Security Box Score — Sunday, July 12, 2026

63 CVEs published July 12, 2026: 3 critical, 17 high, 20 medium, 23 low; 0 in KEV; 4 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 38 in the results table.

League
	MTD	YTD	2025 same span	2025 full
CVEs published	2461	14779	1295	2563
KEV catalog size	1670

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	38	1518	121	866	528	1	27	3	0.2	7.5	.0013	-58
google	79	1343	149	604	549	38	74	6	0.4	7.8	.0023	-511
microsoft	54	765	58	509	177	4	378	28	3.7	7.8	.0044	-153
red hat	36	228	14	92	110	12	4	0	0.0	6.5	.0026	-4
apple	0	99	1	23	66	2	93	7	7.1	6.5	.0031	-14
canonical	1	21	2	6	8	5	0	0	0.0	5.5	.0011	+1
suse	6	19	4	11	4	0	0	0	0.0	8.6	.0036	+6
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0015	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ubiquiti	25	36	14	21	1	0	4	3	8.3	8.8	.0036	+20
cisco	8	31	4	12	8	0	96	11	35.5	7.5	.0056	+5
palo alto networks	14	25	0	2	14	7	14	2	8.0	4.7	.0021	+5
netgear	0	17	0	0	16	1	8	0	0.0	4.3	.0024	-17
checkpoint	0	9	1	5	3	0	3	1	11.1	7.5	.0410	-3
f5	0	9	4	3	1	0	7	1	11.1	8.9	.0221	0
ivanti	0	9	2	3	0	0	33	5	55.6	8.8	.5187	-4
fortinet	0	8	1	3	2	0	28	3	37.5	7.3	.0066	-2

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	61	214	41	84	77	11	40	1	0.5	7.3	.0048	-6
mozilla	3	59	12	18	29	0	13	0	0.0	7.3	.0025	-2
drupal	46	51	6	5	35	5	5	1	2.0	5.9	.0018	+46
gitlab	7	40	0	5	27	6	4	2	5.0	4.7	.0024	-4
github	1	7	1	1	5	0	0	0	0.0	6.0	.0026	+1
docker	0	7	0	5	2	0	1	0	0.0	8.2	.0016	-2
jenkins	0	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	270	131	116	18	4	40	2	0.7	8.8	.0040	-3
adobe	3	149	13	52	79	2	75	4	2.7	5.8	.0021	-121
ibm	2	126	38	42	46	0	7	0	0.0	7.5	.0025	-9
progress	10	19	3	14	2	0	9	0	0.0	7.5	.0034	+5
solarwinds	0	7	1	2	2	0	11	4	57.1	7.5	.0835	-3
veeam	0	4	2	2	0	0	4	0	0.0	9.0	.0046	-1
zohocorp	0	3	1	1	1	0	0	0	0.0	8.4	.0170	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
synology	0	23	2	5	13	3	0	0	0.0	5.6	.0025	-5
d-link	1	14	0	5	3	5	26	1	7.1	6.0	.0058	-7
siemens	4	13	0	7	6	0	1	0	0.0	7.1	.0019	-3
rockwell automation	0	7	1	5	1	0	0	0	0.0	8.7	.0030	0
abb	0	6	0	4	2	0	0	0	0.0	7.2	.0018	-5
schneider electric	0	6	0	4	2	0	1	0	0.0	7.8	.0024	-1
moxa	0	5	0	3	2	0	0	0	0.0	7.0	.0029	-1
dahua	0	3	0	1	1	1	2	0	0.0	6.9	.0036	-3

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	28	99	0	0	53	46	0	0	0.0	5.5	.0026	-7
dell	33	89	4	41	40	3	2	1	1.1	7.0	.0020	+26
capgo	22	83	2	42	38	1	0	0	0.0	7.1	.0028	+20
spring	0	73	2	31	39	1	0	0	0.0	6.5	.0024	-68
openclaw	1	68	0	36	22	10	0	0	0.0	7.0	.0021	-33
edimax	0	65	0	39	0	26	1	0	0.0	7.4	.0059	0
itsourcecode	10	63	0	0	19	44	0	0	0.0	2.1	.0020	-12
themerex	2	60	5	54	1	0	0	0	0.0	8.1	.0043	+2

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-48282	.9924	99.9	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-48908	.8813	99.8	10.0
CVE-2026-34910	.8696	99.7	10.0
CVE-2026-34908	.8519	99.7	10.0
CVE-2026-56290	.8325	99.7	10.0
CVE-2026-20230	.8321	99.7	8.6
CVE-2026-48939	.8250	99.6	10.0
CVE-2026-56291	.7607	99.5	10.0
CVE-2026-48907	.6883	99.3	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-48282	10.0	.9924	KEV
CVE-2026-48908	10.0	.8813	KEV
CVE-2026-34910	10.0	.8696	KEV
CVE-2026-34908	10.0	.8519	KEV
CVE-2026-56290	10.0	.8325	KEV
CVE-2026-48939	10.0	.8250	KEV
CVE-2026-56291	10.0	.7607	KEV
CVE-2026-48907	10.0	.6883	KEV
CVE-2026-34909	10.0	.6390	KEV
CVE-2026-50160	10.0	.1775

Most disclosures (vendor)
Vendor	CVEs
google	579
linux	456
oracle	240
red hat	124
apache	115
capgo	81
microsoft	68
ibm	66
dell	64
themerex	60

Most KEV additions (YTD)
Vendor	KEV
microsoft	28
cisco	11
apple	7
google	6
ivanti	5
adobe	4
solarwinds	4
synacor	4
fortinet	3
linux	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	60
PyPI	5
npm	5
NuGet	3

Fastest to KEV
CVE	Vendor	Days
CVE-2025-67038	Lantronix	0
CVE-2026-12569	PTC	0
CVE-2026-20230	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-20262	Cisco	0
CVE-2026-34908	Ubiquiti Inc	0
CVE-2026-34909	Ubiquiti Inc	0
CVE-2026-34910	Ubiquiti Inc	0
CVE-2026-45659	Microsoft	0
CVE-2026-48282	Adobe	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1698
CVE-2021-27102	Accellion	2021-11-17	1698
CVE-2021-27101	Accellion	2021-11-17	1698
CVE-2021-27103	Accellion	2021-11-17	1698
CVE-2021-21017	Adobe	2021-11-17	1698
CVE-2021-28550	Adobe	2021-11-17	1698
CVE-2021-42013	Apache	2021-11-17	1698
CVE-2021-41773	Apache	2021-11-17	1698
CVE-2021-30858	Apple	2021-11-17	1698
CVE-2021-30860	Apple	2021-11-17	1698

Yesterday's Results

63 CVEs published. 25 box scores, 38 table rows — nothing truncated.

CVE-2026-15511HIGH

Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0262   84.2     —

AFFECTED
  Product        Versions   Fixed
  CF-WR631AX V3  2.7.0.0 –  —

TIMELINE
  Jul 12  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15481HIGH

Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0156   73.2     —

AFFECTED
  Product     Versions   Fixed
  TEW-635BRM  1.00.03 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15495LOW

SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0154   72.8     —

AFFECTED
  Product      Versions  Fixed
  sonic-agent  2.7.0 –   —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 6 references · NVD status: Deferred

CVE-2026-15496LOW

SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.4     —

AFFECTED
  Product      Versions  Fixed
  sonic-agent  2.7.0 –   —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15485MEDIUM

TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0107   62.1     —

AFFECTED
  Product     Versions   Fixed
  TEW-821DAP  1.11B03 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15486MEDIUM

TRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0107   62.1     —

AFFECTED
  Product     Versions   Fixed
  TEW-821DAP  1.11B03 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15487MEDIUM

TRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0107   62.1     —

AFFECTED
  Product     Versions   Fixed
  TEW-821DAP  1.11B03 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15513LOW

Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.0     —

AFFECTED
  Product     Versions  Fixed
  WL-NU516U1  260515 –  —

TIMELINE
  Jul 12  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · 6 references · NVD status: Deferred

CVE-2026-61876CRITICAL

openwrt luci — LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   P   H   H   H    9.4   .0085   55.2     —

AFFECTED
  Product  Versions     Fixed
  luci     unspecified  —

TIMELINE
  Jul 10  Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · 2 references · NVD status: Awaiting Analysis

CVE-2026-59260HIGH

OpenWrt luci-app-samba4 read ACL remote code execution via smbd

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0071   50.7     —

AFFECTED
  Product  Versions     Fixed
  luci     unspecified  —

TIMELINE
  Jul 4   Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-269 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-58596HIGH

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  C  H  H  H    8.3   .0048   39.3     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jul 1   Reserved by CNA
  Jul 12  Published (CNA: microsoft)

CWE-822 · CNA: microsoft · 1 reference · NVD status: Analyzed

CVE-2026-15483HIGH

TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0047   38.8     —

AFFECTED
  Product     Versions   Fixed
  TEW-821DAP  1.12B01 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15484HIGH

TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0047   38.8     —

AFFECTED
  Product     Versions   Fixed
  TEW-821DAP  1.12B01 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15480HIGH

Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.8     —

AFFECTED
  Product     Versions   Fixed
  TEW-635BRM  1.00.03 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-10666CRITICAL

zephyrproject zephyr — Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0045   37.6     —

AFFECTED
  Product  Versions  Fixed
  zephyr   1.9.0 –   —

TIMELINE
  Jun 2   Reserved by CNA
  Jul 12  Public exploit reference published
  Jul 12  Published (CNA: zephyr)

CWE-121 · CNA: zephyr · 3 references · NVD status: Analyzed

CVE-2026-10665HIGH

zephyrproject zephyr — Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  N  H  H    7.4   .0044   36.8     —

AFFECTED
  Product  Versions  Fixed
  zephyr   4.4.0 –   —

TIMELINE
  Jun 2   Reserved by CNA
  Jul 12  Public exploit reference published
  Jul 12  Published (CNA: zephyr)

CWE-787 · CNA: zephyr · 2 references · NVD status: Analyzed

CVE-2026-56260HIGH

Crawl4AI - Arbitrary File Write via output_path Parameter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   H   H    8.8   .0042   35.1     —

AFFECTED
  Product   Versions     Fixed
  Crawl4AI  unspecified  0.8.7

TIMELINE
  Jun 19  Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · 3 references · NVD status: Analyzed

CVE-2026-15497MEDIUM

SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0039   32.5     —

AFFECTED
  Product      Versions  Fixed
  sonic-agent  2.7.0 –   —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-74, CWE-94 · CNA: VulDB · 5 references · NVD status: Deferred

CVE-2026-15491MEDIUM

RafyMrX TOKO-ONLINE-ROTI missing authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0038   31.5     —

AFFECTED
  Product           Versions                                    Fixed
  TOKO-ONLINE-ROTI  ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-287, CWE-306 · CNA: VulDB · 4 references · NVD status: Deferred

CVE-2026-56271CRITICAL

Flowise - Weak Default JWT Secrets in Authentication Middleware

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0038   30.7     —

AFFECTED
  Product  Versions     Fixed
  Flowise  unspecified  3.1.0

TIMELINE
  Jun 20  Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-321 · CNA: VulnCheck · 2 references · NVD status: Analyzed

CVE-2026-56238HIGH

Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0037   29.8     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 19  Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-15488MEDIUM

hcr707305003 shiroiAdmin FileController.php upload unrestricted upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0031   24.1     —

AFFECTED
  Product      Versions  Fixed
  shiroiAdmin  1.1 –     1.4

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-284, CWE-434 · CNA: VulDB · 7 references · NVD status: Deferred

CVE-2026-56259HIGH

Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0031   23.4     —

AFFECTED
  Product   Versions     Fixed
  Crawl4AI  unspecified  0.8.8

TIMELINE
  Jun 19  Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Analyzed

CVE-2026-61875HIGH

openwrt luci — luci-app-upnp Stored XSS via UPnP Port Mapping Description

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   L    8.7   .0029   21.4     —

AFFECTED
  Product  Versions     Fixed
  luci     unspecified  —

TIMELINE
  Jul 10  Reserved by CNA
  Jul 12  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · 2 references · NVD status: Deferred

CVE-2026-15479MEDIUM

H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0028   20.9     —

AFFECTED
  Product  Versions    Fixed
  NX15     V100R017 –  —

TIMELINE
  Jul 11  Reserved by CNA
  Jul 12  Published (CNA: VulDB)

CWE-640 · CNA: VulDB · 5 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-56313	7.2	20.1	Capgo	Capgo	CWE-285	Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint
CVE-2026-15482	5.5	19.8	Aster Telecom	Azcall	CWE-74	Aster Telecom Azcall HTTP sis.php sql injection
CVE-2026-15489	5.5	19.8	RafyMrX	TOKO-ONLINE-ROTI	CWE-74	RafyMrX TOKO-ONLINE-ROTI login.php sql injection
CVE-2026-15490	5.5	19.0	RafyMrX	TOKO-ONLINE-ROTI	CWE-74	RafyMrX TOKO-ONLINE-ROTI add.php sql injection
CVE-2026-15492	2.1	18.3	igweze	wizgrade	CWE-79	igweze wizgrade studentConductManager.php cross site scripting
CVE-2026-15498	6.9	17.1	sergomanov	SmartHomeAdatum	CWE-74	sergomanov SmartHomeAdatum Login users.php sql injection
CVE-2026-15514	5.5	17.1	Metasoft 美特软件	MetaCRM	CWE-74	Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection
CVE-2026-56308	8.4	15.9	Capgo	Capgo	CWE-640	Capgo - Insufficient Authentication in Email Change Endpoint
CVE-2026-10664	5.0	14.5	zephyrproject	zephyr	CWE-787	Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded…
CVE-2026-15512	2.1	13.7	pig-mesh	Pig	CWE-74	pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
CVE-2026-56241	7.2	11.6	Capgo	Capgo	CWE-285	Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right
CVE-2026-15500	2.1	11.4	AstrBotDevs	AstrBot	CWE-918	AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-…
CVE-2026-15471	2.1	11.1	Eleveo	Call Recording Software	CWE-266	Eleveo Call Recording Software pci_dss_status.jsp improper authorization
CVE-2026-15472	2.1	11.1	Eleveo	Call Recording Software	CWE-266	Eleveo Call Recording Software composeEmailAction.do improper authorization
CVE-2026-15474	2.1	11.1	Eleveo	Call Recording Software	CWE-266	Eleveo Call Recording Software audio.jsp improper authorization
CVE-2026-15501	2.1	10.9	AstrBotDevs	AstrBot	CWE-918	AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection…
CVE-2026-15507	2.1	10.9	coollabsio	Coolify	CWE-862	coollabsio Coolify Policy Policies authorization
CVE-2026-15508	2.1	10.9	Helicone	ai-gateway	CWE-918	Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-s…
CVE-2026-15509	2.1	10.9	n/a	Leantime	CWE-266	Leantime JSON-RPC Endpoint addUser improper authorization
CVE-2026-15510	2.1	10.9	n/a	Leantime	CWE-266	Leantime API saveSetting improper authorization
CVE-2026-56336	6.9	10.8	Capgo	Capgo	CWE-200	Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
CVE-2026-15477	2.1	10.8	Bahmni	bahmnicore	CWE-74	Bahmni bahmnicore Search Endpoint sql additionalParams sql injection
CVE-2026-15494	2.0	10.4	AMTT	Hotel Broadband Operation System	CWE-74	AMTT Hotel Broadband Operation System switch_status.php sql injection
CVE-2026-15473	2.1	10.4	Eleveo	Call Recording Software	CWE-266	Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper a…
CVE-2026-15499	2.1	10.4	AstrBotDevs	AstrBot	CWE-266	AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper…
CVE-2026-61874	2.3	9.9	filebrowser	filebrowser	CWE-863	filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
CVE-2026-56281	5.1	9.8	Capgo	Capgo	CWE-89	Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
CVE-2026-15502	5.3	9.7	AojiaoZero	Antaris	CWE-74	AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
CVE-2026-15478	2.1	9.7	n/a	IceHRM	CWE-74	IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection
CVE-2026-15505	2.0	9.5	vnotex	vnote	CWE-79	vnotex vnote YAML Frontmatter markdownit.js cross site scripting
CVE-2026-15493	5.1	9.1	Akpali9	Attendance-Management-System	CWE-79	Akpali9 Attendance-Management-System absent.php cross site scripting
CVE-2026-56252	5.3	6.6	Capgo	Capgo	CWE-863	Capgo - Scope Isolation Failure in Webhook Test Endpoint
CVE-2026-10663	6.1	5.5	zephyrproject	zephyr	CWE-416	Use-after-free / double-free of the root USB device in the experimental USB h…
CVE-2026-10668	4.6	5.5	zephyrproject	zephyr	CWE-400	Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC d…
CVE-2026-10667	7.8	4.9	zephyrproject	zephyr	CWE-416	SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object trackin…
CVE-2026-15506	7.1	3.9	SecureAge	CatchPulse	CWE-119	SecureAge CatchPulse Driver saappctl.sys heap-based overflow
CVE-2026-15476	1.9	1.2	QILING	Disk Master	CWE-266	QILING Disk Master Kernel Driver diskbckp.sys access control
CVE-2026-15475	1.9	1.2	MiniTool	Partition Wizard	CWE-266	MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control

Standings

Leaders (trailing 30 days unless noted)

Transactions

Yesterday's Results

Methodology