Security Box Score — Friday, July 17, 2026

Friday, July 17, 2026 · all times UTC← 2026-07-16 · archive · 2026-07-18 →

288 CVEs published July 17, 2026: 38 critical, 99 high, 131 medium, 20 low; 1 in KEV; 17 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 263 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	4610	16928	1298	2563
KEV catalog size	1670

757 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	41	1521	121	867	530	1	27	3	0.2	7.5	.0013	-56
google	94	1358	150	612	555	38	74	6	0.4	7.8	.0024	-586
microsoft	646	1357	91	931	306	12	378	31	2.3	7.8	.0039	+438
red hat	65	257	14	106	124	13	4	0	0.0	6.5	.0026	0
apple	0	99	1	23	66	2	93	7	7.1	6.5	.0031	-14
canonical	4	24	3	6	10	5	0	0	0.0	5.5	.0011	+4
suse	8	21	4	12	4	1	0	0	0.0	8.5	.0033	+6
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0015	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	16	39	6	16	9	0	96	12	30.8	7.5	.0050	+7
ubiquiti	25	36	14	21	1	0	4	3	8.3	8.8	.0036	+20
palo alto networks	14	25	0	2	14	7	14	2	8.0	4.7	.0021	+5
netgear	6	23	0	0	22	1	8	0	0.0	4.6	.0022	-11
fortinet	14	22	3	6	10	0	28	5	22.7	6.7	.0036	+12
f5	8	17	5	8	3	0	7	1	5.9	8.6	.0057	+2
ivanti	2	11	2	3	2	0	33	5	45.5	8.8	.3445	-2
checkpoint	0	9	1	5	3	0	3	1	11.1	7.5	.0410	-3

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	77	230	47	89	82	11	40	1	0.4	7.5	.0048	+3
mozilla	6	62	12	18	32	0	13	0	0.0	6.5	.0025	-43
drupal	46	51	6	5	35	5	5	1	2.0	5.9	.0018	+46
gitlab	7	40	0	5	27	6	4	2	5.0	4.7	.0024	-4
github	5	11	1	2	8	0	0	0	0.0	6.0	.0026	+5
docker	0	7	0	5	2	0	1	0	0.0	8.2	.0016	-2
jenkins	0	0	0	0	0	0	6	0	—	—	—	0
joomla	0	0	0	0	0	0	1	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1	271	132	116	18	4	40	3	1.1	8.8	.0040	-242
adobe	94	240	26	102	105	4	75	4	1.7	7.5	.0021	-35
ibm	36	160	52	54	54	0	7	0	0.0	7.5	.0026	+25
progress	10	19	3	14	2	0	9	0	0.0	7.5	.0034	+5
solarwinds	0	7	1	2	2	0	11	4	57.1	7.5	.0835	-3
veeam	0	4	2	2	0	0	4	0	0.0	9.0	.0046	-1
zohocorp	0	3	1	1	1	0	0	0	0.0	8.4	.0170	0
servicenow	1	1	1	0	0	0	2	0	0.0	9.5	.2673	+1

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
rockwell automation	17	24	4	18	2	0	0	0	0.0	8.7	.0025	+10
synology	0	23	2	5	13	3	0	0	0.0	5.6	.0025	-5
siemens	7	16	1	8	7	0	1	0	0.0	7.6	.0019	0
d-link	1	14	0	5	3	5	26	1	7.1	6.0	.0058	-8
abb	1	7	0	4	3	0	0	0	0.0	7.2	.0018	-4
schneider electric	0	6	0	4	2	0	1	0	0.0	7.8	.0024	-1
moxa	0	5	0	3	2	0	0	0	0.0	7.0	.0029	-5
dahua	0	3	0	1	1	1	2	0	0.0	6.9	.0036	-3

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
openclaw	44	111	0	58	39	14	0	0	0.0	7.0	.0022	-17
sourcecodester	37	108	0	0	56	52	0	0	0.0	5.5	.0026	0
dell	37	93	4	42	43	3	2	1	1.1	6.8	.0019	+11
capgo	22	83	2	42	38	1	0	0	0.0	7.1	.0028	+20
nvidia	40	79	12	52	15	0	0	0	0.0	7.8	.0019	+34
imagemagick	32	73	1	5	55	12	3	0	0.0	5.3	.0017	+4
spring	0	73	2	31	39	1	0	0	0.0	6.5	.0024	-71
itsourcecode	13	66	0	0	19	47	0	0	0.0	2.1	.0020	-9

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-48282	.9924	99.9	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-39808	.9121	99.8	—
CVE-2026-48908	.8813	99.8	10.0
CVE-2026-34910	.8696	99.7	10.0
CVE-2026-34908	.8519	99.7	10.0
CVE-2026-56290	.8325	99.7	10.0
CVE-2026-20230	.8321	99.7	8.6
CVE-2026-48939	.8250	99.6	10.0
CVE-2026-50522	.7698	99.5	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-48282	10.0	.9924	KEV
CVE-2026-48908	10.0	.8813	KEV
CVE-2026-34910	10.0	.8696	KEV
CVE-2026-34908	10.0	.8519	KEV
CVE-2026-56290	10.0	.8325	KEV
CVE-2026-48939	10.0	.8250	KEV
CVE-2026-56291	10.0	.7607	KEV
CVE-2026-15409	10.0	.7422	KEV
CVE-2026-34909	10.0	.6390	KEV
CVE-2026-50160	10.0	.1775

Most disclosures (vendor)
Vendor	CVEs
microsoft	659
google	504
linux	458
red hat	128
apache	124
adobe	107
ibm	100
capgo	81
dell	49
sourcecodester	49

Most KEV additions (YTD)
Vendor	KEV
microsoft	31
cisco	12
apple	7
google	6
fortinet	5
ivanti	5
adobe	4
solarwinds	4
synacor	4
linux	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	56
PyPI	5
npm	5
NuGet	3
Packagist	1

