Security Box Score — Sunday, August 2, 2026

49 CVEs published August 2, 2026: 4 critical, 21 high, 23 medium, 1 low; 0 in KEV; 2 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 24 in the results table.

League
	MTD	YTD	2025 same span	2025 full
CVEs published	196	9001	1390	2563
KEV catalog size	1670

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	0	1585	207	1127	98	0	27	3	0.2	7.8	.0016	-8
microsoft	0	1361	105	929	302	8	378	32	2.4	7.8	.0039	-7
google	0	412	64	104	226	15	73	5	1.2	6.5	.0022	0
apple	0	244	56	67	112	2	93	7	2.9	7.1	.0027	0
red hat	4	226	9	110	95	12	4	0	0.0	7.1	.0026	+1
canonical	0	3	0	2	1	0	0	0	0.0	7.8	.0013	0
android	0	1	0	1	0	0	16	1	100.0	8.4	.0171	0

Network & Infrastructure
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS
cisco	20	4	6	2	0	96	13	65.0	8.2	.1853
fortinet	18	2	4	9	0	28	6	33.3	6.1	.0054
palo alto networks	15	0	1	7	5	14	2	13.3	4.7	.0028
vmware	12	4	7	0	1	21	0	0.0	8.7	.0044
f5	5	4	0	0	0	7	1	20.0	9.2	.0402
ivanti	5	1	0	0	0	33	5	100.0	10.0	.8152
broadcom	4	0	0	2	0	4	2	50.0	5.1	.0877
checkpoint	4	3	1	0	0	3	2	50.0	9.2	.4696

Open Source Ecosystems
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS
apache	137	24	74	39	0	40	1	0.7	7.5	.0051
mozilla	72	42	26	4	0	13	0	0.0	9.1	.0031
gitlab	15	0	2	10	1	4	2	13.3	4.9	.0029
docker	3	0	1	2	0	1	0	0.0	5.7	.0015
wordpress	3	1	1	1	0	5	2	66.7	8.6	.7310
github	2	0	1	1	0	0	0	0.0	6.1	.0029
drupal	1	1	0	0	0	5	1	100.0	9.8	.8832
kubernetes	1	0	0	0	1	0	0	0.0	2.4	.0024

Enterprise Applications
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS
oracle	1113	212	539	304	57	40	3	0.3	7.6	.0031
ibm	108	31	43	34	0	7	0	0.0	7.5	.0026
adobe	40	10	22	4	0	75	4	10.0	8.4	.0039
progress	23	3	15	5	0	9	0	0.0	8.1	.0032
solarwinds	20	16	1	1	0	11	4	20.0	9.1	.0050
atlassian	3	0	3	0	0	13	0	0.0	8.0	.0026
zohocorp	3	1	1	1	0	0	0	0.0	7.1	.0048
veeam	2	0	1	1	0	4	0	0.0	6.8	.0016

Industrial & Embedded
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS
d-link	8	0	0	6	1	26	1	12.5	5.5	.0073
hikvision	7	0	4	2	0	2	1	14.3	7.2	.0025
bosch	3	0	3	0	0	0	0	0.0	8.1	.0028
schneider electric	3	1	2	0	0	1	0	0.0	8.7	.0020
honeywell	1	0	0	1	0	0	0	0.0	6.9	.0031
mitsubishi electric	1	0	1	0	0	0	0	0.0	7.1	.0013
rockwell automation	1	1	0	0	0	0	0	0.0	9.2	.0030
siemens	1	0	1	0	0	1	0	0.0	8.7	.0032

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
surrealdb	0	57	3	26	25	3	0	7.1	.0025	0
grafana	0	41	2	14	22	3	0	6.5	.0033	0
netty	0	41	6	27	7	1	0	7.5	.0046	0
open ises	0	37	2	14	21	0	0	6.9	.0021	0
erlang	0	32	1	14	14	3	1	6.9	.0033	-6
freerdp	23	31	8	18	4	1	0	8.7	.0034	+23
regularlabs.com	0	29	6	14	9	0	0	7.5	.0022	0
watchguard	0	28	1	18	9	0	4	7.3	.0026	-17

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-48282	.9924	99.9	—
CVE-2026-63030	.9560	99.9	9.8
CVE-2026-39808	.9121	99.8	—
CVE-2026-48908	.8813	99.8	10.0
CVE-2026-56290	.8325	99.7	10.0
CVE-2026-48939	.8250	99.6	10.0
CVE-2026-50522	.7698	99.5	9.8
CVE-2026-15410	.7635	99.5	7.2
CVE-2026-56291	.7607	99.5	10.0
CVE-2026-15409	.7422	99.4	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-48908	10.0	.8813	KEV
CVE-2026-56290	10.0	.8325	KEV
CVE-2026-48939	10.0	.8250	KEV
CVE-2026-56291	10.0	.7607	KEV
CVE-2026-15409	10.0	.7422	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0473
CVE-2026-47668	10.0	.0434
CVE-2026-44359	10.0	.0100
CVE-2025-71389	10.0	.0093

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	659
microsoft	608
google	403
apple	167
red hat	121
apache	105
ibm	100
mozilla	67
surrealdb	57

Most KEV additions (YTD)
Vendor	KEV
microsoft	32
cisco	13
apple	7
fortinet	6
google	5
ivanti	5
adobe	4
langflow	4
solarwinds	4
synacor	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	29
Go	3
crates.io	2
npm	2
NuGet	1
Packagist	1
PyPI	1

Fastest to KEV
CVE	Vendor	Days
CVE-2008-4128	Cisco	0
CVE-2021-27137	DD-WRT	0
CVE-2023-4346	KNX Association	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-20316	Cisco	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1719
CVE-2021-27102	Accellion	2021-11-17	1719
CVE-2021-27101	Accellion	2021-11-17	1719
CVE-2021-27103	Accellion	2021-11-17	1719
CVE-2021-21017	Adobe	2021-11-17	1719
CVE-2021-28550	Adobe	2021-11-17	1719
CVE-2021-42013	Apache	2021-11-17	1719
CVE-2021-41773	Apache	2021-11-17	1719
CVE-2021-30858	Apple	2021-11-17	1719
CVE-2021-30860	Apple	2021-11-17	1719

Yesterday's Results

49 CVEs published. 25 box scores, 24 table rows — nothing truncated.

CVE-2026-9335MEDIUM

keras-team keras-team/keras — Improper Handling of HDF5 ExternalLinks in keras-team/keras

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  N  N    6.5   .0065   48.0     —

AFFECTED
  Product           Versions       Fixed
  keras-team/keras  unspecified –  —

TIMELINE
  May 22  Reserved by CNA
  Aug 2   Published (CNA: @huntr_ai)

CWE-22 · CNA: @huntr_ai · 2 references · NVD status: Received

CVE-2026-65321CRITICAL

laughingman7743 PyAthena — PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0046   37.7     —

AFFECTED
  Product   Versions     Fixed
  PyAthena  unspecified  3.35.4

TIMELINE
  Jul 21  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · 6 references · NVD status: Received

CVE-2026-16540HIGH

Unknown Simply Schedule Appointments — Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0036   28.9     —

AFFECTED
  Product                       Versions     Fixed
  Simply Schedule Appointments  unspecified  —

TIMELINE
  Jul 22  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-863 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-16062MEDIUM

Unknown Event Booking Manager for WooCommerce — Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  H  H    6.6   .0035   28.1     —

AFFECTED
  Product                                Versions     Fixed
  Event Booking Manager for WooCommerce  unspecified  —

TIMELINE
  Jul 17  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-502 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-16261HIGH

Unknown login-social — Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0033   26.2     —

AFFECTED
  Product       Versions     Fixed
  login-social  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-68581HIGH

go-vikunja vikunja — Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   N    8.6   .0032   24.9     —

AFFECTED
  Product  Versions  Fixed
  vikunja  0.22.0 –  —

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · 4 references · NVD status: Received

CVE-2025-71399HIGH

better-auth better-auth — Better Auth before 1.4.5 Path Normalization Bypass via rou3

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   H    8.8   .0031   23.2     —

AFFECTED
  Product      Versions     Fixed
  better-auth  unspecified  1.4.5

TIMELINE
  Jul 18  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-20 · CNA: VulnCheck · 3 references · NVD status: Received

CVE-2026-16256CRITICAL

Unknown POUCO Import Users — Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0030   22.9     —

AFFECTED
  Product             Versions     Fixed
  POUCO Import Users  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-269 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-9856HIGH

huggingface huggingface/transformers — Path Traversal in huggingface/transformers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  H  L    7.1   .0029   22.0     —

AFFECTED
  Product                   Versions       Fixed
  huggingface/transformers  unspecified –  —

TIMELINE
  May 28  Reserved by CNA
  Aug 2   Published (CNA: @huntr_ai)

CWE-22 · CNA: @huntr_ai · 2 references · NVD status: Received

CVE-2026-13389MEDIUM

Unknown webtoffee-cookie-consent — WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  N    6.5   .0029   22.0     —

AFFECTED
  Product                   Versions     Fixed
  webtoffee-cookie-consent  unspecified  —

TIMELINE
  Jun 26  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-14817MEDIUM

Unknown Element Pack Addons for Elementor — Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  U  H  H  H    6.8   .0029   21.5     —

AFFECTED
  Product                            Versions     Fixed
  Element Pack Addons for Elementor  unspecified  —

TIMELINE
  Jul 6   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-79 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-15236HIGH

Unknown Gallery for Google Photos — Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0028   20.4     —

AFFECTED
  Product                    Versions     Fixed
  Gallery for Google Photos  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-200 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-15248MEDIUM

Unknown Meta Box — Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  L    5.5   .0028   20.5     —

AFFECTED
  Product   Versions     Fixed
  Meta Box  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-14920HIGH

Unknown AcyMailing — AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  L  N    8.2   .0027   19.8     —

AFFECTED
  Product     Versions     Fixed
  AcyMailing  unspecified  —

TIMELINE
  Jul 7   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-89 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-68579HIGH

FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0027   19.1     —

AFFECTED
  Product  Versions     Fixed
  FreeRDP  unspecified  3.30.0

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-787 · CNA: VulnCheck · 3 references · NVD status: Received

CVE-2026-15206HIGH

Unknown SMS Alert — SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   18.1     —

AFFECTED
  Product    Versions     Fixed
  SMS Alert  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-15241HIGH

Unknown AI ChatBot for WooCommerce — ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   18.1     —

AFFECTED
  Product                     Versions     Fixed
  AI ChatBot for WooCommerce  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-284 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2026-16285HIGH

Unknown Product Attachment for WooCommerce — WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   18.1     —

AFFECTED
  Product                             Versions     Fixed
  Product Attachment for WooCommerce  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · 1 reference · NVD status: Received

CVE-2025-71401CRITICAL

better-auth before 1.4.2 basePath Modification DoS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0026   17.8     —

AFFECTED
  Product      Versions     Fixed
  better-auth  unspecified  1.4.2

TIMELINE
  Jul 18  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-770 · CNA: VulnCheck · 2 references · NVD status: Received

CVE-2026-12231MEDIUM

timstrifler Exclusive Addons for Elementor — Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0026   17.3     —

AFFECTED
  Product                         Versions     Fixed
  Exclusive Addons for Elementor  unspecified  —

TIMELINE
  Jun 14  Reserved by CNA
  Aug 2   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · 5 references · NVD status: Deferred

CVE-2026-67357HIGH

ArcadeData arcadedb — ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   L   N   H   H   H    7.7   .0025   16.6     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.7.3

TIMELINE
  Jul 29  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · 2 references · NVD status: Received

CVE-2026-67356HIGH

ArcadeData arcadedb — ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0025   16.1     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.7.3

TIMELINE
  Jul 29  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-269 · CNA: VulnCheck · 2 references · NVD status: Received

CVE-2026-18571HIGH

Red Hat Red Hat Build of Keycloak — Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0024   15.9     —

AFFECTED
  Product                                                       Versions     Fixed
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Data Grid 8                                           unspecified  —
  Red Hat JBoss Enterprise Application Platform Expansion Pack  unspecified  —
  Red Hat Single Sign-On 7                                      unspecified  —

TIMELINE
  Aug 2   Reserved by CNA
  Aug 2   Published (CNA: redhat)

CWE-862 · CNA: redhat · 2 references · NVD status: Analyzed

CVE-2026-3245HIGH

Canon Production Printing PRISMAproduction — A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code …

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   H   N   N   N   H   H   H    7.7   .0024   15.4     —

AFFECTED
  Product           Versions          Fixed
  PRISMAproduction  6.5 or earlier –  —

TIMELINE
  Feb 26  Reserved by CNA
  Aug 2   Published (CNA: Canon)

CWE-502 · CNA: Canon · 4 references · NVD status: Received

CVE-2026-68580HIGH

FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   P   H   H   H    7.7   .0024   15.0     —

AFFECTED
  Product  Versions     Fixed
  FreeRDP  unspecified  3.29.0

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-122 · CNA: VulnCheck · 2 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-15151	7.5	14.3	Unknown	Five Star Restaurant Reservations	CWE-284	Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authori…
CVE-2026-18573	6.5	12.9	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: client access-type policy condition byp…
CVE-2026-10848	8.6	12.1	zephyrproject	zephyr	CWE-125	Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
CVE-2026-68578	7.7	12.0	ArcadeData	arcadedb	CWE-306	ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
CVE-2026-68582	9.3	11.6	go-vikunja	vikunja	CWE-639	Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
CVE-2025-71400	7.1	10.5	better-auth	passkey	CWE-639	better-auth passkey before 1.4.0 IDOR via delete-passkey
CVE-2026-16042	4.3	9.5	Unknown	LWS Optimize	CWE-862	LWS Optimize < 3.4 - Subscriber+ Cache Deletion
CVE-2026-11872	4.3	8.4	Unknown	Clever Mega Menu for Visual Composer	CWE-284	Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Up…
CVE-2026-18572	6.5	8.0	Red Hat	Red Hat Build of Keycloak	CWE-863	Keycloak-services: keycloak-services: uma claim token can override authorizat…
CVE-2026-14841	6.1	8.0	Unknown	King Addons for Elementor	CWE-79	King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
CVE-2026-10774	6.5	7.7	zephyrproject	zephyr	CWE-401	PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhau…
CVE-2026-15939	2.7	7.7	Unknown	Simple Restrict	CWE-863	Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST…
CVE-2025-15675	4.8	7.1	Unknown	Charitable	CWE-79	Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text
CVE-2026-12586	8.1	6.2	Unknown	Lenxel WP	CWE-287	Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password…
CVE-2026-14938	4.3	5.9	Unknown	FluentBoards	CWE-639	FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
CVE-2026-16291	4.3	4.9	Unknown	ProfileGrid	CWE-639	ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
CVE-2026-18570	5.4	4.0	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: full-scope-disabled client policy valid…
CVE-2026-16064	5.4	3.6	Unknown	Event Booking Manager for WooCommerce	CWE-863	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post M…
CVE-2026-68583	5.1	3.7	openwrt	luci	CWE-79	luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
CVE-2026-14864	5.4	3.3	Unknown	JetEngine	CWE-79	JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
CVE-2026-15385	5.4	3.3	Unknown	RT Mega Menu	CWE-79	RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
CVE-2026-16063	5.4	3.3	Unknown	Event Booking Manager for WooCommerce	CWE-79	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event …
CVE-2026-16273	4.6	3.3	Unknown	Narrative Publisher	CWE-79	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_scr…
CVE-2026-16292	5.4	0.7	Unknown	Frontend File Manager Plugin	CWE-352	Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

Standings

Leaders (trailing 30 days unless noted)

Transactions

Yesterday's Results

Methodology