kirby: Self cross-site scripting (self-XSS) in the writer field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49276" }, { "rank": 122, "cve_id": "CVE-2026-15137", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00431, "epss_percentile": 0.35659, "kev": false, "kev_due_at": null, "vendor": "code-projects", "product": "Interview Management System", "cwe": "CWE-74", "title": "code-projects Interview Management System View.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15137" }, { "rank": 123, "cve_id": "CVE-2026-15190", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00431, "epss_percentile": 0.35657, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "Simple and Nice Shopping Cart Script", "cwe": "CWE-74", "title": "SourceCodester Simple and Nice Shopping Cart Script login.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15190" }, { "rank": 124, "cve_id": "CVE-2026-13441", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00428, "epss_percentile": 0.35461, "kev": false, "kev_due_at": null, "vendor": "metagauss", "product": "EventPrime – Events Calendar, Bookings and Tickets", "cwe": "CWE-79", "title": "EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13441" }, { "rank": 125, "cve_id": "CVE-2026-54005", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00427, "epss_percentile": 0.35383, "kev": false, "kev_due_at": null, "vendor": "getkirby", "product": "kirby", "cwe": "CWE-862", "title": "Kirby: `pages.access` permission is not checked in the `site/find` REST API route", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54005" }, { "rank": 126, "cve_id": "CVE-2026-15187", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00427, "epss_percentile": 0.35378, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "enquirer", "cwe": "CWE-94", "title": "enquirer Public Package API Enquirer.set prototype pollution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15187" }, { "rank": 127, "cve_id": "CVE-2026-1989", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00425, "epss_percentile": 0.35206, "kev": false, "kev_due_at": null, "vendor": "PAVO Financial Technology Solutions Inc.", "product": "PAVO Pay", "cwe": "CWE-639", "title": "IDOR in PAVO Inc.'s PAVO Pay", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1989" }, { "rank": 128, "cve_id": "CVE-2026-12418", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00423, "epss_percentile": 0.35011, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration", "cwe": "CWE-639", "title": "User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12418" }, { "rank": 129, "cve_id": "CVE-2026-57032", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0042, "epss_percentile": 0.34756, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-236", "title": "Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57032" }, { "rank": 130, "cve_id": "CVE-2026-59212", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.0042, "epss_percentile": 0.34754, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-863", "title": "Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59212" }, { "rank": 131, "cve_id": "CVE-2026-47829", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00419, "epss_percentile": 0.34684, "kev": false, "kev_due_at": null, "vendor": "CloudFoundry Foundation", "product": "bosh-cli", "cwe": "CWE-88", "title": "Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47829" }, { "rank": 132, "cve_id": "CVE-2026-13771", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00419, "epss_percentile": 0.34624, "kev": false, "kev_due_at": null, "vendor": "ivole", "product": "Customer Reviews for WooCommerce", "cwe": "CWE-79", "title": "Customer Reviews for WooCommerce <= 5.113.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13771" }, { "rank": 133, "cve_id": "CVE-2026-57024", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00417, "epss_percentile": 0.34459, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-694", "title": "Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuously", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57024" }, { "rank": 134, "cve_id": "CVE-2026-55424", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00415, "epss_percentile": 0.34267, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-79", "title": "Discourse: Topic featured link susceptible to stored XSS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55424" }, { "rank": 135, "cve_id": "CVE-2026-53962", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00415, "epss_percentile": 0.34267, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-79", "title": "Discourse: Insufficient SVG sanitization logic", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53962" }, { "rank": 136, "cve_id": "CVE-2026-55208", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00413, "epss_percentile": 0.34074, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-89", "title": "Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55208" }, { "rank": 137, "cve_id": "CVE-2026-31983", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00413, "epss_percentile": 0.34083, "kev": false, "kev_due_at": null, "vendor": "Nozomi Networks", "product": "Guardian", "cwe": "CWE-306", "title": "Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31983" }, { "rank": 138, "cve_id": "CVE-2026-59218", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00413, "epss_percentile": 0.34045, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-208", "title": "Open WebUI: Account enumeration via observable login timing discrepancy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59218" }, { "rank": 139, "cve_id": "CVE-2026-61474", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00413, "epss_percentile": 0.34105, "kev": false, "kev_due_at": null, "vendor": "misp", "product": "misp", "cwe": "CWE-863", "title": "MISP: Improper sharing group authorization check when adding attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61474" }, { "rank": 140, "cve_id": "CVE-2026-15186", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00413, "epss_percentile": 0.34133, "kev": false, "kev_due_at": null, "vendor": "macrozheng", "product": "mall", "cwe": "CWE-99", "title": "macrozheng mall Portal Endpoint create resource injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15186" }, { "rank": 141, "cve_id": "CVE-2026-12590", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00412, "epss_percentile": 0.34015, "kev": false, "kev_due_at": null, "vendor": "body-parser", "product": "body-parser", "cwe": "CWE-770", "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12590" }, { "rank": 142, "cve_id": "CVE-2026-54798", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00411, "epss_percentile": 0.33894, "kev": false, "kev_due_at": null, "vendor": "Siemens", "product": "CPCI85 Central Processing/Communication", "cwe": "CWE-489", "title": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54798" }, { "rank": 143, "cve_id": "CVE-2026-55689", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00407, "epss_percentile": 0.33521, "kev": false, "kev_due_at": null, "vendor": "openfga", "product": "openfga", "cwe": "CWE-287", "title": "OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55689" }, { "rank": 144, "cve_id": "CVE-2026-33794", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00405, "epss_percentile": 0.33365, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS Evolved", "cwe": "CWE-754", "title": "Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33794" }, { "rank": 145, "cve_id": "CVE-2026-57022", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00405, "epss_percentile": 0.33362, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-754", "title": "Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57022" }, { "rank": 146, "cve_id": "CVE-2026-59817", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00403, "epss_percentile": 0.33139, "kev": false, "kev_due_at": null, "vendor": "TryGhost", "product": "Ghost", "cwe": "CWE-472", "title": "Ghost: Paid gift memberships obtainable at minimal cost via the donations feature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59817" }, { "rank": 147, "cve_id": "CVE-2026-59209", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00402, "epss_percentile": 0.33008, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-200", "title": "n8n: Shared Credential Header Leak via HTTP Request Pagination Expression", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59209" }, { "rank": 148, "cve_id": "CVE-2026-59853", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00402, "epss_percentile": 0.33008, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-862", "title": "SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59853" }, { "rank": 149, "cve_id": "CVE-2026-33390", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00401, "epss_percentile": 0.32914, "kev": false, "kev_due_at": null, "vendor": "Nozomi Networks", "product": "Guardian", "cwe": "CWE-266", "title": "Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33390" }, { "rank": 150, "cve_id": "CVE-2026-9237", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00394, "epss_percentile": 0.32214, "kev": false, "kev_due_at": null, "vendor": "crewhrm", "product": "Employee, Leave and Recruitment Management System – Crew HRM", "cwe": "CWE-862", "title": "Employee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9237" }, { "rank": 151, "cve_id": "CVE-2026-54771", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00392, "epss_percentile": 0.31965, "kev": false, "kev_due_at": null, "vendor": "langroid", "product": "langroid", "cwe": "CWE-75", "title": "Langroid: handle_message() executes user-supplied tool JSON without sender verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54771" }, { "rank": 152, "cve_id": "CVE-2026-2342", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00391, "epss_percentile": 0.31857, "kev": false, "kev_due_at": null, "vendor": "OceanicSoft Informatics Systems Ltd.", "product": "ValeApp", "cwe": "CWE-79", "title": "XSS in Oceanicsoft's ValeApp", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2342" }, { "rank": 153, "cve_id": "CVE-2026-59224", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00391, "epss_percentile": 0.31853, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-287", "title": "Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59224" }, { "rank": 154, "cve_id": "CVE-2026-15191", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00384, "epss_percentile": 0.3116, "kev": false, "kev_due_at": null, "vendor": "mettle", "product": "sendportal", "cwe": "CWE-285", "title": "mettle sendportal Campaign Creation Endpoint CampaignStoreRequest.php authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15191" }, { "rank": 155, "cve_id": "CVE-2026-59223", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00383, "epss_percentile": 0.31042, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-693", "title": "Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59223" }, { "rank": 156, "cve_id": "CVE-2026-57030", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00381, "epss_percentile": 0.30804, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-362", "title": "Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57030" }, { "rank": 157, "cve_id": "CVE-2026-13334", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0038, "epss_percentile": 0.30728, "kev": false, "kev_due_at": null, "vendor": "kitae-park", "product": "Mang Board WP", "cwe": "CWE-79", "title": "Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13334" }, { "rank": 158, "cve_id": "CVE-2026-56460", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00379, "epss_percentile": 0.30697, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "HCL DevOps Deploy / HCL Launch", "cwe": "CWE-201", "title": "HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56460" }, { "rank": 159, "cve_id": "CVE-2026-39245", "cvss_base": 6.2, "cvss_severity": "MEDIUM", "epss_score": 0.00375, "epss_percentile": 0.3022, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-22", "title": "decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, \"/tmp/app_config\".indexOf(\"/tmp/app\") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39245" }, { "rank": 160, "cve_id": "CVE-2026-58122", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00373, "epss_percentile": 0.30008, "kev": false, "kev_due_at": null, "vendor": "nesquena", "product": "hermes-webui", "cwe": "CWE-348", "title": "Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58122" }, { "rank": 161, "cve_id": "CVE-2026-55604", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00372, "epss_percentile": 0.29966, "kev": false, "kev_due_at": null, "vendor": "arikusi", "product": "deepseek-mcp-server", "cwe": "CWE-639", "title": "@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55604" }, { "rank": 162, "cve_id": "CVE-2026-59217", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00372, "epss_percentile": 0.29891, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-862", "title": "Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59217" }, { "rank": 163, "cve_id": "CVE-2026-33799", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00367, "epss_percentile": 0.29394, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-787", "title": "Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33799" }, { "rank": 164, "cve_id": "CVE-2026-57054", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00366, "epss_percentile": 0.29306, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-706", "title": "Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57054" }, { "rank": 165, "cve_id": "CVE-2026-9027", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00366, "epss_percentile": 0.2925, "kev": false, "kev_due_at": null, "vendor": "corvusinfo", "product": "CorvusPay WooCommerce Payment Gateway", "cwe": "CWE-347", "title": "CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9027" }, { "rank": 166, "cve_id": "CVE-2026-15189", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00366, "epss_percentile": 0.29256, "kev": false, "kev_due_at": null, "vendor": "aerostackdev", "product": "aerostack-mcp", "cwe": "CWE-918", "title": "aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15189" }, { "rank": 167, "cve_id": "CVE-2026-15188", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00366, "epss_percentile": 0.29254, "kev": false, "kev_due_at": null, "vendor": "manjurulhoque", "product": "django-job-portal", "cwe": "CWE-266", "title": "manjurulhoque django-job-portal Employee Dashboard Endpoint views.py EditEmployeeProfileAPIView access control", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15188" }, { "rank": 168, "cve_id": "CVE-2026-13253", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00357, "epss_percentile": 0.28369, "kev": false, "kev_due_at": null, "vendor": "wpxpo", "product": "Post Grid Gutenberg Blocks – PostX", "cwe": "CWE-79", "title": "Post Grid Gutenberg Blocks for News, Magazines, Blog Websites <= 5.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13253" }, { "rank": 169, "cve_id": "CVE-2026-15311", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00356, "epss_percentile": 0.28253, "kev": false, "kev_due_at": null, "vendor": "NousResearch", "product": "hermes-agent", "cwe": "CWE-79", "title": "NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15311" }, { "rank": 170, "cve_id": "CVE-2026-60120", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00355, "epss_percentile": 0.28191, "kev": false, "kev_due_at": null, "vendor": "Webkul", "product": "Bagisto", "cwe": "CWE-79", "title": "Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60120" }, { "rank": 171, "cve_id": "CVE-2026-4256", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00354, "epss_percentile": 0.28026, "kev": false, "kev_due_at": null, "vendor": "PEAKUP Technology Inc.", "product": "PassGate", "cwe": "CWE-90", "title": "LDAP Injection in PEAKUP's PassGate", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4256" }, { "rank": 172, "cve_id": "CVE-2026-4298", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00354, "epss_percentile": 0.28027, "kev": false, "kev_due_at": null, "vendor": "mlfactory", "product": "DSGVO All in one for WP", "cwe": "CWE-862", "title": "DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4298" }, { "rank": 173, "cve_id": "CVE-2026-33803", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00353, "epss_percentile": 0.27959, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS Evolved", "cwe": "CWE-923", "title": "Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33803" }, { "rank": 174, "cve_id": "CVE-2026-55212", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00351, "epss_percentile": 0.27747, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-285", "title": "Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55212" }, { "rank": 175, "cve_id": "CVE-2026-0283", "cvss_base": 4.5, "cvss_severity": "MEDIUM", "epss_score": 0.00351, "epss_percentile": 0.27718, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-306", "title": "PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0283" }, { "rank": 176, "cve_id": "CVE-2026-4653", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27488, "kev": false, "kev_due_at": null, "vendor": "bouncingsprout", "product": "Block, Suspend, Report for BuddyPress", "cwe": "CWE-79", "title": "Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4653" }, { "rank": 177, "cve_id": "CVE-2026-6910", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27486, "kev": false, "kev_due_at": null, "vendor": "safistudio", "product": "Bookero.pl – system rezerwacji online", "cwe": "CWE-79", "title": "Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6910" }, { "rank": 178, "cve_id": "CVE-2026-12170", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27486, "kev": false, "kev_due_at": null, "vendor": "acyba", "product": "AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress", "cwe": "CWE-79", "title": "AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12170" }, { "rank": 179, "cve_id": "CVE-2026-14343", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27488, "kev": false, "kev_due_at": null, "vendor": "codename065", "product": "Download Manager", "cwe": "CWE-79", "title": "Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14343" }, { "rank": 180, "cve_id": "CVE-2026-57111", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00347, "epss_percentile": 0.27254, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Helix REST", "cwe": "CWE-1385", "title": "Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57111" }, { "rank": 181, "cve_id": "CVE-2026-55170", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00339, "epss_percentile": 0.26347, "kev": false, "kev_due_at": null, "vendor": "openfga", "product": "openfga", "cwe": "CWE-178", "title": "OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55170" }, { "rank": 182, "cve_id": "CVE-2026-9235", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00336, "epss_percentile": 0.26034, "kev": false, "kev_due_at": null, "vendor": "dhlparcel", "product": "DHL eCommerce (Benelux) for WooCommerce", "cwe": "CWE-862", "title": "DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9235" }, { "rank": 183, "cve_id": "CVE-2026-9240", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00336, "epss_percentile": 0.26034, "kev": false, "kev_due_at": null, "vendor": "iscpcolissimo", "product": "Colissimo shipping methods for WooCommerce", "cwe": "CWE-862", "title": "Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9240" }, { "rank": 184, "cve_id": "CVE-2026-11359", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00336, "epss_percentile": 0.26034, "kev": false, "kev_due_at": null, "vendor": "metagauss", "product": "Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration", "cwe": "CWE-862", "title": "Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11359" }, { "rank": 185, "cve_id": "CVE-2026-59691", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00326, "epss_percentile": 0.24878, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Gstreamer: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59691" }, { "rank": 186, "cve_id": "CVE-2026-59831", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00326, "epss_percentile": 0.24949, "kev": false, "kev_due_at": null, "vendor": "cli", "product": "cli", "cwe": "CWE-829", "title": "GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59831" }, { "rank": 187, "cve_id": "CVE-2026-11869", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00323, "epss_percentile": 0.24515, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WP DSGVO Tools (GDPR)", "cwe": null, "title": "WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11869" }, { "rank": 188, "cve_id": "CVE-2026-11875", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00323, "epss_percentile": 0.24514, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WP Support Plus Responsive Ticket System", "cwe": null, "title": "WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11875" }, { "rank": 189, "cve_id": "CVE-2026-59215", "cvss_base": 3.1, "cvss_severity": "LOW", "epss_score": 0.00323, "epss_percentile": 0.2457, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-639", "title": "Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59215" }, { "rank": 190, "cve_id": "CVE-2026-59222", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00322, "epss_percentile": 0.24447, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-200", "title": "Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59222" }, { "rank": 191, "cve_id": "CVE-2026-47831", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00319, "epss_percentile": 0.24129, "kev": false, "kev_due_at": null, "vendor": "Cloud Foundry Foundation", "product": "bosh-windows-stemcell-builder", "cwe": null, "title": "Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47831" }, { "rank": 192, "cve_id": "CVE-2026-9253", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00318, "epss_percentile": 0.23981, "kev": false, "kev_due_at": null, "vendor": "loopus", "product": "WP Cost Estimation & Payment Forms Builder", "cwe": "CWE-79", "title": "WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9253" }, { "rank": 193, "cve_id": "CVE-2026-31267", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": 0.00316, "epss_percentile": 0.23725, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "Mercusys MW302R MW302R(EU)_V1_1.4.10 Build 231023 is vulnerable to Buffer Overflow in the administrative web interface. A stack buffer overflow vulnerability in the administrative web interface allows an authenticated attacker with administrative privileges to trigger a system crash by sending a specially crafted request. The vulnerability results in denial of service through control flow manipulation to an arbitrary instruction address.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31267" }, { "rank": 194, "cve_id": "CVE-2026-0280", "cvss_base": 1.7, "cvss_severity": "LOW", "epss_score": 0.00314, "epss_percentile": 0.23614, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-131", "title": "PAN-OS: IPv6 Firewall Policy Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0280" }, { "rank": 195, "cve_id": "CVE-2026-12516", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00313, "epss_percentile": 0.23434, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Fediverse Embeds", "cwe": null, "title": "Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media Proxy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12516" }, { "rank": 196, "cve_id": "CVE-2026-12517", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00313, "epss_percentile": 0.23433, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Fediverse Embeds", "cwe": null, "title": "Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12517" }, { "rank": 197, "cve_id": "CVE-2026-59216", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00308, "epss_percentile": 0.22937, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-94", "title": "Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59216" }, { "rank": 198, "cve_id": "CVE-2026-31982", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00308, "epss_percentile": 0.22892, "kev": false, "kev_due_at": null, "vendor": "Nozomi Networks", "product": "Guardian", "cwe": "CWE-601", "title": "Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31982" }, { "rank": 199, "cve_id": "CVE-2026-13462", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00303, "epss_percentile": 0.22305, "kev": false, "kev_due_at": null, "vendor": "PayRange", "product": "PayRange", "cwe": null, "title": "PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13462" }, { "rank": 200, "cve_id": "CVE-2026-59226", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00303, "epss_percentile": 0.22403, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-285", "title": "Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59226" }, { "rank": 201, "cve_id": "CVE-2026-57028", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00301, "epss_percentile": 0.22099, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS Evolved", "cwe": "CWE-923", "title": "Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57028" }, { "rank": 202, "cve_id": "CVE-2026-39243", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00301, "epss_percentile": 0.22143, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-59", "title": "decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39243" }, { "rank": 203, "cve_id": "CVE-2026-53961", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.003, "epss_percentile": 0.21984, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse", "cwe": "CWE-345", "title": "Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53961" }, { "rank": 