Fastest to KEV
CVE	Vendor	Days
CVE-2008-4128	Cisco	0
CVE-2023-4346	KNX Association	0
CVE-2025-67038	Lantronix	0
CVE-2026-12569	PTC	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-20230	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-25089	Fortinet	0
CVE-2026-34908	Ubiquiti Inc	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1703
CVE-2021-27102	Accellion	2021-11-17	1703
CVE-2021-27101	Accellion	2021-11-17	1703
CVE-2021-27103	Accellion	2021-11-17	1703
CVE-2021-21017	Adobe	2021-11-17	1703
CVE-2021-28550	Adobe	2021-11-17	1703
CVE-2021-42013	Apache	2021-11-17	1703
CVE-2021-41773	Apache	2021-11-17	1703
CVE-2021-30858	Apple	2021-11-17	1703
CVE-2021-30860	Apple	2021-11-17	1703

Transactions

EXPLOIT PUBLISHED — CVE-2025-60357. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16014 (code-projects Hospital Bed Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16073 (AstrBotDevs AstrBot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16074 (AstrBotDevs AstrBot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44251 (wazuh). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44891 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45309 (ronf asyncssh). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45799 (square wire). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50185 (RustCrypto utils). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50289 (sebhildebrandt systeminformation). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-53727 (premailer css_parser). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54497 (ViewComponent view_component). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54498 (ViewComponent view_component). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56740 (jline3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56741 (jline3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-62238 (openremote). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-62241 (MohibShaikh clawvet). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-63094 (signoz). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-63100 (maybe-finance maybe). Public exploit reference added.

DUE DATE PASSED — CVE-2008-4128 (Cisco IOS). CISA remediation deadline was July 16, 2026; still in catalog.

Yesterday's Results

288 CVEs published. 25 box scores, 263 table rows — nothing truncated.

CVE-2026-9198CRITICAL

IBM Langflow OSS — Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .1735   96.9   YES

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  May 21  Reserved by CNA
  Jul 17  Published (CNA: ibm)
  Aug 4   Added to CISA KEV, due Aug 7

CWE-94 · CNA: ibm · 2 references · NVD status: Analyzed · KEV due August 7, 2026

CVE-2026-62241CRITICAL

MohibShaikh clawvet — clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   N    9.3   .0655   93.2     —

AFFECTED
  Product  Versions     Fixed
  clawvet  unspecified  0.7.5

TIMELINE
  Jul 13  Reserved by CNA
  Jul 17  Public exploit reference published
  Jul 17  Published (CNA: VulnCheck)

CWE-306, CWE-321 · CNA: VulnCheck · 2 references · NVD status: Analyzed

CVE-2026-50289HIGH

sebhildebrandt systeminformation — systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0187   77.6     —

AFFECTED
  Product            Versions    Fixed
  systeminformation  < 5.31.7 –  —

TIMELINE
  Jun 4   Reserved by CNA
  Jul 17  Public exploit reference published
  Jul 17  Published (CNA: GitHub_M)

CWE-78 · CNA: GitHub_M · 3 references · NVD status: Analyzed

CVE-2026-42168CRITICAL

n/a n/a — django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0123   66.4     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 24  Reserved by CNA
  Jul 17  Published (CNA: mitre)

CWE-78 · CNA: mitre · 3 references · NVD status: Deferred

CVE-2026-46420CRITICAL

shivammathur setup-php — setup-php: Command Injection in Repository-Derived PHP Version Resolution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0115   64.2     —

AFFECTED
  Product    Versions               Fixed
  setup-php  >= 2.25.0, < 2.37.1 –  —

TIMELINE
  May 13  Reserved by CNA
  Jul 17  Published (CNA: GitHub_M)

CWE-78 · CNA: GitHub_M · 3 references · NVD status: Analyzed

CVE-2026-15457MEDIUM

themeum Kirki – Freeform Page Builder, Website Builder & Customizer — Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0077   52.5     —

AFFECTED
  Product                                                      Versions     Fixed
  Kirki – Freeform Page Builder, Website Builder & Customizer  unspecified  —

TIMELINE
  Jul 10  Reserved by CNA
  Jul 17  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 10 references · NVD status: Deferred

CVE-2026-52199CRITICAL

n/a n/a — An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0060   45.9     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 8   Reserved by CNA
  Jul 17  Published (CNA: mitre)

CWE-77, CWE-94 · CNA: mitre · 1 reference · NVD status: Deferred

CVE-2026-13352HIGH

properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0057   44.7     —

AFFECTED
  Product                                                                                                                Versions     Fixed
  Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress  unspecified  —

TIMELINE
  Jun 25  Reserved by CNA
  Jul 17  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · 8 references · NVD status: Deferred

CVE-2026-45162HIGH

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  H  H  H    8.0   .0057   44.7     —

AFFECTED
  Product  Versions     Fixed
  pimcore  < 11.5.17 –  —

TIMELINE
  May 8   Reserved by CNA
  Jul 17  Published (CNA: GitHub_M)

CWE-502 · CNA: GitHub_M · 4 references · NVD status: Deferred

CVE-2026-36669CRITICAL

n/a n/a — An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 a…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0056   44.2     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jul 17  Published (CNA: mitre)

CWE-434 · CNA: mitre · 2 references · NVD status: Deferred

CVE-2026-8505CRITICAL

IBM Langflow OSS — Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0056   44.0     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  May 13  Reserved by CNA
  Jul 17  Published (CNA: ibm)

CWE-306 · CNA: ibm · 1 reference · NVD status: Modified

CVE-2026-63093HIGH

Anysphere, Inc. Cursor — Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    8.7   .0056   43.8     —

AFFECTED
  Product  Versions  Fixed
  Cursor   3.2.16 –  —

TIMELINE
  Jul 15  Reserved by CNA
  Jul 17  Published (CNA: VulnCheck)

CWE-426 · CNA: VulnCheck · 3 references · NVD status: Analyzed

CVE-2026-45799HIGH

square wire — Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0055   43.2     —

AFFECTED
  Product  Versions   Fixed
  wire     < 6.3.0 –  —

TIMELINE
  May 13  Reserved by CNA
  Jul 17  Public exploit reference published
  Jul 17  Published (CNA: GitHub_M)

CWE-129 · CNA: GitHub_M · 7 references · NVD status: Analyzed

CVE-2026-56741HIGH

JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0052   41.5     —

AFFECTED
  Product  Versions     Fixed
  jline3   < 3.30.14 –  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 17  Public exploit reference published
  Jul 17  Published (CNA: GitHub_M)

CWE-400 · CNA: GitHub_M · 7 references · NVD status: Analyzed

CVE-2026-15094MEDIUM

thimpress WP Hotel Booking — WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  N    6.1   .0051   41.3     —

AFFECTED
  Product           Versions     Fixed
  WP Hotel Booking  unspecified  —

TIMELINE
  Jul 8   Reserved by CNA
  Jul 17  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 6 references · NVD status: Deferred

CVE-2026-56740HIGH

JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0050   40.8     —

AFFECTED
  Product  Versions     Fixed
  jline3   < 3.30.14 –  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 17  Public exploit reference published
  Jul 17  Published (CNA: GitHub_M)

CWE-400 · CNA: GitHub_M · 9 references · NVD status: Analyzed

CVE-2026-8476CRITICAL

IBM Langflow OSS — Disk Cache Deserialization Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0049   40.2     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  May 13  Reserved by CNA
  Jul 17  Published (CNA: ibm)

CWE-502 · CNA: ibm · 1 reference · NVD status: Analyzed

CVE-2026-9135CRITICAL

IBM Langflow OSS — Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0049   39.9     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  May 20  Reserved by CNA
  Jul 17  Published (CNA: ibm)

CWE-94 · CNA: ibm · 1 reference · NVD status: Analyzed

CVE-2026-50273HIGH

Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0048   39.5     —

AFFECTED
  Product          Versions    Fixed
  dd-trace-dotnet  < 3.43.0 –  —

TIMELINE
  Jun 4   Reserved by CNA
  Jul 17  Published (CNA: GitHub_M)

CWE-770 · CNA: GitHub_M · 4 references · NVD status: Awaiting Analysis

CVE-2026-56171HIGH

Microsoft Remote Desktop Web Client — Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0048   39.3     —

AFFECTED
  Product                    Versions   Fixed
  Remote Desktop Web Client  2.0.0.0 –  —
  Windows Admin Center       1809.0 –   —

TIMELINE
  Jun 19  Reserved by CNA
  Jul 17  Published (CNA: microsoft)

CWE-359 · CNA: microsoft · 1 reference · NVD status: Analyzed

CVE-2026-62764MEDIUM

Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   L   A   N   N   H    5.7   .0047   38.7     —

AFFECTED
  Product          Versions  Fixed
  Apache Accumulo  2.1.4 –   —

TIMELINE
  Jul 14  Reserved by CNA
  Jul 17  Published (CNA: apache)

CWE-274 · CNA: apache · 5 references · NVD status: Analyzed

CVE-2026-13473CRITICAL

IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0047   38.7     —

AFFECTED
  Product                 Versions   Fixed
  Storage Protect Client  8.1.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 17  Published (CNA: ibm)

CWE-122 · CNA: ibm · 1 reference · NVD status: Analyzed

CVE-2026-15160MEDIUM

SaturdayDrive Ninja Forms - Excel Export — Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0046   38.0     —

AFFECTED
  Product                     Versions     Fixed
  Ninja Forms - Excel Export  unspecified  —

TIMELINE
  Jul 8   Reserved by CNA
  Jul 17  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · 4 references · NVD status: Deferred

CVE-2026-8481CRITICAL

IBM Langflow OSS — Remote Code Execution via Code Validation Endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0046   37.9     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  May 13  Reserved by CNA
  Jul 17  Published (CNA: ibm)

CWE-94 · CNA: ibm · 1 reference · NVD status: Analyzed

CVE-2026-13448CRITICAL

IBM Langflow OSS — Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0046   37.8     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 17  Published (CNA: ibm)

CWE-184 · CNA: ibm · 1 reference · NVD status: Modified

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-58195	8.8	37.8	ruvnet	agentic-flow	CWE-78	Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsan…
CVE-2026-14499	8.8	37.3	IBM	Langflow OSS	CWE-78	Langflow is affected by remote code execution, denial of service, path traver…
CVE-2026-49835	7.5	37.1	sigstore	timestamp-authority	CWE-770	Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality
CVE-2026-15343	8.6	37.1	GitHub	Enterprise Server	CWE-22	Path traversal vulnerability in GitHub Enterprise Server allowed writing file…
CVE-2026-62229	7.7	37.1	OpenClaw	OpenClaw	CWE-22	OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching
CVE-2026-48049	5.3	37.1	hapijs	inert	CWE-22	@hapi/inert: Static-file confinement bypass via sibling-prefix path
CVE-2026-50271	7.5	36.7	DataDog	dd-trace-py	CWE-770	dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50272	7.5	36.7	DataDog	dd-trace-js	CWE-770	dd-trace: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-50274	7.5	36.7	DataDog	dd-trace-go	CWE-770	dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
CVE-2026-45309	8.2	36.6	ronf	asyncssh	CWE-22	AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected auth…
CVE-2026-48062	9.8	36.5	codeigniter4	CodeIgniter4	CWE-434	CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
CVE-2025-51677	9.1	36.0	n/a	n/a	CWE-116	An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch …
CVE-2025-51678	7.5	36.0	n/a	n/a	CWE-119	An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the P…
CVE-2026-12283	6.1	36.0	AWS	aws-athena-query-federation	CWE-89	SQL injection in Amazon Athena Synapse connector
CVE-2026-50197	7.8	35.8	zalando	skipper	CWE-444	Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-E…
CVE-2026-16013	5.5	35.7	liftoff-sr	CIPster	CWE-119	liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds
CVE-2026-45260	8.1	35.6	pimcore	pimcore	CWE-862	Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
CVE-2026-44891	7.5	35.3	netty	netty	CWE-400	Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
CVE-2026-7755	8.8	34.6	IBM	Langflow OSS	CWE-20	MCP Server Configuration Validator Bypass via File Upload API
CVE-2026-9103	9.8	34.2	IBM	Langflow OSS	CWE-306	Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
CVE-2026-9586	9.3	34.2	Sangoma	Switchvox SMB Edition	CWE-89	Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
CVE-2026-54159	10.0	33.8	PrestaShop	ps_facetedsearch	CWE-74	ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthe…
CVE-2026-13765	7.5	32.0	thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	CWE-862	LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Info…
CVE-2026-14979	7.5	31.8	IBM	Engineering Lifecycle Management	CWE-776	IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML E…
CVE-2026-16015	2.1	31.6	poco-ai	poco-claw	CWE-287	poco-ai poco-claw executor_manager API tasks.py create_task missing authentic…
CVE-2026-52746	7.5	31.0	jsonata-js	jsonata	CWE-1333	JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-51833	7.5	30.8	n/a	n/a	CWE-918	Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privil…
CVE-2026-49485	7.5	30.2	hapifhir	org.hl7.fhir.core	CWE-400	HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HT…
CVE-2026-8859	9.9	29.9	IBM	Langflow OSS	CWE-22	Path Traversal in APIRequest Component via Content-Disposition Header
CVE-2026-15007	5.7	29.7	GitHub	Enterprise Server	CWE-770	Denial of service vulnerability in GitHub Enterprise Server allowed service d…
CVE-2026-50162	6.9	29.6	oras-project	oras-go	CWE-73	oras-go: file store write outside workingDir via symlink traversal
CVE-2026-50151	7.5	29.6	oras-project	oras-go	CWE-918	oras-go: credential forwarding via unvalidated Location header in blob upload
CVE-2026-7872	8.1	29.3	IBM	Langflow OSS	CWE-22	Path Traversal Vulnerability in File Component Leading to Arbitrary File Read…
CVE-2026-59252	8.2	29.3	ZenHive	mpp	CWE-1284	Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
CVE-2026-44251	6.5	29.2	wazuh	wazuh	CWE-122	Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and po…
CVE-2026-7667	8.8	29.0	IBM	Langflow OSS	CWE-22	Path Traversal Vulnerability in API Request Component Content-Disposition Hea…
CVE-2026-14741	7.5	28.4	OALDERS	HTTP::Date	CWE-1333	HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial …
CVE-2026-14956	9.8	28.2	Bricksforge	Bricksforge	CWE-269	Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms f…
CVE-2026-12692	9.8	27.6	Vimesoft Inc.	Enterprise Video Platform	CWE-620	Improper Authentication in Vimesoft's Enterprise Video Platform
CVE-2026-50163	7.1	27.5	oras-project	oras-go	CWE-22	oras-go: Hardlink entry with relative Linkname escapes extract dir via proces…
CVE-2026-44974	7.7	27.4	hapijs	content	CWE-436	Parameter smuggling in @hapi/content header parser allows upload-filter bypas…
CVE-2026-54463	6.9	27.4	faye	websocket-driver-ruby	CWE-770	websocket-driver: Memory exhaustion via abuse of protocol length headers
CVE-2026-54465	6.3	27.4	faye	websocket-driver-ruby	CWE-770	websocket-driver: Memory exhaustion in HTTP header parser
CVE-2026-15982	9.8	26.9	CodeRevolution	Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit	CWE-269	Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Tool…
CVE-2026-62238	7.2	26.2	openremote	openremote	CWE-89	OpenRemote < 1.26.0 SQL Injection via Crosstab Export
CVE-2026-55518	9.6	25.9	avo-hq	avo	CWE-639	Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthor…
CVE-2026-9585	8.6	25.6	Sangoma	Switchvox SMB Edition	CWE-79	Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
CVE-2026-22104	7.1	25.2	hashtopolis	server	CWE-639	Improper access control in Hashtopolis server chunk activity component
CVE-2026-54464	6.3	25.2	faye	websocket-driver-ruby	CWE-770	websocket-driver: Resource limit bypass via message compression
CVE-2026-15091	9.3	24.8	IBM	Engineering AI Hub	CWE-79	Multiple Vulnerabilities in IBM Engineering AI hub.
CVE-2026-58148	8.7	24.5	chronoengine.com	ChronoForms extension for Joomla	CWE-79	Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for…
CVE-2026-63098	6.9	24.4	TheHive-Project	TheHive	CWE-306	TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint
CVE-2026-14501	9.8	24.2	IBM	Db2 Genius Hub	CWE-676	Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub
CVE-2026-9171	7.5	24.1	IBM	PowerVM Novalink	CWE-400	Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.
CVE-2026-45704	7.1	24.1	pimcore	pimcore	CWE-862	Pimcore: CustomReports Share Bypass
CVE-2026-62210	6.0	24.1	OpenClaw	OpenClaw	CWE-770	OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs
CVE-2026-54498	8.7	23.9	ViewComponent	view_component	CWE-79	view_component: around_render HTML-Safety Bypass
CVE-2026-14871	7.1	23.9	osTicket	osTicket	CWE-863	osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-d…
CVE-2026-49209	5.3	23.9	symfony	ux	CWE-770	Symfony UX: Denial of service in symfony/ux-live-component via unbounded batc…
CVE-2026-62214	6.0	23.5	openclaw	msteams	CWE-522	OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation
CVE-2026-49211	6.9	23.1	symfony	ux	CWE-200	Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearch…
CVE-2026-54171	6.5	23.0	excon	excon	CWE-201	Excon: redact additional sensitive/risky headers when following redirects
CVE-2026-48504	5.3	23.0	open-telemetry	opentelemetry-rust	CWE-770	OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation
CVE-2026-9810	9.8	22.9	Unknown	AI Copilot	CWE-269	AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege …
CVE-2026-60024	9.8	22.9	joomdonation.com	Events Booking extension for Joomla	CWE-1188	Joomla Extension - joomdonation.com - Insecure default configuration Events B…
CVE-2026-15322	7.5	23.0	IBM	Engineering AI Hub	CWE-598	Multiple Vulnerabilities in IBM Engineering AI hub.
CVE-2026-52203	7.5	23.0	n/a	n/a	CWE-200	An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive informa…
CVE-2026-53727	8.9	22.8	premailer	css_parser	CWE-918	css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_…
CVE-2026-63101	8.7	22.8	fossasia	open-event-server	CWE-306	Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export …
CVE-2026-8635	9.9	22.6	IBM	Langflow OSS	CWE-94	Arbitrary Code Execution in Python Interpreter Component
CVE-2026-59694	8.3	22.7	ZenHive	mpp	CWE-1284	Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
CVE-2026-59695	8.3	22.7	ZenHive	mpp	CWE-1284	Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request walle…
CVE-2026-62207	7.7	22.7	OpenClaw	OpenClaw	CWE-862	OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools
CVE-2026-12691	7.5	22.5	Vimesoft Inc.	Enterprise Video Platform	CWE-306	Authentication Bypass in Vimesoft's Enterprise Video Platform
CVE-2026-62202	7.7	22.4	OpenClaw	OpenClaw	CWE-863	OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron
CVE-2026-62234	8.4	22.2	getgrav	grav	CWE-918	Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
CVE-2026-8056	8.8	22.0	IBM	Langflow OSS	CWE-94	Parameter Injection Vulnerability in API Graph Execution Engine
CVE-2026-62220	6.3	21.8	OpenClaw	OpenClaw	CWE-307	OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
CVE-2026-62203	7.7	21.4	OpenClaw	OpenClaw	CWE-184	OpenClaw < 2026.6.6 Environment Variable Injection via rustup
CVE-2026-16016	5.5	21.3	poco-ai	poco-claw	CWE-918	poco-ai poco-claw task.py run_task server-side request forgery
CVE-2026-51080	9.8	21.2	n/a	n/a	CWE-611	libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to c…
CVE-2026-14503	6.5	21.2	ploudapp	pCloud WP Backup	CWE-200	pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX …
CVE-2026-44739	8.7	21.0	pimcore	pimcore	CWE-89	Pimcore: SQL Injection in Custom Reports Column Configuration
CVE-2026-62230	8.7	20.7	getgrav	grav	CWE-178	Grav < 2.0.4 File Access Bypass via Case Variation
CVE-2026-62232	9.1	20.5	getgrav	grav	CWE-862	Grav < 2.0.4 2FA Bypass via Secret Regeneration
CVE-2025-60357	8.1	20.5	n/a	n/a	CWE-943	AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injec…
CVE-2026-11324	6.1	20.5	evertec	WooCommerce Placetopay Gateway Belice	CWE-79	WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via …
CVE-2026-9202	9.8	20.4	IBM	Langflow OSS	CWE-306	Unauthenticated User Registration Could Lead to Remote Code Execution
CVE-2026-48015	4.9	20.3	shopware	shopware	CWE-79	Shopware: Stored XSS via SVG file upload — no SVG sanitization
CVE-2026-63308	5.3	19.9	helm	helm	CWE-129	Helm Files.Lines Denial of Service via Empty Chart Files
CVE-2026-15783	5.3	19.7	GitHub	Enterprise Server	CWE-862	Missing Authorization vulnerability was identified in GitHub Enterprise Serve…
CVE-2026-48009	6.8	19.6	shopware	shopware	CWE-200	Shopware: Admin Account Takeover via User Recovery Hash Exposure
CVE-2026-15349	4.3	19.6	wedevs	ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce	CWE-862	ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Mi…
CVE-2026-62386	8.2	19.1	getgrav	grav	CWE-598	Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
CVE-2026-12693	9.4	18.3	Vimesoft Inc.	Enterprise Video Platform	CWE-639	IDOR in Vimesoft's Enterprise Video Platform
CVE-2026-48008	6.5	18.4	shopware	shopware	CWE-862	Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
CVE-2026-48010	6.5	18.4	shopware	shopware	CWE-269	Shopware: Privilege escalation: non-admin user with user:create ACL can creat…
CVE-2026-11763	6.5	18.2	Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.	GisLab Laboratory Management System	CWE-639	IDOR in GIS Informatics' GisLab Laboratory Management System
CVE-2026-54490	6.3	18.2	faye	websocket-driver-node	CWE-770	websocket-driver: Resource limit bypass via message compression
CVE-2026-16014	5.5	18.2	code-projects	Hospital Bed Management System	CWE-74	code-projects Hospital Bed Management System Login Form sql injection
CVE-2026-16008	2.1	18.1	sagold	json-schema-library	CWE-94	sagold json-schema-library propertyDependencies.ts parsePropertyDependencies …
CVE-2026-8297	9.8	17.9	Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.	GisLab Laboratory Management System	CWE-89	SQLi in GIS Informatics' GisLab Laboratory Management System
CVE-2026-52348	9.8	17.9	n/a	n/a	CWE-89	cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method…
CVE-2026-13410	8.2	17.9	GARU	Dancer::Plugin::Auth::Google	CWE-295	Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verificat…
CVE-2026-8396	7.5	17.8	Netcad Software Inc.	NetGIS	CWE-611	XXE in Netcad's NetGIS
CVE-2026-44979	6.3	17.9	hapijs	wreck	CWE-200	@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-host…
CVE-2026-62201	4.9	17.8	OpenClaw	OpenClaw	CWE-918	OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
CVE-2026-62387	7.1	17.7	getgrav	grav	CWE-942	Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin
CVE-2026-7364	6.1	17.7	IBM	Verify Identity Access	CWE-601	Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-54335	3.7	17.7	feathersjs	feathers	CWE-1321	Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parse…
CVE-2026-62208	6.0	17.6	OpenClaw	OpenClaw	CWE-522	OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE
CVE-2026-62213	6.0	17.6	openclaw	msteams	CWE-522	OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests
CVE-2026-54497	6.8	16.5	ViewComponent	view_component	CWE-362	view_component: Reused Component Instances Retain Stale Render Context
CVE-2026-62205	6.0	16.5	OpenClaw	OpenClaw	CWE-862	OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions
CVE-2026-62206	6.0	16.5	OpenClaw	OpenClaw	CWE-862	OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions
CVE-2026-62237	6.0	16.5	getgrav	grav	CWE-1333	Grav < 2.0.4 ReDoS via regex_replace in Sandbox
CVE-2026-62218	8.7	16.3	OpenClaw	OpenClaw	CWE-862	OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve
CVE-2026-62223	7.7	16.3	OpenClaw	OpenClaw	CWE-863	OpenClaw < 2026.5.18 Authorization Bypass via Device-pair
CVE-2026-62228	7.7	16.3	OpenClaw	OpenClaw	CWE-863	OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals
CVE-2026-48487	5.3	16.3	python-zeroconf	python-zeroconf	CWE-130	Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cac…
CVE-2026-11961	8.1	16.3	Unknown	User Registration & Membership	CWE-269	User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation…
CVE-2026-4942	7.5	16.2	IBM	i	CWE-757	IBM i is Affected by Algorithm Downgrade in Transport Layer Security []
CVE-2026-15395	7.2	16.2	wpchill	Kali Forms — Contact Form & Drag-and-Drop Builder	CWE-79	Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digit…
CVE-2026-15415	6.8	16.2	AWS	aws-healthomics-mcp-server	CWE-23	Path traversal and arbitrary file write in the workflow linters of aws-health…
CVE-2026-62233	8.7	16.1	getgrav	grav	CWE-639	grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
CVE-2026-62217	7.7	16.1	OpenClaw	OpenClaw	CWE-863	OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals
CVE-2026-7189	7.5	16.0	Proliz Software Ltd. Co.	Proliz's OBS	CWE-201	Sensitive Data Exposure in Proliz's OBS
CVE-2026-7488	7.5	16.0	IKAS Technology Inc.	E-Commerce	CWE-201	Sensitive Data Exposure in IKAS Technologies' E-Commerce
CVE-2026-12694	9.1	15.7	Vimesoft Inc.	Enterprise Video Platform	CWE-862	Missing Authorization in Vimesoft's Enterprise Video Platform
CVE-2026-62226	5.1	15.5	OpenClaw	OpenClaw	CWE-918	OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route
CVE-2026-49208	6.9	15.4	symfony	ux	CWE-20	Symfony UX: Format-less date LiveProps parsed with the permissive DateTime co…
CVE-2026-8075	6.5	15.3	Mattermost	Mattermost	CWE-754	Posting a malicious markdown image crashes the Mattermost Desktop App
CVE-2026-9602	6.5	15.3	Mattermost	Mattermost	CWE-400	Mattermost Desktop App crashes when malformed arguments are provided to some …
CVE-2026-2594	6.4	15.3	inc2734	Smart Custom Fields	CWE-79	Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scri…
CVE-2026-8861	5.3	15.4	IBM	Verify Identity Access	CWE-209	Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-9588	7.0	15.2	Sangoma	Switchvox SMB Edition	CWE-79	Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
CVE-2026-47183	6.5	15.0	python-zeroconf	python-zeroconf	CWE-400	Zeroconf: Unbounded exception-dedup state retains packet buffers via tracebac…
CVE-2026-47184	6.5	15.0	python-zeroconf	python-zeroconf	CWE-770	Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via m…
CVE-2024-23565	5.3	15.0	HCLSoftware	Aftermarket EPC	CWE-799	HCL Aftermarket EPC is vulnerable to email flooding as the application does n…
CVE-2024-23568	5.3	15.0	HCLSoftware	Aftermarket EPC	CWE-200	HCL Aftermarket EPC is vulnerable to attacks since the server software versio…
CVE-2026-48016	4.3	15.1	shopware	shopware	CWE-639	Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/hand…
CVE-2026-48014	6.5	14.4	shopware	shopware	CWE-862	Shopware: Admin API ACL Bypass in Order State Transition Endpoints
CVE-2026-63307	7.1	14.1	OtterMind	Chat2DB	CWE-639	Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/data…
CVE-2026-9587	7.1	13.9	Sangoma	Switchvox SMB Edition	CWE-73	Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal
CVE-2026-62227	4.9	13.9	OpenClaw	OpenClaw	CWE-918	OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot
CVE-2026-11575	7.5	13.7	Unknown	PhonePe Payment Solutions	CWE-862	PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged…
CVE-2026-8616	5.3	13.8	devozon	Fense Proxy & VPN Blocker	CWE-862	Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated…
CVE-2026-9537	5.3	13.8	JBERGER	Mojo::JWT	CWE-208	Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-con…
CVE-2026-13446	9.8	13.5	IBM	Langflow OSS	CWE-798	Langflow is affected by remote code execution, denial of service, path traver…
CVE-2026-47180	6.5	13.6	python-zeroconf	python-zeroconf	CWE-674	Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-l…
CVE-2026-48045	6.5	13.6	python-zeroconf	python-zeroconf	CWE-770	Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via …
CVE-2026-13402	5.3	13.5	Unknown	Royal Addons for Elementor	CWE-200	Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Templat…
CVE-2026-57980	5.4	13.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-288	Microsoft Edge (Chromium-based) Tampering Vulnerability
CVE-2026-54466	9.2	12.9	faye	websocket-driver-node	CWE-130	websocket-driver: Message corruption via abuse of protocol length headers
CVE-2026-62231	8.6	12.9	getgrav	grav	CWE-863	Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
CVE-2026-51082	7.2	12.9	n/a	n/a	CWE-362	A race condition between the vncproxy and vncwebsocket API calls in Proxmox V…
CVE-2026-48819	4.8	12.9	hey-api	openapi-ts	CWE-1321	Hey API: `buildClientParams` template: prototype chain substitution via unkno…
CVE-2026-13082	5.3	12.3	BURAK	GD::SecurityImage	CWE-338	GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
CVE-2026-15093	4.3	12.1	IBM	Engineering AI Hub	CWE-601	Multiple Vulnerabilities in IBM Engineering AI hub.
CVE-2026-63096	6.9	11.8	matrix-org	dendrite	CWE-918	Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
CVE-2026-16104	6.5	11.7	Red Hat	Red Hat Build of Keycloak	CWE-522	Keycloak-services: keycloak-services: authenticator config endpoint exposes r…
CVE-2026-62216	2.3	11.6	OpenClaw	OpenClaw	CWE-918	OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload
CVE-2026-48978	2.1	11.6	oras-project	oras-go	CWE-319	oras-go: Malicious registry can hijack Bearer token realm to exfiltrate crede…
CVE-2026-54496	9.3	11.5	ZcashFoundation	zebra	CWE-345	Missing copy constraint in halo2_gadgets variable-base scalar multiplication …
CVE-2026-62209	7.6	11.5	OpenClaw	OpenClaw	CWE-863	OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode disp…
CVE-2026-63099	7.1	11.3	TheHive-Project	TheHive	CWE-639	TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endp…
CVE-2026-63100	7.1	11.3	maybe-finance	maybe	CWE-862	Maybe 0.6.0 Missing Authorization via HostingsController show/update
CVE-2026-16017	2.1	11.4	mosaxiv	clawlet	CWE-862	mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
CVE-2026-12715	8.5	11.1	Google Cloud	Firebase Studio	CWE-862	Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
CVE-2026-58149	5.3	11.0	joomdonation.com	Events Booking extension for Joomla	CWE-200	Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
CVE-2026-13445	8.1	10.8	IBM	Langflow OSS	CWE-639	Langflow is affected by remote code execution, denial of service, path traver…
CVE-2026-7754	6.5	10.3	IBM	Langflow OSS	CWE-918	SSRF Protection Configuration Vulnerability
CVE-2026-51083	6.5	10.3	n/a	n/a	CWE-284	Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server…
CVE-2026-15759	6.4	10.3	themeatelier	ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form	CWE-79	ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting …
CVE-2026-16072	4.9	10.3	Red Hat	Red Hat Build of Keycloak	CWE-284	Keycloak-services: keycloak-services: organization invitation link exposure a…
CVE-2026-16074	2.1	10.4	AstrBotDevs	AstrBot	CWE-918	AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side re…
CVE-2026-49977	4.3	10.2	AmauriC	tarteaucitron.js	CWE-285	tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies
CVE-2026-16009	2.1	10.2	itsourcecode	Hospital Management System	CWE-74	itsourcecode Hospital Management System prescriptionorderdetail.php sql injec…
CVE-2026-15943	5.5	10.0	Red Hat	Red Hat Build of Keycloak	CWE-1288	Keycloak-services: keycloak-services: oidc idp update reuses masked client se…
CVE-2026-11966	5.3	10.0	Unknown	User Registration & Membership	CWE-639	User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletio…
CVE-2026-16103	4.3	9.9	Red Hat	Red Hat Build of Keycloak	CWE-841	Keycloak-services: keycloak-services: incomplete fix for ciba brute-force loc…
CVE-2024-23574	5.3	9.8	HCLSoftware	Aftermarket EPC	CWE-204	HCL Aftermarket EPC is vulnerable to attack since It was found that a malicio…
CVE-2024-23575	5.3	9.8	HCLSoftware	Aftermarket EPC	CWE-209	HCL Aftermarket EPC is vulnerable to attack since the application returns det…
CVE-2024-42214	5.3	9.8	HCLSoftware	Aftermarket EPC	CWE-692	HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enab…
CVE-2026-16108	6.5	9.4	Red Hat	Red Hat Build of Keycloak	CWE-200	Keycloak-services: keycloak-services: realm default-group reads disclose hidd…
CVE-2026-49210	2.3	9.4	symfony	ux	CWE-79	Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child co…
CVE-2026-63309	5.3	9.3	surrealdb	surrealdb	CWE-863	SurrealDB < 3.1.5 Information Disclosure via ORDER BY
CVE-2026-16106	4.9	9.2	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: incorrect authorization in admin role-c…
CVE-2026-54243	6.1	9.1	statamic	cms	CWE-1236	Statamic: CSV formula injection in form submission exports
CVE-2026-16073	2.0	9.1	AstrBotDevs	AstrBot	CWE-79	AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross si…
CVE-2024-23564	9.1	8.8	HCL Software	Aftermarket EPC	CWE-326	HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a…
CVE-2026-45703	6.4	8.7	pimcore	pimcore	CWE-862	Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
CVE-2026-48373	7.8	8.5	Adobe	Acrobat Reader	CWE-122	Acrobat Reader \| Heap-based Buffer Overflow (CWE-122)
CVE-2026-55254	6.5	8.5	ncalc	ncalc	CWE-190	NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation
CVE-2026-63095	7.1	8.1	matrix-org	dendrite	CWE-639	Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
CVE-2026-58317	5.1	8.0	TeraTerm Project	TTSSH2	CWE-196	Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 …
CVE-2026-60060	5.1	8.0	TeraTerm Project	TTSSH2	CWE-130	Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability e…
CVE-2026-16093	5.4	7.8	Red Hat	Red Hat Build of Keycloak	CWE-807	Keycloak-services: keycloak-services: required signed-jwt assertion policy ca…
CVE-2024-23567	4.3	7.9	HCLSoftware	Aftermarket EPC	CWE-804	HCL Aftermarket EPC is affected by Sensitive Information in GET method & in U…
CVE-2026-15159	4.3	7.6	SaturdayDrive	Ninja Forms - Excel Export	CWE-639	Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Aut…
CVE-2026-15069	5.4	7.6	IBM	Engineering AI Hub	CWE-78	Multiple Vulnerabilities in IBM Engineering AI hub.
CVE-2026-49216	5.1	7.4	symfony	ux	CWE-79	Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data
CVE-2024-23569	4.3	7.2	HCLSoftware	Aftermarket EPC	CWE-692	HCL Aftermarket EPC is vulnerable to attack since the server is not configure…
CVE-2024-23571	4.3	7.2	HCLSoftware	Aftermarket EPC	CWE-525	HCL Aftermarket EPC is vulnerable to attack since the application does not ha…
CVE-2024-23577	4.3	7.2	HCLSoftware	Aftermarket EPC	CWE-20	HCL Aftermarket EPC is vulnerable since the application does not have a valid…
CVE-2026-4938	6.5	7.2	IBM	Verify Identity Access	CWE-863	Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify…
CVE-2026-10525	6.1	7.1	Unknown	NEX-Forms	CWE-79	NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission
CVE-2026-54163	4.7	7.2	github	secure_headers	CWE-79	secure_headers: CSP directive injection via sandbox, plugin_types, and report…
CVE-2026-54244	3.5	7.1	statamic	cms	CWE-863	Statamic: Incorrect authorization lets view-only users submit Live Preview co…
CVE-2026-62219	6.0	7.1	OpenClaw	OpenClaw	CWE-863	OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs
CVE-2026-62215	5.1	7.0	OpenClaw	OpenClaw	CWE-345	OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas
CVE-2026-63094	7.6	6.9	SigNoz	signoz	CWE-345	SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
CVE-2026-21762	5.3	6.9	HCLSoftware	DevOps Loop	CWE-644	Missing HTTP Security Headers in DevOps Loop
CVE-2026-62212	5.1	6.9	OpenClaw	OpenClaw	CWE-367	OpenClaw < 2026.5.28 Authentication Bypass via safeFetch
CVE-2026-12393	5.4	6.7	Unknown	WPS Bookings for WooCommerce	CWE-639	WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order C…
CVE-2026-62235	2.3	6.7	getgrav	grav	CWE-636	Grav Flex-Objects < 1.4.3 Authorization Bypass via API
CVE-2026-53712	8.2	6.4	ongres	scram	CWE-636	SCRAM: Silent channel-binding authentication downgrade via unsupported certif…
CVE-2026-9762	7.8	6.2	IBM	Db2	CWE-94	IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execut…
CVE-2024-23570	4.3	6.1	HCLSoftware	Aftermarket EPC	CWE-200	HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scr…
CVE-2026-49212	6.9	5.8	symfony	ux	CWE-345	Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding
CVE-2026-63097	5.3	5.7	matrix-org	dendrite	CWE-863	Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure
CVE-2024-23566	6.5	5.6	HCLSoftware	Aftermarket EPC	CWE-804	HCL Aftermarket EPC is vulnerable to brute force attacks since application do…
CVE-2026-9656	4.3	5.5	hubspotdev	HubSpot All-In-One Marketing – Forms, Popups, Live Chat	CWE-200	HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensit…
CVE-2026-15161	6.4	5.3	SaturdayDrive	Ninja Forms - Excel Export	CWE-79	Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cros…
CVE-2024-23573	3.7	5.2	HCLSoftware	Aftermarket EPC	CWE-425	HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerab…
CVE-2026-62224	2.3	5.2	openclaw	msteams	CWE-290	OpenClaw MS Teams < 2026.5.12 Authorization Bypass
CVE-2026-9592	7.5	5.0	SEPPmail	SEPPmail Secure Email Gateway & SEPPmail Cloud	CWE-598	Sensitive Information Disclosure in HTTP header
CVE-2026-51081	6.1	4.6	n/a	n/a	CWE-79	A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PV…
CVE-2026-49284	7.1	4.6	simplesamlphp	simplesamlphp	CWE-345	SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Res…
CVE-2026-21760	4.6	4.6	HCLSoftware	DevOps Loop	CWE-425	Unauthorized Access to Admin Functionality via Forced Browsing
CVE-2026-62225	2.3	4.5	OpenClaw	OpenClaw	CWE-863	OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch
CVE-2026-54242	4.9	4.4	statamic	cms	CWE-367	Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
CVE-2026-21761	5.4	4.4	HCLSoftware	DevOps Loop	CWE-942	CORS Misconfiguration in DevOps Loop
CVE-2026-49852	8.7	4.1	authlib	joserfc	CWE-287	joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language …
CVE-2026-62221	2.3	4.1	OpenClaw	OpenClaw	CWE-863	OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom
CVE-2026-16089	5.9	4.0	Red Hat	Red Hat Build of Keycloak	CWE-384	Keycloak-services: keycloak-services: authorization codes can be retargeted t…
CVE-2026-57860	8.4	3.4	tailcallhq	forgecode	CWE-829	ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Reposi…
CVE-2026-16118	7.1	3.4	xdg	xdgmime	CWE-122	Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in …
CVE-2026-45784	5.1	3.4	rust-openssl	rust-openssl	CWE-131	rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_i…
CVE-2026-21764	4.3	3.3	HCLSoftware	DevOps Loop	CWE-754	Insufficient Input Validation in DevOps Loop
CVE-2026-60025	8.8	3.1	joomdonation.com	Events Booking extension for Joomla	CWE-352	Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
CVE-2026-45785	6.2	3.0	openmcdf	openmcdf	CWE-835	OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on …
CVE-2024-23578	4.2	2.4	HCLSoftware	Aftermarket EPC	CWE-942	HCL Aftermarket EPC is vulnerable to attack as the application implements an …
CVE-2026-48022	6.5	2.3	hapijs	wreck	CWE-319	@hapi/wreck: Sensitive credential headers leak across cross-port and cross-sc…
CVE-2026-62222	7.1	2.0	OpenClaw	OpenClaw	CWE-829	OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode
CVE-2026-52584	7.1	1.9	n/a	n/a	CWE-121	Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local at…
CVE-2026-15380	5.1	1.9	Broadcom	Symantec Management Suite	CWE-269	Local privilege escalation in Symantec ITMS
CVE-2026-49215	2.1	2.0	symfony	ux	CWE-352	Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Head…
CVE-2026-49834	7.5	1.6	sigstore	sigstore-go	CWE-347	sigstore-go: Multi-log threshold bypass via single compromised log
CVE-2026-50185	2.0	1.6	RustCrypto	utils	CWE-758	RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of r…
CVE-2026-21770	6.5	1.5	HCLSoftware	HCL Traveler for Microsoft Outlook (HTMO)	CWE-427	HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking
CVE-2026-62211	4.1	1.5	OpenClaw	OpenClaw	CWE-532	OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory Export
CVE-2026-7771	5.5	1.2	IBM	Db2	CWE-835	IBM® Db2® is vulnerable to a trap when compiling specially crafted statements…
CVE-2026-41993	6.7	1.1	TXOne Networks	SafePortAgent	CWE-284	Improper Access Control vulnerability in the Removable Media Validation funct…
CVE-2026-15379	5.1	1.1	Broadcom	Symantec IT Management Suite	CWE-269	Arbitrary File Read as SYSTEM in Symantec ITMS
CVE-2026-14971	7.0	1.0	IBM	PowerVM Novalink	CWE-16	This PowerVM Novalink update is being released to address
CVE-2026-15995	4.2	1.1	IBM	Cognos Analytics	CWE-362	IBM Cognos Analytics 12.1.3 general availability package contains a data inte…
CVE-2026-62236	2.3	0.9	getgrav	grav	CWE-352	grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret
CVE-2026-12705	5.9	0.9	ABB	KNX Update Tool (ABB)	CWE-353	Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool
CVE-2019-25764	7.3	0.5	ASUS	AURA SYNC	CWE-782	UNSUPPORTED WHEN ASSIGNED Exposed IOCTL with Insufficient Access Control …
CVE-2026-44722	6.2	0.4	danifus	pyzipper	CWE-480	pyzipper: Encryption bypass for small files encrypted with pyzipper
CVE-2024-23572	4.2	0.4	HCLSoftware	Aftermarket EPC	CWE-614	HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a se…
CVE-2025-59866	3.3	0.1	HCLSoftware	DFMPro for CATIA	CWE-732	The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecu…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-17 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.