{ "day": "2026-07-17", "boundary": "UTC calendar day", "published_count": 288, "by_severity": { "CRITICAL": 38, "HIGH": 99, "MEDIUM": 131, "LOW": 20 }, "kev_count": 1, "exploit_reference_count": 17, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-9198", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.37327, "epss_percentile": 0.98409, "kev": true, "kev_due_at": "2026-08-07", "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9198" }, { "rank": 2, "cve_id": "CVE-2026-62241", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.06548, "epss_percentile": 0.93272, "kev": false, "kev_due_at": null, "vendor": "MohibShaikh", "product": "clawvet", "cwe": "CWE-306", "title": "clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62241" }, { "rank": 3, "cve_id": "CVE-2026-50289", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.02181, "epss_percentile": 0.80988, "kev": false, "kev_due_at": null, "vendor": "sebhildebrandt", "product": "systeminformation", "cwe": "CWE-78", "title": "systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50289" }, { "rank": 4, "cve_id": "CVE-2026-42168", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.02055, "epss_percentile": 0.79804, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-78", "title": "django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42168" }, { "rank": 5, "cve_id": "CVE-2026-46420", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01538, "epss_percentile": 0.72941, "kev": false, "kev_due_at": null, "vendor": "shivammathur", "product": "setup-php", "cwe": "CWE-78", "title": "setup-php: Command Injection in Repository-Derived PHP Version Resolution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46420" }, { "rank": 6, "cve_id": "CVE-2026-15457", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.01139, "epss_percentile": 0.6413, "kev": false, "kev_due_at": null, "vendor": "themeum", "product": "Kirki – Freeform Page Builder, Website Builder & Customizer", "cwe": "CWE-22", "title": "Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15457" }, { "rank": 7, "cve_id": "CVE-2026-13352", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01075, "epss_percentile": 0.62404, "kev": false, "kev_due_at": null, "vendor": "properfraction", "product": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress", "cwe": "CWE-434", "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13352" }, { "rank": 8, "cve_id": "CVE-2026-45162", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00987, "epss_percentile": 0.59737, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-502", "title": "Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45162" }, { "rank": 9, "cve_id": "CVE-2026-8476", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00898, "epss_percentile": 0.56908, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-502", "title": "Disk Cache Deserialization Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8476" }, { "rank": 10, "cve_id": "CVE-2026-58195", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00866, "epss_percentile": 0.5593, "kev": false, "kev_due_at": null, "vendor": "ruvnet", "product": "agentic-flow", "cwe": "CWE-78", "title": "Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58195" }, { "rank": 11, "cve_id": "CVE-2026-9135", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00841, "epss_percentile": 0.55105, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9135" }, { "rank": 12, "cve_id": "CVE-2026-8481", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00807, "epss_percentile": 0.54057, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Remote Code Execution via Code Validation Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8481" }, { "rank": 13, "cve_id": "CVE-2026-50271", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00793, "epss_percentile": 0.5357, "kev": false, "kev_due_at": null, "vendor": "DataDog", "product": "dd-trace-py", "cwe": "CWE-770", "title": "dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50271" }, { "rank": 14, "cve_id": "CVE-2026-50272", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00793, "epss_percentile": 0.53571, "kev": false, "kev_due_at": null, "vendor": "DataDog", "product": "dd-trace-js", "cwe": "CWE-770", "title": "dd-trace: Improper parsing of W3C baggage headers may lead to DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50272" }, { "rank": 15, "cve_id": "CVE-2026-50273", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00793, "epss_percentile": 0.53571, "kev": false, "kev_due_at": null, "vendor": "DataDog", "product": "dd-trace-dotnet", "cwe": "CWE-770", "title": "Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50273" }, { "rank": 16, "cve_id": "CVE-2026-50274", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00793, "epss_percentile": 0.53571, "kev": false, "kev_due_at": null, "vendor": "DataDog", "product": "dd-trace-go", "cwe": "CWE-770", "title": "dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50274" }, { "rank": 17, "cve_id": "CVE-2026-48062", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00775, "epss_percentile": 0.53003, "kev": false, "kev_due_at": null, "vendor": "codeigniter4", "product": "CodeIgniter4", "cwe": "CWE-434", "title": "CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48062" }, { "rank": 18, "cve_id": "CVE-2026-54159", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.0075, "epss_percentile": 0.52168, "kev": false, "kev_due_at": null, "vendor": "PrestaShop", "product": "ps_facetedsearch", "cwe": "CWE-74", "title": "ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54159" }, { "rank": 19, "cve_id": "CVE-2026-7755", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00746, "epss_percentile": 0.52053, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-20", "title": "MCP Server Configuration Validator Bypass via File Upload API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7755" }, { "rank": 20, "cve_id": "CVE-2026-16013", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00741, "epss_percentile": 0.5187, "kev": false, "kev_due_at": null, "vendor": "liftoff-sr", "product": "CIPster", "cwe": "CWE-119", "title": "liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16013" }, { "rank": 21, "cve_id": "CVE-2026-9103", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00722, "epss_percentile": 0.51213, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-306", "title": "Unauthenticated Superuser Token Issuance via Auto-Login Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9103" }, { "rank": 22, "cve_id": "CVE-2026-62229", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00716, "epss_percentile": 0.50992, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-22", "title": "OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62229" }, { "rank": 23, "cve_id": "CVE-2026-9586", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00695, "epss_percentile": 0.50205, "kev": false, "kev_due_at": null, "vendor": "Sangoma", "product": "Switchvox SMB Edition", "cwe": "CWE-89", "title": "Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9586" }, { "rank": 24, "cve_id": "CVE-2026-52746", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.49991, "kev": false, "kev_due_at": null, "vendor": "jsonata-js", "product": "jsonata", "cwe": "CWE-1333", "title": "JSONata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52746" }, { "rank": 25, "cve_id": "CVE-2026-15094", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00686, "epss_percentile": 0.49882, "kev": false, "kev_due_at": null, "vendor": "thimpress", "product": "WP Hotel Booking", "cwe": "CWE-79", "title": "WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15094" }, { "rank": 26, "cve_id": "CVE-2026-13765", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00684, "epss_percentile": 0.49777, "kev": false, "kev_due_at": null, "vendor": "thimpress", "product": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses", "cwe": "CWE-862", "title": "LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13765" }, { "rank": 27, "cve_id": "CVE-2026-49485", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00684, "epss_percentile": 0.49797, "kev": false, "kev_due_at": null, "vendor": "hapifhir", "product": "org.hl7.fhir.core", "cwe": "CWE-400", "title": "HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49485" }, { "rank": 28, "cve_id": "CVE-2026-13448", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00666, "epss_percentile": 0.49044, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-184", "title": "Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13448" }, { "rank": 29, "cve_id": "CVE-2026-14499", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00665, "epss_percentile": 0.49029, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-78", "title": "Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14499" }, { "rank": 30, "cve_id": "CVE-2026-52199", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00664, "epss_percentile": 0.48979, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-77", "title": "An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52199" }, { "rank": 31, "cve_id": "CVE-2026-15160", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00664, "epss_percentile": 0.4899, "kev": false, "kev_due_at": null, "vendor": "SaturdayDrive", "product": "Ninja Forms - Excel Export", "cwe": "CWE-22", "title": "Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15160" }, { "rank": 32, "cve_id": "CVE-2026-56171", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0066, "epss_percentile": 0.4882, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Remote Desktop Web Client", "cwe": "CWE-359", "title": "Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56171" }, { "rank": 33, "cve_id": "CVE-2026-12692", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00643, "epss_percentile": 0.48041, "kev": false, "kev_due_at": null, "vendor": "Vimesoft Inc.", "product": "Enterprise Video Platform", "cwe": "CWE-620", "title": "Improper Authentication in Vimesoft's Enterprise Video Platform", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12692" }, { "rank": 34, "cve_id": "CVE-2026-45260", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00636, "epss_percentile": 0.4774, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-862", "title": "Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45260" }, { "rank": 35, "cve_id": "CVE-2026-15007", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": 0.00636, "epss_percentile": 0.47726, "kev": false, "kev_due_at": null, "vendor": "GitHub", "product": "Enterprise Server", "cwe": "CWE-770", "title": "Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configuration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15007" }, { "rank": 36, "cve_id": "CVE-2026-59252", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.0063, "epss_percentile": 0.47442, "kev": false, "kev_due_at": null, "vendor": "ZenHive", "product": "mpp", "cwe": "CWE-1284", "title": "Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59252" }, { "rank": 37, "cve_id": "CVE-2025-51677", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00626, "epss_percentile": 0.47285, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-116", "title": "An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the netlist of the or1200 cpu output port can lead to unexpected behavior.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-51677" }, { "rank": 38, "cve_id": "CVE-2025-51678", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00609, "epss_percentile": 0.46457, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-119", "title": "An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-51678" }, { "rank": 39, "cve_id": "CVE-2026-56741", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00595, "epss_percentile": 0.45792, "kev": false, "kev_due_at": null, "vendor": "jline", "product": "jline3", "cwe": "CWE-400", "title": "JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56741" }, { "rank": 40, "cve_id": "CVE-2026-56740", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00592, "epss_percentile": 0.45667, "kev": false, "kev_due_at": null, "vendor": "jline", "product": "jline3", "cwe": "CWE-400", "title": "JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56740" }, { "rank": 41, "cve_id": "CVE-2026-12283", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0059, "epss_percentile": 0.45581, "kev": false, "kev_due_at": null, "vendor": "AWS", "product": "aws-athena-query-federation", "cwe": "CWE-89", "title": "SQL injection in Amazon Athena Synapse connector", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12283" }, { "rank": 42, "cve_id": "CVE-2026-48049", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0059, "epss_percentile": 0.45592, "kev": false, "kev_due_at": null, "vendor": "hapijs", "product": "inert", "cwe": "CWE-22", "title": "@hapi/inert: Static-file confinement bypass via sibling-prefix path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48049" }, { "rank": 43, "cve_id": "CVE-2026-16015", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.0058, "epss_percentile": 0.45084, "kev": false, "kev_due_at": null, "vendor": "poco-ai", "product": "poco-claw", "cwe": "CWE-287", "title": "poco-ai poco-claw executor_manager API tasks.py create_task missing authentication", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16015" }, { "rank": 44, "cve_id": "CVE-2026-63093", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00575, "epss_percentile": 0.44842, "kev": false, "kev_due_at": null, "vendor": "Anysphere, Inc.", "product": "Cursor", "cwe": "CWE-426", "title": "Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63093" }, { "rank": 45, "cve_id": "CVE-2026-8505", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00572, "epss_percentile": 0.44684, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-306", "title": "Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8505" }, { "rank": 46, "cve_id": "CVE-2026-15343", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.0057, "epss_percentile": 0.44579, "kev": false, "kev_due_at": null, "vendor": "GitHub", "product": "Enterprise Server", "cwe": "CWE-22", "title": "Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15343" }, { "rank": 47, "cve_id": "CVE-2026-15091", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00568, "epss_percentile": 0.44485, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Engineering AI Hub", "cwe": "CWE-79", "title": "Multiple Vulnerabilities in IBM Engineering AI hub.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15091" }, { "rank": 48, "cve_id": "CVE-2026-7872", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00566, "epss_percentile": 0.44384, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-22", "title": "Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7872" }, { "rank": 49, "cve_id": "CVE-2026-62207", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00566, "epss_percentile": 0.44392, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-862", "title": "OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62207" }, { "rank": 50, "cve_id": "CVE-2026-36669", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00563, "epss_percentile": 0.44251, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-434", "title": "An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ directory.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-36669" }, { "rank": 51, "cve_id": "CVE-2026-8859", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.0056, "epss_percentile": 0.44043, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-22", "title": "Path Traversal in APIRequest Component via Content-Disposition Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8859" }, { "rank": 52, "cve_id": "CVE-2026-7667", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0056, "epss_percentile": 0.44042, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-22", "title": "Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7667" }, { "rank": 53, "cve_id": "CVE-2026-49209", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0056, "epss_percentile": 0.44073, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-770", "title": "Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49209" }, { "rank": 54, "cve_id": "CVE-2026-9585", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00554, "epss_percentile": 0.43767, "kev": false, "kev_due_at": null, "vendor": "Sangoma", "product": "Switchvox SMB Edition", "cwe": "CWE-79", "title": "Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9585" }, { "rank": 55, "cve_id": "CVE-2026-50197", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0055, "epss_percentile": 0.43517, "kev": false, "kev_due_at": null, "vendor": "zalando", "product": "skipper", "cwe": "CWE-444", "title": "Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50197" }, { "rank": 56, "cve_id": "CVE-2026-9171", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00549, "epss_percentile": 0.43462, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "PowerVM Novalink", "cwe": "CWE-400", "title": "Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9171" }, { "rank": 57, "cve_id": "CVE-2026-45799", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00546, "epss_percentile": 0.4331, "kev": false, "kev_due_at": null, "vendor": "square", "product": "wire", "cwe": "CWE-129", "title": "Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45799" }, { "rank": 58, "cve_id": "CVE-2026-60024", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00545, "epss_percentile": 0.43287, "kev": false, "kev_due_at": null, "vendor": "joomdonation.com", "product": "Events Booking extension for Joomla", "cwe": "CWE-1188", "title": "Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60024" }, { "rank": 59, "cve_id": "CVE-2026-62202", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00543, "epss_percentile": 0.43146, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62202" }, { "rank": 60, "cve_id": "CVE-2026-49211", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00531, "epss_percentile": 0.42484, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-200", "title": "Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49211" }, { "rank": 61, "cve_id": "CVE-2026-8635", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.0053, "epss_percentile": 0.42385, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Arbitrary Code Execution in Python Interpreter Component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8635" }, { "rank": 62, "cve_id": "CVE-2026-8056", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0053, "epss_percentile": 0.42385, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Parameter Injection Vulnerability in API Graph Execution Engine", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8056" }, { "rank": 63, "cve_id": "CVE-2026-62203", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00525, "epss_percentile": 0.42138, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-184", "title": "OpenClaw < 2026.6.6 Environment Variable Injection via rustup", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62203" }, { "rank": 64, "cve_id": "CVE-2026-59694", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00524, "epss_percentile": 0.42049, "kev": false, "kev_due_at": null, "vendor": "ZenHive", "product": "mpp", "cwe": "CWE-1284", "title": "Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59694" }, { "rank": 65, "cve_id": "CVE-2026-59695", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00524, "epss_percentile": 0.42047, "kev": false, "kev_due_at": null, "vendor": "ZenHive", "product": "mpp", "cwe": "CWE-1284", "title": "Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59695" }, { "rank": 66, "cve_id": "CVE-2026-63101", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0052, "epss_percentile": 0.41818, "kev": false, "kev_due_at": null, "vendor": "fossasia", "product": "open-event-server", "cwe": "CWE-306", "title": "Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63101" }, { "rank": 67, "cve_id": "CVE-2026-62220", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00518, "epss_percentile": 0.41674, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-307", "title": "OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62220" }, { "rank": 68, "cve_id": "CVE-2026-51080", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00517, "epss_percentile": 0.41612, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-611", "title": "libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51080" }, { "rank": 69, "cve_id": "CVE-2026-12691", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00515, "epss_percentile": 0.41464, "kev": false, "kev_due_at": null, "vendor": "Vimesoft Inc.", "product": "Enterprise Video Platform", "cwe": "CWE-306", "title": "Authentication Bypass in Vimesoft's Enterprise Video Platform", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12691" }, { "rank": 70, "cve_id": "CVE-2026-15322", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00515, "epss_percentile": 0.4148, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Engineering AI Hub", "cwe": "CWE-598", "title": "Multiple Vulnerabilities in IBM Engineering AI hub.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15322" }, { "rank": 71, "cve_id": "CVE-2026-52203", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00515, "epss_percentile": 0.4148, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-200", "title": "An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52203" }, { "rank": 72, "cve_id": "CVE-2026-50162", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00507, "epss_percentile": 0.40915, "kev": false, "kev_due_at": null, "vendor": "oras-project", "product": "oras-go", "cwe": "CWE-73", "title": "oras-go: file store write outside workingDir via symlink traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50162" }, { "rank": 73, "cve_id": "CVE-2026-14503", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00506, "epss_percentile": 0.40888, "kev": false, "kev_due_at": null, "vendor": "ploudapp", "product": "pCloud WP Backup", "cwe": "CWE-200", "title": "pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14503" }, { "rank": 74, "cve_id": "CVE-2026-9202", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00502, "epss_percentile": 0.40665, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-306", "title": "Unauthenticated User Registration Could Lead to Remote Code Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9202" }, { "rank": 75, "cve_id": "CVE-2026-9810", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00498, "epss_percentile": 0.40428, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "AI Copilot", "cwe": "CWE-269", "title": "AI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuth", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9810" }, { "rank": 76, "cve_id": "CVE-2026-16016", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00495, "epss_percentile": 0.40204, "kev": false, "kev_due_at": null, "vendor": "poco-ai", "product": "poco-claw", "cwe": "CWE-918", "title": "poco-ai poco-claw task.py run_task server-side request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16016" }, { "rank": 77, "cve_id": "CVE-2026-48015", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00485, "epss_percentile": 0.39524, "kev": false, "kev_due_at": null, "vendor": "shopware", "product": "shopware", "cwe": "CWE-79", "title": "Shopware: Stored XSS via SVG file upload — no SVG sanitization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48015" }, { "rank": 78, "cve_id": "CVE-2026-62230", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00479, "epss_percentile": 0.39168, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-178", "title": "Grav < 2.0.4 File Access Bypass via Case Variation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62230" }, { "rank": 79, "cve_id": "CVE-2026-15349", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00473, "epss_percentile": 0.38747, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce", "cwe": "CWE-862", "title": "ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15349" }, { "rank": 80, "cve_id": "CVE-2026-44974", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00472, "epss_percentile": 0.38696, "kev": false, "kev_due_at": null, "vendor": "hapijs", "product": "content", "cwe": "CWE-436", "title": "Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplicate parameters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44974" }, { "rank": 81, "cve_id": "CVE-2026-48008", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00472, "epss_percentile": 0.38691, "kev": false, "kev_due_at": null, "vendor": "shopware", "product": "shopware", "cwe": "CWE-862", "title": "Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48008" }, { "rank": 82, "cve_id": "CVE-2026-48010", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00472, "epss_percentile": 0.38691, "kev": false, "kev_due_at": null, "vendor": "shopware", "product": "shopware", "cwe": "CWE-269", "title": "Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48010" }, { "rank": 83, "cve_id": "CVE-2026-62764", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": 0.00471, "epss_percentile": 0.38589, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Accumulo", "cwe": "CWE-274", "title": "Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62764" }, { "rank": 84, "cve_id": "CVE-2026-13473", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0047, "epss_percentile": 0.38546, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Storage Protect Client", "cwe": "CWE-122", "title": "IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13473" }, { "rank": 85, "cve_id": "CVE-2026-8297", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00468, "epss_percentile": 0.38437, "kev": false, "kev_due_at": null, "vendor": "Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.", "product": "GisLab Laboratory Management System", "cwe": "CWE-89", "title": "SQLi in GIS Informatics' GisLab Laboratory Management System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8297" }, { "rank": 86, "cve_id": "CVE-2026-52348", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00468, "epss_percentile": 0.38436, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52348" }, { "rank": 87, "cve_id": "CVE-2026-12693", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00459, "epss_percentile": 0.37815, "kev": false, "kev_due_at": null, "vendor": "Vimesoft Inc.", "product": "Enterprise Video Platform", "cwe": "CWE-639", "title": "IDOR in Vimesoft's Enterprise Video Platform", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12693" }, { "rank": 88, "cve_id": "CVE-2026-48009", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00457, "epss_percentile": 0.37684, "kev": false, "kev_due_at": null, "vendor": "shopware", "product": "shopware", "cwe": "CWE-200", "title": "Shopware: Admin Account Takeover via User Recovery Hash Exposure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48009" }, { "rank": 89, "cve_id": "CVE-2026-16008", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00457, "epss_percentile": 0.37688, "kev": false, "kev_due_at": null, "vendor": "sagold", "product": "json-schema-library", "cwe": "CWE-94", "title": "sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16008" }, { "rank": 90, "cve_id": "CVE-2026-62232", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00453, "epss_percentile": 0.37405, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-862", "title": "Grav < 2.0.4 2FA Bypass via Secret Regeneration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62232" }, { "rank": 91, "cve_id": "CVE-2026-62218", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37282, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-862", "title": "OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62218" }, { "rank": 92, "cve_id": "CVE-2026-62223", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37282, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw < 2026.5.18 Authorization Bypass via Device-pair", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62223" }, { "rank": 93, "cve_id": "CVE-2026-62228", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37281, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62228" }, { "rank": 94, "cve_id": "CVE-2026-22104", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0045, "epss_percentile": 0.37188, "kev": false, "kev_due_at": null, "vendor": "hashtopolis", "product": "server", "cwe": "CWE-639", "title": "Improper access control in Hashtopolis server chunk activity component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22104" }, { "rank": 95, "cve_id": "CVE-2026-62210", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.0045, "epss_percentile": 0.37239, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-770", "title": "OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62210" }, { "rank": 96, "cve_id": "CVE-2026-15783", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00449, "epss_percentile": 0.37125, "kev": false, "kev_due_at": null, "vendor": "GitHub", "product": "Enterprise Server", "cwe": "CWE-862", "title": "Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15783" }, { "rank": 97, "cve_id": "CVE-2026-55518", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00448, "epss_percentile": 0.37053, "kev": false, "kev_due_at": null, "vendor": "avo-hq", "product": "avo", "cwe": "CWE-639", "title": "Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55518" }, { "rank": 98, "cve_id": "CVE-2026-62217", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00447, "epss_percentile": 0.37023, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62217" }, { "rank": 99, "cve_id": "CVE-2026-49835", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00447, "epss_percentile": 0.36978, "kev": false, "kev_due_at": null, "vendor": "sigstore", "product": "timestamp-authority", "cwe": "CWE-770", "title": "Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49835" }, { "rank": 100, "cve_id": "CVE-2026-54464", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00445, "epss_percentile": 0.36826, "kev": false, "kev_due_at": null, "vendor": "faye", "product": "websocket-driver-ruby", "cwe": "CWE-770", "title": "websocket-driver: Resource limit bypass via message compression", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54464" }, { "rank": 101, "cve_id": "CVE-2026-44251", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00444, "epss_percentile": 0.36765, "kev": false, "kev_due_at": null, "vendor": "wazuh", "product": "wazuh", "cwe": "CWE-122", "title": "Wazuh : size_t underflow in msgs.c ReadSecMSG causes wazuh-remoted DoS and potential heap overflow via crafted agent message", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44251" }, { "rank": 102, "cve_id": "CVE-2026-62233", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00442, "epss_percentile": 0.36625, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-639", "title": "grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62233" }, { "rank": 103, "cve_id": "CVE-2026-45309", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.0044, "epss_percentile": 0.36438, "kev": false, "kev_due_at": null, "vendor": "ronf", "product": "asyncssh", "cwe": "CWE-22", "title": "AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45309" }, { "rank": 104, "cve_id": "CVE-2026-8396", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0044, "epss_percentile": 0.36477, "kev": false, "kev_due_at": null, "vendor": "Netcad Software Inc.", "product": "NetGIS", "cwe": "CWE-611", "title": "XXE in Netcad's NetGIS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8396" }, { "rank": 105, "cve_id": "CVE-2026-62214", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.0044, "epss_percentile": 0.36479, "kev": false, "kev_due_at": null, "vendor": "openclaw", "product": "msteams", "cwe": "CWE-522", "title": "OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62214" }, { "rank": 106, "cve_id": "CVE-2026-12694", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00437, "epss_percentile": 0.36237, "kev": false, "kev_due_at": null, "vendor": "Vimesoft Inc.", "product": "Enterprise Video Platform", "cwe": "CWE-862", "title": "Missing Authorization in Vimesoft's Enterprise Video Platform", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12694" }, { "rank": 107, "cve_id": "CVE-2026-58148", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00436, "epss_percentile": 0.36169, "kev": false, "kev_due_at": null, "vendor": "chronoengine.com", "product": "ChronoForms extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58148" }, { "rank": 108, "cve_id": "CVE-2026-62237", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00436, "epss_percentile": 0.36101, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-1333", "title": "Grav < 2.0.4 ReDoS via regex_replace in Sandbox", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62237" }, { "rank": 109, "cve_id": "CVE-2026-62386", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00432, "epss_percentile": 0.35782, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-598", "title": "Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62386" }, { "rank": 110, "cve_id": "CVE-2026-16014", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00431, "epss_percentile": 0.3566, "kev": false, "kev_due_at": null, "vendor": "code-projects", "product": "Hospital Bed Management System", "cwe": "CWE-74", "title": "code-projects Hospital Bed Management System Login Form sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16014" }, { "rank": 111, "cve_id": "CVE-2026-50163", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00429, "epss_percentile": 0.35524, "kev": false, "kev_due_at": null, "vendor": "oras-project", "product": "oras-go", "cwe": "CWE-22", "title": "oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50163" }, { "rank": 112, "cve_id": "CVE-2026-15395", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00428, "epss_percentile": 0.35461, "kev": false, "kev_due_at": null, "vendor": "wpchill", "product": "Kali Forms — Contact Form & Drag-and-Drop Builder", "cwe": "CWE-79", "title": "Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15395" }, { "rank": 113, "cve_id": "CVE-2026-14871", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00427, "epss_percentile": 0.35384, "kev": false, "kev_due_at": null, "vendor": "osTicket", "product": "osTicket", "cwe": "CWE-863", "title": "osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14871" }, { "rank": 114, "cve_id": "CVE-2026-45704", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00427, "epss_percentile": 0.35383, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-862", "title": "Pimcore: CustomReports Share Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45704" }, { "rank": 115, "cve_id": "CVE-2026-54171", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00427, "epss_percentile": 0.35363, "kev": false, "kev_due_at": null, "vendor": "excon", "product": "excon", "cwe": "CWE-201", "title": "Excon: redact additional sensitive/risky headers when following redirects", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54171" }, { "rank": 116, "cve_id": "CVE-2026-44891", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00423, "epss_percentile": 0.35051, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-400", "title": "Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44891" }, { "rank": 117, "cve_id": "CVE-2026-8075", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0042, "epss_percentile": 0.34755, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-754", "title": "Posting a malicious markdown image crashes the Mattermost Desktop App", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8075" }, { "rank": 118, "cve_id": "CVE-2026-9602", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0042, "epss_percentile": 0.34756, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-400", "title": "Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9602" }, { "rank": 119, "cve_id": "CVE-2026-44979", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.0042, "epss_percentile": 0.34735, "kev": false, "kev_due_at": null, "vendor": "hapijs", "product": "wreck", "cwe": "CWE-200", "title": "@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44979" }, { "rank": 120, "cve_id": "CVE-2025-60357", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00419, "epss_percentile": 0.34613, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-943", "title": "AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60357" }, { "rank": 121, "cve_id": "CVE-2026-48504", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00418, "epss_percentile": 0.3454, "kev": false, "kev_due_at": null, "vendor": "open-telemetry", "product": "opentelemetry-rust", "cwe": "CWE-770", "title": "OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48504" }, { "rank": 122, "cve_id": "CVE-2026-7189", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00416, "epss_percentile": 0.34342, "kev": false, "kev_due_at": null, "vendor": "Proliz Software Ltd. Co.", "product": "Proliz's OBS", "cwe": "CWE-201", "title": "Sensitive Data Exposure in Proliz's OBS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7189" }, { "rank": 123, "cve_id": "CVE-2026-7488", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00416, "epss_percentile": 0.34343, "kev": false, "kev_due_at": null, "vendor": "IKAS Technology Inc.", "product": "E-Commerce", "cwe": "CWE-201", "title": "Sensitive Data Exposure in IKAS Technologies' E-Commerce", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7488" }, { "rank": 124, "cve_id": "CVE-2026-48016", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00414, "epss_percentile": 0.34174, "kev": false, "kev_due_at": null, "vendor": "shopware", "product": "shopware", "cwe": "CWE-639", "title": "Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48016" }, { "rank": 125, "cve_id": "CVE-2026-49208", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00412, "epss_percentile": 0.33976, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-20", "title": "Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49208" }, { "rank": 126, "cve_id": "CVE-2026-51833", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00409, "epss_percentile": 0.33731, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-918", "title": "Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services (ports) or expose the original IP address of the server.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51833" }, { "rank": 127, "cve_id": "CVE-2026-9588", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00405, "epss_percentile": 0.33355, "kev": false, "kev_due_at": null, "vendor": "Sangoma", "product": "Switchvox SMB Edition", "cwe": "CWE-79", "title": "Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9588" }, { "rank": 128, "cve_id": "CVE-2026-63307", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00402, "epss_percentile": 0.33007, "kev": false, "kev_due_at": null, "vendor": "OtterMind", "product": "Chat2DB", "cwe": "CWE-639", "title": "Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63307" }, { "rank": 129, "cve_id": "CVE-2024-23565", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00402, "epss_percentile": 0.33069, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-799", "title": "HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23565" }, { "rank": 130, "cve_id": "CVE-2024-23568", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00402, "epss_percentile": 0.33069, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-200", "title": "HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated software version is in use with published vulnerabilities.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23568" }, { "rank": 131, "cve_id": "CVE-2026-8861", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00402, "epss_percentile": 0.33031, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Verify Identity Access", "cwe": "CWE-209", "title": "Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8861" }, { "rank": 132, "cve_id": "CVE-2026-62234", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00395, "epss_percentile": 0.32359, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-918", "title": "Grav < 2.0.4 SSRF via Unrestricted cURL Protocols", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62234" }, { "rank": 133, "cve_id": "CVE-2026-44739", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00392, "epss_percentile": 0.32031, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-89", "title": "Pimcore: SQL Injection in Custom Reports Column Configuration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44739" }, { "rank": 134, "cve_id": "CVE-2026-57980", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00392, "epss_percentile": 0.3195, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-288", "title": "Microsoft Edge (Chromium-based) Tampering Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57980" }, { "rank": 135, "cve_id": "CVE-2026-62227", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00392, "epss_percentile": 0.32022, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-918", "title": "OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62227" }, { "rank": 136, "cve_id": "CVE-2026-8616", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00391, "epss_percentile": 0.31889, "kev": false, "kev_due_at": null, "vendor": "devozon", "product": "Fense Proxy & VPN Blocker", "cwe": "CWE-862", "title": "Fense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8616" }, { "rank": 137, "cve_id": "CVE-2026-47183", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00389, "epss_percentile": 0.31671, "kev": false, "kev_due_at": null, "vendor": "python-zeroconf", "product": "python-zeroconf", "cwe": "CWE-400", "title": "Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47183" }, { "rank": 138, "cve_id": "CVE-2026-47184", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00389, "epss_percentile": 0.31671, "kev": false, "kev_due_at": null, "vendor": "python-zeroconf", "product": "python-zeroconf", "cwe": "CWE-770", "title": "Zeroconf: Unbounded DNS record cache allows LAN-local memory exhaustion via multicast flood", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47184" }, { "rank": 139, "cve_id": "CVE-2026-48014", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00389, "epss_percentile": 0.31657, "kev": false, "kev_due_at": null, "vendor": "shopware", "product": "shopware", "cwe": "CWE-862", "title": "Shopware: Admin API ACL Bypass in Order State Transition Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48014" }, { "rank": 140, "cve_id": "CVE-2026-11324", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00389, "epss_percentile": 0.31664, "kev": false, "kev_due_at": null, "vendor": "evertec", "product": "WooCommerce Placetopay Gateway Belice", "cwe": "CWE-79", "title": "WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11324" }, { "rank": 141, "cve_id": "CVE-2026-54335", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00389, "epss_percentile": 0.31701, "kev": false, "kev_due_at": null, "vendor": "feathersjs", "product": "feathers", "cwe": "CWE-1321", "title": "Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54335" }, { "rank": 142, "cve_id": "CVE-2026-62231", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00386, "epss_percentile": 0.31355, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-863", "title": "Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62231" }, { "rank": 143, "cve_id": "CVE-2026-14979", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00386, "epss_percentile": 0.31417, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Engineering Lifecycle Management", "cwe": "CWE-776", "title": "IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14979" }, { "rank": 144, "cve_id": "CVE-2026-51082", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00386, "epss_percentile": 0.31348, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-362", "title": "A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call \"vncproxy\" to hijack a VNC session that is established in parallel by a different user for a different VM.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51082" }, { "rank": 145, "cve_id": "CVE-2026-13410", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00383, "epss_percentile": 0.31062, "kev": false, "kev_due_at": null, "vendor": "GARU", "product": "Dancer::Plugin::Auth::Google", "cwe": "CWE-295", "title": "Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13410" }, { "rank": 146, "cve_id": "CVE-2026-11961", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00383, "epss_percentile": 0.31108, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "User Registration & Membership", "cwe": "CWE-269", "title": "User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11961" }, { "rank": 147, "cve_id": "CVE-2026-13446", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00381, "epss_percentile": 0.30872, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-798", "title": "Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13446" }, { "rank": 148, "cve_id": "CVE-2026-9587", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00378, "epss_percentile": 0.30529, "kev": false, "kev_due_at": null, "vendor": "Sangoma", "product": "Switchvox SMB Edition", "cwe": "CWE-73", "title": "Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9587" }, { "rank": 149, "cve_id": "CVE-2026-62209", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.0037, "epss_percentile": 0.29753, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62209" }, { "rank": 150, "cve_id": "CVE-2026-47180", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0037, "epss_percentile": 0.29698, "kev": false, "kev_due_at": null, "vendor": "python-zeroconf", "product": "python-zeroconf", "cwe": "CWE-674", "title": "Zeroconf: Unbounded recursion in DNS compression-pointer decoder allows LAN-local denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47180" }, { "rank": 151, "cve_id": "CVE-2026-48045", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0037, "epss_percentile": 0.29698, "kev": false, "kev_due_at": null, "vendor": "python-zeroconf", "product": "python-zeroconf", "cwe": "CWE-770", "title": "Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48045" }, { "rank": 152, "cve_id": "CVE-2026-16017", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00366, "epss_percentile": 0.29258, "kev": false, "kev_due_at": null, "vendor": "mosaxiv", "product": "clawlet", "cwe": "CWE-862", "title": "mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16017" }, { "rank": 153, "cve_id": "CVE-2026-53727", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00365, "epss_percentile": 0.29183, "kev": false, "kev_due_at": null, "vendor": "premailer", "product": "css_parser", "cwe": "CWE-918", "title": "css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53727" }, { "rank": 154, "cve_id": "CVE-2026-15093", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00365, "epss_percentile": 0.29175, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Engineering AI Hub", "cwe": "CWE-601", "title": "Multiple Vulnerabilities in IBM Engineering AI hub.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15093" }, { "rank": 155, "cve_id": "CVE-2026-50151", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00364, "epss_percentile": 0.29141, "kev": false, "kev_due_at": null, "vendor": "oras-project", "product": "oras-go", "cwe": "CWE-918", "title": "oras-go: credential forwarding via unvalidated Location header in blob upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50151" }, { "rank": 156, "cve_id": "CVE-2026-11763", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00361, "epss_percentile": 0.28791, "kev": false, "kev_due_at": null, "vendor": "Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc.", "product": "GisLab Laboratory Management System", "cwe": "CWE-639", "title": "IDOR in GIS Informatics' GisLab Laboratory Management System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11763" }, { "rank": 157, "cve_id": "CVE-2026-62201", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00361, "epss_percentile": 0.28731, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-918", "title": "OpenClaw < 2026.6.6 Network Policy Bypass via exec-server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62201" }, { "rank": 158, "cve_id": "CVE-2026-11575", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00358, "epss_percentile": 0.28423, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "PhonePe Payment Solutions", "cwe": "CWE-862", "title": "PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11575" }, { "rank": 159, "cve_id": "CVE-2026-62208", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00358, "epss_percentile": 0.28433, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-522", "title": "OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62208" }, { "rank": 160, "cve_id": "CVE-2026-62213", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00358, "epss_percentile": 0.28433, "kev": false, "kev_due_at": null, "vendor": "openclaw", "product": "msteams", "cwe": "CWE-522", "title": "OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62213" }, { "rank": 161, "cve_id": "CVE-2026-62205", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00356, "epss_percentile": 0.28211, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-862", "title": "OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62205" }, { "rank": 162, "cve_id": "CVE-2026-62206", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00356, "epss_percentile": 0.28211, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-862", "title": "OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62206" }, { "rank": 163, "cve_id": "CVE-2026-63099", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00354, "epss_percentile": 0.28004, "kev": false, "kev_due_at": null, "vendor": "TheHive-Project", "product": "TheHive", "cwe": "CWE-639", "title": "TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63099" }, { "rank": 164, "cve_id": "CVE-2026-63100", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00354, "epss_percentile": 0.28005, "kev": false, "kev_due_at": null, "vendor": "maybe-finance", "product": "maybe", "cwe": "CWE-862", "title": "Maybe 0.6.0 Missing Authorization via HostingsController show/update", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63100" }, { "rank": 165, "cve_id": "CVE-2026-49977", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00354, "epss_percentile": 0.28044, "kev": false, "kev_due_at": null, "vendor": "AmauriC", "product": "tarteaucitron.js", "cwe": "CWE-285", "title": "tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49977" }, { "rank": 166, "cve_id": "CVE-2026-14741", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00353, "epss_percentile": 0.27927, "kev": false, "kev_due_at": null, "vendor": "OALDERS", "product": "HTTP::Date", "cwe": "CWE-1333", "title": "HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14741" }, { "rank": 167, "cve_id": "CVE-2026-15415", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00353, "epss_percentile": 0.27907, "kev": false, "kev_due_at": null, "vendor": "AWS", "product": "aws-healthomics-mcp-server", "cwe": "CWE-23", "title": "Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15415" }, { "rank": 168, "cve_id": "CVE-2026-48819", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00352, "epss_percentile": 0.27781, "kev": false, "kev_due_at": null, "vendor": "hey-api", "product": "openapi-ts", "cwe": "CWE-1321", "title": "Hey API: `buildClientParams` template: prototype chain substitution via unknown `$___proto__` key", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48819" }, { "rank": 169, "cve_id": "CVE-2026-14956", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00351, "epss_percentile": 0.27749, "kev": false, "kev_due_at": null, "vendor": "Bricksforge", "product": "Bricksforge", "cwe": "CWE-269", "title": "Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14956" }, { "rank": 170, "cve_id": "CVE-2026-12715", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00351, "epss_percentile": 0.27655, "kev": false, "kev_due_at": null, "vendor": "Google Cloud", "product": "Firebase Studio", "cwe": "CWE-862", "title": "Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12715" }, { "rank": 171, "cve_id": "CVE-2026-13445", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.0035, "epss_percentile": 0.27562, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-639", "title": "Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13445" }, { "rank": 172, "cve_id": "CVE-2026-15759", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00349, "epss_percentile": 0.27487, "kev": false, "kev_due_at": null, "vendor": "themeatelier", "product": "ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form", "cwe": "CWE-79", "title": "ChatHelp <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15759" }, { "rank": 173, "cve_id": "CVE-2026-16074", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00347, "epss_percentile": 0.27312, "kev": false, "kev_due_at": null, "vendor": "AstrBotDevs", "product": "AstrBot", "cwe": "CWE-918", "title": "AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16074" }, { "rank": 174, "cve_id": "CVE-2026-13402", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.2699, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Royal Addons for Elementor", "cwe": "CWE-200", "title": "Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13402" }, { "rank": 175, "cve_id": "CVE-2026-58149", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.2699, "kev": false, "kev_due_at": null, "vendor": "joomdonation.com", "product": "Events Booking extension for Joomla", "cwe": "CWE-200", "title": "Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58149" }, { "rank": 176, "cve_id": "CVE-2026-16072", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.27092, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-284", "title": "Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16072" }, { "rank": 177, "cve_id": "CVE-2026-54463", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00344, "epss_percentile": 0.26895, "kev": false, "kev_due_at": null, "vendor": "faye", "product": "websocket-driver-ruby", "cwe": "CWE-770", "title": "websocket-driver: Memory exhaustion via abuse of protocol length headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54463" }, { "rank": 178, "cve_id": "CVE-2026-54465", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00344, "epss_percentile": 0.26894, "kev": false, "kev_due_at": null, "vendor": "faye", "product": "websocket-driver-ruby", "cwe": "CWE-770", "title": "websocket-driver: Memory exhaustion in HTTP header parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54465" }, { "rank": 179, "cve_id": "CVE-2026-62387", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00341, "epss_percentile": 0.26624, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-942", "title": "Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62387" }, { "rank": 180, "cve_id": "CVE-2026-16103", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00341, "epss_percentile": 0.26649, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-841", "title": "Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16103" }, { "rank": 181, "cve_id": "CVE-2026-7754", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0034, "epss_percentile": 0.2654, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-918", "title": "SSRF Protection Configuration Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7754" }, { "rank": 182, "cve_id": "CVE-2026-51083", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0034, "epss_percentile": 0.26537, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-284", "title": "Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51083" }, { "rank": 183, "cve_id": "CVE-2026-15982", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00339, "epss_percentile": 0.26396, "kev": false, "kev_due_at": null, "vendor": "CodeRevolution", "product": "Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit", "cwe": "CWE-269", "title": "Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15982" }, { "rank": 184, "cve_id": "CVE-2026-54243", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00338, "epss_percentile": 0.26228, "kev": false, "kev_due_at": null, "vendor": "statamic", "product": "cms", "cwe": "CWE-1236", "title": "Statamic: CSV formula injection in form submission exports", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54243" }, { "rank": 185, "cve_id": "CVE-2026-49210", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00338, "epss_percentile": 0.26227, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-79", "title": "Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49210" }, { "rank": 186, "cve_id": "CVE-2026-48373", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.26176, "kev": false, "kev_due_at": null, "vendor": "Adobe", "product": "Acrobat Reader", "cwe": "CWE-122", "title": "Acrobat Reader | Heap-based Buffer Overflow (CWE-122)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48373" }, { "rank": 187, "cve_id": "CVE-2026-15943", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00337, "epss_percentile": 0.26104, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-1288", "title": "Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15943" }, { "rank": 188, "cve_id": "CVE-2026-63096", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00335, "epss_percentile": 0.25954, "kev": false, "kev_due_at": null, "vendor": "matrix-org", "product": "dendrite", "cwe": "CWE-918", "title": "Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63096" }, { "rank": 189, "cve_id": "CVE-2026-62226", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00334, "epss_percentile": 0.25826, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-918", "title": "OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62226" }, { "rank": 190, "cve_id": "CVE-2026-62238", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00333, "epss_percentile": 0.25738, "kev": false, "kev_due_at": null, "vendor": "openremote", "product": "openremote", "cwe": "CWE-89", "title": "OpenRemote < 1.26.0 SQL Injection via Crosstab Export", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62238" }, { "rank": 191, "cve_id": "CVE-2026-16009", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00333, "epss_percentile": 0.25668, "kev": false, "kev_due_at": null, "vendor": "itsourcecode", "product": "Hospital Management System", "cwe": "CWE-74", "title": "itsourcecode Hospital Management System prescriptionorderdetail.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16009" }, { "rank": 192, "cve_id": "CVE-2026-63309", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00331, "epss_percentile": 0.25445, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB < 3.1.5 Information Disclosure via ORDER BY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63309" }, { "rank": 193, "cve_id": "CVE-2026-16073", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00331, "epss_percentile": 0.25404, "kev": false, "kev_due_at": null, "vendor": "AstrBotDevs", "product": "AstrBot", "cwe": "CWE-79", "title": "AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16073" }, { "rank": 194, "cve_id": "CVE-2024-23574", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0033, "epss_percentile": 0.25317, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-204", "title": "HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system. Use renumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23574" }, { "rank": 195, "cve_id": "CVE-2024-23575", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0033, "epss_percentile": 0.25317, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-209", "title": "HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more focused attack.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23575" }, { "rank": 196, "cve_id": "CVE-2024-42214", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0033, "epss_percentile": 0.25316, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-692", "title": "HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the Web server which allows an attacker to narrow and intensify their efforts.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42214" }, { "rank": 197, "cve_id": "CVE-2026-16106", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.0033, "epss_percentile": 0.25298, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-862", "title": "Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16106" }, { "rank": 198, "cve_id": "CVE-2026-9537", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00322, "epss_percentile": 0.24487, "kev": false, "kev_due_at": null, "vendor": "JBERGER", "product": "Mojo::JWT", "cwe": "CWE-208", "title": "Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9537" }, { "rank": 199, "cve_id": "CVE-2026-2594", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00321, "epss_percentile": 0.24286, "kev": false, "kev_due_at": null, "vendor": "inc2734", "product": "Smart Custom Fields", "cwe": "CWE-79", "title": "Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2594" }, { "rank": 200, "cve_id": "CVE-2026-58317", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.0032, "epss_percentile": 0.24272, "kev": false, "kev_due_at": null, "vendor": "TeraTerm Project", "product": "TTSSH2", "cwe": "CWE-196", "title": "Unsigned to Signed Conversion Error (CWE-196) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58317" }, { "rank": 201, "cve_id": "CVE-2026-60060", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.0032, "epss_percentile": 0.24272, "kev": false, "kev_due_at": null, "vendor": "TeraTerm Project", "product": "TTSSH2", "cwe": "CWE-130", "title": "Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60060" }, { "rank": 202, "cve_id": "CVE-2026-63098", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00317, "epss_percentile": 0.23859, "kev": false, "kev_due_at": null, "vendor": "TheHive-Project", "product": "TheHive", "cwe": "CWE-306", "title": "TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63098" }, { "rank": 203, "cve_id": "CVE-2026-45703", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00317, "epss_percentile": 0.23924, "kev": false, "kev_due_at": null, "vendor": "pimcore", "product": "pimcore", "cwe": "CWE-862", "title": "Pimcore: WordExport Authorization Bypass for Unauthorized Document Export", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45703" }, { "rank": 204, "cve_id": "CVE-2026-14501", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00315, "epss_percentile": 0.2366, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Db2 Genius Hub", "cwe": "CWE-676", "title": "Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14501" }, { "rank": 205, "cve_id": "CVE-2026-54496", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00315, "epss_percentile": 0.2371, "kev": false, "kev_due_at": null, "vendor": "ZcashFoundation", "product": "zebra", "cwe": "CWE-345", "title": "Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54496" }, { "rank": 206, "cve_id": "CVE-2026-54498", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00312, "epss_percentile": 0.23394, "kev": false, "kev_due_at": null, "vendor": "ViewComponent", "product": "view_component", "cwe": "CWE-79", "title": "view_component: around_render HTML-Safety Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54498" }, { "rank": 207, "cve_id": "CVE-2026-49216", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00312, "epss_percentile": 0.233, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-79", "title": "Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49216" }, { "rank": 208, "cve_id": "CVE-2024-23567", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00306, "epss_percentile": 0.22664, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-804", "title": "HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23567" }, { "rank": 209, "cve_id": "CVE-2026-13082", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00305, "epss_percentile": 0.22605, "kev": false, "kev_due_at": null, "vendor": "BURAK", "product": "GD::SecurityImage", "cwe": "CWE-338", "title": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13082" }, { "rank": 210, "cve_id": "CVE-2026-16093", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00304, "epss_percentile": 0.22455, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-807", "title": "Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16093" }, { "rank": 211, "cve_id": "CVE-2026-11966", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00304, "epss_percentile": 0.22408, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "User Registration & Membership", "cwe": "CWE-639", "title": "User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11966" }, { "rank": 212, "cve_id": "CVE-2026-54244", "cvss_base": 3.5, "cvss_severity": "LOW", "epss_score": 0.00303, "epss_percentile": 0.22291, "kev": false, "kev_due_at": null, "vendor": "statamic", "product": "cms", "cwe": "CWE-863", "title": "Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54244" }, { "rank": 213, "cve_id": "CVE-2026-15069", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00302, "epss_percentile": 0.22175, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Engineering AI Hub", "cwe": "CWE-78", "title": "Multiple Vulnerabilities in IBM Engineering AI hub.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15069" }, { "rank": 214, "cve_id": "CVE-2026-62219", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00301, "epss_percentile": 0.22089, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62219" }, { "rank": 215, "cve_id": "CVE-2026-4938", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00299, "epss_percentile": 0.21949, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Verify Identity Access", "cwe": "CWE-863", "title": "Incorrect Authorization in IBM Verify Identity Access and IBM Security Verify Access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4938" }, { "rank": 216, "cve_id": "CVE-2024-23569", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00297, "epss_percentile": 0.21688, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-692", "title": "HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection\" header", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23569" }, { "rank": 217, "cve_id": "CVE-2024-23571", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00297, "epss_percentile": 0.21688, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-525", "title": "HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23571" }, { "rank": 218, "cve_id": "CVE-2024-23577", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00297, "epss_percentile": 0.21688, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-20", "title": "HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23577" }, { "rank": 219, "cve_id": "CVE-2026-63095", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00296, "epss_percentile": 0.21566, "kev": false, "kev_due_at": null, "vendor": "matrix-org", "product": "dendrite", "cwe": "CWE-639", "title": "Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63095" }, { "rank": 220, "cve_id": "CVE-2024-23564", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00295, "epss_percentile": 0.2144, "kev": false, "kev_due_at": null, "vendor": "HCL Software", "product": "Aftermarket EPC", "cwe": "CWE-326", "title": "HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23564" }, { "rank": 221, "cve_id": "CVE-2026-62216", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00293, "epss_percentile": 0.21224, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-918", "title": "OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62216" }, { "rank": 222, "cve_id": "CVE-2026-12393", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00287, "epss_percentile": 0.20663, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WPS Bookings for WooCommerce", "cwe": "CWE-639", "title": "WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDOR", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12393" }, { "rank": 223, "cve_id": "CVE-2026-62235", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00287, "epss_percentile": 0.20634, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-636", "title": "Grav Flex-Objects < 1.4.3 Authorization Bypass via API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62235" }, { "rank": 224, "cve_id": "CVE-2026-54163", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00286, "epss_percentile": 0.20526, "kev": false, "kev_due_at": null, "vendor": "github", "product": "secure_headers", "cwe": "CWE-79", "title": "secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54163" }, { "rank": 225, "cve_id": "CVE-2026-15159", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00281, "epss_percentile": 0.20008, "kev": false, "kev_due_at": null, "vendor": "SaturdayDrive", "product": "Ninja Forms - Excel Export", "cwe": "CWE-639", "title": "Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15159" }, { "rank": 226, "cve_id": "CVE-2024-23570", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00279, "epss_percentile": 0.19837, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-200", "title": "HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forgery, sensitive information leakage and more.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23570" }, { "rank": 227, "cve_id": "CVE-2026-10525", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00275, "epss_percentile": 0.19368, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "NEX-Forms", "cwe": "CWE-79", "title": "NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10525" }, { "rank": 228, "cve_id": "CVE-2026-63308", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00275, "epss_percentile": 0.19329, "kev": false, "kev_due_at": null, "vendor": "helm", "product": "helm", "cwe": "CWE-129", "title": "Helm Files.Lines Denial of Service via Empty Chart Files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63308" }, { "rank": 229, "cve_id": "CVE-2026-63097", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00267, "epss_percentile": 0.18338, "kev": false, "kev_due_at": null, "vendor": "matrix-org", "product": "dendrite", "cwe": "CWE-863", "title": "Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63097" }, { "rank": 230, "cve_id": "CVE-2024-23566", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00266, "epss_percentile": 0.18069, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-804", "title": "HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23566" }, { "rank": 231, "cve_id": "CVE-2026-9656", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00264, "epss_percentile": 0.17818, "kev": false, "kev_due_at": null, "vendor": "hubspotdev", "product": "HubSpot All-In-One Marketing – Forms, Popups, Live Chat", "cwe": "CWE-200", "title": "HubSpot All-In-One Marketing <= 11.3.62 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9656" }, { "rank": 232, "cve_id": "CVE-2026-54490", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00263, "epss_percentile": 0.17667, "kev": false, "kev_due_at": null, "vendor": "faye", "product": "websocket-driver-node", "cwe": "CWE-770", "title": "websocket-driver: Resource limit bypass via message compression", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54490" }, { "rank": 233, "cve_id": "CVE-2026-63094", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00262, "epss_percentile": 0.17559, "kev": false, "kev_due_at": null, "vendor": "SigNoz", "product": "signoz", "cwe": "CWE-345", "title": "SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63094" }, { "rank": 234, "cve_id": "CVE-2026-15161", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00261, "epss_percentile": 0.17422, "kev": false, "kev_due_at": null, "vendor": "SaturdayDrive", "product": "Ninja Forms - Excel Export", "cwe": "CWE-79", "title": "Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15161" }, { "rank": 235, "cve_id": "CVE-2026-53712", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.0026, "epss_percentile": 0.17307, "kev": false, "kev_due_at": null, "vendor": "ongres", "product": "scram", "cwe": "CWE-636", "title": "SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53712" }, { "rank": 236, "cve_id": "CVE-2026-62224", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.0026, "epss_percentile": 0.17281, "kev": false, "kev_due_at": null, "vendor": "openclaw", "product": "msteams", "cwe": "CWE-290", "title": "OpenClaw MS Teams < 2026.5.12 Authorization Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62224" }, { "rank": 237, "cve_id": "CVE-2026-48978", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.0026, "epss_percentile": 0.17362, "kev": false, "kev_due_at": null, "vendor": "oras-project", "product": "oras-go", "cwe": "CWE-319", "title": "oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48978" }, { "rank": 238, "cve_id": "CVE-2026-7364", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00259, "epss_percentile": 0.17218, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Verify Identity Access", "cwe": "CWE-601", "title": "Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7364" }, { "rank": 239, "cve_id": "CVE-2026-51081", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16448, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-79", "title": "A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51081" }, { "rank": 240, "cve_id": "CVE-2026-62215", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.0025, "epss_percentile": 0.161, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-345", "title": "OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62215" }, { "rank": 241, "cve_id": "CVE-2026-54497", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.15942, "kev": false, "kev_due_at": null, "vendor": "ViewComponent", "product": "view_component", "cwe": "CWE-362", "title": "view_component: Reused Component Instances Retain Stale Render Context", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54497" }, { "rank": 242, "cve_id": "CVE-2026-62225", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00249, "epss_percentile": 0.16016, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62225" }, { "rank": 243, "cve_id": "CVE-2026-48487", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00248, "epss_percentile": 0.15796, "kev": false, "kev_due_at": null, "vendor": "python-zeroconf", "product": "python-zeroconf", "cwe": "CWE-130", "title": "Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48487" }, { "rank": 244, "cve_id": "CVE-2026-4942", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00247, "epss_percentile": 0.15708, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-757", "title": "IBM i is Affected by Algorithm Downgrade in Transport Layer Security []", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4942" }, { "rank": 245, "cve_id": "CVE-2024-23573", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00244, "epss_percentile": 0.15374, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-425", "title": "HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.0 and TLS1.0. This can also be considered a type of man-in-the-middle attack.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23573" }, { "rank": 246, "cve_id": "CVE-2026-49212", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00242, "epss_percentile": 0.1505, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-345", "title": "Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49212" }, { "rank": 247, "cve_id": "CVE-2026-62221", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00242, "epss_percentile": 0.15083, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-863", "title": "OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62221" }, { "rank": 248, "cve_id": "CVE-2026-9592", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00241, "epss_percentile": 0.1502, "kev": false, "kev_due_at": null, "vendor": "SEPPmail", "product": "SEPPmail Secure Email Gateway & SEPPmail Cloud", "cwe": "CWE-598", "title": "Sensitive Information Disclosure in HTTP header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9592" }, { "rank": 249, "cve_id": "CVE-2026-54242", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13068, "kev": false, "kev_due_at": null, "vendor": "statamic", "product": "cms", "cwe": "CWE-367", "title": "Statamic: Server-Side Request Forgery via Glide (DNS rebinding)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54242" }, { "rank": 250, "cve_id": "CVE-2026-62212", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00225, "epss_percentile": 0.12979, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-367", "title": "OpenClaw < 2026.5.28 Authentication Bypass via safeFetch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62212" }, { "rank": 251, "cve_id": "CVE-2026-49284", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00222, "epss_percentile": 0.12588, "kev": false, "kev_due_at": null, "vendor": "simplesamlphp", "product": "simplesamlphp", "cwe": "CWE-345", "title": "SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49284" }, { "rank": 252, "cve_id": "CVE-2026-54466", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00221, "epss_percentile": 0.1249, "kev": false, "kev_due_at": null, "vendor": "faye", "product": "websocket-driver-node", "cwe": "CWE-130", "title": "websocket-driver: Message corruption via abuse of protocol length headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54466" }, { "rank": 253, "cve_id": "CVE-2026-16104", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00211, "epss_percentile": 0.11243, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-522", "title": "Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16104" }, { "rank": 254, "cve_id": "CVE-2026-21760", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00207, "epss_percentile": 0.10696, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "DevOps Loop", "cwe": "CWE-425", "title": "Unauthorized Access to Admin Functionality via Forced Browsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21760" }, { "rank": 255, "cve_id": "CVE-2026-60025", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00201, "epss_percentile": 0.09846, "kev": false, "kev_due_at": null, "vendor": "joomdonation.com", "product": "Events Booking extension for Joomla", "cwe": "CWE-352", "title": "Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60025" }, { "rank": 256, "cve_id": "CVE-2026-57860", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00196, "epss_percentile": 0.09339, "kev": false, "kev_due_at": null, "vendor": "tailcallhq", "product": "forgecode", "cwe": "CWE-829", "title": "ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57860" }, { "rank": 257, "cve_id": "CVE-2024-23578", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00196, "epss_percentile": 0.09256, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-942", "title": "HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain (*-Wildcard).", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23578" }, { "rank": 258, "cve_id": "CVE-2026-49852", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00194, "epss_percentile": 0.09133, "kev": false, "kev_due_at": null, "vendor": "authlib", "product": "joserfc", "cwe": "CWE-287", "title": "joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49852" }, { "rank": 259, "cve_id": "CVE-2026-16108", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00194, "epss_percentile": 0.09068, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-200", "title": "Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16108" }, { "rank": 260, "cve_id": "CVE-2026-55254", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00191, "epss_percentile": 0.08787, "kev": false, "kev_due_at": null, "vendor": "ncalc", "product": "ncalc", "cwe": "CWE-190", "title": "NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55254" }, { "rank": 261, "cve_id": "CVE-2026-45785", "cvss_base": 6.2, "cvss_severity": "MEDIUM", "epss_score": 0.00184, "epss_percentile": 0.07951, "kev": false, "kev_due_at": null, "vendor": "openmcdf", "product": "openmcdf", "cwe": "CWE-835", "title": "OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45785" }, { "rank": 262, "cve_id": "CVE-2026-49215", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00177, "epss_percentile": 0.07233, "kev": false, "kev_due_at": null, "vendor": "symfony", "product": "ux", "cwe": "CWE-352", "title": "Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49215" }, { "rank": 263, "cve_id": "CVE-2026-62222", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00176, "epss_percentile": 0.07072, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-829", "title": "OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62222" }, { "rank": 264, "cve_id": "CVE-2026-48022", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.07132, "kev": false, "kev_due_at": null, "vendor": "hapijs", "product": "wreck", "cwe": "CWE-319", "title": "@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48022" }, { "rank": 265, "cve_id": "CVE-2026-21762", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00172, "epss_percentile": 0.06649, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "DevOps Loop", "cwe": "CWE-644", "title": "Missing HTTP Security Headers in DevOps Loop", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21762" }, { "rank": 266, "cve_id": "CVE-2026-15380", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00168, "epss_percentile": 0.0617, "kev": false, "kev_due_at": null, "vendor": "Broadcom", "product": "Symantec Management Suite", "cwe": "CWE-269", "title": "Local privilege escalation in Symantec ITMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15380" }, { "rank": 267, "cve_id": "CVE-2026-9762", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00165, "epss_percentile": 0.05875, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Db2", "cwe": "CWE-94", "title": "IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9762" }, { "rank": 268, "cve_id": "CVE-2026-52584", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00163, "epss_percentile": 0.05703, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52584" }, { "rank": 269, "cve_id": "CVE-2026-50185", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00157, "epss_percentile": 0.05047, "kev": false, "kev_due_at": null, "vendor": "RustCrypto", "product": "utils", "cwe": "CWE-758", "title": "RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50185" }, { "rank": 270, "cve_id": "CVE-2026-12705", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.04582, "kev": false, "kev_due_at": null, "vendor": "ABB", "product": "KNX Update Tool (ABB)", "cwe": "CWE-353", "title": "Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12705" }, { "rank": 271, "cve_id": "CVE-2026-41993", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.0015, "epss_percentile": 0.04434, "kev": false, "kev_due_at": null, "vendor": "TXOne Networks", "product": "SafePortAgent", "cwe": "CWE-284", "title": "Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with administrator privileges to bypass the file lockdown mechanism, resulting in unauthorized file transfer to the victim device. The attacker needs to deploy unauthorized file on the removable media in advance. This issue affects SafePortAgent: before 3.2.5024; StellarProtect: from 3.2.4011 before 5.0.1083.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41993" }, { "rank": 272, "cve_id": "CVE-2026-62211", "cvss_base": 4.1, "cvss_severity": "MEDIUM", "epss_score": 0.0015, "epss_percentile": 0.04407, "kev": false, "kev_due_at": null, "vendor": "OpenClaw", "product": "OpenClaw", "cwe": "CWE-532", "title": "OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory Export", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62211" }, { "rank": 273, "cve_id": "CVE-2026-7771", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00148, "epss_percentile": 0.0423, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Db2", "cwe": "CWE-835", "title": "IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7771" }, { "rank": 274, "cve_id": "CVE-2026-21761", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04117, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "DevOps Loop", "cwe": "CWE-942", "title": "CORS Misconfiguration in DevOps Loop", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21761" }, { "rank": 275, "cve_id": "CVE-2026-15379", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04119, "kev": false, "kev_due_at": null, "vendor": "Broadcom", "product": "Symantec IT Management Suite", "cwe": "CWE-269", "title": "Arbitrary File Read as SYSTEM in Symantec ITMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15379" }, { "rank": 276, "cve_id": "CVE-2026-62236", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00143, "epss_percentile": 0.03811, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-352", "title": "grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62236" }, { "rank": 277, "cve_id": "CVE-2026-16089", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.03715, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-384", "title": "Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16089" }, { "rank": 278, "cve_id": "CVE-2026-16118", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00134, "epss_percentile": 0.03139, "kev": false, "kev_due_at": null, "vendor": "xdg", "product": "xdgmime", "cwe": "CWE-122", "title": "Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16118" }, { "rank": 279, "cve_id": "CVE-2026-45784", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00134, "epss_percentile": 0.03117, "kev": false, "kev_due_at": null, "vendor": "rust-openssl", "product": "rust-openssl", "cwe": "CWE-131", "title": "rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45784" }, { "rank": 280, "cve_id": "CVE-2026-21764", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00133, "epss_percentile": 0.0303, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "DevOps Loop", "cwe": "CWE-754", "title": "Insufficient Input Validation in DevOps Loop", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21764" }, { "rank": 281, "cve_id": "CVE-2024-23572", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00131, "epss_percentile": 0.02933, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Aftermarket EPC", "cwe": "CWE-614", "title": "HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23572" }, { "rank": 282, "cve_id": "CVE-2019-25764", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00122, "epss_percentile": 0.02222, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "AURA SYNC", "cwe": "CWE-782", "title": "**UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2019-25764" }, { "rank": 283, "cve_id": "CVE-2026-44722", "cvss_base": 6.2, "cvss_severity": "MEDIUM", "epss_score": 0.00116, "epss_percentile": 0.01798, "kev": false, "kev_due_at": null, "vendor": "danifus", "product": "pyzipper", "cwe": "CWE-480", "title": "pyzipper: Encryption bypass for small files encrypted with pyzipper", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44722" }, { "rank": 284, "cve_id": "CVE-2026-49834", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00113, "epss_percentile": 0.01539, "kev": false, "kev_due_at": null, "vendor": "sigstore", "product": "sigstore-go", "cwe": "CWE-347", "title": "sigstore-go: Multi-log threshold bypass via single compromised log", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49834" }, { "rank": 285, "cve_id": "CVE-2026-21770", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00111, "epss_percentile": 0.0146, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "HCL Traveler for Microsoft Outlook (HTMO)", "cwe": "CWE-427", "title": "HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21770" }, { "rank": 286, "cve_id": "CVE-2026-14971", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00101, "epss_percentile": 0.00971, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "PowerVM Novalink", "cwe": "CWE-16", "title": "This PowerVM Novalink update is being released to address", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14971" }, { "rank": 287, "cve_id": "CVE-2026-15995", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00101, "epss_percentile": 0.01, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Cognos Analytics", "cwe": "CWE-362", "title": "IBM Cognos Analytics 12.1.3 general availability package contains a data integrity issue in the Agentic AI assistant that may cause incorrect report summaries or report-processing errors under concurrent use", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15995" }, { "rank": 288, "cve_id": "CVE-2025-59866", "cvss_base": 3.3, "cvss_severity": "LOW", "epss_score": 0.00101, "epss_percentile": 0.00996, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "DFMPro for CATIA", "cwe": "CWE-732", "title": "The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-59866" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2025-60357", "detail": "EXPLOIT PUBLISHED — CVE-2025-60357. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-16014", "detail": "EXPLOIT PUBLISHED — CVE-2026-16014 (code-projects Hospital Bed Management System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-16073", "detail": "EXPLOIT PUBLISHED — CVE-2026-16073 (AstrBotDevs AstrBot). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-16074", "detail": "EXPLOIT PUBLISHED — CVE-2026-16074 (AstrBotDevs AstrBot). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-44251", "detail": "EXPLOIT PUBLISHED — CVE-2026-44251 (wazuh). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-44891", "detail": "EXPLOIT PUBLISHED — CVE-2026-44891 (netty). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45309", "detail": "EXPLOIT PUBLISHED — CVE-2026-45309 (ronf asyncssh). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45799", "detail": "EXPLOIT PUBLISHED — CVE-2026-45799 (square wire). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-50185", "detail": "EXPLOIT PUBLISHED — CVE-2026-50185 (RustCrypto utils). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-50289", "detail": "EXPLOIT PUBLISHED — CVE-2026-50289 (sebhildebrandt systeminformation). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-53727", "detail": "EXPLOIT PUBLISHED — CVE-2026-53727 (premailer css_parser). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54497", "detail": "EXPLOIT PUBLISHED — CVE-2026-54497 (ViewComponent view_component). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54498", "detail": "EXPLOIT PUBLISHED — CVE-2026-54498 (ViewComponent view_component). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56740", "detail": "EXPLOIT PUBLISHED — CVE-2026-56740 (jline3). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56741", "detail": "EXPLOIT PUBLISHED — CVE-2026-56741 (jline3). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-62238", "detail": "EXPLOIT PUBLISHED — CVE-2026-62238 (openremote). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-62241", "detail": "EXPLOIT PUBLISHED — CVE-2026-62241 (MohibShaikh clawvet). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-63094", "detail": "EXPLOIT PUBLISHED — CVE-2026-63094 (signoz). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-63100", "detail": "EXPLOIT PUBLISHED — CVE-2026-63100 (maybe-finance maybe). Public exploit reference added." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2008-4128", "detail": "DUE DATE PASSED — CVE-2008-4128 (Cisco IOS). CISA remediation deadline was July 16, 2026; still in catalog." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }