{
  "day": "2026-07-12",
  "boundary": "UTC calendar day",
  "published_count": 63,
  "by_severity": {
    "CRITICAL": 3,
    "HIGH": 17,
    "MEDIUM": 20,
    "LOW": 23
  },
  "kev_count": 0,
  "exploit_reference_count": 4,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-15511",
      "cvss_base": 8.9,
      "cvss_severity": "HIGH",
      "epss_score": 0.04731,
      "epss_percentile": 0.91153,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Comfast",
      "product": "CF-WR631AX V3",
      "cwe": "CWE-77",
      "title": "Comfast CF-WR631AX V3 FastCGI Backend webmgnt system_wl_upload_pic_file os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15511"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-15481",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.02889,
      "epss_percentile": 0.85821,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Trendnet",
      "product": "TEW-635BRM",
      "cwe": "CWE-74",
      "title": "Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15481"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-15495",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.02676,
      "epss_percentile": 0.8464,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SonicCloudOrg",
      "product": "sonic-agent",
      "cwe": "CWE-77",
      "title": "SonicCloudOrg sonic-agent Android WebSocket Server AndroidWSServer.java os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15495"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-15496",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.01986,
      "epss_percentile": 0.79054,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SonicCloudOrg",
      "product": "sonic-agent",
      "cwe": "CWE-77",
      "title": "SonicCloudOrg sonic-agent Groovy Script GroovyScriptImpl.java evalIsFailed os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15496"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-15513",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.01817,
      "epss_percentile": 0.77036,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Wavlink",
      "product": "WL-NU516U1",
      "cwe": "CWE-77",
      "title": "Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15513"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-15485",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.01768,
      "epss_percentile": 0.76366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-821DAP",
      "cwe": "CWE-77",
      "title": "TRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15485"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-15486",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.01768,
      "epss_percentile": 0.76366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-821DAP",
      "cwe": "CWE-77",
      "title": "TRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15486"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-15487",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.01768,
      "epss_percentile": 0.76366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-821DAP",
      "cwe": "CWE-77",
      "title": "TRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15487"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-61876",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01277,
      "epss_percentile": 0.67746,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openwrt",
      "product": "luci",
      "cwe": "CWE-79",
      "title": "LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61876"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-15483",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00792,
      "epss_percentile": 0.53534,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-821DAP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15483"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-15484",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00792,
      "epss_percentile": 0.53533,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-821DAP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-821DAP ssi tools_nslookup sub_41EC14 buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15484"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-15480",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00792,
      "epss_percentile": 0.53532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Trendnet",
      "product": "TEW-635BRM",
      "cwe": "CWE-119",
      "title": "Trendnet TEW-635BRM Web Service rc start_httpd stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15480"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-59260",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00682,
      "epss_percentile": 0.49722,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openwrt",
      "product": "luci",
      "cwe": "CWE-269",
      "title": "OpenWrt luci-app-samba4 read ACL remote code execution via smbd",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59260"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-15497",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00672,
      "epss_percentile": 0.49287,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SonicCloudOrg",
      "product": "sonic-agent",
      "cwe": "CWE-74",
      "title": "SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15497"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-56271",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00655,
      "epss_percentile": 0.48589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flowise",
      "product": "Flowise",
      "cwe": "CWE-321",
      "title": "Flowise - Weak Default JWT Secrets in Authentication Middleware",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56271"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-10666",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00654,
      "epss_percentile": 0.48572,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-121",
      "title": "Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10666"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-15491",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00654,
      "epss_percentile": 0.48576,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RafyMrX",
      "product": "TOKO-ONLINE-ROTI",
      "cwe": "CWE-287",
      "title": "RafyMrX TOKO-ONLINE-ROTI missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15491"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-56260",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00648,
      "epss_percentile": 0.48269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crawl4AI",
      "product": "Crawl4AI",
      "cwe": "CWE-22",
      "title": "Crawl4AI - Arbitrary File Write via output_path Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56260"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-58596",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00608,
      "epss_percentile": 0.46406,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Microsoft",
      "product": "Microsoft Edge (Chromium-based)",
      "cwe": "CWE-822",
      "title": "Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58596"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-10665",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00602,
      "epss_percentile": 0.46139,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-787",
      "title": "Heap buffer overflow on WireGuard receive path via unbounded incoming packet length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10665"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-56238",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00559,
      "epss_percentile": 0.43988,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-200",
      "title": "Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56238"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-61875",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00551,
      "epss_percentile": 0.43576,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openwrt",
      "product": "luci",
      "cwe": "CWE-79",
      "title": "luci-app-upnp Stored XSS via UPnP Port Mapping Description",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61875"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-56313",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00503,
      "epss_percentile": 0.40685,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-285",
      "title": "Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56313"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-15488",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.005,
      "epss_percentile": 0.40502,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hcr707305003",
      "product": "shiroiAdmin",
      "cwe": "CWE-284",
      "title": "hcr707305003 shiroiAdmin FileController.php upload unrestricted upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15488"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-15479",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00472,
      "epss_percentile": 0.38695,
      "kev": false,
      "kev_due_at": null,
      "vendor": "H3C",
      "product": "NX15",
      "cwe": "CWE-640",
      "title": "H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15479"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-15492",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00449,
      "epss_percentile": 0.37112,
      "kev": false,
      "kev_due_at": null,
      "vendor": "igweze",
      "product": "wizgrade",
      "cwe": "CWE-79",
      "title": "igweze wizgrade studentConductManager.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15492"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-56259",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00433,
      "epss_percentile": 0.35898,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crawl4AI",
      "product": "Crawl4AI",
      "cwe": "CWE-200",
      "title": "Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56259"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-56308",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.0043,
      "epss_percentile": 0.3556,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-640",
      "title": "Capgo - Insufficient Authentication in Email Change Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56308"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-15498",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00411,
      "epss_percentile": 0.33873,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sergomanov",
      "product": "SmartHomeAdatum",
      "cwe": "CWE-74",
      "title": "sergomanov SmartHomeAdatum Login users.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15498"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-15482",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00411,
      "epss_percentile": 0.33875,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aster Telecom",
      "product": "Azcall",
      "cwe": "CWE-74",
      "title": "Aster Telecom Azcall HTTP sis.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15482"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-15489",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00411,
      "epss_percentile": 0.33873,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RafyMrX",
      "product": "TOKO-ONLINE-ROTI",
      "cwe": "CWE-74",
      "title": "RafyMrX TOKO-ONLINE-ROTI login.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15489"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-15490",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00411,
      "epss_percentile": 0.33874,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RafyMrX",
      "product": "TOKO-ONLINE-ROTI",
      "cwe": "CWE-74",
      "title": "RafyMrX TOKO-ONLINE-ROTI add.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15490"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-15514",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00411,
      "epss_percentile": 0.33875,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Metasoft 美特软件",
      "product": "MetaCRM",
      "cwe": "CWE-74",
      "title": "Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15514"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-15512",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00393,
      "epss_percentile": 0.32068,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pig-mesh",
      "product": "Pig",
      "cwe": "CWE-74",
      "title": "pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15512"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-56241",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00371,
      "epss_percentile": 0.29846,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-285",
      "title": "Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56241"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-15500",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00366,
      "epss_percentile": 0.29257,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AstrBotDevs",
      "product": "AstrBot",
      "cwe": "CWE-918",
      "title": "AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15500"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-15471",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00348,
      "epss_percentile": 0.27442,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eleveo",
      "product": "Call Recording Software",
      "cwe": "CWE-266",
      "title": "Eleveo Call Recording Software pci_dss_status.jsp improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15471"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-15472",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00348,
      "epss_percentile": 0.27442,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eleveo",
      "product": "Call Recording Software",
      "cwe": "CWE-266",
      "title": "Eleveo Call Recording Software composeEmailAction.do improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15472"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-15474",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00348,
      "epss_percentile": 0.27442,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eleveo",
      "product": "Call Recording Software",
      "cwe": "CWE-266",
      "title": "Eleveo Call Recording Software audio.jsp improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15474"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-15473",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27314,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eleveo",
      "product": "Call Recording Software",
      "cwe": "CWE-266",
      "title": "Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15473"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-15499",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27315,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AstrBotDevs",
      "product": "AstrBot",
      "cwe": "CWE-266",
      "title": "AstrBotDevs AstrBot Scheduled Task cron_tools.py FutureTaskTool.call improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15499"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-15501",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27314,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AstrBotDevs",
      "product": "AstrBot",
      "cwe": "CWE-918",
      "title": "AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15501"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-15507",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27314,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coollabsio",
      "product": "Coolify",
      "cwe": "CWE-862",
      "title": "coollabsio Coolify Policy Policies authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15507"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-15508",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Helicone",
      "product": "ai-gateway",
      "cwe": "CWE-918",
      "title": "Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15508"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-15509",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Leantime",
      "cwe": "CWE-266",
      "title": "Leantime JSON-RPC Endpoint addUser improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15509"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-15510",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00347,
      "epss_percentile": 0.27313,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Leantime",
      "cwe": "CWE-266",
      "title": "Leantime API saveSetting improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15510"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-56336",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00343,
      "epss_percentile": 0.26808,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-200",
      "title": "Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56336"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-56281",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00334,
      "epss_percentile": 0.25819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-89",
      "title": "Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56281"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-15477",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.25671,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bahmni",
      "product": "bahmnicore",
      "cwe": "CWE-74",
      "title": "Bahmni bahmnicore Search Endpoint sql additionalParams sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15477"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-15494",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00332,
      "epss_percentile": 0.25524,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AMTT",
      "product": "Hotel Broadband Operation System",
      "cwe": "CWE-74",
      "title": "AMTT Hotel Broadband Operation System switch_status.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15494"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-15493",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.25403,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Akpali9",
      "product": "Attendance-Management-System",
      "cwe": "CWE-79",
      "title": "Akpali9 Attendance-Management-System absent.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15493"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-15505",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00331,
      "epss_percentile": 0.25404,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vnotex",
      "product": "vnote",
      "cwe": "CWE-79",
      "title": "vnotex vnote YAML Frontmatter markdownit.js cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15505"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-15502",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00316,
      "epss_percentile": 0.23799,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AojiaoZero",
      "product": "Antaris",
      "cwe": "CWE-74",
      "title": "AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15502"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-15478",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00316,
      "epss_percentile": 0.23799,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "IceHRM",
      "cwe": "CWE-74",
      "title": "IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15478"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-61874",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00315,
      "epss_percentile": 0.23661,
      "kev": false,
      "kev_due_at": null,
      "vendor": "filebrowser",
      "product": "filebrowser",
      "cwe": "CWE-863",
      "title": "filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61874"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-56252",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00282,
      "epss_percentile": 0.20166,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Capgo",
      "product": "Capgo",
      "cwe": "CWE-863",
      "title": "Capgo - Scope Isolation Failure in Webhook Test Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56252"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-10663",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00236,
      "epss_percentile": 0.1441,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-416",
      "title": "Use-after-free / double-free of the root USB device in the experimental USB host stack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10663"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-10668",
      "cvss_base": 4.6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0023,
      "epss_percentile": 0.13619,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-400",
      "title": "Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10668"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-10664",
      "cvss_base": 5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00223,
      "epss_percentile": 0.12636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10664"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-15506",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00197,
      "epss_percentile": 0.09461,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SecureAge",
      "product": "CatchPulse",
      "cwe": "CWE-119",
      "title": "SecureAge CatchPulse Driver saappctl.sys heap-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15506"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-10667",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00149,
      "epss_percentile": 0.04345,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-416",
      "title": "SMP use-after-free in Zephyr `CONFIG_USERSPACE` dynamic kernel-object tracking, reachable from unprivileged user threads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10667"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-15475",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00146,
      "epss_percentile": 0.0406,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MiniTool",
      "product": "Partition Wizard",
      "cwe": "CWE-266",
      "title": "MiniTool Partition Wizard Signed Kernel Driver pwdrvio.sys access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15475"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-15476",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00146,
      "epss_percentile": 0.0406,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QILING",
      "product": "Disk Master",
      "cwe": "CWE-266",
      "title": "QILING Disk Master Kernel Driver diskbckp.sys access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15476"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-10664",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-10664 (zephyrproject zephyr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-10665",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-10665 (zephyrproject zephyr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-10666",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-10666 (zephyrproject zephyr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-10667",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-10667 (zephyrproject zephyr). Public exploit reference added."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}