204, "cve_id": "CVE-2026-12879", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.003, "epss_percentile": 0.22003, "kev": false, "kev_due_at": null, "vendor": "Google Cloud", "product": "Apigee", "cwe": "CWE-441", "title": "Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12879" }, { "rank": 205, "cve_id": "CVE-2026-12270", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00298, "epss_percentile": 0.21849, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Everest Forms", "cwe": null, "title": "Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12270" }, { "rank": 206, "cve_id": "CVE-2026-59213", "cvss_base": 5, "cvss_severity": "MEDIUM", "epss_score": 0.00297, "epss_percentile": 0.21667, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-524", "title": "Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59213" }, { "rank": 207, "cve_id": "CVE-2026-4275", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00294, "epss_percentile": 0.21411, "kev": false, "kev_due_at": null, "vendor": "badhonrocks", "product": "Divi Torque Lite – Divi Modules for the Divi Builder & Theme", "cwe": "CWE-352", "title": "Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4275" }, { "rank": 208, "cve_id": "CVE-2026-0282", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00293, "epss_percentile": 0.21245, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-20", "title": "PAN-OS: File Deletion Vulnerability in Management Web Interface", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0282" }, { "rank": 209, "cve_id": "CVE-2026-59214", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00286, "epss_percentile": 0.20487, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-79", "title": "Open WebUI: Stored web worker XSS via Pyodide", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59214" }, { "rank": 210, "cve_id": "CVE-2026-47828", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00286, "epss_percentile": 0.20486, "kev": false, "kev_due_at": null, "vendor": "BOSH-Ecosystem / BOSH (bosh-cli)", "product": "bosh-cli", "cwe": null, "title": "Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47828" }, { "rank": 211, "cve_id": "CVE-2026-0281", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00284, "epss_percentile": 0.20297, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-524", "title": "PAN-OS: Information Disclosure Vulnerability in Management Web Interface", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0281" }, { "rank": 212, "cve_id": "CVE-2026-33801", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00281, "epss_percentile": 0.19991, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-754", "title": "Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33801" }, { "rank": 213, "cve_id": "CVE-2025-63579", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0027, "epss_percentile": 0.18661, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-200", "title": "Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be obtained. This affects Kyocera Command Center RX TASKalfa 2552ci, TASKalfa 3252ci, TASKalfa 2553ci, TASKalfa 3253ci, TASKalfa 3554ci, TASKalfa 4052ci, TASKalfa 5052ci, TASKalfa 6052ci, TASKalfa 7052ci, TASKalfa 8052ci, TASKalfa 7353ci, TASKalfa 8353ci, TASKalfa 2554ci, TASKalfa 3254ci, TASKalfa 505.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-63579" }, { "rank": 214, "cve_id": "CVE-2026-33800", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00269, "epss_percentile": 0.18524, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-606", "title": "Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33800" }, { "rank": 215, "cve_id": "CVE-2026-57019", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00269, "epss_percentile": 0.18525, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-1284", "title": "Junos OS: MX Series: Specific traffic causes an FPC to reset", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57019" }, { "rank": 216, "cve_id": "CVE-2026-57020", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00269, "epss_percentile": 0.18525, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-754", "title": "Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast flood", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57020" }, { "rank": 217, "cve_id": "CVE-2026-57027", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00269, "epss_percentile": 0.18526, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-401", "title": "Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57027" }, { "rank": 218, "cve_id": "CVE-2026-51598", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00269, "epss_percentile": 0.18525, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-20", "title": "An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51598" }, { "rank": 219, "cve_id": "CVE-2026-59269", "cvss_base": 3.8, "cvss_severity": "LOW", "epss_score": 0.00269, "epss_percentile": 0.18539, "kev": false, "kev_due_at": null, "vendor": "VMware", "product": "Pinniped", "cwe": null, "title": "Privilege Escalation via Active Directory LDAP injection in Pinniped Supervisor can be executed by an attacker who can edit LDAP Group DN entries", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59269" }, { "rank": 220, "cve_id": "CVE-2026-56458", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00263, "epss_percentile": 0.17675, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "HCL DevOps Deploy", "cwe": "CWE-942", "title": "HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56458" }, { "rank": 221, "cve_id": "CVE-2026-59148", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00262, "epss_percentile": 0.17627, "kev": false, "kev_due_at": null, "vendor": "mockoon", "product": "mockoon", "cwe": "CWE-306", "title": "Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59148" }, { "rank": 222, "cve_id": "CVE-2026-59227", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00259, "epss_percentile": 0.17217, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-862", "title": "Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59227" }, { "rank": 223, "cve_id": "CVE-2026-5793", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16447, "kev": false, "kev_due_at": null, "vendor": "Inrove Software and Internet Services", "product": "BiEticaret", "cwe": "CWE-79", "title": "XSS in Inrove Software's BiEticaret", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5793" }, { "rank": 224, "cve_id": "CVE-2026-31981", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16287, "kev": false, "kev_due_at": null, "vendor": "Nozomi Networks", "product": "Guardian", "cwe": "CWE-79", "title": "HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31981" }, { "rank": 225, "cve_id": "CVE-2026-57031", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00238, "epss_percentile": 0.1463, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-754", "title": "Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57031" }, { "rank": 226, "cve_id": "CVE-2026-58143", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00235, "epss_percentile": 0.14265, "kev": false, "kev_due_at": null, "vendor": "Cotonti", "product": "Cotonti", "cwe": "CWE-352", "title": "Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58143" }, { "rank": 227, "cve_id": "CVE-2026-54800", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00229, "epss_percentile": 0.13502, "kev": false, "kev_due_at": null, "vendor": "Siemens", "product": "CPCI85 Central Processing/Communication", "cwe": "CWE-1188", "title": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application ships with a default configuration that disables all OPC UA security mechanisms. This could allow an attacker to gain unauthorized access and control over critical system functions.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54800" }, { "rank": 228, "cve_id": "CVE-2026-0285", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00229, "epss_percentile": 0.13446, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-918", "title": "PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0285" }, { "rank": 229, "cve_id": "CVE-2026-41857", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00226, "epss_percentile": 0.13099, "kev": false, "kev_due_at": null, "vendor": "CloudFoundry BOSH", "product": "BOSH CLI", "cwe": "CWE-78", "title": "BOSH CLI Shell Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41857" }, { "rank": 230, "cve_id": "CVE-2026-5005", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13071, "kev": false, "kev_due_at": null, "vendor": "Twiser Informatics Technology Consulting, Trade and Education Inc.", "product": "OKRs & Goals", "cwe": "CWE-79", "title": "Stored XSS in Twiser's OKRs & Goals", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5005" }, { "rank": 231, "cve_id": "CVE-2026-58144", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13073, "kev": false, "kev_due_at": null, "vendor": "Cotonti", "product": "Cotonti", "cwe": "CWE-79", "title": "Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58144" }, { "rank": 232, "cve_id": "CVE-2026-59715", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12616, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-306", "title": "Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59715" }, { "rank": 233, "cve_id": "CVE-2026-47840", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00217, "epss_percentile": 0.11945, "kev": false, "kev_due_at": null, "vendor": "CloudFoundry Foundation", "product": "UAA", "cwe": null, "title": "LDAP StartTLS unconditionally disables hostname verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47840" }, { "rank": 234, "cve_id": "CVE-2026-59856", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00216, "epss_percentile": 0.11827, "kev": false, "kev_due_at": null, "vendor": "vim", "product": "vim", "cwe": "CWE-94", "title": "Vim: Arbitrary Code Execution via PHP Omni-Completion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59856" }, { "rank": 235, "cve_id": "CVE-2026-59225", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00211, "epss_percentile": 0.11215, "kev": false, "kev_due_at": null, "vendor": "open-webui", "product": "open-webui", "cwe": "CWE-862", "title": "Open WebUI: Arena task endpoints can bypass underlying model access controls", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59225" }, { "rank": 236, "cve_id": "CVE-2026-31985", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10114, "kev": false, "kev_due_at": null, "vendor": "Nozomi Networks", "product": "Remote Collector", "cwe": "CWE-671", "title": "Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31985" }, { "rank": 237, "cve_id": "CVE-2026-0277", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.0988, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "cwe": "CWE-295", "title": "Prisma Access Agent: Improper Certificate Validation on iOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0277" }, { "rank": 238, "cve_id": "CVE-2026-44342", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00191, "epss_percentile": 0.08786, "kev": false, "kev_due_at": null, "vendor": "QuantumNous", "product": "new-api", "cwe": "CWE-352", "title": "New API CSRF in email and WeChat account binding endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44342" }, { "rank": 239, "cve_id": "CVE-2026-57029", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.0019, "epss_percentile": 0.08641, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS Evolved", "cwe": "CWE-820", "title": "Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57029" }, { "rank": 240, "cve_id": "CVE-2026-15182", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.00185, "epss_percentile": 0.08063, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "LibreDWG", "cwe": "CWE-119", "title": "GNU LibreDWG BMP Image dwg.c dwg_bmp heap-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15182" }, { "rank": 241, "cve_id": "CVE-2026-50181", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00184, "epss_percentile": 0.07931, "kev": false, "kev_due_at": null, "vendor": "langroid", "product": "langroid", "cwe": "CWE-22", "title": "Langroid: Path traversal in the file tools allows read/write outside configured current directory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50181" }, { "rank": 242, "cve_id": "CVE-2026-54799", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00183, "epss_percentile": 0.0792, "kev": false, "kev_due_at": null, "vendor": "Siemens", "product": "CPCI85 Central Processing/Communication", "cwe": "CWE-489", "title": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54799" }, { "rank": 243, "cve_id": "CVE-2025-58146", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00178, "epss_percentile": 0.07344, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "XAPI", "cwe": "CWE-20", "title": "XAPI UTF-8 string handling", "url": "https://www.cve.org/CVERecord?id=CVE-2025-58146" }, { "rank": 244, "cve_id": "CVE-2026-56288", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00168, "epss_percentile": 0.06173, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "patch", "cwe": "CWE-476", "title": "NULL Pointer Dereference in GNU patch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56288" }, { "rank": 245, "cve_id": "CVE-2026-56289", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00168, "epss_percentile": 0.06173, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "patch", "cwe": "CWE-835", "title": "Loop with Unreachable Exit Condition in GNU patch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56289" }, { "rank": 246, "cve_id": "CVE-2026-15184", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.00168, "epss_percentile": 0.06185, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "LibreDWG", "cwe": "CWE-404", "title": "GNU LibreDWG DWG File dwg.c dwg_next_entity null pointer dereference", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15184" }, { "rank": 247, "cve_id": "CVE-2026-23559", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00167, "epss_percentile": 0.06135, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "XAPI", "cwe": "CWE-250", "title": "Multiple RBAC issues in XAPI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23559" }, { "rank": 248, "cve_id": "CVE-2026-23560", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00167, "epss_percentile": 0.06135, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "XAPI", "cwe": "CWE-250", "title": "Multiple RBAC issues in XAPI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23560" }, { "rank": 249, "cve_id": "CVE-2026-23561", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00167, "epss_percentile": 0.06136, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "XAPI", "cwe": "CWE-250", "title": "Multiple RBAC issues in XAPI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23561" }, { "rank": 250, "cve_id": "CVE-2026-23562", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00167, "epss_percentile": 0.06136, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "XAPI", "cwe": "CWE-250", "title": "Multiple RBAC issues in XAPI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23562" }, { "rank": 251, "cve_id": "CVE-2026-42486", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00167, "epss_percentile": 0.06136, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "XAPI", "cwe": "CWE-250", "title": "Multiple RBAC issues in XAPI", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42486" }, { "rank": 252, "cve_id": "CVE-2026-21901", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00166, "epss_percentile": 0.05967, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-476", "title": "Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21901" }, { "rank": 253, "cve_id": "CVE-2026-0275", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00165, "epss_percentile": 0.05918, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Prisma Browser", "cwe": "CWE-269", "title": "Prisma Browser: Local Privilege Escalation on macOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0275" }, { "rank": 254, "cve_id": "CVE-2026-58303", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00163, "epss_percentile": 0.0567, "kev": false, "kev_due_at": null, "vendor": "Samsung Open Source", "product": "Escargot", "cwe": "CWE-121", "title": "Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before b30b63fc63b403907d8137da1c65aaa4521fe74e.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58303" }, { "rank": 255, "cve_id": "CVE-2026-58306", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00163, "epss_percentile": 0.05669, "kev": false, "kev_due_at": null, "vendor": "Samsung Open Source", "product": "Escargot", "cwe": "CWE-122", "title": "Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before ef525f337fafddecde77a3c426212a84bb20cb98.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58306" }, { "rank": 256, "cve_id": "CVE-2026-15194", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.00161, "epss_percentile": 0.05424, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "Open5GS", "cwe": "CWE-119", "title": "Open5GS AMF context.c amf_context_final use after free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15194" }, { "rank": 257, "cve_id": "CVE-2026-15185", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.0016, "epss_percentile": 0.05337, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "GPAC", "cwe": "CWE-119", "title": "GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15185" }, { "rank": 258, "cve_id": "CVE-2026-15274", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.0016, "epss_percentile": 0.05335, "kev": false, "kev_due_at": null, "vendor": "lo48576", "product": "fbxcel", "cwe": "CWE-404", "title": "lo48576 fbxcel Node Header parser.rs denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15274" }, { "rank": 259, "cve_id": "CVE-2026-15276", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.0016, "epss_percentile": 0.05335, "kev": false, "kev_due_at": null, "vendor": "pdeljanov", "product": "Symphonia", "cwe": "CWE-404", "title": "pdeljanov Symphonia Metadata denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15276" }, { "rank": 260, "cve_id": "CVE-2025-27462", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00158, "epss_percentile": 0.05186, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "Windows PV drivers", "cwe": "CWE-276", "title": "WinPVDrivers: Excessive permissions on user-exposed devices", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27462" }, { "rank": 261, "cve_id": "CVE-2025-27463", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00158, "epss_percentile": 0.05185, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "Windows PV drivers", "cwe": "CWE-276", "title": "WinPVDrivers: Excessive permissions on user-exposed devices", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27463" }, { "rank": 262, "cve_id": "CVE-2025-27464", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00158, "epss_percentile": 0.05186, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "Windows PV drivers", "cwe": "CWE-276", "title": "WinPVDrivers: Excessive permissions on user-exposed devices", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27464" }, { "rank": 263, "cve_id": "CVE-2026-0278", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00155, "epss_percentile": 0.04834, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "cwe": "CWE-693", "title": "Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0278" }, { "rank": 264, "cve_id": "CVE-2026-58304", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00151, "epss_percentile": 0.04466, "kev": false, "kev_due_at": null, "vendor": "Samsung Open Source", "product": "Escargot", "cwe": "CWE-125", "title": "Out-of-bounds read, Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58304" }, { "rank": 265, "cve_id": "CVE-2026-58305", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00151, "epss_percentile": 0.04466, "kev": false, "kev_due_at": null, "vendor": "Samsung Open Source", "product": "Escargot", "cwe": "CWE-843", "title": "Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 779f6bedf58f334dec64b0a51ebb724b4708b84a.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58305" }, { "rank": 266, "cve_id": "CVE-2026-58307", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00151, "epss_percentile": 0.04465, "kev": false, "kev_due_at": null, "vendor": "Samsung Open Source", "product": "Escargot", "cwe": "CWE-125", "title": "Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overread Buffers, Input Data Manipulation. This issue affects Escargot: before 2dee22f5c7b8bf31cb7252d7731fae8c07f2842c.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58307" }, { "rank": 267, "cve_id": "CVE-2026-47830", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00148, "epss_percentile": 0.04218, "kev": false, "kev_due_at": null, "vendor": "Cloud Foundry Foundation", "product": "bosh-windows-stemcell-builder", "cwe": null, "title": "Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47830" }, { "rank": 268, "cve_id": "CVE-2026-56459", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00147, "epss_percentile": 0.04194, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "HCL DevOps Deploy / HCL Launch", "cwe": "CWE-532", "title": "HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56459" }, { "rank": 269, "cve_id": "CVE-2026-0276", "cvss_base": 1.1, "cvss_severity": "LOW", "epss_score": 0.00144, "epss_percentile": 0.03944, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cortex XDR Broker VM", "cwe": "CWE-269", "title": "Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0276" }, { "rank": 270, "cve_id": "CVE-2026-57025", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.0014, "epss_percentile": 0.03603, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-466", "title": "Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57025" }, { "rank": 271, "cve_id": "CVE-2025-58151", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00137, "epss_percentile": 0.03355, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "varstored", "cwe": "CWE-367", "title": "varstored: TOCTOU issues with mapped guest memory", "url": "https://www.cve.org/CVERecord?id=CVE-2025-58151" }, { "rank": 272, "cve_id": "CVE-2026-23556", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00137, "epss_percentile": 0.03297, "kev": false, "kev_due_at": null, "vendor": "Xen", "product": "oxenstored", "cwe": "CWE-281", "title": "oxenstored keeps quota related use counts across domain destruction", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23556" }, { "rank": 273, "cve_id": "CVE-2026-59858", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00137, "epss_percentile": 0.03347, "kev": false, "kev_due_at": null, "vendor": "vim", "product": "vim", "cwe": "CWE-94", "title": "Vim: Arbitrary Code Execution via C Omni-Completion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59858" }, { "rank": 274, "cve_id": "CVE-2026-58198", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00123, "epss_percentile": 0.0231, "kev": false, "kev_due_at": null, "vendor": "gunthercox", "product": "ChatterBot", "cwe": "CWE-59", "title": "ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58198" }, { "rank": 275, "cve_id": "CVE-2026-33802", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00122, "epss_percentile": 0.0223, "kev": false, "kev_due_at": null, "vendor": "Juniper Networks", "product": "Junos OS", "cwe": "CWE-862", "title": "Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33802" }, { "rank": 276, "cve_id": "CVE-2026-59857", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.0011, "epss_percentile": 0.01381, "kev": false, "kev_due_at": null, "vendor": "vim", "product": "vim", "cwe": "CWE-787", "title": "Vim: Out-of-bounds Write in SAL Soundfolding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59857" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-39243", "detail": "EXPLOIT PUBLISHED — CVE-2026-39243. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-39245", "detail": "EXPLOIT PUBLISHED — CVE-2026-39245. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-39246", "detail": "EXPLOIT PUBLISHED — CVE-2026-39246. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54695", "detail": "EXPLOIT PUBLISHED — CVE-2026-54695 (pipecat-ai pipecat). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56292", "detail": "EXPLOIT PUBLISHED — CVE-2026-56292 (acymailing.com AcyMailing extension for Joomla). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58459", "detail": "EXPLOIT PUBLISHED — CVE-2026-58459 (ntpsec gpsd). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59212", "detail": "EXPLOIT PUBLISHED — CVE-2026-59212 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59213", "detail": "EXPLOIT PUBLISHED — CVE-2026-59213 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59217", "detail": "EXPLOIT PUBLISHED — CVE-2026-59217 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59219", "detail": "EXPLOIT PUBLISHED — CVE-2026-59219 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59220", "detail": "EXPLOIT PUBLISHED — CVE-2026-59220 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59221", "detail": "EXPLOIT PUBLISHED — CVE-2026-59221 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59222", "detail": "EXPLOIT PUBLISHED — CVE-2026-59222 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59227", "detail": "EXPLOIT PUBLISHED — CVE-2026-59227 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59715", "detail": "EXPLOIT PUBLISHED — CVE-2026-59715 (open-webui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59856", "detail": "EXPLOIT PUBLISHED — CVE-2026-59856 (vim). Public exploit reference added." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }