{ "day": "2026-07-20", "boundary": "UTC calendar day", "published_count": 266, "by_severity": { "CRITICAL": 48, "HIGH": 99, "MEDIUM": 115, "LOW": 4 }, "kev_count": 0, "exploit_reference_count": 22, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-63108", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.01768, "epss_percentile": 0.76368, "kev": false, "kev_due_at": null, "vendor": "RooCodeInc", "product": "Roo-Code", "cwe": "CWE-184", "title": "Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63108" }, { "rank": 2, "cve_id": "CVE-2026-63766", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.01749, "epss_percentile": 0.76099, "kev": false, "kev_due_at": null, "vendor": "RVC-Boss", "product": "GPT-SoVITS", "cwe": "CWE-78", "title": "GPT-SoVITS 20250606v2pro OS Command Injection via webui.py", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63766" }, { "rank": 3, "cve_id": "CVE-2026-16327", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.01574, "epss_percentile": 0.73532, "kev": false, "kev_due_at": null, "vendor": "D-Link", "product": "DNS-320", "cwe": "CWE-284", "title": "D-Link DNS-320 upload.php unrestricted upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16327" }, { "rank": 4, "cve_id": "CVE-2026-64193", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01439, "epss_percentile": 0.7113, "kev": false, "kev_due_at": null, "vendor": "NLNETLABS", "product": "Net::DNS", "cwe": "CWE-95", "title": "Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64193" }, { "rank": 5, "cve_id": "CVE-2026-51026", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.01254, "epss_percentile": 0.67192, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-23", "title": "Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51026" }, { "rank": 6, "cve_id": "CVE-2026-12701", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.01194, "epss_percentile": 0.6564, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8", "cwe": "CWE-22", "title": "Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12701" }, { "rank": 7, "cve_id": "CVE-2026-63767", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.01116, "epss_percentile": 0.63567, "kev": false, "kev_due_at": null, "vendor": "kvcache-ai", "product": "ktransformers", "cwe": "CWE-502", "title": "ktransformers Unauthenticated Pickle Deserialization RCE via ZMQ", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63767" }, { "rank": 8, "cve_id": "CVE-2026-27823", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.01028, "epss_percentile": 0.61018, "kev": false, "kev_due_at": null, "vendor": "EGroupware", "product": "egroupware", "cwe": "CWE-285", "title": "Remote Code Execution Vulnerability in EGroupware", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27823" }, { "rank": 9, "cve_id": "CVE-2026-14448", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00936, "epss_percentile": 0.58131, "kev": false, "kev_due_at": null, "vendor": "MB connect line", "product": "mbCONNECT24", "cwe": "CWE-78", "title": "Authenticated RCE in system_certificates view", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14448" }, { "rank": 10, "cve_id": "CVE-2026-40187", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00933, "epss_percentile": 0.58029, "kev": false, "kev_due_at": null, "vendor": "EGroupware", "product": "egroupware", "cwe": "CWE-78", "title": "Authenticated RCE via Malicious eTemplate Upload in EGroupware", "url": "https://www.cve.org/CVERecord?id=CVE-2026-40187" }, { "rank": 11, "cve_id": "CVE-2026-63090", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00929, "epss_percentile": 0.5787, "kev": false, "kev_due_at": null, "vendor": "proftpd", "product": "proftpd", "cwe": "CWE-122", "title": "ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63090" }, { "rank": 12, "cve_id": "CVE-2026-13147", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00912, "epss_percentile": 0.57321, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Kirki", "cwe": null, "title": "Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13147" }, { "rank": 13, "cve_id": "CVE-2026-32820", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00893, "epss_percentile": 0.56753, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-22", "title": "dataCycle Public Markdown Path Traversal Via /docs/*path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32820" }, { "rank": 14, "cve_id": "CVE-2026-44178", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00882, "epss_percentile": 0.56429, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-122", "title": "xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44178" }, { "rank": 15, "cve_id": "CVE-2026-16248", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00854, "epss_percentile": 0.55529, "kev": false, "kev_due_at": null, "vendor": "Tenda", "product": "AC10", "cwe": "CWE-119", "title": "Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16248" }, { "rank": 16, "cve_id": "CVE-2026-64620", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00851, "epss_percentile": 0.55433, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-122", "title": "FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64620" }, { "rank": 17, "cve_id": "CVE-2026-57308", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00832, "epss_percentile": 0.54854, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Syncope", "cwe": "CWE-89", "title": "Apache Syncope: SQL injection vulnerability in Audit Events search", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57308" }, { "rank": 18, "cve_id": "CVE-2026-16242", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00798, "epss_percentile": 0.53737, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.1", "cwe": "CWE-306", "title": "Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16242" }, { "rank": 19, "cve_id": "CVE-2026-46412", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00765, "epss_percentile": 0.52678, "kev": false, "kev_due_at": null, "vendor": "BeProduct", "product": "beproduct-org-nestjs-auth", "cwe": "CWE-506", "title": "Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46412" }, { "rank": 20, "cve_id": "CVE-2026-63071", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00752, "epss_percentile": 0.52236, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Syncope", "cwe": "CWE-653", "title": "Apache Syncope: RCE via Groovy Sandbox bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63071" }, { "rank": 21, "cve_id": "CVE-2026-53405", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00746, "epss_percentile": 0.52032, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Syncope", "cwe": "CWE-653", "title": "Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53405" }, { "rank": 22, "cve_id": "CVE-2026-52656", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00726, "epss_percentile": 0.51322, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-94", "title": "An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52656" }, { "rank": 23, "cve_id": "CVE-2026-62183", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0069, "epss_percentile": 0.5002, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Syncope", "cwe": "CWE-269", "title": "Apache Syncope: User self-service privilege escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62183" }, { "rank": 24, "cve_id": "CVE-2026-57852", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00686, "epss_percentile": 0.49897, "kev": false, "kev_due_at": null, "vendor": "Trilby Media", "product": "Grav CMS scheduler-webhook plugin", "cwe": "CWE-303", "title": "Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57852" }, { "rank": 25, "cve_id": "CVE-2026-53421", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00678, "epss_percentile": 0.49545, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Syncope", "cwe": "CWE-653", "title": "Apache Syncope: Remote Code Execution via Scripted Connector", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53421" }, { "rank": 26, "cve_id": "CVE-2026-54538", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00672, "epss_percentile": 0.49282, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-835", "title": "xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54538" }, { "rank": 27, "cve_id": "CVE-2026-41521", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00671, "epss_percentile": 0.49244, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-190", "title": "xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41521" }, { "rank": 28, "cve_id": "CVE-2026-54051", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00666, "epss_percentile": 0.49057, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-78", "title": "Network-AI has an an OS Command Injection issue", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54051" }, { "rank": 29, "cve_id": "CVE-2026-58624", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00635, "epss_percentile": 0.47702, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "cwe": "CWE-20", "title": "Apache MINA SSHD: Remote execution of JGit commands can write files on the server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58624" }, { "rank": 30, "cve_id": "CVE-2026-48812", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00633, "epss_percentile": 0.47621, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-287", "title": "FreeScout Allows Unauthenticated Access to Legacy Attachment Files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48812" }, { "rank": 31, "cve_id": "CVE-2026-57311", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00633, "epss_percentile": 0.47593, "kev": false, "kev_due_at": null, "vendor": "JCD", "product": "Windu CMS", "cwe": "CWE-434", "title": "Unrestricted Upload of File with Dangerous Type in Windu CMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57311" }, { "rank": 32, "cve_id": "CVE-2026-51027", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00616, "epss_percentile": 0.46813, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-200", "title": "An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51027" }, { "rank": 33, "cve_id": "CVE-2026-41252", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00609, "epss_percentile": 0.46436, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-122", "title": "xrdp: lib_palette_update Heap Buffer Overflow & RCE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41252" }, { "rank": 34, "cve_id": "CVE-2024-51311", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00598, "epss_percentile": 0.45966, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51311" }, { "rank": 35, "cve_id": "CVE-2024-51312", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00598, "epss_percentile": 0.45965, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51312" }, { "rank": 36, "cve_id": "CVE-2024-51313", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00598, "epss_percentile": 0.45965, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51313" }, { "rank": 37, "cve_id": "CVE-2024-51314", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00598, "epss_percentile": 0.45963, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg.", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51314" }, { "rank": 38, "cve_id": "CVE-2024-51315", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00598, "epss_percentile": 0.45963, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51315" }, { "rank": 39, "cve_id": "CVE-2026-64625", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00598, "epss_percentile": 0.45956, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-78", "title": "AVideo before 29.0 OS Command Injection via execAsync", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64625" }, { "rank": 40, "cve_id": "CVE-2026-35048", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00579, "epss_percentile": 0.45009, "kev": false, "kev_due_at": null, "vendor": "Piwigo", "product": "Piwigo", "cwe": "CWE-20", "title": "Piwigo RCE via PHP Code Injection into Config File in Installer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35048" }, { "rank": 41, "cve_id": "CVE-2026-61425", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00573, "epss_percentile": 0.44747, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-288", "title": "Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61425" }, { "rank": 42, "cve_id": "CVE-2026-15903", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00573, "epss_percentile": 0.44754, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-125", "title": "Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15903" }, { "rank": 43, "cve_id": "CVE-2026-56623", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00571, "epss_percentile": 0.44615, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "cwe": "CWE-22", "title": "Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56623" }, { "rank": 44, "cve_id": "CVE-2026-45797", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.0057, "epss_percentile": 0.44582, "kev": false, "kev_due_at": null, "vendor": "heyform", "product": "heyform", "cwe": "CWE-79", "title": "HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45797" }, { "rank": 45, "cve_id": "CVE-2026-59238", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00562, "epss_percentile": 0.44148, "kev": false, "kev_due_at": null, "vendor": "maalfer", "product": "Pentestify", "cwe": "CWE-79", "title": "Stored XSS in Pentestify via unsanitized finding images and report client logo", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59238" }, { "rank": 46, "cve_id": "CVE-2026-8170", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00561, "epss_percentile": 0.44118, "kev": false, "kev_due_at": null, "vendor": "Extreme Networks", "product": "Switch Engine (EXOS)", "cwe": "CWE-59", "title": "ExtremeXOS Privilege Escalation via Symlink Following in File Utilities", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8170" }, { "rank": 47, "cve_id": "CVE-2026-16235", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00553, "epss_percentile": 0.43712, "kev": false, "kev_due_at": null, "vendor": "DRSTEVE", "product": "Crypt::Password", "cwe": "CWE-338", "title": "Crypt::Password versions through 0.28 for Perl generate insecure random values for salts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16235" }, { "rank": 48, "cve_id": "CVE-2026-16337", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.0055, "epss_percentile": 0.43515, "kev": false, "kev_due_at": null, "vendor": "dotCMS", "product": "dotCMS", "cwe": "CWE-269", "title": "Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16337" }, { "rank": 49, "cve_id": "CVE-2026-25039", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00548, "epss_percentile": 0.43404, "kev": false, "kev_due_at": null, "vendor": "Scille", "product": "parsec-cloud", "cwe": "CWE-40", "title": "The application evaluate UNC path in workspace name", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25039" }, { "rank": 50, "cve_id": "CVE-2026-26080", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00546, "epss_percentile": 0.43343, "kev": false, "kev_due_at": null, "vendor": "HAProxy", "product": "HAProxy", "cwe": "CWE-252", "title": "HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26080" }, { "rank": 51, "cve_id": "CVE-2026-53595", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00543, "epss_percentile": 0.43139, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-178", "title": "FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53595" }, { "rank": 52, "cve_id": "CVE-2026-63757", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00536, "epss_percentile": 0.42767, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-306", "title": "SurrealDB before 3.1.0 Session Hijacking via /rpc sessions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63757" }, { "rank": 53, "cve_id": "CVE-2026-44978", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00532, "epss_percentile": 0.42534, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-20", "title": "xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44978" }, { "rank": 54, "cve_id": "CVE-2026-57309", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00531, "epss_percentile": 0.42501, "kev": false, "kev_due_at": null, "vendor": "JCD", "product": "Windu CMS", "cwe": "CWE-89", "title": "Blind SQL Injection in Windu CMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57309" }, { "rank": 55, "cve_id": "CVE-2026-51385", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00529, "epss_percentile": 0.42379, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-94", "title": "An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_html and _download_binary functions.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51385" }, { "rank": 56, "cve_id": "CVE-2026-60026", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00527, "epss_percentile": 0.42253, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "Quix Page Builder Pro extension for Joomla", "cwe": "CWE-94", "title": "Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60026" }, { "rank": 57, "cve_id": "CVE-2026-53594", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00527, "epss_percentile": 0.42218, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-22", "title": "FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53594" }, { "rank": 58, "cve_id": "CVE-2026-63091", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00525, "epss_percentile": 0.42119, "kev": false, "kev_due_at": null, "vendor": "proftpd", "product": "proftpd", "cwe": "CWE-126", "title": "ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63091" }, { "rank": 59, "cve_id": "CVE-2026-42210", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00521, "epss_percentile": 0.4185, "kev": false, "kev_due_at": null, "vendor": "webmin", "product": "webmin", "cwe": "CWE-287", "title": "Webmin 2FA requirement bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42210" }, { "rank": 60, "cve_id": "CVE-2026-60027", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00518, "epss_percentile": 0.41688, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "Quix Page Builder Pro extension for Joomla", "cwe": "CWE-22", "title": "Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60027" }, { "rank": 61, "cve_id": "CVE-2026-55238", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00516, "epss_percentile": 0.41593, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-126", "title": "xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55238" }, { "rank": 62, "cve_id": "CVE-2026-63747", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00515, "epss_percentile": 0.41516, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-248", "title": "SurrealDB before 3.1.0 Denial of Service via malformed RPC use", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63747" }, { "rank": 63, "cve_id": "CVE-2026-63760", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00515, "epss_percentile": 0.41516, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-674", "title": "SurrealDB before 3.1.0 Denial of Service via JSON Parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63760" }, { "rank": 64, "cve_id": "CVE-2026-56452", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0051, "epss_percentile": 0.41195, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "cwe": "CWE-22", "title": "Apache MINA SSHD: Path traversal in SCP file reception", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56452" }, { "rank": 65, "cve_id": "CVE-2026-53593", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00509, "epss_percentile": 0.41077, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-434", "title": "FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53593" }, { "rank": 66, "cve_id": "CVE-2026-63429", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00507, "epss_percentile": 0.40915, "kev": false, "kev_due_at": null, "vendor": "heyform", "product": "heyform", "cwe": "CWE-306", "title": "HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63429" }, { "rank": 67, "cve_id": "CVE-2026-16277", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00505, "epss_percentile": 0.40844, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-121", "title": "Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16277" }, { "rank": 68, "cve_id": "CVE-2026-63763", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00497, "epss_percentile": 0.40327, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-639", "title": "SurrealDB before 2.5.0 Privilege Escalation via Future Fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63763" }, { "rank": 69, "cve_id": "CVE-2026-63750", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00493, "epss_percentile": 0.40103, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-770", "title": "SurrealDB before 3.1.0 Memory Amplification via /sql WebSocket", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63750" }, { "rank": 70, "cve_id": "CVE-2026-6656", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00492, "epss_percentile": 0.40009, "kev": false, "kev_due_at": null, "vendor": "DRSTEVE", "product": "Crypt::Password", "cwe": "CWE-208", "title": "Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6656" }, { "rank": 71, "cve_id": "CVE-2026-35198", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.0049, "epss_percentile": 0.3988, "kev": false, "kev_due_at": null, "vendor": "heyform", "product": "heyform", "cwe": "CWE-79", "title": "HeyForm vulnerable to stored XSS via form field titles", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35198" }, { "rank": 72, "cve_id": "CVE-2024-51316", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00488, "epss_percentile": 0.39761, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-400", "title": "The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName", "url": "https://www.cve.org/CVERecord?id=CVE-2024-51316" }, { "rank": 73, "cve_id": "CVE-2026-51031", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00488, "epss_percentile": 0.39782, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-918", "title": "FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51031" }, { "rank": 74, "cve_id": "CVE-2026-46715", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00488, "epss_percentile": 0.39786, "kev": false, "kev_due_at": null, "vendor": "pallets-eco", "product": "Flask-Security-Too", "cwe": "CWE-287", "title": "Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46715" }, { "rank": 75, "cve_id": "CVE-2026-63737", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00487, "epss_percentile": 0.39697, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-674", "title": "SurrealDB before 3.1.5 Denial of Service via deep operator chains", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63737" }, { "rank": 76, "cve_id": "CVE-2026-45139", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00479, "epss_percentile": 0.39204, "kev": false, "kev_due_at": null, "vendor": "ci4-cms-erp", "product": "ci4ms", "cwe": "CWE-73", "title": "CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45139" }, { "rank": 77, "cve_id": "CVE-2026-55645", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00479, "epss_percentile": 0.3916, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-125", "title": "xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55645" }, { "rank": 78, "cve_id": "CVE-2026-63739", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00476, "epss_percentile": 0.38964, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-22", "title": "SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63739" }, { "rank": 79, "cve_id": "CVE-2026-26081", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00476, "epss_percentile": 0.38993, "kev": false, "kev_due_at": null, "vendor": "HAProxy", "product": "HAProxy", "cwe": "CWE-130", "title": "HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26081" }, { "rank": 80, "cve_id": "CVE-2026-62418", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00472, "epss_percentile": 0.38702, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Syncope", "cwe": "CWE-918", "title": "Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62418" }, { "rank": 81, "cve_id": "CVE-2026-63734", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00472, "epss_percentile": 0.3869, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-20", "title": "SurrealDB before 3.2.0 Denial of Service via malformed SurrealML import", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63734" }, { "rank": 82, "cve_id": "CVE-2026-16324", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00472, "epss_percentile": 0.38694, "kev": false, "kev_due_at": null, "vendor": "Metasoft 美特软件", "product": "MetaCRM", "cwe": "CWE-284", "title": "Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16324" }, { "rank": 83, "cve_id": "CVE-2026-54685", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00468, "epss_percentile": 0.38455, "kev": false, "kev_due_at": null, "vendor": "gtsteffaniak", "product": "filebrowser", "cwe": "CWE-208", "title": "FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54685" }, { "rank": 84, "cve_id": "CVE-2026-34239", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00465, "epss_percentile": 0.38215, "kev": false, "kev_due_at": null, "vendor": "chamilo", "product": "chamilo-lms", "cwe": "CWE-285", "title": "Chamilo Authenticated Remote Code Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34239" }, { "rank": 85, "cve_id": "CVE-2026-12898", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00461, "epss_percentile": 0.37985, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "All-in-One WP Migration and Backup", "cwe": "CWE-22", "title": "All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12898" }, { "rank": 86, "cve_id": "CVE-2026-54910", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.0046, "epss_percentile": 0.37882, "kev": false, "kev_due_at": null, "vendor": "gtsteffaniak", "product": "filebrowser", "cwe": "CWE-22", "title": "FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54910" }, { "rank": 87, "cve_id": "CVE-2026-64622", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00453, "epss_percentile": 0.37399, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-862", "title": "Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64622" }, { "rank": 88, "cve_id": "CVE-2026-13577", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00452, "epss_percentile": 0.37355, "kev": false, "kev_due_at": null, "vendor": "CROMEDOME", "product": "Dancer2", "cwe": "CWE-338", "title": "Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13577" }, { "rank": 89, "cve_id": "CVE-2026-63754", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0045, "epss_percentile": 0.3724, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-754", "title": "SurrealDB before 3.1.0 Denial of Service via LIVE Query", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63754" }, { "rank": 90, "cve_id": "CVE-2026-63759", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0045, "epss_percentile": 0.37238, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-674", "title": "SurrealDB before 3.1.0 Denial of Service nested type annotations", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63759" }, { "rank": 91, "cve_id": "CVE-2026-63762", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.0045, "epss_percentile": 0.37238, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-476", "title": "SurrealDB before v2.6.1 Denial of Service via scripting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63762" }, { "rank": 92, "cve_id": "CVE-2026-61424", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00445, "epss_percentile": 0.36824, "kev": false, "kev_due_at": null, "vendor": "dj-extensions.com", "product": "DJ-Classifieds extension for Joomla", "cwe": "CWE-434", "title": "Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61424" }, { "rank": 93, "cve_id": "CVE-2026-61900", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00445, "epss_percentile": 0.36825, "kev": false, "kev_due_at": null, "vendor": "dj-extensions.com", "product": "jDownloads extension for Joomla", "cwe": "CWE-434", "title": "Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61900" }, { "rank": 94, "cve_id": "CVE-2026-46410", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00445, "epss_percentile": 0.36825, "kev": false, "kev_due_at": null, "vendor": "gtsteffaniak", "product": "filebrowser", "cwe": "CWE-200", "title": "FileBrowser Quantum: unauthenticated user share share info", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46410" }, { "rank": 95, "cve_id": "CVE-2026-11349", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00445, "epss_percentile": 0.3686, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Modern Event Calendar Pro", "cwe": "CWE-89", "title": "Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11349" }, { "rank": 96, "cve_id": "CVE-2026-15901", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00443, "epss_percentile": 0.36705, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15901" }, { "rank": 97, "cve_id": "CVE-2026-46516", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00441, "epss_percentile": 0.36547, "kev": false, "kev_due_at": null, "vendor": "mwtcmi", "product": "frogman", "cwe": "CWE-79", "title": "Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46516" }, { "rank": 98, "cve_id": "CVE-2026-55831", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00439, "epss_percentile": 0.36397, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-400", "title": "Netty SPDY SETTINGS frame count materializes unbounded settings map", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55831" }, { "rank": 99, "cve_id": "CVE-2026-39878", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00435, "epss_percentile": 0.36022, "kev": false, "kev_due_at": null, "vendor": "chamilo", "product": "chamilo-lms", "cwe": "CWE-79", "title": "Chamilo stored XSS via user registration leads to admin account takeover", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39878" }, { "rank": 100, "cve_id": "CVE-2026-16252", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00431, "epss_percentile": 0.35657, "kev": false, "kev_due_at": null, "vendor": "Beijing Shenzhou Shihan Technology", "product": "Multimedia Integrated Business Display System", "cwe": "CWE-74", "title": "Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16252" }, { "rank": 101, "cve_id": "CVE-2026-63771", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.0043, "epss_percentile": 0.35615, "kev": false, "kev_due_at": null, "vendor": "vrana", "product": "adminer", "cwe": "CWE-113", "title": "Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63771" }, { "rank": 102, "cve_id": "CVE-2026-60031", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00428, "epss_percentile": 0.35423, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "Quix Page Builder Pro extension for Joomla", "cwe": "CWE-200", "title": "Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60031" }, { "rank": 103, "cve_id": "CVE-2026-21824", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00424, "epss_percentile": 0.35145, "kev": false, "kev_due_at": null, "vendor": "HCLSoftware", "product": "Commerce", "cwe": "CWE-266", "title": "A privilege escalation vulnerability affects HCL Commerce", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21824" }, { "rank": 104, "cve_id": "CVE-2026-55639", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00424, "epss_percentile": 0.35086, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-125", "title": "xrdp: Out-of-bounds read in GCC Conference Create Request CS_SECURITY processing (xrdp_sec_process_mcs_data_CS_SECURITY)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55639" }, { "rank": 105, "cve_id": "CVE-2026-55833", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00423, "epss_percentile": 0.35059, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-400", "title": "Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55833" }, { "rank": 106, "cve_id": "CVE-2026-48824", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00421, "epss_percentile": 0.34868, "kev": false, "kev_due_at": null, "vendor": "axllent", "product": "mailpit", "cwe": "CWE-770", "title": "Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48824" }, { "rank": 107, "cve_id": "CVE-2026-60034", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00418, "epss_percentile": 0.34511, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "JMedia extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60034" }, { "rank": 108, "cve_id": "CVE-2026-60028", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00418, "epss_percentile": 0.34512, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "Quix Page Builder Pro extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60028" }, { "rank": 109, "cve_id": "CVE-2026-42218", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00418, "epss_percentile": 0.34515, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-204", "title": "XRDP is vulnerable to a server timing attack, leading to user enumeration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42218" }, { "rank": 110, "cve_id": "CVE-2026-60029", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00418, "epss_percentile": 0.34512, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "Quix Page Builder Pro extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60029" }, { "rank": 111, "cve_id": "CVE-2026-64194", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00416, "epss_percentile": 0.34414, "kev": false, "kev_due_at": null, "vendor": "NLNETLABS", "product": "Net::DNS", "cwe": "CWE-674", "title": "Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64194" }, { "rank": 112, "cve_id": "CVE-2026-63731", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00415, "epss_percentile": 0.34287, "kev": false, "kev_due_at": null, "vendor": "hyperdxio", "product": "hyperdx", "cwe": "CWE-918", "title": "HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63731" }, { "rank": 113, "cve_id": "CVE-2026-44583", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00415, "epss_percentile": 0.34298, "kev": false, "kev_due_at": null, "vendor": "Paymenter", "product": "Paymenter", "cwe": "CWE-918", "title": "Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44583" }, { "rank": 114, "cve_id": "CVE-2026-44231", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00411, "epss_percentile": 0.33912, "kev": false, "kev_due_at": null, "vendor": "bestpractical", "product": "rt", "cwe": "CWE-200", "title": "RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44231" }, { "rank": 115, "cve_id": "CVE-2026-47276", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00411, "epss_percentile": 0.33894, "kev": false, "kev_due_at": null, "vendor": "nanomq", "product": "nanomq", "cwe": "CWE-476", "title": "NULL Pointer Dereference in REST API properties_parse via Malformed user_properties", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47276" }, { "rank": 116, "cve_id": "CVE-2026-60032", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00409, "epss_percentile": 0.33753, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "JMedia extension for Joomla", "cwe": "CWE-434", "title": "Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60032" }, { "rank": 117, "cve_id": "CVE-2026-60030", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00406, "epss_percentile": 0.33412, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "Quix Page Builder Pro extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60030" }, { "rank": 118, "cve_id": "CVE-2026-62414", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00404, "epss_percentile": 0.33322, "kev": false, "kev_due_at": null, "vendor": "joomlack.fr", "product": "Page Builder CK extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62414" }, { "rank": 119, "cve_id": "CVE-2026-47198", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00402, "epss_percentile": 0.33095, "kev": false, "kev_due_at": null, "vendor": "Paymenter", "product": "Paymenter", "cwe": "CWE-20", "title": "Paymenter: URL parameter injection bypasses paid plan limits at checkout", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47198" }, { "rank": 120, "cve_id": "CVE-2026-63769", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00402, "epss_percentile": 0.33007, "kev": false, "kev_due_at": null, "vendor": "huginn", "product": "huginn", "cwe": "CWE-918", "title": "Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63769" }, { "rank": 121, "cve_id": "CVE-2026-53596", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00402, "epss_percentile": 0.33068, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-400", "title": "FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53596" }, { "rank": 122, "cve_id": "CVE-2026-47129", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00401, "epss_percentile": 0.32914, "kev": false, "kev_due_at": null, "vendor": "pdovhomilja", "product": "nextcrm-app", "cwe": "CWE-862", "title": "NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47129" }, { "rank": 123, "cve_id": "CVE-2026-63730", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.004, "epss_percentile": 0.32815, "kev": false, "kev_due_at": null, "vendor": "hyperdxio", "product": "hyperdx", "cwe": "CWE-918", "title": "HyperDX < 2.31.0 SSRF via Webhook Test Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63730" }, { "rank": 124, "cve_id": "CVE-2026-15899", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00399, "epss_percentile": 0.32738, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15899" }, { "rank": 125, "cve_id": "CVE-2026-15900", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00399, "epss_percentile": 0.32737, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15900" }, { "rank": 126, "cve_id": "CVE-2026-63746", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00399, "epss_percentile": 0.32719, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-200", "title": "SurrealDB before 3.1.0 Permission Bypass via Graph Traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63746" }, { "rank": 127, "cve_id": "CVE-2026-8825", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00398, "epss_percentile": 0.3259, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Elementor Website Builder", "cwe": "CWE-200", "title": "Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8825" }, { "rank": 128, "cve_id": "CVE-2026-28220", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00396, "epss_percentile": 0.32413, "kev": false, "kev_due_at": null, "vendor": "wazuh", "product": "wazuh", "cwe": "CWE-502", "title": "Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28220" }, { "rank": 129, "cve_id": "CVE-2026-32806", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00394, "epss_percentile": 0.32194, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-285", "title": "dataCycle Authorization Bypass Via /remote_render", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32806" }, { "rank": 130, "cve_id": "CVE-2026-32807", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00394, "epss_percentile": 0.32191, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-285", "title": "dataCycle Public DataLink Text File Download Ignores Validity And Authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32807" }, { "rank": 131, "cve_id": "CVE-2026-45713", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00388, "epss_percentile": 0.31609, "kev": false, "kev_due_at": null, "vendor": "axllent", "product": "mailpit", "cwe": "CWE-400", "title": "Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45713" }, { "rank": 132, "cve_id": "CVE-2026-60033", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00388, "epss_percentile": 0.31604, "kev": false, "kev_due_at": null, "vendor": "themexpert.com", "product": "JMedia extension for Joomla", "cwe": "CWE-918", "title": "Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60033" }, { "rank": 133, "cve_id": "CVE-2026-13142", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00383, "epss_percentile": 0.31109, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Social Login, Passkeys, Magic Link & Email OTP", "cwe": "CWE-269", "title": "Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13142" }, { "rank": 134, "cve_id": "CVE-2026-8169", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00382, "epss_percentile": 0.30942, "kev": false, "kev_due_at": null, "vendor": "Extreme Networks", "product": "Switch Engine (EXOS)", "cwe": "CWE-338", "title": "ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8169" }, { "rank": 135, "cve_id": "CVE-2026-64612", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00382, "epss_percentile": 0.30921, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-248", "title": "Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64612" }, { "rank": 136, "cve_id": "CVE-2026-52349", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00381, "epss_percentile": 0.30807, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-22", "title": "Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality, PedComponentChanger create folder/createfile/rename functionality.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52349" }, { "rank": 137, "cve_id": "CVE-2026-53591", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00375, "epss_percentile": 0.30196, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-287", "title": "FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53591" }, { "rank": 138, "cve_id": "CVE-2026-16254", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00373, "epss_percentile": 0.30052, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Security 4", "cwe": "CWE-125", "title": "Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16254" }, { "rank": 139, "cve_id": "CVE-2026-39385", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00372, "epss_percentile": 0.29922, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "lms", "cwe": "CWE-288", "title": "Frappe LMS enrollment bypass in paid courses via unrelated batch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39385" }, { "rank": 140, "cve_id": "CVE-2026-57494", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00372, "epss_percentile": 0.29922, "kev": false, "kev_due_at": null, "vendor": "agenticmail", "product": "@agenticmail/api", "cwe": "CWE-639", "title": "AgenticMail: Cross-agent task authorization bypass in AgenticMail API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57494" }, { "rank": 141, "cve_id": "CVE-2026-63741", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00369, "epss_percentile": 0.2958, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-862", "title": "SurrealDB before 3.1.0 Authentication Bypass via USE statement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63741" }, { "rank": 142, "cve_id": "CVE-2026-63756", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00368, "epss_percentile": 0.29497, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-362", "title": "SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63756" }, { "rank": 143, "cve_id": "CVE-2026-45270", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00367, "epss_percentile": 0.29327, "kev": false, "kev_due_at": null, "vendor": "ci4-cms-erp", "product": "ci4ms", "cwe": "CWE-79", "title": "CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45270" }, { "rank": 144, "cve_id": "CVE-2026-63735", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00367, "epss_percentile": 0.2942, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-639", "title": "SurrealDB before 3.2.0 Authentication Bypass via Custom API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63735" }, { "rank": 145, "cve_id": "CVE-2026-51025", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00364, "epss_percentile": 0.29099, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-79", "title": "Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51025" }, { "rank": 146, "cve_id": "CVE-2026-57495", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00362, "epss_percentile": 0.28892, "kev": false, "kev_due_at": null, "vendor": "agenticmail", "product": "@agenticmail/core", "cwe": "CWE-306", "title": "AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57495" }, { "rank": 147, "cve_id": "CVE-2026-63755", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00361, "epss_percentile": 0.28731, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB before 3.1.0 Permission Bypass via WHERE Clause", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63755" }, { "rank": 148, "cve_id": "CVE-2026-63749", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0036, "epss_percentile": 0.28714, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63749" }, { "rank": 149, "cve_id": "CVE-2026-15813", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00359, "epss_percentile": 0.28594, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15813" }, { "rank": 150, "cve_id": "CVE-2026-63740", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00358, "epss_percentile": 0.28433, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB before 3.1.4 Array Element Permission Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63740" }, { "rank": 151, "cve_id": "CVE-2026-63107", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00354, "epss_percentile": 0.28005, "kev": false, "kev_due_at": null, "vendor": "LimeSurvey", "product": "LimeSurvey", "cwe": "CWE-918", "title": "LimeSurvey SSRF via REST API Survey Template Host Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63107" }, { "rank": 152, "cve_id": "CVE-2026-12592", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00352, "epss_percentile": 0.27824, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "SlimStat Analytics", "cwe": "CWE-79", "title": "SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12592" }, { "rank": 153, "cve_id": "CVE-2026-32821", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.0035, "epss_percentile": 0.27561, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-285", "title": "API Collection Impersonation Via user_email And Missing Object- Level Authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32821" }, { "rank": 154, "cve_id": "CVE-2026-63753", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0035, "epss_percentile": 0.27558, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-613", "title": "SurrealDB before 3.1.0 Authentication Bypass via LIVE Query", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63753" }, { "rank": 155, "cve_id": "CVE-2026-15902", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00349, "epss_percentile": 0.2745, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15902" }, { "rank": 156, "cve_id": "CVE-2026-32824", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00342, "epss_percentile": 0.26758, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-601", "title": "dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32824" }, { "rank": 157, "cve_id": "CVE-2026-32825", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00342, "epss_percentile": 0.26758, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-307", "title": "dataCycle No Brute-Force Protection On Web And API Login Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32825" }, { "rank": 158, "cve_id": "CVE-2026-63428", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.26773, "kev": false, "kev_due_at": null, "vendor": "heyform", "product": "heyform", "cwe": "CWE-20", "title": "HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63428" }, { "rank": 159, "cve_id": "CVE-2026-63768", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.26774, "kev": false, "kev_due_at": null, "vendor": "calcom", "product": "cal.diy", "cwe": "CWE-601", "title": "cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63768" }, { "rank": 160, "cve_id": "CVE-2026-12723", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00339, "epss_percentile": 0.26389, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Kirki", "cwe": "CWE-862", "title": "Kirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12723" }, { "rank": 161, "cve_id": "CVE-2026-55550", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00338, "epss_percentile": 0.26288, "kev": false, "kev_due_at": null, "vendor": "pdovhomilja", "product": "nextcrm-app", "cwe": "CWE-269", "title": "NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55550" }, { "rank": 162, "cve_id": "CVE-2026-45295", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00338, "epss_percentile": 0.26284, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-639", "title": "FreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45295" }, { "rank": 163, "cve_id": "CVE-2026-48389", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.26176, "kev": false, "kev_due_at": null, "vendor": "Adobe", "product": "DNG SDK", "cwe": "CWE-121", "title": "DNG SDK | Stack-based Buffer Overflow (CWE-121)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48389" }, { "rank": 164, "cve_id": "CVE-2026-63102", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00334, "epss_percentile": 0.25856, "kev": false, "kev_due_at": null, "vendor": "rConfig", "product": "rConfig v8 Core", "cwe": "CWE-915", "title": "rConfig Core < 8.2.8 Privilege Escalation via Users API role field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63102" }, { "rank": 165, "cve_id": "CVE-2026-16244", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00333, "epss_percentile": 0.25671, "kev": false, "kev_due_at": null, "vendor": "itsourcecode", "product": "Hospital Management System", "cwe": "CWE-74", "title": "itsourcecode Hospital Management System prescriptionorderreport.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16244" }, { "rank": 166, "cve_id": "CVE-2026-63748", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00326, "epss_percentile": 0.24938, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-209", "title": "SurrealDB before 3.1.0 Information Disclosure via Error Messages", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63748" }, { "rank": 167, "cve_id": "CVE-2026-63744", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00324, "epss_percentile": 0.2468, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-918", "title": "SurrealDB before 3.1.5 SSRF via JWKS URL Redirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63744" }, { "rank": 168, "cve_id": "CVE-2026-12900", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00321, "epss_percentile": 0.24288, "kev": false, "kev_due_at": null, "vendor": "brainstormforce", "product": "Spectra Legacy – Gutenberg Blocks", "cwe": "CWE-79", "title": "Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12900" }, { "rank": 169, "cve_id": "CVE-2026-35217", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0032, "epss_percentile": 0.24175, "kev": false, "kev_due_at": null, "vendor": "nanomq", "product": "nanomq", "cwe": "CWE-125", "title": "NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35217" }, { "rank": 170, "cve_id": "CVE-2026-46428", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00319, "epss_percentile": 0.24138, "kev": false, "kev_due_at": null, "vendor": "lettre", "product": "lettre", "cwe": "CWE-295", "title": "lettre has TLS hostname verification disabled when using Boring TLS backend", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46428" }, { "rank": 171, "cve_id": "CVE-2026-26197", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00319, "epss_percentile": 0.24067, "kev": false, "kev_due_at": null, "vendor": "HDFGroup", "product": "hdf5", "cwe": "CWE-125", "title": "Array full size, element count, and element size are not checked to make sure they match in H5Odtype.c", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26197" }, { "rank": 172, "cve_id": "CVE-2026-64626", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00319, "epss_percentile": 0.24131, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-918", "title": "AVideo Encoder downloadURL SSRF via unpinned retry fallback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64626" }, { "rank": 173, "cve_id": "CVE-2026-55544", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00314, "epss_percentile": 0.2355, "kev": false, "kev_due_at": null, "vendor": "pdovhomilja", "product": "nextcrm-app", "cwe": "CWE-284", "title": "NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55544" }, { "rank": 174, "cve_id": "CVE-2026-63736", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00314, "epss_percentile": 0.23604, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-918", "title": "SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63736" }, { "rank": 175, "cve_id": "CVE-2026-45711", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00311, "epss_percentile": 0.23273, "kev": false, "kev_due_at": null, "vendor": "axllent", "product": "mailpit", "cwe": "CWE-22", "title": "Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45711" }, { "rank": 176, "cve_id": "CVE-2026-63758", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00309, "epss_percentile": 0.23027, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-862", "title": "SurrealDB before 3.1.0 Authorization Bypass via KILL Statement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63758" }, { "rank": 177, "cve_id": "CVE-2026-64621", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00304, "epss_percentile": 0.22414, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-415", "title": "FreeRDP before 3.28.0 Double-Free via selectedmonitors", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64621" }, { "rank": 178, "cve_id": "CVE-2026-11868", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00304, "epss_percentile": 0.22408, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WP Travel", "cwe": "CWE-862", "title": "WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11868" }, { "rank": 179, "cve_id": "CVE-2026-15904", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00298, "epss_percentile": 0.21792, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15904" }, { "rank": 180, "cve_id": "CVE-2026-26199", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00297, "epss_percentile": 0.21697, "kev": false, "kev_due_at": null, "vendor": "HDFGroup", "product": "hdf5", "cwe": "CWE-124", "title": "Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26199" }, { "rank": 181, "cve_id": "CVE-2026-64619", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00295, "epss_percentile": 0.21466, "kev": false, "kev_due_at": null, "vendor": "vastsa", "product": "FileCodeBox", "cwe": "CWE-348", "title": "FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64619" }, { "rank": 182, "cve_id": "CVE-2026-63770", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00295, "epss_percentile": 0.21465, "kev": false, "kev_due_at": null, "vendor": "glanceapp", "product": "glance", "cwe": "CWE-348", "title": "Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63770" }, { "rank": 183, "cve_id": "CVE-2026-12972", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00295, "epss_percentile": 0.21441, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "PayPlus Payment Gateway", "cwe": "CWE-284", "title": "PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12972" }, { "rank": 184, "cve_id": "CVE-2026-63742", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00293, "epss_percentile": 0.21224, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNT", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63742" }, { "rank": 185, "cve_id": "CVE-2026-63751", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00293, "epss_percentile": 0.21225, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63751" }, { "rank": 186, "cve_id": "CVE-2026-10081", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00292, "epss_percentile": 0.21099, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Unlimited Elements For Elementor", "cwe": "CWE-79", "title": "Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10081" }, { "rank": 187, "cve_id": "CVE-2026-56624", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.0029, "epss_percentile": 0.20894, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache MINA SSHD", "cwe": "CWE-295", "title": "Apache MINA SSHD: SSH certificate options lack validations", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56624" }, { "rank": 188, "cve_id": "CVE-2026-13432", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00287, "epss_percentile": 0.20663, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "ThumbPress", "cwe": "CWE-862", "title": "ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13432" }, { "rank": 189, "cve_id": "CVE-2026-63733", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00287, "epss_percentile": 0.20684, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63733" }, { "rank": 190, "cve_id": "CVE-2026-44585", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00285, "epss_percentile": 0.20423, "kev": false, "kev_due_at": null, "vendor": "Paymenter", "product": "Paymenter", "cwe": "CWE-639", "title": "Paymenter: Broken object level authorization via service reference manipulation on ticket creation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44585" }, { "rank": 191, "cve_id": "CVE-2026-63738", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00284, "epss_percentile": 0.20339, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-863", "title": "SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63738" }, { "rank": 192, "cve_id": "CVE-2026-9833", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00282, "epss_percentile": 0.20094, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Tag Groups is the Advanced Way to Display Your Taxonomy Terms", "cwe": "CWE-79", "title": "Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9833" }, { "rank": 193, "cve_id": "CVE-2026-10755", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00281, "epss_percentile": 0.20053, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "All in One SEO", "cwe": "CWE-863", "title": "All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10755" }, { "rank": 194, "cve_id": "CVE-2026-57310", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.0028, "epss_percentile": 0.19895, "kev": false, "kev_due_at": null, "vendor": "JCD", "product": "Windu CMS", "cwe": "CWE-916", "title": "Weak password hashing in Windu CMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57310" }, { "rank": 195, "cve_id": "CVE-2026-63752", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0028, "epss_percentile": 0.19894, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-285", "title": "SurrealDB before 3.1.0 RELATE Statement Record Overwrite", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63752" }, { "rank": 196, "cve_id": "CVE-2026-64623", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00278, "epss_percentile": 0.19662, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-347", "title": "Network-AI before 5.13.4 Cryptographic Signature Verification Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64623" }, { "rank": 197, "cve_id": "CVE-2026-47130", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00278, "epss_percentile": 0.19646, "kev": false, "kev_due_at": null, "vendor": "pdovhomilja", "product": "nextcrm-app", "cwe": "CWE-639", "title": "NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47130" }, { "rank": 198, "cve_id": "CVE-2026-63761", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00278, "epss_percentile": 0.19649, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-327", "title": "SurrealDB before 3.1.0 Algorithm Downgrade via ES512", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63761" }, { "rank": 199, "cve_id": "CVE-2026-13724", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00277, "epss_percentile": 0.19582, "kev": false, "kev_due_at": null, "vendor": "Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co.", "product": "Corporate Training Management System", "cwe": "CWE-602", "title": "Business Logic Bypass in Gobito's Corporate Training Management System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13724" }, { "rank": 200, "cve_id": "CVE-2026-32822", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00275, "epss_percentile": 0.19367, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-80", "title": "dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32822" }, { "rank": 201, "cve_id": "CVE-2026-15788", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.00274, "epss_percentile": 0.19247, "kev": false, "kev_due_at": null, "vendor": "moby", "product": "BuildKit", "cwe": "CWE-59", "title": "WCOW cache mount source selector resolves NTFS junctions outside of cache root", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15788" }, { "rank": 202, "cve_id": "CVE-2026-47275", "cvss_base": 2.6, "cvss_severity": "LOW", "epss_score": 0.00273, "epss_percentile": 0.19173, "kev": false, "kev_due_at": null, "vendor": "nanomq", "product": "nanomq", "cwe": "CWE-476", "title": "nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47275" }, { "rank": 203, "cve_id": "CVE-2026-39879", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0027, "epss_percentile": 0.18615, "kev": false, "kev_due_at": null, "vendor": "syslog-ng", "product": "syslog-ng", "cwe": "CWE-150", "title": "SQL injection in syslog-ng SQL destionation driver", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39879" }, { "rank": 204, "cve_id": "CVE-2026-32819", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.0027, "epss_percentile": 0.18689, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-285", "title": "dataCycle User Directory Enumeration Via /users/search", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32819" }, { "rank": 205, "cve_id": "CVE-2026-12973", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00267, "epss_percentile": 0.18342, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "PayPlus Payment Gateway", "cwe": "CWE-862", "title": "PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12973" }, { "rank": 206, "cve_id": "CVE-2026-45709", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00265, "epss_percentile": 0.17951, "kev": false, "kev_due_at": null, "vendor": "axllent", "product": "mailpit", "cwe": "CWE-918", "title": "Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45709" }, { "rank": 207, "cve_id": "CVE-2026-26483", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00263, "epss_percentile": 0.17653, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-79", "title": "Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject malicious JavaScript code that is executed in the browsers of users who access the affected template.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26483" }, { "rank": 208, "cve_id": "CVE-2026-44227", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00263, "epss_percentile": 0.17654, "kev": false, "kev_due_at": null, "vendor": "bestpractical", "product": "rt", "cwe": "CWE-79", "title": "RT: Reflected Cross-Site Scripting via URL parameters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44227" }, { "rank": 209, "cve_id": "CVE-2026-44230", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00263, "epss_percentile": 0.17654, "kev": false, "kev_due_at": null, "vendor": "bestpractical", "product": "rt", "cwe": "CWE-79", "title": "RT: Reflected Cross-Site Scripting in search results chart", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44230" }, { "rank": 210, "cve_id": "CVE-2026-64206", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00259, "epss_percentile": 0.17183, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64206" }, { "rank": 211, "cve_id": "CVE-2026-44228", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00255, "epss_percentile": 0.16756, "kev": false, "kev_due_at": null, "vendor": "bestpractical", "product": "rt", "cwe": "CWE-79", "title": "RT: Stored Cross-Site Scripting via insufficient template escaping", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44228" }, { "rank": 212, "cve_id": "CVE-2026-2445", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16447, "kev": false, "kev_due_at": null, "vendor": "WSO2", "product": "WSO2 API Manager", "cwe": "CWE-79", "title": "Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2445" }, { "rank": 213, "cve_id": "CVE-2026-47255", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00252, "epss_percentile": 0.1631, "kev": false, "kev_due_at": null, "vendor": "agenticmail", "product": "@agenticmail/api", "cwe": "CWE-20", "title": "AgenticMail API/storage and outbound relay hardening", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47255" }, { "rank": 214, "cve_id": "CVE-2026-12970", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00251, "epss_percentile": 0.1626, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "LearnPress", "cwe": "CWE-79", "title": "LearnPress < 4.4.1 - Reflected XSS via c_search", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12970" }, { "rank": 215, "cve_id": "CVE-2026-63743", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.16016, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-918", "title": "SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63743" }, { "rank": 216, "cve_id": "CVE-2026-63745", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.16017, "kev": false, "kev_due_at": null, "vendor": "surrealdb", "product": "surrealdb", "cwe": "CWE-639", "title": "SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63745" }, { "rank": 217, "cve_id": "CVE-2026-45712", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00247, "epss_percentile": 0.15766, "kev": false, "kev_due_at": null, "vendor": "axllent", "product": "mailpit", "cwe": "CWE-362", "title": "Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45712" }, { "rank": 218, "cve_id": "CVE-2026-61901", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0024, "epss_percentile": 0.14804, "kev": false, "kev_due_at": null, "vendor": "hikashop.com", "product": "Hikashop extension for Joomla", "cwe": "CWE-601", "title": "Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61901" }, { "rank": 219, "cve_id": "CVE-2026-44229", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.0024, "epss_percentile": 0.14849, "kev": false, "kev_due_at": null, "vendor": "bestpractical", "product": "rt", "cwe": "CWE-79", "title": "RT: Cross-Site Scripting via inline-served uploaded content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44229" }, { "rank": 220, "cve_id": "CVE-2026-13380", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00235, "epss_percentile": 0.14187, "kev": false, "kev_due_at": null, "vendor": "VSee", "product": "Clinic", "cwe": "CWE-201", "title": "VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13380" }, { "rank": 221, "cve_id": "CVE-2026-46415", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00234, "epss_percentile": 0.14129, "kev": false, "kev_due_at": null, "vendor": "JasonLovesDoggo", "product": "caddy-defender", "cwe": "CWE-284", "title": "Caddy Defender trusted proxy client IP bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46415" }, { "rank": 222, "cve_id": "CVE-2026-6793", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00226, "epss_percentile": 0.13074, "kev": false, "kev_due_at": null, "vendor": "Bifra Engineering Consulting Ltd.", "product": "Q-smart NexT Poll", "cwe": "CWE-79", "title": "Stored XSS in Bifra Engineering's Q-smart NexT Poll", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6793" }, { "rank": 223, "cve_id": "CVE-2026-46701", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00223, "epss_percentile": 0.12707, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-346", "title": "Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46701" }, { "rank": 224, "cve_id": "CVE-2026-12341", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00216, "epss_percentile": 0.11892, "kev": false, "kev_due_at": null, "vendor": "SailPoint Technologies", "product": "IdentityIQ", "cwe": "CWE-287", "title": "SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12341" }, { "rank": 225, "cve_id": "CVE-2026-55219", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00214, "epss_percentile": 0.11497, "kev": false, "kev_due_at": null, "vendor": "Paymenter", "product": "Paymenter", "cwe": "CWE-362", "title": "Paymenter: Race condition in payWithCredit() enables credit double-spend", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55219" }, { "rank": 226, "cve_id": "CVE-2026-13381", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00209, "epss_percentile": 0.10871, "kev": false, "kev_due_at": null, "vendor": "VSee", "product": "Clinic", "cwe": "CWE-639", "title": "VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13381" }, { "rank": 227, "cve_id": "CVE-2026-58484", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00207, "epss_percentile": 0.10716, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-22", "title": "Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58484" }, { "rank": 228, "cve_id": "CVE-2026-63728", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00206, "epss_percentile": 0.10604, "kev": false, "kev_due_at": null, "vendor": "gitleaks", "product": "gitleaks", "cwe": "CWE-1336", "title": "Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63728" }, { "rank": 229, "cve_id": "CVE-2026-58481", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00203, "epss_percentile": 0.10118, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-22", "title": "Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58481" }, { "rank": 230, "cve_id": "CVE-2026-58413", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00203, "epss_percentile": 0.10117, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-22", "title": "EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58413" }, { "rank": 231, "cve_id": "CVE-2026-58414", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00203, "epss_percentile": 0.10118, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-22", "title": "Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58414" }, { "rank": 232, "cve_id": "CVE-2026-53592", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00194, "epss_percentile": 0.09053, "kev": false, "kev_due_at": null, "vendor": "freescout-help-desk", "product": "freescout", "cwe": "CWE-1321", "title": "FreeScout vulnerable to prototype pollution in getQueryParam", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53592" }, { "rank": 233, "cve_id": "CVE-2026-15588", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00192, "epss_percentile": 0.08806, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-770", "title": "Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15588" }, { "rank": 234, "cve_id": "CVE-2026-46671", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00191, "epss_percentile": 0.08782, "kev": false, "kev_due_at": null, "vendor": "msiemens", "product": "onenote.rs", "cwe": "CWE-22", "title": "Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46671" }, { "rank": 235, "cve_id": "CVE-2026-46555", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00189, "epss_percentile": 0.0848, "kev": false, "kev_due_at": null, "vendor": "verygoodplugins", "product": "whatsapp-mcp", "cwe": "CWE-22", "title": "WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46555" }, { "rank": 236, "cve_id": "CVE-2026-47144", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00184, "epss_percentile": 0.07963, "kev": false, "kev_due_at": null, "vendor": "BKDDFS", "product": "shamefile", "cwe": "CWE-22", "title": "Shamefile has an arbitrary file read via shamefile.yaml in shame next", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47144" }, { "rank": 237, "cve_id": "CVE-2026-12080", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00181, "epss_percentile": 0.07637, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-61", "title": "Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12080" }, { "rank": 238, "cve_id": "CVE-2026-64624", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07619, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-88", "title": "FreeRDP RDP File Parser Remote Code Execution via CLI Options", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64624" }, { "rank": 239, "cve_id": "CVE-2026-64205", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00172, "epss_percentile": 0.06636, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "i2c: i801: fix hardware state machine corruption in error path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64205" }, { "rank": 240, "cve_id": "CVE-2026-15905", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00169, "epss_percentile": 0.06377, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15905" }, { "rank": 241, "cve_id": "CVE-2026-33327", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00166, "epss_percentile": 0.05976, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-190", "title": "Possible integer overflow leading to potential heap-based buffer overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33327" }, { "rank": 242, "cve_id": "CVE-2026-35591", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00166, "epss_percentile": 0.05975, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-122", "title": "Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35591" }, { "rank": 243, "cve_id": "CVE-2026-44584", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00163, "epss_percentile": 0.05666, "kev": false, "kev_due_at": null, "vendor": "Paymenter", "product": "Paymenter", "cwe": "CWE-345", "title": "Paymenter doesn't reset email verification status after email change", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44584" }, { "rank": 244, "cve_id": "CVE-2026-64650", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00161, "epss_percentile": 0.05512, "kev": false, "kev_due_at": null, "vendor": "vercel", "product": "@ai-sdk/harness-codex", "cwe": "CWE-863", "title": "AI SDK Codex Harness Tool Relay Authorization Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64650" }, { "rank": 245, "cve_id": "CVE-2026-64651", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00161, "epss_percentile": 0.05512, "kev": false, "kev_due_at": null, "vendor": "vercel", "product": "@ai-sdk/harness-opencode", "cwe": "CWE-863", "title": "AI SDK OpenCode Harness Tool Relay Authorization Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64651" }, { "rank": 246, "cve_id": "CVE-2026-58482", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00159, "epss_percentile": 0.05254, "kev": false, "kev_due_at": null, "vendor": "Jovancoding", "product": "Network-AI", "cwe": "CWE-352", "title": "Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58482" }, { "rank": 247, "cve_id": "CVE-2026-16246", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00155, "epss_percentile": 0.04899, "kev": false, "kev_due_at": null, "vendor": "Bizerba SE & Co. KG", "product": "BRAIN2", "cwe": "CWE-276", "title": "Insecure permission assignment due to execution of LogPathConfig.exe during setup", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16246" }, { "rank": 248, "cve_id": "CVE-2026-47133", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.04543, "kev": false, "kev_due_at": null, "vendor": "craigjbass", "product": "clearancekit", "cwe": "CWE-294", "title": "ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47133" }, { "rank": 249, "cve_id": "CVE-2026-47134", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.04544, "kev": false, "kev_due_at": null, "vendor": "craigjbass", "product": "clearancekit", "cwe": "CWE-732", "title": "ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47134" }, { "rank": 250, "cve_id": "CVE-2026-33328", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04127, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-190", "title": "Possible integer overflow on 32-bit systems when reading GIF images", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33328" }, { "rank": 251, "cve_id": "CVE-2026-35590", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04127, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-122", "title": "Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35590" }, { "rank": 252, "cve_id": "CVE-2026-12724", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04127, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Kirki", "cwe": "CWE-345", "title": "Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12724" }, { "rank": 253, "cve_id": "CVE-2026-50743", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00145, "epss_percentile": 0.04005, "kev": false, "kev_due_at": null, "vendor": "Revive", "product": "Adserver", "cwe": "CWE-352", "title": "A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50743" }, { "rank": 254, "cve_id": "CVE-2026-64190", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00143, "epss_percentile": 0.03847, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "net: team: fix NULL pointer dereference in team_xmit during mode change", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64190" }, { "rank": 255, "cve_id": "CVE-2026-16247", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00142, "epss_percentile": 0.03719, "kev": false, "kev_due_at": null, "vendor": "Bizerba SE & Co. KG", "product": "_connect.BRAIN", "cwe": "CWE-276", "title": "Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16247" }, { "rank": 256, "cve_id": "CVE-2026-32823", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.03712, "kev": false, "kev_due_at": null, "vendor": "datacycle-engine", "product": "dataCycle-CORE", "cwe": "CWE-352", "title": "dataCycle State-Changing GET Endpoints Enable CSRF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32823" }, { "rank": 257, "cve_id": "CVE-2026-13156", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00138, "epss_percentile": 0.0337, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "MailerSend", "cwe": "CWE-352", "title": "MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13156" }, { "rank": 258, "cve_id": "CVE-2026-47128", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0013, "epss_percentile": 0.02845, "kev": false, "kev_due_at": null, "vendor": "always-further", "product": "nono", "cwe": "CWE-863", "title": "nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47128" }, { "rank": 259, "cve_id": "CVE-2026-64191", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00127, "epss_percentile": 0.02595, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-125", "title": "i2c: stub: Reject I2C block transfers with invalid length", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64191" }, { "rank": 260, "cve_id": "CVE-2026-55626", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00126, "epss_percentile": 0.02483, "kev": false, "kev_due_at": null, "vendor": "neutrinolabs", "product": "xrdp", "cwe": "CWE-287", "title": "xrdp: No authentication required with Xvnc backend on RHEL 9", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55626" }, { "rank": 261, "cve_id": "CVE-2026-10724", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00126, "epss_percentile": 0.02496, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Reviews Feed", "cwe": "CWE-345", "title": "Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10724" }, { "rank": 262, "cve_id": "CVE-2026-64192", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00118, "epss_percentile": 0.01911, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64192" }, { "rank": 263, "cve_id": "CVE-2026-64188", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00117, "epss_percentile": 0.01857, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64188" }, { "rank": 264, "cve_id": "CVE-2026-64187", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00114, "epss_percentile": 0.0165, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "xfs: fail recovery on a committed log item with no regions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64187" }, { "rank": 265, "cve_id": "CVE-2026-64207", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00113, "epss_percentile": 0.01561, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "net/sched: dualpi2: fix GSO backlog accounting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64207" }, { "rank": 266, "cve_id": "CVE-2026-64189", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00097, "epss_percentile": 0.00808, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-362", "title": "netfilter: ipset: fix race between dump and ip_set_list resize", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64189" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2024-1014", "detail": "EXPLOIT PUBLISHED — CVE-2024-1014 (SE-elektronic GmbH E-DDC3.3). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-26197", "detail": "EXPLOIT PUBLISHED — CVE-2026-26197 (HDFGroup hdf5). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-26199", "detail": "EXPLOIT PUBLISHED — CVE-2026-26199 (HDFGroup hdf5). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-28220", "detail": "EXPLOIT PUBLISHED — CVE-2026-28220 (wazuh). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-32286", "detail": "EXPLOIT PUBLISHED — CVE-2026-32286 (github.com/jackc/pgproto3/v2). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45709", "detail": "EXPLOIT PUBLISHED — CVE-2026-45709 (axllent mailpit). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45711", "detail": "EXPLOIT PUBLISHED — CVE-2026-45711 (axllent mailpit). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45712", "detail": "EXPLOIT PUBLISHED — CVE-2026-45712 (axllent mailpit). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45713", "detail": "EXPLOIT PUBLISHED — CVE-2026-45713 (axllent mailpit). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-46701", "detail": "EXPLOIT PUBLISHED — CVE-2026-46701 (Jovancoding Network-AI). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-47774", "detail": "EXPLOIT PUBLISHED — CVE-2026-47774 (envoyproxy envoy). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-48824", "detail": "EXPLOIT PUBLISHED — CVE-2026-48824 (axllent mailpit). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58413", "detail": "EXPLOIT PUBLISHED — CVE-2026-58413 (Jovancoding Network-AI). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58414", "detail": "EXPLOIT PUBLISHED — CVE-2026-58414 (Jovancoding Network-AI). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58481", "detail": "EXPLOIT PUBLISHED — CVE-2026-58481 (Jovancoding Network-AI). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58482", "detail": "EXPLOIT PUBLISHED — CVE-2026-58482 (Jovancoding Network-AI). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-58484", "detail": "EXPLOIT PUBLISHED — CVE-2026-58484 (Jovancoding Network-AI). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-64620", "detail": "EXPLOIT PUBLISHED — CVE-2026-64620 (FreeRDP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-64621", "detail": "EXPLOIT PUBLISHED — CVE-2026-64621 (FreeRDP). Public exploit reference added." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-25089", "detail": "DUE DATE PASSED — CVE-2026-25089 (Fortinet FortiSandbox). CISA remediation deadline was July 19, 2026; still in catalog." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-39808", "detail": "DUE DATE PASSED — CVE-2026-39808 (Fortinet FortiSandbox). CISA remediation deadline was July 19, 2026; still in catalog." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-58644", "detail": "DUE DATE PASSED — CVE-2026-58644 (Microsoft SharePoint Enterprise Server 2016). CISA remediation deadline was July 19, 2026; still in catalog." }, { "type": "RESCORED", "cve_id": "CVE-2024-1014", "detail": "RESCORED — CVE-2024-1014 (SE-elektronic GmbH E-DDC3.3). CVSS 6.2 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2024-35260", "detail": "RESCORED — CVE-2024-35260 (Microsoft Power Platform). CVSS 8 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16074", "detail": "RESCORED — CVE-2026-16074 (AstrBotDevs AstrBot). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16076", "detail": "RESCORED — CVE-2026-16076 (AstrBotDevs AstrBot). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16077", "detail": "RESCORED — CVE-2026-16077 (AstrBotDevs AstrBot). CVSS 4.8 → 1.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16081", "detail": "RESCORED — CVE-2026-16081 (Sipeed PicoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16083", "detail": "RESCORED — CVE-2026-16083 (Sipeed PicoClaw). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16085", "detail": "RESCORED — CVE-2026-16085 (Sipeed PicoClaw). CVSS 4.8 → 1.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16088", "detail": "RESCORED — CVE-2026-16088 (halo-dev halo). CVSS 5.1 → 2 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16120", "detail": "RESCORED — CVE-2026-16120 (nextlevelbuilder GoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16121", "detail": "RESCORED — CVE-2026-16121 (nextlevelbuilder GoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16122", "detail": "RESCORED — CVE-2026-16122 (nextlevelbuilder GoClaw). CVSS 4.8 → 1.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16124", "detail": "RESCORED — CVE-2026-16124 (nextlevelbuilder GoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16126", "detail": "RESCORED — CVE-2026-16126 (zevorn rt-claw). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16127", "detail": "RESCORED — CVE-2026-16127 (zevorn rt-claw). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16128", "detail": "RESCORED — CVE-2026-16128 (zevorn rt-claw). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16130", "detail": "RESCORED — CVE-2026-16130 (nearai ironclaw). CVSS 4.8 → 1.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16133", "detail": "RESCORED — CVE-2026-16133 (LiuMengxuan04 MiniCode). CVSS 2.3 → 1.3 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16154", "detail": "RESCORED — CVE-2026-16154 (SourceCodester Class and Exam Timetabling System). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16194", "detail": "RESCORED — CVE-2026-16194 (zhayujie CowAgent). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16195", "detail": "RESCORED — CVE-2026-16195 (Sipeed PicoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16197", "detail": "RESCORED — CVE-2026-16197 (Sipeed PicoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16199", "detail": "RESCORED — CVE-2026-16199 (nextlevelbuilder GoClaw). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16200", "detail": "RESCORED — CVE-2026-16200 (zevorn rt-claw). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16201", "detail": "RESCORED — CVE-2026-16201 (zevorn rt-claw). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16203", "detail": "RESCORED — CVE-2026-16203 (SourceCodester Class and Exam Timetabling System). CVSS 5.1 → 2 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16205", "detail": "RESCORED — CVE-2026-16205 (Pluck CMS). CVSS 4.8 → 1.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16209", "detail": "RESCORED — CVE-2026-16209 (Gerapy). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16211", "detail": "RESCORED — CVE-2026-16211 (allegro). CVSS 2.1 → 1.2 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16212", "detail": "RESCORED — CVE-2026-16212 (awesto django-shop). CVSS 2.3 → 1.3 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16215", "detail": "RESCORED — CVE-2026-16215 (geex-arts django-jet). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16217", "detail": "RESCORED — CVE-2026-16217 (guohongze adminset). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16219", "detail": "RESCORED — CVE-2026-16219 (Croogo CMS). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16222", "detail": "RESCORED — CVE-2026-16222 (1Panel-dev CordysCRM). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16225", "detail": "RESCORED — CVE-2026-16225 (davenardella snap7). CVSS 5.3 → 2.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16228", "detail": "RESCORED — CVE-2026-16228 (SourceCodester Class and Exam Timetabling System). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-33845", "detail": "RESCORED — CVE-2026-33845 (gnutls). CVSS 7.5 → 9.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-3602", "detail": "RESCORED — CVE-2026-3602 (IBM App Connect Enterprise). CVSS 4.7 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-49790", "detail": "RESCORED — CVE-2026-49790 (Microsoft Windows 10 Version 1607). CVSS 7.3 → 7.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-50374", "detail": "RESCORED — CVE-2026-50374 (Microsoft Windows 10 Version 1809). CVSS 6.3 → 6.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-54991", "detail": "RESCORED — CVE-2026-54991 (Microsoft Windows 11 Version 24H2). CVSS 7.8 → 7 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-54992", "detail": "RESCORED — CVE-2026-54992 (Microsoft Windows 10 Version 1607). CVSS 8.4 → 7.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-54995", "detail": "RESCORED — CVE-2026-54995 (Microsoft Windows 10 Version 1607). CVSS 8.1 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-57973", "detail": "RESCORED — CVE-2026-57973 (Microsoft Windows Subsystem for Linux (WSL2)). CVSS 6.3 → 4.7 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-7872", "detail": "RESCORED — CVE-2026-7872 (IBM Langflow OSS). CVSS 7.5 → 8.1 (NVD)." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }