{ "day": "2026-07-29", "boundary": "UTC calendar day", "published_count": 274, "by_severity": { "CRITICAL": 47, "HIGH": 116, "MEDIUM": 103, "LOW": 8 }, "kev_count": 1, "exploit_reference_count": 5, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-20316", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.09816, "epss_percentile": 0.95172, "kev": true, "kev_due_at": "2026-08-01", "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "cwe": "CWE-259", "title": "Cisco Secure Firewall Management Center Software Static Credential Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20316" }, { "rank": 2, "cve_id": "CVE-2026-5492", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.016, "epss_percentile": 0.73892, "kev": false, "kev_due_at": null, "vendor": "DriveLock", "product": "DriveLock", "cwe": "CWE-22", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5492" }, { "rank": 3, "cve_id": "CVE-2026-5491", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.01539, "epss_percentile": 0.72964, "kev": false, "kev_due_at": null, "vendor": "DriveLock", "product": "DriveLock", "cwe": "CWE-22", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5491" }, { "rank": 4, "cve_id": "CVE-2026-5487", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.01535, "epss_percentile": 0.72893, "kev": false, "kev_due_at": null, "vendor": "DriveLock", "product": "DriveLock", "cwe": "CWE-22", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5487" }, { "rank": 5, "cve_id": "CVE-2026-5489", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.01266, "epss_percentile": 0.67496, "kev": false, "kev_due_at": null, "vendor": "DriveLock", "product": "DriveLock", "cwe": "CWE-22", "title": "DriveLock Directory Traversal Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5489" }, { "rank": 6, "cve_id": "CVE-2026-67438", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.00997, "epss_percentile": 0.60048, "kev": false, "kev_due_at": null, "vendor": "OliveTin", "product": "OliveTin", "cwe": "CWE-78", "title": "OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67438" }, { "rank": 7, "cve_id": "CVE-2026-12935", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0091, "epss_percentile": 0.57292, "kev": false, "kev_due_at": null, "vendor": "TP-Link Systems Inc.", "product": "TL-WR940N v6", "cwe": "CWE-121", "title": "Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12935" }, { "rank": 8, "cve_id": "CVE-2026-18072", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00878, "epss_percentile": 0.56312, "kev": false, "kev_due_at": null, "vendor": "nico23", "product": "Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick …", "cwe": "CWE-506", "title": "Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18072" }, { "rank": 9, "cve_id": "CVE-2026-41939", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00801, "epss_percentile": 0.53851, "kev": false, "kev_due_at": null, "vendor": "Care Everywhere LLC", "product": "Care Everywhere Gateway", "cwe": "CWE-1392", "title": "Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41939" }, { "rank": 10, "cve_id": "CVE-2026-14266", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00742, "epss_percentile": 0.51898, "kev": false, "kev_due_at": null, "vendor": "7-Zip", "product": "7-Zip", "cwe": "CWE-122", "title": "7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14266" }, { "rank": 11, "cve_id": "CVE-2026-12357", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00726, "epss_percentile": 0.51349, "kev": false, "kev_due_at": null, "vendor": "Heimdall Data", "product": "Database Proxy", "cwe": "CWE-93", "title": "Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12357" }, { "rank": 12, "cve_id": "CVE-2026-65883", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00709, "epss_percentile": 0.5073, "kev": false, "kev_due_at": null, "vendor": "aimy-extensions.com", "product": "Aimy Captcha-Less Form Guard plugin for Joomla", "cwe": "CWE-502", "title": "Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65883" }, { "rank": 13, "cve_id": "CVE-2026-14900", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0069, "epss_percentile": 0.50031, "kev": false, "kev_due_at": null, "vendor": "StylemixThemes", "product": "Cost Calculator Builder PRO", "cwe": "CWE-94", "title": "Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14900" }, { "rank": 14, "cve_id": "CVE-2026-67192", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00657, "epss_percentile": 0.48673, "kev": false, "kev_due_at": null, "vendor": "Xlight", "product": "Xlight FTP Server", "cwe": "CWE-121", "title": "Xlight FTP Server < 3.9.5 Pre-Auth Stack Buffer Overflow via SSH GCM Cipher", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67192" }, { "rank": 15, "cve_id": "CVE-2026-67191", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00617, "epss_percentile": 0.46839, "kev": false, "kev_due_at": null, "vendor": "Xlight", "product": "Xlight FTP Server", "cwe": "CWE-122", "title": "Xlight FTP Server < 3.9.5 Pre-Auth Heap Buffer Overflow via SSH Parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67191" }, { "rank": 16, "cve_id": "CVE-2026-12476", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00611, "epss_percentile": 0.46564, "kev": false, "kev_due_at": null, "vendor": "smub", "product": "Easy Digital Downloads – eCommerce Payments and Subscriptions made easy", "cwe": "CWE-434", "title": "Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12476" }, { "rank": 17, "cve_id": "CVE-2026-13308", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00567, "epss_percentile": 0.44418, "kev": false, "kev_due_at": null, "vendor": "Autel", "product": "MaxiCharger AC Elite Home", "cwe": "CWE-191", "title": "Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13308" }, { "rank": 18, "cve_id": "CVE-2026-13423", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00536, "epss_percentile": 0.42757, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Streamit", "cwe": "CWE-94", "title": "Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13423" }, { "rank": 19, "cve_id": "CVE-2026-14270", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00532, "epss_percentile": 0.42529, "kev": false, "kev_due_at": null, "vendor": "ThemeComplete", "product": "Extra Checkout Options - addon for Extra Product Options plugin", "cwe": "CWE-434", "title": "Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14270" }, { "rank": 20, "cve_id": "CVE-2026-60112", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00528, "epss_percentile": 0.42291, "kev": false, "kev_due_at": null, "vendor": "NASA-AMMOS", "product": "AIT-GUI", "cwe": "CWE-306", "title": "AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60112" }, { "rank": 21, "cve_id": "CVE-2026-67595", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00528, "epss_percentile": 0.42285, "kev": false, "kev_due_at": null, "vendor": "webreinvent", "product": "vaahcms", "cwe": "CWE-506", "title": "VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67595" }, { "rank": 22, "cve_id": "CVE-2026-60113", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00525, "epss_percentile": 0.42142, "kev": false, "kev_due_at": null, "vendor": "NASA-AMMOS", "product": "AIT-DSN", "cwe": "CWE-306", "title": "AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-60113" }, { "rank": 23, "cve_id": "CVE-2026-58151", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00524, "epss_percentile": 0.42044, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-400", "title": "Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58151" }, { "rank": 24, "cve_id": "CVE-2026-65324", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00524, "epss_percentile": 0.42044, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-400", "title": "Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65324" }, { "rank": 25, "cve_id": "CVE-2026-23904", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00524, "epss_percentile": 0.421, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kyuubi", "cwe": "CWE-923", "title": "Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23904" }, { "rank": 26, "cve_id": "CVE-2026-66723", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00494, "epss_percentile": 0.40158, "kev": false, "kev_due_at": null, "vendor": "CERT.PL", "product": "MWDB Core", "cwe": "CWE-862", "title": "Missing authentication requirement in Remote Instances proxy API in MWDB Core", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66723" }, { "rank": 27, "cve_id": "CVE-2026-11974", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00489, "epss_percentile": 0.39827, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "wp-media-folder-addon", "cwe": "CWE-22", "title": "Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11974" }, { "rank": 28, "cve_id": "CVE-2026-67429", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00488, "epss_percentile": 0.39788, "kev": false, "kev_due_at": null, "vendor": "flytohub", "product": "flyto-core", "cwe": "CWE-22", "title": "Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67429" }, { "rank": 29, "cve_id": "CVE-2026-5057", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00484, "epss_percentile": 0.39497, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-306", "title": "ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5057" }, { "rank": 30, "cve_id": "CVE-2026-5490", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00481, "epss_percentile": 0.39304, "kev": false, "kev_due_at": null, "vendor": "DriveLock", "product": "DriveLock", "cwe": "CWE-89", "title": "DriveLock SQL Injection Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5490" }, { "rank": 31, "cve_id": "CVE-2026-15975", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00473, "epss_percentile": 0.3877, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-770", "title": "Allocation of Resources Without Limits or Throttling in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15975" }, { "rank": 32, "cve_id": "CVE-2026-13723", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00465, "epss_percentile": 0.38236, "kev": false, "kev_due_at": null, "vendor": "Develar", "product": "app-builder", "cwe": "CWE-22", "title": "Develar's electron-builder allows arbitrary file overwrite", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13723" }, { "rank": 33, "cve_id": "CVE-2026-13697", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00463, "epss_percentile": 0.381, "kev": false, "kev_due_at": null, "vendor": "undici", "product": "undici", "cwe": "CWE-200", "title": "undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13697" }, { "rank": 34, "cve_id": "CVE-2026-67215", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00463, "epss_percentile": 0.38067, "kev": false, "kev_due_at": null, "vendor": "DaveGamble", "product": "cJSON", "cwe": "CWE-674", "title": "cJSON JSON Patch copy/add Uncontrolled Recursion Stack Exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67215" }, { "rank": 35, "cve_id": "CVE-2026-58153", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00463, "epss_percentile": 0.3811, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-444", "title": "Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58153" }, { "rank": 36, "cve_id": "CVE-2026-59243", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00445, "epss_percentile": 0.36863, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Airflow FAB provider", "cwe": "CWE-347", "title": "Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59243" }, { "rank": 37, "cve_id": "CVE-2026-58161", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00442, "epss_percentile": 0.36616, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-476", "title": "Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58161" }, { "rank": 38, "cve_id": "CVE-2026-58188", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00433, "epss_percentile": 0.35836, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-787", "title": "Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58188" }, { "rank": 39, "cve_id": "CVE-2026-67432", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00431, "epss_percentile": 0.35644, "kev": false, "kev_due_at": null, "vendor": "modelcontextprotocol", "product": "ruby-sdk", "cwe": "CWE-770", "title": "MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67432" }, { "rank": 40, "cve_id": "CVE-2026-67216", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00427, "epss_percentile": 0.35322, "kev": false, "kev_due_at": null, "vendor": "DaveGamble", "product": "cJSON", "cwe": "CWE-407", "title": "cJSON cJSON_Compare Exponential Complexity Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67216" }, { "rank": 41, "cve_id": "CVE-2026-54680", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00426, "epss_percentile": 0.35264, "kev": false, "kev_due_at": null, "vendor": "kube-logging", "product": "logging-operator", "cwe": "CWE-74", "title": "Logging operator has Fluentd configuration injection that allows remote code execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54680" }, { "rank": 42, "cve_id": "CVE-2026-58182", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00424, "epss_percentile": 0.35113, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-400", "title": "Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58182" }, { "rank": 43, "cve_id": "CVE-2026-46678", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00419, "epss_percentile": 0.34646, "kev": false, "kev_due_at": null, "vendor": "pydantic", "product": "pydantic-ai", "cwe": "CWE-918", "title": "Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46678" }, { "rank": 44, "cve_id": "CVE-2026-58160", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00418, "epss_percentile": 0.34524, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-125", "title": "Apache Traffic Server: Out-of-bounds reads while parsing DNS responses", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58160" }, { "rank": 45, "cve_id": "CVE-2026-58186", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00416, "epss_percentile": 0.34353, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-20", "title": "Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58186" }, { "rank": 46, "cve_id": "CVE-2026-22068", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0041, "epss_percentile": 0.33769, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-777", "title": "Apache Traffic Server: Regex mappings match with malicious domain names", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22068" }, { "rank": 47, "cve_id": "CVE-2026-58155", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00404, "epss_percentile": 0.33325, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-444", "title": "Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58155" }, { "rank": 48, "cve_id": "CVE-2026-58175", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.004, "epss_percentile": 0.32872, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-401", "title": "Apache Traffic Server: HostDB SRV handling leaks memory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58175" }, { "rank": 49, "cve_id": "CVE-2026-58178", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.004, "epss_percentile": 0.32872, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-674", "title": "Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58178" }, { "rank": 50, "cve_id": "CVE-2026-58180", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.004, "epss_percentile": 0.32872, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-121", "title": "Apache Traffic Server: txn_box plugin overflows the stack from attacker input", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58180" }, { "rank": 51, "cve_id": "CVE-2026-64560", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00399, "epss_percentile": 0.3269, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "posix-cpu-timers: Prevent UAF caused by non-leader exec() race", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64560" }, { "rank": 52, "cve_id": "CVE-2026-58154", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00398, "epss_percentile": 0.3267, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-787", "title": "Apache Traffic Server: Memory-safety errors in MIME and header parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58154" }, { "rank": 53, "cve_id": "CVE-2026-5056", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00398, "epss_percentile": 0.32594, "kev": false, "kev_due_at": null, "vendor": "GStreamer", "product": "GStreamer", "cwe": "CWE-121", "title": "GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5056" }, { "rank": 54, "cve_id": "CVE-2026-14529", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00395, "epss_percentile": 0.32368, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "WebSphere Application Server", "cwe": "CWE-306", "title": "IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14529" }, { "rank": 55, "cve_id": "CVE-2026-58164", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00392, "epss_percentile": 0.3197, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-416", "title": "Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58164" }, { "rank": 56, "cve_id": "CVE-2026-58181", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00392, "epss_percentile": 0.3197, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-121", "title": "Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58181" }, { "rank": 57, "cve_id": "CVE-2026-58183", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00391, "epss_percentile": 0.31838, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-20", "title": "Apache Traffic Server: prefetch plugin can crash on attacker-influenced input", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58183" }, { "rank": 58, "cve_id": "CVE-2026-67201", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00391, "epss_percentile": 0.3189, "kev": false, "kev_due_at": null, "vendor": "vlang", "product": "v", "cwe": "CWE-436", "title": "V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67201" }, { "rank": 59, "cve_id": "CVE-2026-11973", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00385, "epss_percentile": 0.3128, "kev": false, "kev_due_at": null, "vendor": "wp-lab", "product": "WP-Lister Lite for eBay", "cwe": "CWE-89", "title": "WP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11973" }, { "rank": 60, "cve_id": "CVE-2026-18191", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00383, "epss_percentile": 0.3107, "kev": false, "kev_due_at": null, "vendor": "Vacron", "product": "VIN-DS783E-E6", "cwe": "CWE-912", "title": "Vacron｜IP Camera - Hidden Functionality", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18191" }, { "rank": 61, "cve_id": "CVE-2026-58163", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00383, "epss_percentile": 0.31011, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-502", "title": "Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58163" }, { "rank": 62, "cve_id": "CVE-2026-33930", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00381, "epss_percentile": 0.30825, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-121", "title": "Apache Traffic Server: Buffer overflow via Host field that has a long string value", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33930" }, { "rank": 63, "cve_id": "CVE-2026-18192", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0038, "epss_percentile": 0.30769, "kev": false, "kev_due_at": null, "vendor": "Vacron", "product": "VIN-DS783E-E6", "cwe": "CWE-23", "title": "Vacron｜IP Camera - Arbitrary File Read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18192" }, { "rank": 64, "cve_id": "CVE-2026-57834", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00379, "epss_percentile": 0.30683, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-444", "title": "Apache Traffic Server: Malformed chunked message body allows request smuggling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57834" }, { "rank": 65, "cve_id": "CVE-2026-18236", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00376, "epss_percentile": 0.30372, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Google-ADK", "cwe": "CWE-863", "title": "Google-ADK Continuation Forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18236" }, { "rank": 66, "cve_id": "CVE-2026-33267", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00375, "epss_percentile": 0.30277, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-20", "title": "Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33267" }, { "rank": 67, "cve_id": "CVE-2026-0667", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00369, "epss_percentile": 0.29575, "kev": false, "kev_due_at": null, "vendor": "Schneider Electric", "product": "SCADAPack 47x", "cwe": "CWE-754", "title": "CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0667" }, { "rank": 68, "cve_id": "CVE-2026-58150", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00367, "epss_percentile": 0.29332, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-444", "title": "Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58150" }, { "rank": 69, "cve_id": "CVE-2026-58179", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00366, "epss_percentile": 0.29265, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-121", "title": "Apache Traffic Server: regex_remap plugin overflows the stack from attacker input", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58179" }, { "rank": 70, "cve_id": "CVE-2026-65886", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00364, "epss_percentile": 0.29091, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-22", "title": "Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65886" }, { "rank": 71, "cve_id": "CVE-2025-10656", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00362, "epss_percentile": 0.28892, "kev": false, "kev_due_at": null, "vendor": "holest", "product": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light", "cwe": "CWE-863", "title": "Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation", "url": "https://www.cve.org/CVERecord?id=CVE-2025-10656" }, { "rank": 72, "cve_id": "CVE-2026-58189", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.0036, "epss_percentile": 0.28624, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-918", "title": "Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58189" }, { "rank": 73, "cve_id": "CVE-2026-67427", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00359, "epss_percentile": 0.28547, "kev": false, "kev_due_at": null, "vendor": "flytohub", "product": "flyto-core", "cwe": "CWE-522", "title": "Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67427" }, { "rank": 74, "cve_id": "CVE-2026-12144", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00358, "epss_percentile": 0.28442, "kev": false, "kev_due_at": null, "vendor": "saadiqbal", "product": "Wholesale for WooCommerce", "cwe": "CWE-269", "title": "Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12144" }, { "rank": 75, "cve_id": "CVE-2026-65100", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00354, "epss_percentile": 0.28066, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-696", "title": "Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65100" }, { "rank": 76, "cve_id": "CVE-2026-67437", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0035, "epss_percentile": 0.2755, "kev": false, "kev_due_at": null, "vendor": "OliveTin", "product": "OliveTin", "cwe": "CWE-400", "title": "OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67437" }, { "rank": 77, "cve_id": "CVE-2026-58184", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00349, "epss_percentile": 0.27451, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-787", "title": "Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58184" }, { "rank": 78, "cve_id": "CVE-2026-50782", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00349, "epss_percentile": 0.275, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-611", "title": "Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50782" }, { "rank": 79, "cve_id": "CVE-2026-54735", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00345, "epss_percentile": 0.27089, "kev": false, "kev_due_at": null, "vendor": "prebid", "product": "prebid-server", "cwe": "CWE-918", "title": "prebid-server's request forgery vulnerability allows for possible host environment data extraction", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54735" }, { "rank": 80, "cve_id": "CVE-2026-58158", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00345, "epss_percentile": 0.27035, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-121", "title": "Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58158" }, { "rank": 81, "cve_id": "CVE-2026-58152", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.27034, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-190", "title": "Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58152" }, { "rank": 82, "cve_id": "CVE-2026-58187", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.27035, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-787", "title": "Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58187" }, { "rank": 83, "cve_id": "CVE-2026-15344", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00345, "epss_percentile": 0.27059, "kev": false, "kev_due_at": null, "vendor": "opajaap", "product": "WP Photo Album Plus", "cwe": "CWE-89", "title": "WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15344" }, { "rank": 84, "cve_id": "CVE-2026-54693", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00343, "epss_percentile": 0.268, "kev": false, "kev_due_at": null, "vendor": "zitadel", "product": "zitadel", "cwe": "CWE-863", "title": "ZITADEL Users Can Self-Verify Email/Phone via API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54693" }, { "rank": 85, "cve_id": "CVE-2026-58185", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00338, "epss_percentile": 0.26237, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-416", "title": "Apache Traffic Server: Use-after-free in the intercept plugin", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58185" }, { "rank": 86, "cve_id": "CVE-2026-67428", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.26136, "kev": false, "kev_due_at": null, "vendor": "flytohub", "product": "flyto-core", "cwe": "CWE-918", "title": "Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67428" }, { "rank": 87, "cve_id": "CVE-2026-50622", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00336, "epss_percentile": 0.26044, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Atlas", "cwe": "CWE-862", "title": "Apache Atlas: Missing Authorization on Admin Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50622" }, { "rank": 88, "cve_id": "CVE-2026-59899", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00335, "epss_percentile": 0.25872, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-770", "title": "Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59899" }, { "rank": 89, "cve_id": "CVE-2026-18022", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00334, "epss_percentile": 0.25833, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "pgvector", "cwe": "CWE-190", "title": "pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18022" }, { "rank": 90, "cve_id": "CVE-2026-6267", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00333, "epss_percentile": 0.25694, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-201", "title": "Insertion of Sensitive Information Into Sent Data in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6267" }, { "rank": 91, "cve_id": "CVE-2026-67214", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.0033, "epss_percentile": 0.253, "kev": false, "kev_due_at": null, "vendor": "nanoid_project", "product": "nanoid", "cwe": "CWE-835", "title": "nanoid Infinite Loop via Negative Size in non-secure module", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67214" }, { "rank": 92, "cve_id": "CVE-2026-44943", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.0033, "epss_percentile": 0.25351, "kev": false, "kev_due_at": null, "vendor": "open-iscsi", "product": "open-iscsi", "cwe": "CWE-22", "title": "remote limited file-write as root via discovery in open-iscsi", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44943" }, { "rank": 93, "cve_id": "CVE-2026-63227", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00328, "epss_percentile": 0.25139, "kev": false, "kev_due_at": null, "vendor": "An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.", "product": "Koollab LMS", "cwe": "CWE-434", "title": "Unrestricted SCORM file upload vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63227" }, { "rank": 94, "cve_id": "CVE-2026-58177", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00327, "epss_percentile": 0.24964, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-787", "title": "Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58177" }, { "rank": 95, "cve_id": "CVE-2026-24033", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00326, "epss_percentile": 0.24879, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-444", "title": "Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24033" }, { "rank": 96, "cve_id": "CVE-2026-14341", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00326, "epss_percentile": 0.24946, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-862", "title": "Missing Authorization in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14341" }, { "rank": 97, "cve_id": "CVE-2026-54078", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0032, "epss_percentile": 0.24174, "kev": false, "kev_due_at": null, "vendor": "veraPDF", "product": "veraPDF-validation", "cwe": "CWE-611", "title": "veraPDF Validation XXE via Rich Text", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54078" }, { "rank": 98, "cve_id": "CVE-2026-54079", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.0032, "epss_percentile": 0.24174, "kev": false, "kev_due_at": null, "vendor": "veraPDF", "product": "veraPDF-validation", "cwe": "CWE-611", "title": "veraPDF Validation XXE via XFA", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54079" }, { "rank": 99, "cve_id": "CVE-2026-67425", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.0032, "epss_percentile": 0.24196, "kev": false, "kev_due_at": null, "vendor": "flytohub", "product": "flyto-core", "cwe": "CWE-201", "title": "Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67425" }, { "rank": 100, "cve_id": "CVE-2026-67213", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00319, "epss_percentile": 0.24107, "kev": false, "kev_due_at": null, "vendor": "nanoid_project", "product": "nanoid", "cwe": "CWE-835", "title": "nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67213" }, { "rank": 101, "cve_id": "CVE-2026-58159", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00317, "epss_percentile": 0.23908, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-863", "title": "Apache Traffic Server: Listener and ACL handling allow access-control bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58159" }, { "rank": 102, "cve_id": "CVE-2026-12436", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.0031, "epss_percentile": 0.23111, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-915", "title": "Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12436" }, { "rank": 103, "cve_id": "CVE-2026-41920", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00309, "epss_percentile": 0.23037, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-284", "title": "Apache Traffic Server: SNI to Host header matching policy is not properly enforced", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41920" }, { "rank": 104, "cve_id": "CVE-2026-67426", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00308, "epss_percentile": 0.22901, "kev": false, "kev_due_at": null, "vendor": "flytohub", "product": "flyto-core", "cwe": "CWE-306", "title": "Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67426" }, { "rank": 105, "cve_id": "CVE-2026-67430", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00308, "epss_percentile": 0.22933, "kev": false, "kev_due_at": null, "vendor": "modelcontextprotocol", "product": "ruby-sdk", "cwe": "CWE-401", "title": "MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67430" }, { "rank": 106, "cve_id": "CVE-2026-14488", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00307, "epss_percentile": 0.22793, "kev": false, "kev_due_at": null, "vendor": "Meta Box", "product": "Meta Box AIO", "cwe": "CWE-862", "title": "Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14488" }, { "rank": 107, "cve_id": "CVE-2026-67194", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00305, "epss_percentile": 0.22582, "kev": false, "kev_due_at": null, "vendor": "svarshavchik", "product": "Courier IMAP", "cwe": "CWE-674", "title": "Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67194" }, { "rank": 108, "cve_id": "CVE-2026-14643", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00304, "epss_percentile": 0.2243, "kev": false, "kev_due_at": null, "vendor": "undici", "product": "undici", "cwe": "CWE-436", "title": "undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14643" }, { "rank": 109, "cve_id": "CVE-2026-16655", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00304, "epss_percentile": 0.22414, "kev": false, "kev_due_at": null, "vendor": "wpmanageninja", "product": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "cwe": "CWE-79", "title": "Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16655" }, { "rank": 110, "cve_id": "CVE-2026-54080", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00302, "epss_percentile": 0.22172, "kev": false, "kev_due_at": null, "vendor": "veraPDF", "product": "veraPDF-parser", "cwe": "CWE-1325", "title": "veraPDF Parser DoS via PostScript CMap Streams", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54080" }, { "rank": 111, "cve_id": "CVE-2026-54081", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00302, "epss_percentile": 0.22172, "kev": false, "kev_due_at": null, "vendor": "veraPDF", "product": "veraPDF-parser", "cwe": "CWE-1325", "title": "veraPDF Parser DoS via PostScript Type 1 Font Programs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54081" }, { "rank": 112, "cve_id": "CVE-2026-65887", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00301, "epss_percentile": 0.22077, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65887" }, { "rank": 113, "cve_id": "CVE-2026-8338", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.003, "epss_percentile": 0.21986, "kev": false, "kev_due_at": null, "vendor": "Black Duck", "product": "Coverity Connect", "cwe": "CWE-288", "title": "Authentication and Authorization Bypass in Coverity Connect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8338" }, { "rank": 114, "cve_id": "CVE-2026-50642", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.003, "epss_percentile": 0.21987, "kev": false, "kev_due_at": null, "vendor": "so-fancy", "product": "diff-so-fancy", "cwe": "CWE-116", "title": "Terminal Escape Injection in diff‑so‑fancy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50642" }, { "rank": 115, "cve_id": "CVE-2026-16326", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00299, "epss_percentile": 0.21917, "kev": false, "kev_due_at": null, "vendor": "HashiCorp", "product": "Tooling", "cwe": "CWE-488", "title": "consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16326" }, { "rank": 116, "cve_id": "CVE-2026-67217", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00298, "epss_percentile": 0.21766, "kev": false, "kev_due_at": null, "vendor": "DaveGamble", "product": "cJSON", "cwe": "CWE-696", "title": "cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67217" }, { "rank": 117, "cve_id": "CVE-2026-63229", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00296, "epss_percentile": 0.21564, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-89", "title": "Pre-authentication blind SQL injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63229" }, { "rank": 118, "cve_id": "CVE-2026-63230", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00296, "epss_percentile": 0.21563, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-89", "title": "Pre-authentication error-based SQL injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63230" }, { "rank": 119, "cve_id": "CVE-2026-18220", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00296, "epss_percentile": 0.21637, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18220" }, { "rank": 120, "cve_id": "CVE-2026-16751", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00295, "epss_percentile": 0.21467, "kev": false, "kev_due_at": null, "vendor": "Ente", "product": "Museum Server", "cwe": null, "title": "Ente Museum Server Authorization Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16751" }, { "rank": 121, "cve_id": "CVE-2026-14351", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00295, "epss_percentile": 0.21434, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-1230", "title": "Exposure of Sensitive Information Through Metadata in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14351" }, { "rank": 122, "cve_id": "CVE-2026-63232", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00294, "epss_percentile": 0.21407, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-89", "title": "SQL injection and unsafe deserialisation vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63232" }, { "rank": 123, "cve_id": "CVE-2026-63233", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00294, "epss_percentile": 0.21407, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-89", "title": "SQL injection and unsafe deserialisation vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63233" }, { "rank": 124, "cve_id": "CVE-2026-63234", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00294, "epss_percentile": 0.21407, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-89", "title": "SQL injection and unsafe deserialisation vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63234" }, { "rank": 125, "cve_id": "CVE-2026-65885", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00292, "epss_percentile": 0.21191, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-434", "title": "Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65885" }, { "rank": 126, "cve_id": "CVE-2026-67431", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00292, "epss_percentile": 0.21177, "kev": false, "kev_due_at": null, "vendor": "modelcontextprotocol", "product": "ruby-sdk", "cwe": "CWE-284", "title": "MCP Ruby SDK: Ruby SSE Session Poisoning", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67431" }, { "rank": 127, "cve_id": "CVE-2026-13346", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.00292, "epss_percentile": 0.21174, "kev": false, "kev_due_at": null, "vendor": "Python Packaging Authority", "product": "pip", "cwe": "CWE-36", "title": "pip absolute path traversal during download from malicious package indexes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13346" }, { "rank": 128, "cve_id": "CVE-2026-65888", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.0029, "epss_percentile": 0.20979, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65888" }, { "rank": 129, "cve_id": "CVE-2026-65889", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.0029, "epss_percentile": 0.20953, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65889" }, { "rank": 130, "cve_id": "CVE-2026-9177", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00288, "epss_percentile": 0.20752, "kev": false, "kev_due_at": null, "vendor": "Axway", "product": "SecureTransport", "cwe": "CWE-1336", "title": "Server-Side Template Injection in SecureTransport's Apache Velocity mail templates", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9177" }, { "rank": 131, "cve_id": "CVE-2026-54666", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00286, "epss_percentile": 0.20501, "kev": false, "kev_due_at": null, "vendor": "acacode", "product": "swagger-typescript-api", "cwe": "CWE-74", "title": "swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54666" }, { "rank": 132, "cve_id": "CVE-2026-67435", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00286, "epss_percentile": 0.20582, "kev": false, "kev_due_at": null, "vendor": "Linuxfabrik", "product": "monitoring-plugins", "cwe": "CWE-200", "title": "linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67435" }, { "rank": 133, "cve_id": "CVE-2026-4672", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00285, "epss_percentile": 0.20479, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-862", "title": "Missing Authorization in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4672" }, { "rank": 134, "cve_id": "CVE-2026-65884", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00284, "epss_percentile": 0.20379, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65884" }, { "rank": 135, "cve_id": "CVE-2026-65890", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00282, "epss_percentile": 0.20083, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-89", "title": "Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65890" }, { "rank": 136, "cve_id": "CVE-2026-67193", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00281, "epss_percentile": 0.20056, "kev": false, "kev_due_at": null, "vendor": "Xlight", "product": "Xlight FTP Server", "cwe": "CWE-203", "title": "Xlight FTP Server < 3.9.5 Information Disclosure via USER Command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67193" }, { "rank": 137, "cve_id": "CVE-2025-69943", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00276, "epss_percentile": 0.19467, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69943" }, { "rank": 138, "cve_id": "CVE-2026-58157", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00274, "epss_percentile": 0.19199, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-200", "title": "Apache Traffic Server: Improper server-session reuse can expose data across client connections", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58157" }, { "rank": 139, "cve_id": "CVE-2026-18255", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00272, "epss_percentile": 0.19038, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Quay 3", "cwe": "CWE-863", "title": "Quay: quay: global read-only superuser can view robot account tokens", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18255" }, { "rank": 140, "cve_id": "CVE-2026-54661", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0027, "epss_percentile": 0.18678, "kev": false, "kev_due_at": null, "vendor": "acacode", "product": "swagger-typescript-api", "cwe": "CWE-74", "title": "swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54661" }, { "rank": 141, "cve_id": "CVE-2026-54662", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0027, "epss_percentile": 0.18677, "kev": false, "kev_due_at": null, "vendor": "acacode", "product": "swagger-typescript-api", "cwe": "CWE-74", "title": "swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54662" }, { "rank": 142, "cve_id": "CVE-2026-54664", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0027, "epss_percentile": 0.18678, "kev": false, "kev_due_at": null, "vendor": "acacode", "product": "swagger-typescript-api", "cwe": "CWE-74", "title": "swagger-typescript-api vulnerable to code injection via unescaped enum string values", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54664" }, { "rank": 143, "cve_id": "CVE-2026-6089", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.0027, "epss_percentile": 0.18604, "kev": false, "kev_due_at": null, "vendor": "blendmedia", "product": "WP CTA – Call Now Button, Sticky Button & Call to Action Builder", "cwe": "CWE-918", "title": "WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6089" }, { "rank": 144, "cve_id": "CVE-2026-66724", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00268, "epss_percentile": 0.18483, "kev": false, "kev_due_at": null, "vendor": "CERT.PL", "product": "MWDB Core", "cwe": "CWE-862", "title": "Permission Bypass Via Undocumented HTTP Methods In MWDB Core", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66724" }, { "rank": 145, "cve_id": "CVE-2026-59901", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00263, "epss_percentile": 0.17689, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-835", "title": "Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59901" }, { "rank": 146, "cve_id": "CVE-2025-65340", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0026, "epss_percentile": 0.17347, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-65340" }, { "rank": 147, "cve_id": "CVE-2025-67403", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0026, "epss_percentile": 0.17349, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67403" }, { "rank": 148, "cve_id": "CVE-2025-67404", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0026, "epss_percentile": 0.17349, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67404" }, { "rank": 149, "cve_id": "CVE-2025-69942", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0026, "epss_percentile": 0.17351, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69942" }, { "rank": 150, "cve_id": "CVE-2026-6336", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00255, "epss_percentile": 0.1673, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-863", "title": "Incorrect Authorization in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6336" }, { "rank": 151, "cve_id": "CVE-2026-13690", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00254, "epss_percentile": 0.16576, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "UsersWP", "cwe": "CWE-287", "title": "UsersWP < 1.2.67 - Two-Factor Authentication Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13690" }, { "rank": 152, "cve_id": "CVE-2026-65891", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00254, "epss_percentile": 0.16658, "kev": false, "kev_due_at": null, "vendor": "joomlacontenteditor.net", "product": "Joomla Content Editor (JCE) extension for Joomla", "cwe": "CWE-20", "title": "Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65891" }, { "rank": 153, "cve_id": "CVE-2026-16553", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00254, "epss_percentile": 0.16632, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-522", "title": "Insufficiently Protected Credentials in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16553" }, { "rank": 154, "cve_id": "CVE-2026-67439", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16411, "kev": false, "kev_due_at": null, "vendor": "OliveTin", "product": "OliveTin", "cwe": "CWE-863", "title": "OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67439" }, { "rank": 155, "cve_id": "CVE-2026-55995", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00252, "epss_percentile": 0.1634, "kev": false, "kev_due_at": null, "vendor": "open-iscsi", "product": "open-iscsi", "cwe": "CWE-415", "title": "Double-free in the iSNS attribute decoder in open-iscsi", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55995" }, { "rank": 156, "cve_id": "CVE-2026-63231", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00252, "epss_percentile": 0.16387, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-89", "title": "Post-authentication SQL injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63231" }, { "rank": 157, "cve_id": "CVE-2026-15077", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16166, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-74", "title": "Improper Neutralization of Input Used for LLM Prompting in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15077" }, { "rank": 158, "cve_id": "CVE-2026-50558", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.0025, "epss_percentile": 0.16086, "kev": false, "kev_due_at": null, "vendor": "brightio", "product": "penelope", "cwe": "CWE-22", "title": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50558" }, { "rank": 159, "cve_id": "CVE-2026-67436", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00249, "epss_percentile": 0.15956, "kev": false, "kev_due_at": null, "vendor": "Linuxfabrik", "product": "monitoring-plugins", "cwe": "CWE-20", "title": "Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67436" }, { "rank": 160, "cve_id": "CVE-2026-59898", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.1601, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-444", "title": "Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59898" }, { "rank": 161, "cve_id": "CVE-2026-13425", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00248, "epss_percentile": 0.1586, "kev": false, "kev_due_at": null, "vendor": "code4life", "product": "Database for CF7", "cwe": "CWE-79", "title": "Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13425" }, { "rank": 162, "cve_id": "CVE-2026-58156", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00248, "epss_percentile": 0.1588, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-863", "title": "Apache Traffic Server: URL and port parsing errors allow access-control bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58156" }, { "rank": 163, "cve_id": "CVE-2026-18266", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00248, "epss_percentile": 0.15889, "kev": false, "kev_due_at": null, "vendor": "LangGenius", "product": "Dify", "cwe": "CWE-601", "title": "Dify AI Workflow oauth_redirect_url Open Redirect Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18266" }, { "rank": 164, "cve_id": "CVE-2026-15144", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00246, "epss_percentile": 0.15665, "kev": false, "kev_due_at": null, "vendor": "@fastify/rate-limit", "product": "@fastify/rate-limit", "cwe": "CWE-307", "title": "@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15144" }, { "rank": 165, "cve_id": "CVE-2026-54660", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00243, "epss_percentile": 0.15268, "kev": false, "kev_due_at": null, "vendor": "acacode", "product": "swagger-typescript-api", "cwe": "CWE-200", "title": "swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54660" }, { "rank": 166, "cve_id": "CVE-2026-64557", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00241, "epss_percentile": 0.14949, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64557" }, { "rank": 167, "cve_id": "CVE-2026-16597", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00241, "epss_percentile": 0.14975, "kev": false, "kev_due_at": null, "vendor": "duracelltomi", "product": "GTM4WP – A Google Tag Manager (GTM) plugin for WordPress", "cwe": "CWE-79", "title": "GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16597" }, { "rank": 168, "cve_id": "CVE-2026-33385", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.0024, "epss_percentile": 0.1489, "kev": false, "kev_due_at": null, "vendor": "OpenSolution", "product": "Quick.CMS", "cwe": "CWE-89", "title": "Blind SQL Injection in Quick.CMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33385" }, { "rank": 169, "cve_id": "CVE-2026-14300", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00239, "epss_percentile": 0.14744, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)", "cwe": "CWE-287", "title": "miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14300" }, { "rank": 170, "cve_id": "CVE-2026-59920", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00239, "epss_percentile": 0.14729, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-93", "title": "Netty: STOMP CONNECT Frame Header Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59920" }, { "rank": 171, "cve_id": "CVE-2026-67424", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00237, "epss_percentile": 0.14431, "kev": false, "kev_due_at": null, "vendor": "flytohub", "product": "flyto-core", "cwe": "CWE-918", "title": "Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67424" }, { "rank": 172, "cve_id": "CVE-2026-4604", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00235, "epss_percentile": 0.1417, "kev": false, "kev_due_at": null, "vendor": "klubraum", "product": "Klubraum Membership Request", "cwe": "CWE-862", "title": "Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4604" }, { "rank": 173, "cve_id": "CVE-2026-3093", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00235, "epss_percentile": 0.14218, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-79", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-3093" }, { "rank": 174, "cve_id": "CVE-2026-12703", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00234, "epss_percentile": 0.14129, "kev": false, "kev_due_at": null, "vendor": "TeamViewer", "product": "Remote", "cwe": "CWE-288", "title": "Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12703" }, { "rank": 175, "cve_id": "CVE-2026-8791", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00234, "epss_percentile": 0.14092, "kev": false, "kev_due_at": null, "vendor": "ameliabooking", "product": "Booking System Trafft", "cwe": "CWE-79", "title": "Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8791" }, { "rank": 176, "cve_id": "CVE-2026-16328", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00232, "epss_percentile": 0.13856, "kev": false, "kev_due_at": null, "vendor": "HashiCorp", "product": "Tooling", "cwe": "CWE-918", "title": "consul-mcp-server vulnerable to server side request forgery leading to token exposure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16328" }, { "rank": 177, "cve_id": "CVE-2025-60931", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00232, "epss_percentile": 0.13857, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-639", "title": "An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60931" }, { "rank": 178, "cve_id": "CVE-2026-65943", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00232, "epss_percentile": 0.13855, "kev": false, "kev_due_at": null, "vendor": "rolandd.com", "product": "RO CSVI extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65943" }, { "rank": 179, "cve_id": "CVE-2026-59900", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00232, "epss_percentile": 0.13886, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-444", "title": "Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59900" }, { "rank": 180, "cve_id": "CVE-2026-54082", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0023, "epss_percentile": 0.13628, "kev": false, "kev_due_at": null, "vendor": "veraPDF", "product": "veraPDF-validation", "cwe": "CWE-611", "title": "veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54082" }, { "rank": 181, "cve_id": "CVE-2026-13605", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00229, "epss_percentile": 0.13433, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "PhotoSwipe", "cwe": "CWE-79", "title": "Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13605" }, { "rank": 182, "cve_id": "CVE-2026-13307", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00228, "epss_percentile": 0.1328, "kev": false, "kev_due_at": null, "vendor": "Autel", "product": "MaxiCharger AC Elite Home", "cwe": "CWE-122", "title": "Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13307" }, { "rank": 183, "cve_id": "CVE-2026-13309", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00228, "epss_percentile": 0.13281, "kev": false, "kev_due_at": null, "vendor": "Autel", "product": "MaxiCharger AC Elite Home", "cwe": "CWE-121", "title": "Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13309" }, { "rank": 184, "cve_id": "CVE-2026-58162", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00225, "epss_percentile": 0.12903, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-295", "title": "Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58162" }, { "rank": 185, "cve_id": "CVE-2026-17166", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00225, "epss_percentile": 0.13027, "kev": false, "kev_due_at": null, "vendor": "magepeopleteam", "product": "Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar", "cwe": "CWE-862", "title": "Event Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17166" }, { "rank": 186, "cve_id": "CVE-2025-14562", "cvss_base": 3.1, "cvss_severity": "LOW", "epss_score": 0.00225, "epss_percentile": 0.12906, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-863", "title": "Incorrect Authorization in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2025-14562" }, { "rank": 187, "cve_id": "CVE-2026-18207", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12614, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-285", "title": "Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18207" }, { "rank": 188, "cve_id": "CVE-2026-15831", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12506, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-1270", "title": "Generation of Incorrect Security Tokens in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15831" }, { "rank": 189, "cve_id": "CVE-2026-18201", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00217, "epss_percentile": 0.11908, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-862", "title": "Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18201" }, { "rank": 190, "cve_id": "CVE-2026-12895", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00216, "epss_percentile": 0.11824, "kev": false, "kev_due_at": null, "vendor": "Frappe", "product": "ERPNext", "cwe": "CWE-89", "title": "SQL Injection in Frappe's ERPNext", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12895" }, { "rank": 191, "cve_id": "CVE-2026-63238", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00216, "epss_percentile": 0.11874, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-287", "title": "Authentication bypass vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63238" }, { "rank": 192, "cve_id": "CVE-2026-5060", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00214, "epss_percentile": 0.11588, "kev": false, "kev_due_at": null, "vendor": "stylemix", "product": "MasterStudy LMS WordPress Plugin – for Online Courses and Education", "cwe": "CWE-639", "title": "MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5060" }, { "rank": 193, "cve_id": "CVE-2026-54705", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00208, "epss_percentile": 0.10866, "kev": false, "kev_due_at": null, "vendor": "arnog", "product": "mathlive", "cwe": "CWE-116", "title": "mathlive's Lack of Escaping of HTML allows for XSS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54705" }, { "rank": 194, "cve_id": "CVE-2026-12938", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.10582, "kev": false, "kev_due_at": null, "vendor": "contrid", "product": "Newsletters", "cwe": "CWE-79", "title": "Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12938" }, { "rank": 195, "cve_id": "CVE-2026-12939", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.10581, "kev": false, "kev_due_at": null, "vendor": "contrid", "product": "Newsletters", "cwe": "CWE-79", "title": "Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12939" }, { "rank": 196, "cve_id": "CVE-2026-11351", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.1057, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "ShinyStat Analytics", "cwe": "CWE-200", "title": "ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11351" }, { "rank": 197, "cve_id": "CVE-2026-66489", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00205, "epss_percentile": 0.10396, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-200", "title": "Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66489" }, { "rank": 198, "cve_id": "CVE-2026-66488", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00204, "epss_percentile": 0.10308, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-285", "title": "Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66488" }, { "rank": 199, "cve_id": "CVE-2026-8339", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10189, "kev": false, "kev_due_at": null, "vendor": "Black Duck", "product": "Coverity Connect", "cwe": "CWE-89", "title": "SQL Injection in Coverity Connect SOAP API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8339" }, { "rank": 200, "cve_id": "CVE-2025-67406", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10122, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is interpolated directly into an SQL query, allowing attackers to infer or extract data and, in some cases, execute stacked/time-based payloads. ¶¶ Affected Component & Parameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=1 HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Location: GET Injection Techniques (as identified by sqlmap) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=1 AND EXTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=6268,1))),0x716a7a6b71)) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp Repeater)", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67406" }, { "rank": 201, "cve_id": "CVE-2026-13113", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.0984, "kev": false, "kev_due_at": null, "vendor": "GitLab", "product": "GitLab", "cwe": "CWE-367", "title": "Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13113" }, { "rank": 202, "cve_id": "CVE-2026-5626", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00199, "epss_percentile": 0.09711, "kev": false, "kev_due_at": null, "vendor": "bplugins", "product": "Survey Form Block – collect answers and insights from your audience", "cwe": "CWE-862", "title": "Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5626" }, { "rank": 203, "cve_id": "CVE-2026-64685", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00198, "epss_percentile": 0.09507, "kev": false, "kev_due_at": null, "vendor": "ImageMagick", "product": "ImageMagick", "cwe": "CWE-125", "title": "ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64685" }, { "rank": 204, "cve_id": "CVE-2026-54249", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00197, "epss_percentile": 0.09443, "kev": false, "kev_due_at": null, "vendor": "pydantic", "product": "pydantic-ai", "cwe": "CWE-918", "title": "VercelAIAdapter trusts client-controlled `providerMetadata` to construct `UploadedFile` — S3/GCS confused deputy via provider metadata injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54249" }, { "rank": 205, "cve_id": "CVE-2026-65975", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00197, "epss_percentile": 0.09429, "kev": false, "kev_due_at": null, "vendor": "pydantic", "product": "pydantic-ai", "cwe": "CWE-863", "title": "Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65975" }, { "rank": 206, "cve_id": "CVE-2026-63235", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00196, "epss_percentile": 0.09267, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-284", "title": "Improper access control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63235" }, { "rank": 207, "cve_id": "CVE-2026-63118", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00195, "epss_percentile": 0.09239, "kev": false, "kev_due_at": null, "vendor": "modelcontextprotocol", "product": "ruby-sdk", "cwe": "CWE-346", "title": "MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63118" }, { "rank": 208, "cve_id": "CVE-2026-15157", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00193, "epss_percentile": 0.08946, "kev": false, "kev_due_at": null, "vendor": "undici", "product": "undici", "cwe": "CWE-93", "title": "undici vulnerable to CRLF Injection via blob-like body 'type' property", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15157" }, { "rank": 209, "cve_id": "CVE-2026-18174", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00193, "epss_percentile": 0.0895, "kev": false, "kev_due_at": null, "vendor": "@fastify/forwarded", "product": "@fastify/forwarded", "cwe": "CWE-20", "title": "@fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18174" }, { "rank": 210, "cve_id": "CVE-2026-16729", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00191, "epss_percentile": 0.08712, "kev": false, "kev_due_at": null, "vendor": "undici", "product": "undici", "cwe": "CWE-74", "title": "undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16729" }, { "rank": 211, "cve_id": "CVE-2026-16463", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00189, "epss_percentile": 0.08576, "kev": false, "kev_due_at": null, "vendor": "Autodesk", "product": "AutoCAD", "cwe": "CWE-122", "title": "DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16463" }, { "rank": 212, "cve_id": "CVE-2026-7436", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00188, "epss_percentile": 0.08356, "kev": false, "kev_due_at": null, "vendor": "wpclever", "product": "WPC Badge Management for WooCommerce", "cwe": "CWE-79", "title": "WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7436" }, { "rank": 213, "cve_id": "CVE-2026-15735", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00188, "epss_percentile": 0.08359, "kev": false, "kev_due_at": null, "vendor": "itpathsolutions", "product": "Contact Form to Any API", "cwe": "CWE-79", "title": "Contact Form to Any API <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15735" }, { "rank": 214, "cve_id": "CVE-2026-17161", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00188, "epss_percentile": 0.08362, "kev": false, "kev_due_at": null, "vendor": "wpxpo", "product": "WowStore – Store Builder & Product Blocks for WooCommerce", "cwe": "CWE-79", "title": "WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17161" }, { "rank": 215, "cve_id": "CVE-2026-17162", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00188, "epss_percentile": 0.08362, "kev": false, "kev_due_at": null, "vendor": "wpxpo", "product": "WowStore – Store Builder & Product Blocks for WooCommerce", "cwe": "CWE-79", "title": "WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17162" }, { "rank": 216, "cve_id": "CVE-2026-13306", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00183, "epss_percentile": 0.07828, "kev": false, "kev_due_at": null, "vendor": "Autel", "product": "MaxiCharger AC Elite Home", "cwe": "CWE-306", "title": "Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13306" }, { "rank": 217, "cve_id": "CVE-2026-13692", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00182, "epss_percentile": 0.07737, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "PayU CommercePro Plugin", "cwe": "CWE-862", "title": "PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13692" }, { "rank": 218, "cve_id": "CVE-2026-54663", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00181, "epss_percentile": 0.07662, "kev": false, "kev_due_at": null, "vendor": "acacode", "product": "swagger-typescript-api", "cwe": "CWE-20", "title": "swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54663" }, { "rank": 219, "cve_id": "CVE-2026-16465", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00179, "epss_percentile": 0.07433, "kev": false, "kev_due_at": null, "vendor": "Autodesk", "product": "AutoCAD", "cwe": "CWE-125", "title": "DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16465" }, { "rank": 220, "cve_id": "CVE-2025-69949", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00176, "epss_percentile": 0.07073, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69949" }, { "rank": 221, "cve_id": "CVE-2026-16728", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.0714, "kev": false, "kev_due_at": null, "vendor": "undici", "product": "undici", "cwe": "CWE-444", "title": "undici vulnerable to downstream response desynchronization via retry interceptor", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16728" }, { "rank": 222, "cve_id": "CVE-2026-17550", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.07123, "kev": false, "kev_due_at": null, "vendor": "Autodesk", "product": "AutoCAD", "cwe": "CWE-125", "title": "DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17550" }, { "rank": 223, "cve_id": "CVE-2026-63240", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.0715, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-200", "title": "Information disclosure vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63240" }, { "rank": 224, "cve_id": "CVE-2026-35226", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00172, "epss_percentile": 0.06652, "kev": false, "kev_due_at": null, "vendor": "CODESYS", "product": "CODESYS PROFINET", "cwe": "CWE-787", "title": "Out-of-bounds Write in CODESYS PROFINET Controller", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35226" }, { "rank": 225, "cve_id": "CVE-2025-67405", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00169, "epss_percentile": 0.06352, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67405" }, { "rank": 226, "cve_id": "CVE-2025-67407", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00169, "epss_percentile": 0.06352, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67407" }, { "rank": 227, "cve_id": "CVE-2025-67408", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00169, "epss_percentile": 0.06353, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-67408" }, { "rank": 228, "cve_id": "CVE-2025-69944", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00169, "epss_percentile": 0.06353, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69944" }, { "rank": 229, "cve_id": "CVE-2025-69945", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00169, "epss_percentile": 0.06353, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69945" }, { "rank": 230, "cve_id": "CVE-2026-63236", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00166, "epss_percentile": 0.0607, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-284", "title": "Improper access control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63236" }, { "rank": 231, "cve_id": "CVE-2026-12927", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.0016, "epss_percentile": 0.05322, "kev": false, "kev_due_at": null, "vendor": "Schneider Electric", "product": "IGSS Definition (Def.exe)", "cwe": "CWE-787", "title": "CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is imported to IGSS Definition.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12927" }, { "rank": 232, "cve_id": "CVE-2026-50641", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0016, "epss_percentile": 0.05383, "kev": false, "kev_due_at": null, "vendor": "Streamsoft", "product": "Business Intelligence", "cwe": "CWE-256", "title": "Plaintext password storage in Streamsoft Business Intelligence", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50641" }, { "rank": 233, "cve_id": "CVE-2026-18197", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00156, "epss_percentile": 0.0498, "kev": false, "kev_due_at": null, "vendor": null, "product": "Link Library", "cwe": "CWE-79", "title": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18197" }, { "rank": 234, "cve_id": "CVE-2026-65325", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00156, "epss_percentile": 0.04944, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Traffic Server", "cwe": "CWE-295", "title": "Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65325" }, { "rank": 235, "cve_id": "CVE-2025-65337", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00155, "epss_percentile": 0.04818, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-79", "title": "Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-65337" }, { "rank": 236, "cve_id": "CVE-2026-66490", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00155, "epss_percentile": 0.04819, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66490" }, { "rank": 237, "cve_id": "CVE-2026-56389", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00154, "epss_percentile": 0.04764, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "Bison", "cwe": "CWE-78", "title": "Arbitrary Command Execution in GNU Bison", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56389" }, { "rank": 238, "cve_id": "CVE-2026-66400", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.0459, "kev": false, "kev_due_at": null, "vendor": "getgrav", "product": "grav", "cwe": "CWE-613", "title": "Grav Login Plugin before 3.8.13 Insufficient Session Expiration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66400" }, { "rank": 239, "cve_id": "CVE-2026-63242", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.04597, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-639", "title": "Business logic vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63242" }, { "rank": 240, "cve_id": "CVE-2026-13268", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00151, "epss_percentile": 0.04516, "kev": false, "kev_due_at": null, "vendor": "G DATA", "product": "Total Security", "cwe": "CWE-59", "title": "G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13268" }, { "rank": 241, "cve_id": "CVE-2026-65946", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00149, "epss_percentile": 0.04309, "kev": false, "kev_due_at": null, "vendor": "rolandd.com", "product": "RO CSVI extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65946" }, { "rank": 242, "cve_id": "CVE-2026-54574", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00145, "epss_percentile": 0.04016, "kev": false, "kev_due_at": null, "vendor": "termux", "product": "proot-distro", "cwe": "CWE-61", "title": "`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54574" }, { "rank": 243, "cve_id": "CVE-2026-14224", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00141, "epss_percentile": 0.03682, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Easy Appointments", "cwe": "CWE-639", "title": "Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14224" }, { "rank": 244, "cve_id": "CVE-2026-15228", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0014, "epss_percentile": 0.03579, "kev": false, "kev_due_at": null, "vendor": null, "product": "Kong/kubernetes-ingress-controller", "cwe": "CWE-400", "title": "Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15228" }, { "rank": 245, "cve_id": "CVE-2026-16543", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0014, "epss_percentile": 0.03579, "kev": false, "kev_due_at": null, "vendor": null, "product": "Kong/kong-operator", "cwe": "CWE-400", "title": "Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16543" }, { "rank": 246, "cve_id": "CVE-2026-63241", "cvss_base": 3.1, "cvss_severity": "LOW", "epss_score": 0.0014, "epss_percentile": 0.03595, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-639", "title": "Insecure direct object reference vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63241" }, { "rank": 247, "cve_id": "CVE-2026-59919", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00139, "epss_percentile": 0.0348, "kev": false, "kev_due_at": null, "vendor": "netty", "product": "netty", "cwe": "CWE-93", "title": "Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59919" }, { "rank": 248, "cve_id": "CVE-2026-56390", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00133, "epss_percentile": 0.03035, "kev": false, "kev_due_at": null, "vendor": "GNU", "product": "Bison", "cwe": "CWE-73", "title": "Arbitrary Output Location Change in GNU Bison", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56390" }, { "rank": 249, "cve_id": "CVE-2026-65944", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0013, "epss_percentile": 0.02878, "kev": false, "kev_due_at": null, "vendor": "rolandd.com", "product": "RO CSVI extension for Joomla", "cwe": "CWE-352", "title": "Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65944" }, { "rank": 250, "cve_id": "CVE-2026-59247", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00128, "epss_percentile": 0.02646, "kev": false, "kev_due_at": null, "vendor": "gleam-lang", "product": "gleam", "cwe": "CWE-345", "title": "Insufficient verification of Hex package metadata in Gleam", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59247" }, { "rank": 251, "cve_id": "CVE-2026-9720", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00128, "epss_percentile": 0.02685, "kev": false, "kev_due_at": null, "vendor": "facturadorvirtual", "product": "Facturación Electrónica Costa Rica", "cwe": "CWE-352", "title": "Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9720" }, { "rank": 252, "cve_id": "CVE-2026-63228", "cvss_base": 2.6, "cvss_severity": "LOW", "epss_score": 0.00128, "epss_percentile": 0.02705, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-434", "title": "Unrestricted image upload vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63228" }, { "rank": 253, "cve_id": "CVE-2026-63119", "cvss_base": 6.2, "cvss_severity": "MEDIUM", "epss_score": 0.00127, "epss_percentile": 0.02609, "kev": false, "kev_due_at": null, "vendor": "modelcontextprotocol", "product": "ruby-sdk", "cwe": "CWE-400", "title": "MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63119" }, { "rank": 254, "cve_id": "CVE-2026-65947", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00126, "epss_percentile": 0.0254, "kev": false, "kev_due_at": null, "vendor": "balbooa.com", "product": "Gridbox extension for Joomla", "cwe": "CWE-352", "title": "Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65947" }, { "rank": 255, "cve_id": "CVE-2026-64556", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00124, "epss_percentile": 0.02385, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "perf/core: Detach event groups during remove_on_exec", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64556" }, { "rank": 256, "cve_id": "CVE-2026-63239", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00122, "epss_percentile": 0.02167, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-798", "title": "Hard-coded AWS IAM credentials vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63239" }, { "rank": 257, "cve_id": "CVE-2026-54727", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00121, "epss_percentile": 0.02103, "kev": false, "kev_due_at": null, "vendor": "termux", "product": "proot-distro", "cwe": "CWE-668", "title": "proot-distro has a Container Isolation Bypass via Crafted Restore Archive", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54727" }, { "rank": 258, "cve_id": "CVE-2026-13305", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00121, "epss_percentile": 0.02136, "kev": false, "kev_due_at": null, "vendor": "Autel", "product": "MaxiCharger AC Elite Home", "cwe": "CWE-347", "title": "Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13305" }, { "rank": 259, "cve_id": "CVE-2026-64558", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0012, "epss_percentile": 0.02003, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "s390/pkey: Check length in pkey_pckmo handler implementation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64558" }, { "rank": 260, "cve_id": "CVE-2026-64559", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0012, "epss_percentile": 0.02003, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "s390/pkey: Check length in PKEY_VERIFYPROTK ioctl", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64559" }, { "rank": 261, "cve_id": "CVE-2026-14354", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00117, "epss_percentile": 0.01804, "kev": false, "kev_due_at": null, "vendor": "Schneider Electric", "product": "EcoStruxure™ Cybersecurity Admin Expert", "cwe": "CWE-522", "title": "CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to compromise of managed devices, when a local privileged attacker leverages weaknesses in the handling and protection of stored credentials within the application.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14354" }, { "rank": 262, "cve_id": "CVE-2026-63237", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00117, "epss_percentile": 0.01813, "kev": false, "kev_due_at": null, "vendor": "Three Learning", "product": "Koollab LMS", "cwe": "CWE-347", "title": "TOTP two-factor authentication bypass vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63237" }, { "rank": 263, "cve_id": "CVE-2026-40272", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00113, "epss_percentile": 0.01543, "kev": false, "kev_due_at": null, "vendor": "BlackBerry Ltd", "product": "QNX Software Development Platform", "cwe": "CWE-1284", "title": "Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform", "url": "https://www.cve.org/CVERecord?id=CVE-2026-40272" }, { "rank": 264, "cve_id": "CVE-2026-62995", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00106, "epss_percentile": 0.01208, "kev": false, "kev_due_at": null, "vendor": "authlib", "product": "joserfc", "cwe": "CWE-345", "title": "joserfc accepts JWT with padding, leading to JWT malleability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62995" }, { "rank": 265, "cve_id": "CVE-2026-52791", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00102, "epss_percentile": 0.01038, "kev": false, "kev_due_at": null, "vendor": "containers", "product": "fuse-overlayfs", "cwe": "CWE-266", "title": "fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52791" }, { "rank": 266, "cve_id": "CVE-2026-18257", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.001, "epss_percentile": 0.00921, "kev": false, "kev_due_at": null, "vendor": "Systerel", "product": "S2OPC", "cwe": "CWE-295", "title": "Improper Certificate Validation in S2OPC", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18257" }, { "rank": 267, "cve_id": "CVE-2026-10684", "cvss_base": 3, "cvss_severity": "LOW", "epss_score": 0.001, "epss_percentile": 0.00925, "kev": false, "kev_due_at": null, "vendor": "zephyrproject", "product": "zephyr", "cwe": "CWE-125", "title": "Out-of-bounds read in coredump shell when printing stored-dump target code", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10684" }, { "rank": 268, "cve_id": "CVE-2026-14234", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00099, "epss_percentile": 0.00905, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WOLF", "cwe": "CWE-79", "title": "WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14234" }, { "rank": 269, "cve_id": "CVE-2026-2482", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00098, "epss_percentile": 0.00853, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "WebSphere Application Server - Liberty", "cwe": "CWE-352", "title": "IBM WebSphere Application Server Liberty is affected by a cross-site request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2482" }, { "rank": 270, "cve_id": "CVE-2026-44944", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00093, "epss_percentile": 0.00601, "kev": false, "kev_due_at": null, "vendor": "open-iscsi", "product": "open-iscsi", "cwe": "CWE-863", "title": "iscsiuio control-socket authentication bypass in open-iscsi", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44944" }, { "rank": 271, "cve_id": "CVE-2026-62343", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00091, "epss_percentile": 0.00528, "kev": false, "kev_due_at": null, "vendor": "ImageMagick", "product": "ImageMagick", "cwe": "CWE-190", "title": "ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62343" }, { "rank": 272, "cve_id": "CVE-2026-6102", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00086, "epss_percentile": 0.00386, "kev": false, "kev_due_at": null, "vendor": "MSI", "product": "MSI Center", "cwe": "CWE-346", "title": "MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-6102" }, { "rank": 273, "cve_id": "CVE-2026-8497", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00082, "epss_percentile": 0.00252, "kev": false, "kev_due_at": null, "vendor": "Devolutions", "product": "Password Manager", "cwe": "CWE-295", "title": "Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8497" }, { "rank": 274, "cve_id": "CVE-2026-67433", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.0008, "epss_percentile": 0.00186, "kev": false, "kev_due_at": null, "vendor": "Linuxfabrik", "product": "monitoring-plugins", "cwe": "CWE-59", "title": "Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67433" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2021-29022", "detail": "EXPLOIT PUBLISHED — CVE-2021-29022. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2021-29023", "detail": "EXPLOIT PUBLISHED — CVE-2021-29023. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2021-29024", "detail": "EXPLOIT PUBLISHED — CVE-2021-29024. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2022-36271", "detail": "EXPLOIT PUBLISHED — CVE-2022-36271. Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2025-38352", "detail": "EXPLOIT PUBLISHED — CVE-2025-38352 (Linux). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-34632", "detail": "EXPLOIT PUBLISHED — CVE-2026-34632 (Adobe Photoshop Installer). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-45700", "detail": "EXPLOIT PUBLISHED — CVE-2026-45700 (FreeRDP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-50289", "detail": "EXPLOIT PUBLISHED — CVE-2026-50289 (sebhildebrandt systeminformation). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54497", "detail": "EXPLOIT PUBLISHED — CVE-2026-54497 (ViewComponent view_component). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-54498", "detail": "EXPLOIT PUBLISHED — CVE-2026-54498 (ViewComponent view_component). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-56821", "detail": "EXPLOIT PUBLISHED — CVE-2026-56821 (netty). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59733", "detail": "EXPLOIT PUBLISHED — CVE-2026-59733 (rclone). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59919", "detail": "EXPLOIT PUBLISHED — CVE-2026-59919 (netty). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-60113", "detail": "EXPLOIT PUBLISHED — CVE-2026-60113 (NASA-AMMOS AIT-DSN). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-66746", "detail": "EXPLOIT PUBLISHED — CVE-2026-66746 (tomaka rouille). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-66748", "detail": "EXPLOIT PUBLISHED — CVE-2026-66748 (owen2345 camaleon-cms). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-66754", "detail": "EXPLOIT PUBLISHED — CVE-2026-66754 (tomaka rouille). Public exploit reference added." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-56155", "detail": "DUE DATE PASSED — CVE-2026-56155 (Microsoft Windows 10 Version 1607). CISA remediation deadline was July 28, 2026; still in catalog." }, { "type": "RESCORED", "cve_id": "CVE-2024-21537", "detail": "RESCORED — CVE-2024-21537 (lilconfig). CVSS 9.3 → 8.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-11541", "detail": "RESCORED — CVE-2026-11541 (IBM CICS Transaction Gateway for Multiplatforms). CVSS 7.4 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-49181", "detail": "RESCORED — CVE-2026-49181 (Microsoft Windows 10 Version 1607). CVSS 7.5 → 9.8 (NVD)." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2025-38352", "detail": "PATCH SHIPPED — CVE-2025-38352 (Linux). Fixed in Linux 5.4.295." }, { "type": "ENRICHED", "cve_id": "CVE-2021-29022", "detail": "ENRICHED — CVE-2021-29022. Received CVSS 5.3 and CPE data from NVD." }, { "type": "ENRICHED", "cve_id": "CVE-2021-29023", "detail": "ENRICHED — CVE-2021-29023. Received CVSS 5.3 and CPE data from NVD." }, { "type": "ENRICHED", "cve_id": "CVE-2021-29024", "detail": "ENRICHED — CVE-2021-29024. Received CVSS 7.5 and CPE data from NVD." }, { "type": "ENRICHED", "cve_id": "CVE-2026-53376", "detail": "ENRICHED — CVE-2026-53376 (Linux). Received CVSS 5.5 and CPE data from NVD." }, { "type": "ENRICHED", "cve_id": "CVE-2026-53377", "detail": "ENRICHED — CVE-2026-53377 (Linux). Received CVSS 5.5 and CPE data from NVD." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }