432 CVEs published August 5, 2026: 61 critical, 203 high, 146 medium, 17 low; 1 in KEV; 7 with a public exploit reference; 5 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 407 in the results table.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 1211 | 10016 | 1396 | 2563 |
| KEV catalog size | 1670 | |||
485 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; medians are over each vendor's YTD disclosures.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 22 | 1607 | 209 | 1141 | 98 | 0 | 27 | 3 | 0.2 | 7.8 | .0016 | +10 |
| microsoft | 16 | 1377 | 106 | 936 | 310 | 8 | 378 | 32 | 2.3 | 7.8 | .0039 | -34 |
| 2 | 414 | 65 | 104 | 227 | 15 | 73 | 5 | 1.2 | 6.5 | .0022 | +2 | |
| red hat | 34 | 256 | 13 | 116 | 111 | 16 | 4 | 0 | 0.0 | 7.0 | .0025 | +28 |
| apple | 0 | 244 | 56 | 67 | 112 | 2 | 93 | 7 | 2.9 | 7.1 | .0027 | 0 |
| suse | 5 | 5 | 1 | 2 | 2 | 0 | 0 | 0 | 0.0 | 7.3 | .0022 | +5 |
| canonical | 0 | 3 | 0 | 2 | 1 | 0 | 0 | 0 | 0.0 | 7.8 | .0013 | 0 |
| android | 0 | 1 | 0 | 1 | 0 | 0 | 16 | 1 | 100.0 | 8.4 | .0171 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cisco | 23 | 43 | 9 | 17 | 9 | 0 | 96 | 13 | 30.2 | 8.6 | .0032 | +23 |
| fortinet | 0 | 18 | 2 | 4 | 9 | 0 | 28 | 6 | 33.3 | 6.1 | .0054 | 0 |
| palo alto networks | 0 | 15 | 0 | 1 | 7 | 5 | 14 | 2 | 13.3 | 4.7 | .0028 | 0 |
| vmware | 0 | 12 | 4 | 7 | 0 | 1 | 21 | 0 | 0.0 | 8.7 | .0044 | 0 |
| checkpoint | 1 | 5 | 4 | 1 | 0 | 0 | 3 | 2 | 40.0 | 9.3 | .2062 | +1 |
| f5 | 0 | 5 | 4 | 0 | 0 | 0 | 7 | 1 | 20.0 | 9.2 | .0402 | 0 |
| ivanti | 0 | 5 | 1 | 0 | 0 | 0 | 33 | 5 | 100.0 | 10.0 | .8152 | 0 |
| zyxel | 3 | 4 | 0 | 3 | 1 | 0 | 11 | 0 | 0.0 | 7.2 | .0075 | +3 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 40 | 177 | 27 | 96 | 53 | 1 | 40 | 2 | 1.1 | 7.5 | .0049 | +40 |
| mozilla | 1 | 73 | 42 | 26 | 5 | 0 | 13 | 0 | 0.0 | 9.1 | .0031 | +1 |
| gitlab | 0 | 15 | 0 | 2 | 10 | 1 | 4 | 2 | 13.3 | 4.9 | .0029 | 0 |
| github | 2 | 4 | 0 | 2 | 2 | 0 | 0 | 0 | 0.0 | 7.0 | .0040 | +2 |
| docker | 0 | 3 | 0 | 1 | 2 | 0 | 1 | 0 | 0.0 | 5.7 | .0015 | 0 |
| wordpress | 0 | 3 | 1 | 1 | 1 | 0 | 5 | 2 | 66.7 | 8.6 | .7310 | 0 |
| drupal | 0 | 1 | 1 | 0 | 0 | 0 | 5 | 1 | 100.0 | 9.8 | .8832 | 0 |
| kubernetes | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | 0.0 | 2.4 | .0024 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 0 | 1113 | 212 | 539 | 304 | 57 | 40 | 3 | 0.3 | 7.6 | .0031 | 0 |
| ibm | 32 | 140 | 36 | 61 | 42 | 1 | 7 | 1 | 0.7 | 7.5 | .0027 | +32 |
| adobe | 7 | 47 | 16 | 23 | 4 | 0 | 75 | 4 | 8.5 | 8.6 | .0047 | +7 |
| progress | 10 | 33 | 10 | 18 | 5 | 0 | 9 | 0 | 0.0 | 8.1 | .0029 | +10 |
| solarwinds | 0 | 20 | 16 | 1 | 1 | 0 | 11 | 4 | 20.0 | 9.1 | .0050 | 0 |
| veeam | 10 | 12 | 3 | 7 | 2 | 0 | 4 | 0 | 0.0 | 8.6 | .0027 | +10 |
| atlassian | 0 | 3 | 0 | 3 | 0 | 0 | 13 | 0 | 0.0 | 8.0 | .0026 | 0 |
| zohocorp | 0 | 3 | 1 | 1 | 1 | 0 | 0 | 0 | 0.0 | 7.1 | .0048 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| d-link | 0 | 8 | 0 | 0 | 6 | 1 | 26 | 1 | 12.5 | 5.5 | .0073 | 0 |
| hikvision | 0 | 7 | 0 | 4 | 2 | 0 | 2 | 1 | 14.3 | 7.2 | .0025 | 0 |
| bosch | 0 | 3 | 0 | 3 | 0 | 0 | 0 | 0 | 0.0 | 8.1 | .0028 | 0 |
| schneider electric | 0 | 3 | 1 | 2 | 0 | 0 | 1 | 0 | 0.0 | 8.7 | .0020 | 0 |
| synology | 1 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0.0 | 7.3 | .0013 | +1 |
| honeywell | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 0.0 | 6.9 | .0031 | 0 |
| mitsubishi electric | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0.0 | 7.1 | .0013 | 0 |
| rockwell automation | 0 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0.0 | 9.2 | .0030 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| surrealdb | 0 | 57 | 3 | 26 | 25 | 3 | 0 | 0 | 0.0 | 7.1 | .0025 | 0 |
| grafana | 0 | 41 | 2 | 14 | 22 | 3 | 0 | 0 | 0.0 | 6.5 | .0033 | 0 |
| netty | 0 | 41 | 6 | 27 | 7 | 1 | 0 | 0 | 0.0 | 7.5 | .0046 | 0 |
| legion of the bouncy castle | 32 | 39 | 5 | 25 | 9 | 0 | 0 | 0 | 0.0 | 8.7 | .0026 | +32 |
| open ises | 0 | 37 | 2 | 14 | 21 | 0 | 0 | 0 | 0.0 | 6.9 | .0021 | 0 |
| mediatek | 34 | 34 | 0 | 4 | 30 | 0 | 1 | 0 | 0.0 | 6.0 | .0011 | +34 |
| erlang | 0 | 32 | 1 | 14 | 14 | 3 | 1 | 0 | 0.0 | 6.9 | .0033 | -6 |
| freerdp | 23 | 31 | 8 | 18 | 4 | 1 | 0 | 0 | 0.0 | 8.7 | .0034 | +23 |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-48282 | .9924 | 99.9 | — |
| CVE-2026-63030 | .9560 | 99.9 | 9.8 |
| CVE-2026-39808 | .9121 | 99.8 | — |
| CVE-2026-48908 | .8813 | 99.8 | 10.0 |
| CVE-2026-56290 | .8325 | 99.7 | 10.0 |
| CVE-2026-34486 | .8293 | 99.6 | 7.5 |
| CVE-2026-48939 | .8250 | 99.6 | 10.0 |
| CVE-2026-50522 | .7698 | 99.5 | 9.8 |
| CVE-2026-15410 | .7635 | 99.5 | 7.2 |
| CVE-2026-56291 | .7607 | 99.5 | 10.0 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-48908 | 10.0 | .8813 | KEV |
| CVE-2026-56290 | 10.0 | .8325 | KEV |
| CVE-2026-48939 | 10.0 | .8250 | KEV |
| CVE-2026-56291 | 10.0 | .7607 | KEV |
| CVE-2026-15409 | 10.0 | .7422 | KEV |
| CVE-2026-8985 | 10.0 | .0660 | |
| CVE-2026-6516 | 10.0 | .0473 | |
| CVE-2026-47668 | 10.0 | .0434 | |
| CVE-2026-44359 | 10.0 | .0100 | |
| CVE-2025-71389 | 10.0 | .0093 |
| Vendor | CVEs |
|---|---|
| oracle | 1109 |
| linux | 677 |
| microsoft | 624 |
| 405 | |
| apple | 167 |
| red hat | 150 |
| apache | 145 |
| ibm | 132 |
| mozilla | 68 |
| surrealdb | 57 |
| Vendor | KEV |
|---|---|
| microsoft | 32 |
| cisco | 13 |
| apple | 7 |
| fortinet | 6 |
| 5 | |
| ivanti | 5 |
| adobe | 4 |
| langflow | 4 |
| solarwinds | 4 |
| synacor | 4 |
| Ecosystem | Advisories |
|---|---|
| Maven | 49 |
| PyPI | 5 |
| Go | 3 |
| crates.io | 2 |
| npm | 2 |
| NuGet | 1 |
| Packagist | 1 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2008-4128 | Cisco | 0 |
| CVE-2021-27137 | DD-WRT | 0 |
| CVE-2023-4346 | KNX Association | 0 |
| CVE-2025-68686 | Fortinet | 0 |
| CVE-2026-0770 | Langflow | 0 |
| CVE-2026-15409 | SonicWall | 0 |
| CVE-2026-15410 | SonicWall | 0 |
| CVE-2026-16232 | checkpoint | 0 |
| CVE-2026-16812 | Arista Networks | 0 |
| CVE-2026-18556 | N-able | 0 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | Accellion | 2021-11-17 | 1722 |
| CVE-2021-27102 | Accellion | 2021-11-17 | 1722 |
| CVE-2021-27101 | Accellion | 2021-11-17 | 1722 |
| CVE-2021-27103 | Accellion | 2021-11-17 | 1722 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1722 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1722 |
| CVE-2021-42013 | Apache | 2021-11-17 | 1722 |
| CVE-2021-41773 | Apache | 2021-11-17 | 1722 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1722 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1722 |
EXPLOIT PUBLISHED — CVE-2023-0669 (Fortra Goanywhere MFT). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2023-3519 (Citrix NetScaler ADC). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2023-38831. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2024-51378. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2024-55956. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2025-26633 (Microsoft Windows 10 Version 1507). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2025-66024 (xwiki-contrib application-blog-ui). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18766 (chetans9 core-php-admin-panel). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18774 (NousResearch hermes-agent). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18784 (o6 open62541). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18788 (Trippo ResponsiveFilemanager). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18811 (H3C NX15). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18812 (H3C NX15). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18813 (H3C NX15). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18814 (H3C NX15). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18819 (RackTables). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-3609 (Wellbia XIGNCODE3). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-4629 (Red Hat build of Keycloak 26.4). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-46581 (Eclipse Foundation Eclipse Mojarra). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-54904 (ruby-concurrency concurrent-ruby). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55554 (dompdf). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-61515 (Puwell Technology Inc. IP Camera). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-66297 (livebook-dev livebook). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-66881 (livebook-dev livebook). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-67196 (perspective-dev perspective). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-67200 (perspective-dev perspective). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-69098 (Cinnamon kotaemon). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-70619 (odysseus-dev odysseus). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-70620 (odysseus-dev odysseus). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-71225 (Stephan Muelle libkcapi). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-71227 (Stephan Muelle libkcapi). Public exploit reference added.
DUE DATE PASSED — CVE-2026-60137 (WordPress). CISA remediation deadline was August 4, 2026; still in catalog.
RESCORED — CVE-2023-35078 (Ivanti Endpoint Manager Mobile). CVSS 10 → 9.8 (NVD).
RESCORED — CVE-2023-41265. CVSS 9.6 → 9.9 (NVD).
RESCORED — CVE-2023-41266. CVSS 8.2 → 6.5 (NVD).
RESCORED — CVE-2024-11667 (Zyxel ATP series firmware). CVSS 7.5 → 9.8 (NVD).
RESCORED — CVE-2024-51378. CVSS 10 → 9.8 (NVD).
RESCORED — CVE-2024-55591 (Fortinet FortiOS). CVSS 9.6 → 9.8 (NVD).
RESCORED — CVE-2026-16158 (@fastify/reply-from). CVSS 8.7 → 10 (NVD).
RESCORED — CVE-2026-18852 (epsilla-cloud vectordb). CVSS 4.8 → 1.9 (NVD).
RESCORED — CVE-2026-18853 (ZomboDroid Meme Generator App). CVSS 4.8 → 1.9 (NVD).
RESCORED — CVE-2026-24457 (Eclipse Foundation Eclipse OpenMQ). CVSS 9.1 → 9.8 (NVD).
RESCORED — CVE-2026-3609 (Wellbia XIGNCODE3). CVSS 5.3 → 7.8 (NVD).
RESCORED — CVE-2026-9793 (Red Hat build of Keycloak 26.4). CVSS 5.9 → 7.5 (NVD).
ENRICHED — CVE-2021-3483 (Linux kernel). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2021-3501 (Linux kernel). Received CVSS 7.1 and CPE data from NVD.
ENRICHED — CVE-2022-1353 (Linux kernel). Received CVSS 7.1 and CPE data from NVD.
432 CVEs published. 25 box scores and 375 table rows below; the remaining 32 continue on page 2 — every CVE is listed, nothing truncated.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .1072 95.4 YES
AFFECTED Product Versions Fixed TeamCity unspecified —
TIMELINE Jul 15 Reserved by CNA Aug 5 Added to CISA KEV, due Aug 8 Aug 5 Published (CNA: JetBrains)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N H N H H H 7.3 .0238 82.5 —
AFFECTED Product Versions Fixed NX15 V100R017 – —
TIMELINE Aug 4 Reserved by CNA Aug 5 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N H N H H H 7.3 .0238 82.5 —
AFFECTED Product Versions Fixed NX15 V100R017 – —
TIMELINE Aug 4 Reserved by CNA Aug 5 Published (CNA: VulDB)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0223 81.3 —
AFFECTED Product Versions Fixed Backup Migration unspecified —
TIMELINE May 2 Reserved by CNA Aug 5 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0176 76.1 —
AFFECTED Product Versions Fixed audiobookshelf 2.19.1 – —
TIMELINE Aug 5 Reserved by CNA Aug 5 Published (CNA: TuranSec)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P H A N N N 4.9 .0155 73.0 —
AFFECTED Product Versions Fixed livebook 0.13.0 – — livebook 0.13.0 – — livebook 7cf4af5c10ec645f55a10f30e5661c54f6a6b319 – b2a8416d149043132fe5a14ed611e0fefc9dc9cd
TIMELINE Jul 24 Reserved by CNA Aug 5 Public exploit reference published Aug 5 Published (CNA: EEF)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0098 59.3 —
AFFECTED Product Versions Fixed hashbrown-cms unspecified —
TIMELINE Aug 4 Reserved by CNA Aug 5 Published (CNA: TuranSec)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0097 59.0 —
AFFECTED Product Versions Fixed hashbrown-cms unspecified —
TIMELINE Aug 4 Reserved by CNA Aug 5 Published (CNA: TuranSec)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0096 58.7 —
AFFECTED Product Versions Fixed Langflow OSS 1.0.0 – —
TIMELINE Jul 27 Reserved by CNA Aug 5 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H H 10.0 .0091 56.9 —
AFFECTED Product Versions Fixed PraisonAI < 4.6.40 – —
TIMELINE May 20 Reserved by CNA Aug 5 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0089 56.4 —
AFFECTED Product Versions Fixed fledge unspecified —
TIMELINE Aug 5 Reserved by CNA Aug 5 Published (CNA: TuranSec)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0084 54.9 —
AFFECTED Product Versions Fixed Cisco Unified Computing System (Standalone) 4.3(1.230097) – —
TIMELINE Oct 8 Reserved by CNA Aug 5 Published (CNA: cisco)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R C L L N 6.1 .0080 53.7 —
AFFECTED Product Versions Fixed TranslatePress – Translate Multilingual sites with AI Translation unspecified —
TIMELINE Jul 26 Reserved by CNA Aug 5 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0078 52.9 —
AFFECTED Product Versions Fixed Langflow OSS 1.0.0 – —
TIMELINE Jul 27 Reserved by CNA Aug 5 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U N H H 8.1 .0077 52.7 —
AFFECTED Product Versions Fixed Content Egg – Affiliate Product Importer & Price Comparison unspecified —
TIMELINE Jul 16 Reserved by CNA Aug 5 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV P L L N C H L L 6.5 .0069 49.8 —
AFFECTED Product Versions Fixed NX799J (Red Magic 11 Air) GEN_CN_NX799JV1.0.0B15 – —
TIMELINE May 27 Reserved by CNA Aug 5 Published (CNA: zte)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0066 48.7 —
AFFECTED Product Versions Fixed Page and Post Restriction unspecified —
TIMELINE Jun 11 Reserved by CNA Aug 5 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0066 48.5 —
AFFECTED Product Versions Fixed LightSync Pro – Connect & Sync Cloud Assets | Lightroom, Canva, Figma, Dropbox & Shutterstock unspecified —
TIMELINE Apr 12 Reserved by CNA Aug 5 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H L 8.2 .0062 46.6 —
AFFECTED Product Versions Fixed WPFormify – Stripe Payments with Form and Checkout unspecified —
TIMELINE Apr 19 Reserved by CNA Aug 5 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0059 45.3 —
AFFECTED Product Versions Fixed Hi Browser 2.23.1.1 – —
TIMELINE Aug 5 Reserved by CNA Aug 5 Published (CNA: TECNOMobile)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0058 44.9 —
AFFECTED Product Versions Fixed CPE2801 Firmware 22.10.09 – — WE1026-5G-WD Firmware 21.04.07 – — WE1326 Firmware 22.02.18_1 – — WE2007 Firmware 23.08.12 – — WE2008-DSIM Firmware 23.08.11 – — WE2416 Firmware 21.03.22_1 – — WE3326 Firmware 20.09.30 – — WE5927 Firmware 22.08.10 – — WE5931 Firmware 22.05.31 – — WE5931AC Firmware 22.05.31 – — + 10 more
TIMELINE Jul 27 Reserved by CNA Aug 5 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0058 44.8 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jul 30 Reserved by CNA Aug 5 Published (CNA: mitre)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N N H 8.7 .0057 44.4 —
AFFECTED Product Versions Fixed milvus unspecified —
TIMELINE Aug 3 Reserved by CNA Aug 5 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0057 44.3 —
AFFECTED Product Versions Fixed HiPER 1250GW 3.2.7-210907-180535 – —
TIMELINE Aug 4 Reserved by CNA Aug 5 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0057 44.3 —
AFFECTED Product Versions Fixed HiPER 1250GW v3.2.7-210907-180535 – —
TIMELINE Aug 4 Reserved by CNA Aug 5 Published (CNA: VulDB)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-61486 | 9.8 | 44.3 | Apache Software Foundation | Apache Lucy | CWE-121 | Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed… |
| CVE-2026-17532 | 6.1 | 44.0 | seraphinitesoft | Seraphinite Accelerator | CWE-79 | Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting |
| CVE-2026-61484 | 9.8 | 43.6 | Apache Software Foundation | Apache Lucy | CWE-502 | Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::tha… |
| CVE-2026-6020 | 7.2 | 42.8 | devitemsllc | ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | CWE-470 | ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execu… |
| CVE-2026-64577 | 7.5 | 42.7 | Linux | Linux | — | gtp: check skb_pull_data() return in gtp1u_send_echo_resp() |
| CVE-2026-71207 | 9.8 | 42.4 | mrswapnilsahu | Stock-Inventory-Management-System | CWE-89 | Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcod… |
| CVE-2026-67623 | 8.6 | 42.3 | mistralai | mistral-vibe | CWE-829 | Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook |
| CVE-2026-61483 | 7.5 | 41.9 | Apache Software Foundation | Apache Lucy | CWE-674 | Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stac… |
| CVE-2026-61485 | 7.5 | 41.9 | Apache Software Foundation | Apache Lucy | CWE-789 | Apache Lucy: Freezer/InStream deserialization bomb - unbounded allocation rea… |
| CVE-2026-48834 | 7.5 | 40.2 | Apache Software Foundation | Apache Answer | CWE-400 | Apache Answer: Denial of service via crafted Accept-Language header parsing |
| CVE-2026-66274 | 7.5 | 40.2 | Apache Software Foundation | Apache Qpid Proton-J | CWE-674 | Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication s… |
| CVE-2026-67465 | 7.5 | 40.2 | Apache Software Foundation | Apache Qpid Proton Dotnet | CWE-770 | Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-aut… |
| CVE-2026-67551 | 7.5 | 40.2 | Apache Software Foundation | Apache Qpid Proton Dotnet | CWE-789 | Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive all… |
| CVE-2026-67589 | 7.5 | 40.2 | Apache Software Foundation | Apache Qpid ProtonJ2 | CWE-789 | Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocati… |
| CVE-2026-67590 | 7.5 | 40.2 | Apache Software Foundation | Apache Qpid ProtonJ2 | CWE-674 | Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication s… |
| CVE-2026-68074 | 7.5 | 40.2 | Apache Software Foundation | Apache Qpid Broker-J | CWE-770 | Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authenti… |
| CVE-2026-55707 | 7.1 | 39.8 | OpenStack | Neutron | CWE-863 | In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not ve… |
| CVE-2026-67552 | 7.5 | 39.5 | Apache Software Foundation | Apache Qpid Proton Dotnet | CWE-674 | Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authenticat… |
| CVE-2026-67588 | 7.5 | 39.5 | Apache Software Foundation | Apache Qpid ProtonJ2 | CWE-770 | Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authenti… |
| CVE-2026-68060 | 7.5 | 39.5 | Apache Software Foundation | Apache Qpid Broker-J | CWE-770 | Apache Qpid Broker-J: Type size/count handling can lead to excessive allocati… |
| CVE-2026-68073 | 7.5 | 39.5 | Apache Software Foundation | Apache Qpid Broker-J | CWE-674 | Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication s… |
| CVE-2026-8400 | 9.8 | 39.5 | IBM | WebSphere Application Server | CWE-470 | Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Se… |
| CVE-2026-16022 | 7.8 | 39.4 | Swiss Federal Office of Information Technology, Systems and Telecommunication | @oblique/cli | CWE-78 | Command Injection in @oblique/cli |
| CVE-2026-67592 | 7.5 | 39.2 | Apache Software Foundation | Apache Qpid ProtonJ2 | CWE-770 | Apache Qpid ProtonJ2: Unable to govern the maximum number of transfer frames … |
| CVE-2026-9192 | 9.8 | 38.9 | Progress Software Corporation | MarkLogic Server | CWE-287 | Authentication bypass in Progress MarkLogic Server ODBC App Server |
| CVE-2026-18898 | 7.4 | 38.7 | UTT | HiPER 1200GW | CWE-119 | UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow |
| CVE-2026-71190 | 8.7 | 38.4 | OpenStack | Swift | CWE-1333 | In OpenStack Swift through 2.38.0, the proxy server Accept header parser cont… |
| CVE-2026-67866 | 7.5 | 38.4 | n/a | n/a | CWE-121 | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacke… |
| CVE-2026-67867 | 7.5 | 38.4 | n/a | n/a | CWE-122 | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacke… |
| CVE-2026-67869 | 7.5 | 38.4 | n/a | n/a | CWE-120 | Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to… |
| CVE-2026-67871 | 7.5 | 38.4 | n/a | n/a | CWE-120 | Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacke… |
| CVE-2026-17556 | 8.8 | 38.3 | GitHub | Enterprise Server | CWE-22 | Path traversal in GitHub Enterprise Server allowed unauthenticated deletion o… |
| CVE-2026-5581 | 9.1 | 37.8 | sh1zen | Multi Uploader for Gravity Forms | CWE-862 | Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthen… |
| CVE-2026-18901 | 7.3 | 37.6 | H3C | NX15 | CWE-749 | H3C NX15 Web API esps service.add routine |
| CVE-2026-61891 | 7.5 | 37.5 | Eclipse Foundation | Eclipse Theia | CWE-22 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem`… |
| CVE-2026-17632 | 8.8 | 37.3 | IBM | Langflow OSS | CWE-94 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-68746 | 7.7 | 37.2 | livebook-dev | livebook | CWE-636 | Livebook Teams identity check fails open when the deployment group is unresol… |
| CVE-2026-71320 | 8.1 | 36.5 | nuxt | nuxt | CWE-74 | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nux… |
| CVE-2025-63823 | 9.8 | 36.4 | n/a | n/a | CWE-798 | My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the … |
| CVE-2026-67531 | 9.3 | 36.1 | agentfront | frontmcp | CWE-94 | FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by… |
| CVE-2026-59675 | 7.5 | 36.0 | SUSE | Rancher | CWE-770 | Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service |
| CVE-2026-14553 | 8.1 | 36.0 | Unknown | zportals | CWE-434 | Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload |
| CVE-2026-66257 | 7.5 | 35.6 | Apache Software Foundation | Apache Qpid Proton-J | CWE-770 | Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authenti… |
| CVE-2026-66273 | 7.5 | 35.6 | Apache Software Foundation | Apache Qpid Proton-J | CWE-789 | Apache Qpid Proton-J: Type size/count handling can lead to excessive allocati… |
| CVE-2026-9190 | 9.1 | 35.2 | Progress Software Corporation | MarkLogic Server | CWE-444 | HTTP request smuggling in Progress MarkLogic Server |
| CVE-2026-17613 | 7.5 | 35.3 | Penpot | Penpot | CWE-862 | CVE-2026-17613 |
| CVE-2026-67864 | 7.5 | 35.2 | n/a | n/a | CWE-400 | An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a … |
| CVE-2026-67865 | 7.5 | 35.2 | n/a | n/a | CWE-125 | S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. Thi… |
| CVE-2026-67872 | 7.5 | 35.2 | n/a | n/a | CWE-400 | An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial o… |
| CVE-2026-71321 | 7.5 | 35.3 | nuxt | nuxt | CWE-407 | Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endp… |
| CVE-2026-17630 | 8.8 | 35.1 | IBM | Langflow OSS | CWE-184 | Langflow is affected by security vulnerabilities in Model Context Protocol fe… |
| CVE-2026-66275 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid Proton-J | CWE-770 | Apache Qpid Proton-J: Incoming session flow control window can be exceeded |
| CVE-2026-66276 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid Proton-J | CWE-606 | Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial… |
| CVE-2026-66277 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid Proton-J | CWE-770 | Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames … |
| CVE-2026-67591 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid ProtonJ2 | CWE-770 | Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded |
| CVE-2026-68075 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid Broker-J | CWE-770 | Apache Qpid Broker-J: Incoming session flow control window can be exceeded |
| CVE-2026-68077 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid Broker-J | CWE-606 | Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial… |
| CVE-2026-68080 | 6.5 | 35.2 | Apache Software Foundation | Apache Qpid Broker-J | CWE-406 | Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of ser… |
| CVE-2026-71237 | 9.8 | 35.1 | Miantang | IoT-PHP | CWE-89 | Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin |
| CVE-2026-67553 | 6.5 | 34.4 | Apache Software Foundation | Apache Qpid Proton Dotnet | CWE-770 | Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded |
| CVE-2026-67554 | 6.5 | 34.4 | Apache Software Foundation | Apache Qpid Proton Dotnet | CWE-606 | Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to d… |
| CVE-2026-67555 | 6.5 | 34.4 | Apache Software Foundation | Apache Qpid Proton Dotnet | CWE-770 | Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer fr… |
| CVE-2026-68078 | 6.5 | 34.4 | Apache Software Foundation | Apache Qpid Broker-J | CWE-770 | Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames … |
| CVE-2026-67863 | 7.5 | 34.2 | n/a | n/a | CWE-416 | In open62541 1.5.5, a server-side use-after-free exists in the local Monitore… |
| CVE-2026-12609 | 7.5 | 34.0 | Eclipse Foundation | Eclipse Theia | CWE-22 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/p… |
| CVE-2026-71248 | 9.8 | 33.4 | Harsh21Patel | Inventory-Management-System-PHP | CWE-89 | Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and … |
| CVE-2026-67873 | 9.8 | 33.3 | n/a | n/a | CWE-122 | A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side Fi… |
| CVE-2026-71314 | 7.5 | 33.2 | nuxt | nuxt | CWE-400 | Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in is… |
| CVE-2026-15996 | 6.6 | 33.2 | GitHub | Enterprise Server | CWE-674 | Denial of service vulnerability in GitHub Enterprise Server allowed unauthent… |
| CVE-2026-16940 | 10.0 | 33.2 | Unknown | Custom Fields | CWE-22 | Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deleti… |
| CVE-2026-17633 | 8.8 | 32.9 | IBM | Langflow OSS | CWE-94 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-11454 | 6.5 | 32.7 | trainingbusinesspros | Groundhogg — CRM, Newsletters, and Marketing Automation | CWE-639 | Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure D… |
| CVE-2026-60023 | 7.5 | 32.5 | Apache Software Foundation | Apache Answer | CWE-200 | Apache Answer: Unauthorized disclosure of deleted or pending answer content |
| CVE-2026-6079 | 7.3 | 32.6 | ho3einie | Material Dashboard | CWE-862 | Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task … |
| CVE-2026-20310 | 9.1 | 32.3 | Cisco | Cisco Catalyst SD-WAN Controller | CWE-59 | Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution B… |
| CVE-2026-9195 | 9.3 | 32.0 | Progress Software Corporation | MarkLogic Server | CWE-22 | Cross-site scripting in Progress MarkLogic Server Query Console |
| CVE-2026-15918 | 7.5 | 32.0 | e4jvikwp | VikAppointments Services Booking Calendar | CWE-89 | VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL I… |
| CVE-2026-8182 | 8.8 | 31.5 | IBM | Langflow OSS | CWE-94 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-70610 | 5.4 | 31.4 | electron | electron | CWE-1321 | Electron: contextBridge object copy honors prototype setters |
| CVE-2025-70962 | 7.5 | 31.3 | n/a | n/a | CWE-284 | Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The … |
| CVE-2026-71269 | 7.2 | 31.2 | node-red | node-red | CWE-22 | Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write |
| CVE-2026-14587 | 5.5 | 31.2 | neo4j | Enterprise Edition | CWE-130 | Unathenticated connection can hold Bolt channel open |
| CVE-2026-18531 | 5.3 | 30.9 | IBM | Maximo Application Suite | CWE-330 | IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerab… |
| CVE-2026-5651 | 4.9 | 30.9 | 2wstechnologies | Askeet — Talk to Your WooCommerce Data | CWE-89 | Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' … |
| CVE-2026-66881 | 7.0 | 30.8 | livebook-dev | livebook | CWE-23 | Path traversal in imported file_entries name allows arbitrary file write via … |
| CVE-2026-17624 | 8.8 | 30.7 | IBM | Langflow OSS | CWE-94 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-18881 | 7.5 | 30.7 | realmag777 | TableOn – WordPress Posts Table Filterable | CWE-89 | TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' … |
| CVE-2026-70431 | 8.8 | 30.5 | Jenkins Project | Jenkins Multijob Plugin | CWE-94 | Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scrip… |
| CVE-2026-8183 | 7.7 | 30.5 | IBM | Langflow OSS | CWE-22 | Langflow OSS is affected by arbitrary code execution in custom component vali… |
| CVE-2026-48911 | 7.5 | 30.5 | Apache Software Foundation | Apache Answer | CWE-306 | Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Exist… |
| CVE-2026-71310 | 5.9 | 30.4 | rclone | rclone | CWE-400 | rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory |
| CVE-2026-71215 | 7.5 | 30.4 | art-template | art-template | CWE-22 | art-template - Path Traversal in Sub-Template Resolution via include()/extend() |
| CVE-2026-18959 | 2.1 | 30.3 | yushine | InnoShop | CWE-22 | yushine InnoShop Files Endpoint panel-api.php destroyFiles path traversal |
| CVE-2026-8478 | 8.8 | 30.2 | IBM | Langflow OSS | CWE-94 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-46581 | 7.5 | 30.2 | Eclipse Foundation | Eclipse Mojarra | CWE-22 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFacelet… |
| CVE-2026-8761 | 8.8 | 29.9 | dokaninc | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | CWE-862 | Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege E… |
| CVE-2026-71289 | 9.8 | 29.8 | NASA-AMMOS | anms | CWE-306 | NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution… |
| CVE-2026-6639 | 7.5 | 29.8 | wupsales | AI Copilot – Content Generator | CWE-862 | AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to … |
| CVE-2026-71268 | 9.9 | 29.6 | thiagoralves | OpenPLC_v3 | CWE-22 | OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading t… |
| CVE-2026-20272 | 9.8 | 29.5 | Cisco | Cisco IOS XE Software | CWE-74 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-15372 | 7.5 | 29.5 | Unknown | WP 2FA | CWE-287 | WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider |
| CVE-2026-71279 | 8.0 | 29.4 | Koenkk | zigbee2mqtt | CWE-22 | Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execu… |
| CVE-2026-70612 | 5.4 | 29.2 | electron | electron | CWE-284 | Electron: Sandboxed iframes can launch external protocol handlers |
| CVE-2026-71231 | 9.8 | 28.9 | thebradleysanders | IOTSmartHome | CWE-89 | IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie |
| CVE-2026-71278 | 9.8 | 28.9 | iot-ecology | rust-iot-platform | CWE-94 | rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-… |
| CVE-2026-70377 | 7.5 | 28.8 | theotherphil | imagecli | CWE-789 | imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes De… |
| CVE-2026-18903 | 2.1 | 28.8 | yeqifu | warehouse | CWE-22 | yeqifu warehouse FileController.java path traversal |
| CVE-2026-7753 | 6.5 | 28.6 | stylemix | Cost Calculator Builder | CWE-862 | Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (S… |
| CVE-2026-64566 | 9.8 | 28.2 | Linux | Linux | — | xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() |
| CVE-2026-7529 | 7.5 | 28.2 | wisemattic | wiseCampaign – WooCommerce Conversions Made Easy | CWE-862 | wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Conf… |
| CVE-2026-71262 | 9.8 | 28.1 | IoTSharp | IoTSharp | CWE-306 | IoTSharp BlobStorageController Missing Authentication and Path Traversal |
| CVE-2026-60053 | 9.1 | 27.9 | Apache Software Foundation | Apache Answer | CWE-613 | Apache Answer: Residual Administrative API Key Access After Role or Account R… |
| CVE-2026-15572 | 8.8 | 27.9 | Red Hat | Red Hat build of Keycloak 26.4 | CWE-843 | Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy by… |
| CVE-2026-10025 | 9.8 | 27.8 | IBM | QRadar | CWE-611 | IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability |
| CVE-2026-20288 | 6.5 | 27.6 | Cisco | Cisco Unified Computing System (Standalone) | CWE-146 | Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerabi… |
| CVE-2026-20124 | 7.7 | 27.5 | Cisco | Cisco IOS XE Software | CWE-772 | Cisco IOS XE Software SNMP Denial of Service Vulnerability |
| CVE-2026-55523 | 7.7 | 27.3 | MervinPraison | PraisonAI | CWE-918 | PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets |
| CVE-2026-54416 | 7.2 | 27.2 | pluck-cms | Pluck CMS | CWE-434 | Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Bl… |
| CVE-2026-17617 | 9.8 | 26.5 | IBM | Application Gateway Operator | CWE-918 | Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator |
| CVE-2026-15281 | 6.5 | 26.5 | gm_alex | User Access Manager | CWE-89 | User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection |
| CVE-2026-18411 | 7.2 | 26.4 | Acrisure | KARR BT | CWE-321 | Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100 |
| CVE-2026-7658 | 6.5 | 26.4 | IBM | Langflow OSS | CWE-22 | Langflow OSS is affected by arbitrary code execution in custom component vali… |
| CVE-2026-70607 | 5.3 | 26.4 | electron | electron | CWE-20 | Electron: window.open features string controls some window options considered… |
| CVE-2026-4431 | 9.1 | 26.3 | themeruby | Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress | CWE-862 | Easy Post Submission <= 2.3.0 - Missing Authorization |
| CVE-2026-11421 | 6.5 | 25.6 | wedevs | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | CWE-89 | ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17… |
| CVE-2026-20263 | 8.6 | 25.6 | Cisco | Cisco IOS XE Software | CWE-388 | Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service V… |
| CVE-2026-20301 | 8.6 | 25.6 | Cisco | Cisco IOS XE Software | CWE-606 | Cisco IOS Software and IOS XE Software Extensible Messaging Client Protocol D… |
| CVE-2026-71319 | 9.6 | 25.3 | nuxt | devtools | CWE-94 | Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution |
| CVE-2026-15360 | 9.1 | 25.2 | Unknown | Ajax Load More | CWE-89 | Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args |
| CVE-2026-71213 | 9.1 | 25.1 | typemill | typemill | CWE-307 | typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brut… |
| CVE-2026-60009 | 8.8 | 25.1 | Eclipse Foundation | Eclipse Theia | CWE-22 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem`… |
| CVE-2026-70609 | 5.7 | 25.0 | electron | electron | CWE-94 | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter |
| CVE-2026-20308 | 4.3 | 24.7 | Cisco | Cisco IOS XE Software | CWE-269 | Cisco IOS XE Software Web-Based Management Interface Vulnerability |
| CVE-2026-71292 | 7.2 | 24.6 | intelliants | subrion | CWE-89 | Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter |
| CVE-2026-7329 | 9.9 | 24.5 | Progress Software Corporation | MarkLogic Server | CWE-269 | Privilege escalation in Progress MarkLogic Server REST query interfaces |
| CVE-2026-64578 | 8.2 | 24.4 | Linux | Linux | — | ksmbd: validate compound request size before reading StructureSize2 |
| CVE-2026-16602 | 7.5 | 24.3 | Unknown | Passster | CWE-200 | Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Conten… |
| CVE-2026-16603 | 7.5 | 24.3 | Unknown | Passster | CWE-200 | Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Conten… |
| CVE-2026-16604 | 7.5 | 24.3 | Unknown | Passster | CWE-200 | Content Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disc… |
| CVE-2026-16605 | 7.2 | 24.4 | Unknown | MultiVendorX | CWE-862 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion… |
| CVE-2026-18322 | 8.8 | 24.1 | supsysticcom | Smart Popup by Supsystic | CWE-269 | Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to … |
| CVE-2026-71309 | 8.6 | 24.1 | rclone | rclone | CWE-22 | rclone: Incomplete path validation allows backend root escape in serve restic |
| CVE-2026-34966 | 8.3 | 24.1 | Gitea | Gitea | CWE-918 | Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass |
| CVE-2026-71238 | 9.1 | 24.0 | DjangoCRM | django-crm | CWE-798 | DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery |
| CVE-2026-71270 | 8.6 | 24.0 | Stirling-Tools | Stirling-PDF | CWE-918 | Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPri… |
| CVE-2026-10716 | 7.5 | 23.7 | Directus | Directus | CWE-89 | Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostG… |
| CVE-2026-20303 | 9.9 | 23.5 | Cisco | Cisco Catalyst SD-WAN Controller | CWE-20 | Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabi… |
| CVE-2026-9077 | 8.5 | 23.6 | IBM | Langflow OSS | CWE-807 | Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model … |
| CVE-2026-71254 | 9.8 | 23.4 | debevv | nanoMODBUS | CWE-787 | nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record() |
| CVE-2026-71256 | 9.8 | 23.4 | debevv | nanoMODBUS | CWE-125 | nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via o… |
| CVE-2026-71267 | 9.8 | 23.4 | rxi | microtar | CWE-121 | microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir… |
| CVE-2026-16100 | 6.5 | 23.3 | Red Hat | Red Hat build of Keycloak 26.6 | CWE-770 | Keycloak-services: keycloak-services: unbounded metric cardinality in user ev… |
| CVE-2026-71287 | 8.8 | 23.1 | Cacti | cacti | CWE-89 | Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions … |
| CVE-2026-71288 | 8.8 | 23.1 | Koha Community | Koha | CWE-89 | Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_repor… |
| CVE-2026-71291 | 8.8 | 23.1 | bolt | core | CWE-1336 | Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rend… |
| CVE-2026-48912 | 6.5 | 23.2 | Apache Software Foundation | Apache Answer | CWE-639 | Apache Answer: Improper authorization in avatar update cleanup allows authent… |
| CVE-2026-50749 | 6.5 | 23.2 | Apache Software Foundation | Apache Answer | CWE-863 | Apache Answer: Missing authorization in revision audit reject allows authenti… |
| CVE-2026-16055 | 7.5 | 23.0 | Unknown | Contest Gallery | CWE-287 | Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass vi… |
| CVE-2026-44945 | 9.1 | 22.9 | SUSE | Rancher | CWE-441 | Cross-Cluster Impersonation Confused-Deputy Privilege Escalation |
| CVE-2026-7646 | 6.5 | 22.8 | IBM | Langflow OSS | CWE-22 | Langflow is affected by security vulnerabilities in Model Context Protocol fe… |
| CVE-2026-11969 | 4.9 | 22.7 | jgwhite33 | WP TripAdvisor Review Slider | CWE-89 | WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Inj… |
| CVE-2026-16036 | 7.5 | 22.5 | Unknown | miniOrange 2FA | CWE-287 | miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding |
| CVE-2026-71232 | 7.2 | 22.6 | magicblack | maccms10 | CWE-94 | MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authentic… |
| CVE-2026-71316 | 7.5 | 22.3 | nuxt | nuxt | CWE-524 | Nuxt runtime payload cache discloses another user's SSR data across users and… |
| CVE-2026-5116 | 4.4 | 22.3 | sevenspark | DTX – Dynamic Text Extension for Contact Form 7 | CWE-79 | Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) St… |
| CVE-2026-15210 | 9.1 | 22.2 | Unknown | OTP Login With Phone Number, OTP Verification | CWE-287 | Login/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated A… |
| CVE-2026-16561 | 7.5 | 22.2 | Unknown | Sunshine Photo Cart | CWE-862 | Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclo… |
| CVE-2026-16736 | 7.5 | 22.2 | Unknown | User Registration & Membership | CWE-284 | User Registration & Membership < 5.2.6 - Unauthenticated Account Creation Whi… |
| CVE-2026-70426 | 9.0 | 21.8 | Jenkins Project | Jenkins | CWE-502 | In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, i… |
| CVE-2026-15573 | 8.1 | 21.5 | Red Hat | Red Hat build of Keycloak 26.4 | CWE-178 | Keycloak-services: keycloak-services: authorization bypass via unnormalized u… |
| CVE-2026-11920 | 4.9 | 21.5 | beardev | JoomSport – for Sports: Team & League, Football, Hockey & more | CWE-89 | JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order'… |
| CVE-2026-71235 | 8.8 | 21.3 | absmach | magistrala | CWE-94 | Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine |
| CVE-2026-71243 | 8.8 | 21.3 | adaltas | backmeup | CWE-78 | backmeup (npm) - OS Command Injection via Backup Option Values |
| CVE-2026-17626 | 8.8 | 21.1 | IBM | Langflow OSS | CWE-266 | Langflow is affected by security vulnerabilities in Model Context Protocol fe… |
| CVE-2026-71283 | 4.9 | 21.1 | fledge-iot | fledge | CWE-22 | Fledge IoT Gateway Backup Restore Tar Path Traversal |
| CVE-2026-71252 | 8.2 | 20.9 | raghav993 | toner-management | CWE-862 | toner-management - Unauthenticated State-Changing Admin Actions |
| CVE-2026-8446 | 7.5 | 20.9 | IBM | Langflow OSS | CWE-306 | Langflow is affected by security vulnerabilities in Model Context Protocol fe… |
| CVE-2026-71241 | 7.5 | 20.7 | lyric777 | Book-Management-System | CWE-306 | Book-Management-System - Unauthenticated Disclosure of Student PII and Borrow… |
| CVE-2026-14574 | 5.7 | 20.7 | Eclipse Foundation | Eclipse Theia | CWE-1321 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `Preferenc… |
| CVE-2026-71263 | 9.1 | 20.3 | cwalter-at | FreeModbus | CWE-787 | FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() |
| CVE-2026-70378 | 7.5 | 20.2 | theotherphil | imagecli | CWE-1284 | imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via… |
| CVE-2026-18933 | 7.2 | 20.2 | wp-downloadmanager | wp-downloadmanager | CWE-434 | wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Vali… |
| CVE-2026-18969 | 5.5 | 20.3 | Rongzhitong | Visual Integrated Command and Dispatch Platform | CWE-284 | Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestrict… |
| CVE-2026-9273 | 9.3 | 20.0 | stellarwp | Membership Plugin – Kadence Memberships | CWE-640 | Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password R… |
| CVE-2026-71312 | 8.0 | 20.0 | rclone | rclone | CWE-78 | rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Co… |
| CVE-2026-10059 | 9.1 | 19.6 | Red Hat | Multicluster Engine for Kubernetes | CWE-266 | Cluster-curator-controller: cluster-curator-controller: namespace admin can e… |
| CVE-2026-71281 | 8.8 | 19.5 | huggingface | peft | CWE-502 | peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA … |
| CVE-2026-7520 | 8.1 | 19.2 | mailmunch | Mailmunch Forms for Mailchimp | CWE-862 | MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticate… |
| CVE-2026-20304 | 9.9 | 19.1 | Cisco | Cisco Catalyst SD-WAN Controller | CWE-284 | Cisco Catalyst SD-WAN Security Hardening Release - Access Control Vulnerabili… |
| CVE-2026-52466 | 9.8 | 19.0 | n/a | n/a | CWE-863 | Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect A… |
| CVE-2026-71214 | 9.8 | 19.0 | NASA-AMMOS | plandev (sequencing-server) | CWE-306 | NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin A… |
| CVE-2026-20268 | 8.6 | 18.9 | Cisco | Cisco IOS XE Software | CWE-119 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20269 | 8.6 | 18.9 | Cisco | Cisco IOS XE Software | CWE-664 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20270 | 8.6 | 18.9 | Cisco | Cisco IOS XE Software | CWE-682 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20271 | 8.6 | 18.9 | Cisco | Cisco IOS XE Software | CWE-691 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20273 | 8.6 | 18.9 | Cisco | Cisco IOS XE Software | CWE-20 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-71315 | 8.2 | 18.9 | nuxt | nuxt | CWE-178 | Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddlewa… |
| CVE-2026-16573 | 7.5 | 18.9 | Unknown | Bit Form | CWE-79 | Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload |
| CVE-2026-7726 | 6.5 | 18.9 | techeshta | Layouts for WPBakery | CWE-862 | Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Temp… |
| CVE-2026-7557 | 9.1 | 18.6 | Progress Software Corporation | MarkLogic Server | CWE-347 | SAML authentication bypass in Progress MarkLogic Server |
| CVE-2026-5062 | 4.9 | 18.8 | supercleanse | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links | CWE-89 | PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' … |
| CVE-2026-9196 | 8.8 | 18.5 | IBM | Langflow OSS | CWE-94 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-55739 | 8.3 | 18.5 | crater-invoice | Crater | CWE-639 | Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Compan… |
| CVE-2026-20313 | 7.7 | 18.3 | Cisco | Cisco Catalyst SD-WAN Controller | CWE-1284 | Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerab… |
| CVE-2026-71202 | 7.5 | 18.2 | kosinix | raster | CWE-191 | raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow… |
| CVE-2026-18968 | 2.1 | 18.3 | ttttonyhe | OBlog | CWE-79 | ttttonyhe OBlog tags.php cross site scripting |
| CVE-2026-54876 | 7.5 | 18.0 | OpenSSL | OpenSSL | CWE-401 | Client-Side Memory Leak in OCSP Response Checking |
| CVE-2026-39923 | 9.2 | 17.9 | Flarum | Flarum Framework | CWE-324 | Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset |
| CVE-2026-13477 | 8.8 | 17.8 | IBM | QRadar | CWE-78 | IBM QRadar SIEM is vulnerable to remote code execution by privileged users |
| CVE-2026-70608 | 7.2 | 17.7 | electron | electron | CWE-693 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the Op… |
| CVE-2026-55747 | 6.8 | 17.6 | The-Pocket | PocketFlow (pocketflow-coding-agent cookbook example) | CWE-22 | PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File … |
| CVE-2026-8709 | 9.9 | 17.6 | Progress Software Corporation | MarkLogic Server | CWE-269 | Privilege escalation in Progress MarkLogic Server REST document patch operation |
| CVE-2026-9193 | 9.9 | 17.6 | Progress Software Corporation | MarkLogic Server | CWE-269 | Privilege escalation in Progress MarkLogic Server Hadoop integration |
| CVE-2026-18854 | 5.5 | 17.1 | Shandong Hoteam | PDM Product Data Management System | CWE-74 | Shandong Hoteam PDM Product Data Management System DataService GetStoredClass… |
| CVE-2026-18859 | 5.5 | 17.1 | ESAFENET | CDG | CWE-74 | ESAFENET CDG usbkey;logindojojs sql injection |
| CVE-2026-18958 | 5.5 | 17.1 | imranrisal-dev | Student-Management-System | CWE-74 | imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection |
| CVE-2026-18970 | 5.5 | 17.1 | Rongzhitong | Visual Integrated Command and Dispatch Platform | CWE-74 | Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injec… |
| CVE-2026-16102 | 8.1 | 17.0 | Red Hat | Red Hat build of Keycloak 26.4 | CWE-284 | Keycloak-services: keycloak-services: default dcr policy allows role forgery … |
| CVE-2026-71313 | 6.9 | 17.0 | rclone | rclone | CWE-22 | rclone: Local Encoding Path Traversal |
| CVE-2026-71192 | 6.0 | 16.9 | OpenStack | Swift | CWE-863 | In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swi… |
| CVE-2026-71191 | 6.0 | 16.8 | OpenStack | Swift | CWE-863 | In OpenStack Swift through 2.38.0, S3API middleware does not enforce that sem… |
| CVE-2026-20028 | 5.0 | 16.8 | Cisco | Cisco Terminal Services Agent | CWE-266 | Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability |
| CVE-2026-11977 | 6.5 | 16.5 | afthemes | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | CWE-89 | WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection |
| CVE-2026-15941 | 6.5 | 16.5 | Relevanssi | Relevanssi Premium – A Better Search | CWE-89 | Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contri… |
| CVE-2026-15230 | 8.1 | 16.3 | Unknown | YayPricing | CWE-284 | YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupo… |
| CVE-2026-54418 | 8.1 | 16.3 | Leantime | Leantime | CWE-862 | Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Accou… |
| CVE-2026-70427 | 4.3 | 16.4 | Jenkins Project | Jenkins | CWE-59 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle sym… |
| CVE-2026-10090 | 9.0 | 16.3 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-267 | Multicluster-operators-subscription: multicluster-operators-subscription: nam… |
| CVE-2026-7456 | 6.5 | 16.2 | webocoders | Udimi Tools | CWE-862 | Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plu… |
| CVE-2026-20267 | 9.0 | 15.9 | Cisco | Cisco IOS XE Software | CWE-284 | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-71234 | 7.5 | 16.0 | documize | community | CWE-863 | Documize Community - Attachment Download Authorization Bypass via Non-Validat… |
| CVE-2026-5108 | 4.4 | 16.0 | superpwa | Super Progressive Web Apps | CWE-79 | Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored … |
| CVE-2026-70428 | 4.3 | 15.9 | Jenkins Project | Jenkins | CWE-22 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file… |
| CVE-2026-0931 | 6.9 | 15.6 | M-Files Corporation | M-Files Server | CWE-1286 | Denial-of-service vulnerability in M-Files Server |
| CVE-2026-71277 | 9.1 | 15.5 | iot-ecology | rust-iot-platform | CWE-287 | rust-iot-platform Authentication Bypass via Non-Validated Authorization Header |
| CVE-2026-70429 | 8.1 | 15.5 | Jenkins Project | Jenkins | CWE-178 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity… |
| CVE-2026-71225 | 6.5 | 15.4 | Stephan Muelle | libkcapi | CWE-330 | Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes ciph… |
| CVE-2026-12762 | 5.3 | 15.4 | IBM | Cloud Pak For Business Automation | CWE-538 | Insertion of Sensitive Information into Externally-Accessible File in IBM Bus… |
| CVE-2026-71271 | 8.5 | 15.2 | usememos | memos | CWE-918 | Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass |
| CVE-2026-15452 | 4.7 | 15.2 | smub | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | CWE-79 | Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting vi… |
| CVE-2026-71311 | 6.4 | 15.0 | rclone | rclone | CWE-93 | rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Pres… |
| CVE-2026-16143 | 7.2 | 14.9 | e4jvikwp | VikRentItems Flexible Rental Management System | CWE-79 | VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Sto… |
| CVE-2026-9201 | 8.8 | 14.3 | IBM | Langflow OSS | CWE-326 | Langflow OSS is affected by arbitrary code execution in component generation,… |
| CVE-2026-71260 | 6.5 | 14.3 | esphome | esphome | CWE-522 | ESPHome web_server Plaintext Password Disclosure via JSON "value" Field |
| CVE-2026-9205 | 9.8 | 14.2 | IBM | Langflow OSS | CWE-338 | Langflow is affected by weaknesses in secret handling and sensitive configura… |
| CVE-2026-70617 | 8.6 | 14.1 | Spacebar Server | Spacebar Server | CWE-862 | Spacebar Server Missing Authorization via Group DM Recipient Endpoint |
| CVE-2026-53992 | 5.1 | 14.1 | ProjectSend | ProjectSend | CWE-79 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_d… |
| CVE-2026-17506 | 7.2 | 14.0 | bensibley | Independent Analytics – WordPress Analytics Plugin | CWE-79 | Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-71282 | 6.5 | 13.7 | chirpstack | chirpstack | CWE-89 | ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter |
| CVE-2026-18856 | 2.0 | 13.6 | Poesis | Rhymix CMS | CWE-918 | Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdmin… |
| CVE-2026-10547 | 8.1 | 13.4 | IBM | Langflow OSS | CWE-284 | Langflow OSS is affected by arbitrary code execution in custom component vali… |
| CVE-2026-71239 | 8.1 | 13.4 | DjangoCRM | django-crm | CWE-1336 | DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering |
| CVE-2026-39924 | 7.6 | 13.4 | Flarum | Flarum Framework | CWE-613 | Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation |
| CVE-2026-71294 | 7.6 | 13.3 | Cotonti | Cotonti | CWE-502 | Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize… |
| CVE-2026-25703 | 7.3 | 13.3 | SUSE | NeuVector | CWE-202 | Potential information leakage from manager /network/graph API in NeuVector |
| CVE-2026-10128 | 6.5 | 13.2 | IBM | Langflow OSS | CWE-200 | Langflow is affected by weaknesses in secret handling and sensitive configura… |
| CVE-2026-7327 | 8.1 | 13.0 | Progress Software Corporation | MarkLogic Server | CWE-269 | Privilege escalation in Progress MarkLogic Server REST API document processing |
| CVE-2025-63822 | 8.1 | 12.9 | n/a | n/a | CWE-284 | SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Contro… |
| CVE-2026-70436 | 4.3 | 12.8 | Jenkins Project | Jenkins External Workspace Manager Plugin | CWE-862 | Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform … |
| CVE-2026-71255 | 8.6 | 12.7 | debevv | nanoMODBUS | CWE-787 | nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_dev… |
| CVE-2026-8790 | 6.1 | 12.8 | antoineh | Football Pool | CWE-79 | Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Sc… |
| CVE-2026-16968 | 6.5 | 12.6 | Unknown | GeoDirectory | CWE-200 | GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_s… |
| CVE-2026-16746 | 2.7 | 12.5 | Unknown | MultiVendorX | CWE-639 | MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure v… |
| CVE-2026-71250 | 4.3 | 12.3 | firefly-iii | firefly-iii | CWE-918 | Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypass… |
| CVE-2026-7869 | 5.4 | 12.3 | IBM | Langflow OSS | CWE-22 | Langflow OSS is affected by arbitrary code execution in custom component vali… |
| CVE-2026-70615 | 8.5 | 12.1 | boringproxy | boringproxy | CWE-93 | boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation |
| CVE-2026-71206 | 8.3 | 12.1 | go-shiori | shiori | CWE-613 | shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Priv… |
| CVE-2026-71242 | 8.3 | 12.1 | crater-invoice | crater | CWE-639 | Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in N… |
| CVE-2026-71285 | 8.1 | 12.2 | louislam | uptime-kuma | CWE-79 | Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages |
| CVE-2026-71293 | 6.2 | 12.2 | statamic | cms | CWE-200 | Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_use… |
| CVE-2026-9203 | 8.5 | 11.7 | Progress Software Corporation | MarkLogic Server | CWE-918 | Server-side request forgery in Progress MarkLogic Server |
| CVE-2026-71208 | 6.5 | 11.3 | kubesphere | KubeSphere | CWE-918 | KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster … |
| CVE-2026-71318 | 4.8 | 11.4 | nuxt | nuxt | CWE-20 | Nuxt: Unauthorized Component Instantiation via Server Island Props |
| CVE-2026-70432 | 8.8 | 11.0 | Jenkins Project | Jenkins Multijob Plugin | CWE-352 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin … |
| CVE-2026-20198 | 4.8 | 11.0 | Cisco | Cisco Enterprise NFV Infrastructure Software | CWE-79 | Cisco Integrated Management Controller Cross-Site Scripting Vulnerability |
| CVE-2026-70604 | 7.4 | 10.9 | electron | electron | CWE-942 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cro… |
| CVE-2026-0516 | 6.5 | 10.8 | SonicWall | SonicOS | CWE-644 | A improper neutralization of HTTP Headers for Scripting Syntax vulnerability … |
| CVE-2026-55998 | 5.3 | 10.8 | SUSE | Rancher | CWE-204 | Cluster Existence Oracle via Unauthenticated Import Endpoint |
| CVE-2026-7105 | 4.3 | 10.6 | xpro | Xpro Addons — 140+ Widgets for Elementor | CWE-862 | Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) A… |
| CVE-2026-16442 | 9.8 | 10.4 | Red Hat | Red Hat build of Keycloak 26.4 | CWE-346 | Keycloak-services: keycloak-services: saml idp-initiated broker login bypasse… |
| CVE-2026-7657 | 6.5 | 10.3 | IBM | Langflow OSS | CWE-918 | Langflow OSS is affected by server-side request forgery in provider validatio… |
| CVE-2026-71244 | 6.5 | 10.3 | paperless-ngx | paperless-ngx | CWE-918 | Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credenti… |
| CVE-2026-71251 | 6.5 | 10.3 | akaunting | akaunting | CWE-639 | Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint |
| CVE-2026-6972 | 6.4 | 10.3 | sonalsinha21 | SKT Skill Bar | CWE-79 | SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2026-7441 | 6.4 | 10.3 | alphawolf | Simple Yearly Archive | CWE-79 | Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Si… |
| CVE-2026-18927 | 2.1 | 10.4 | imranrisal-dev | Student-Management-System | CWE-284 | imranrisal-dev Student-Management-System Shared Upload Helper student_profile… |
| CVE-2026-71233 | 8.7 | 10.0 | invoiceninja | invoiceninja | CWE-79 | InvoiceNinja - Stored XSS via Invoice/Quote Terms Field |
| CVE-2026-71236 | 8.7 | 10.0 | grocy | grocy | CWE-79 | Grocy - Stored XSS via HTMLPurifier Output Double-Decode |
| CVE-2026-20312 | 8.8 | 10.0 | Cisco | Cisco Catalyst SD-WAN Controller | CWE-312 | Cisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vul… |
| CVE-2026-70616 | 7.1 | 10.0 | boringproxy | boringproxy | CWE-833 | boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint |
| CVE-2026-70605 | 5.9 | 9.8 | electron | electron | CWE-918 | Electron: HTTP redirect followed into local file loader |
| CVE-2026-71204 | 6.2 | 9.6 | dgtlmoon | changedetection.io | CWE-284 | changedetection.io - Omitted Checkbox in /settings Save Silently Disables API… |
| CVE-2026-71264 | 8.2 | 9.5 | Aircoookie | WLED | CWE-862 | WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settin… |
| CVE-2026-55524 | 7.5 | 9.4 | MervinPraison | PraisonAI | CWE-367 | PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (v… |
| CVE-2026-70448 | 7.1 | 9.4 | Jenkins Project | Jenkins Ivy Report Plugin | CWE-611 | Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser t… |
| CVE-2026-71265 | 7.5 | 9.3 | domoticz | domoticz | CWE-121 | Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy() |
| CVE-2026-16981 | 5.3 | 9.3 | Unknown | DHL Shipping Germany for WooCommerce | CWE-639 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR |
| CVE-2026-70618 | 5.3 | 9.3 | Spacebar Server | Spacebar Server | CWE-862 | Spacebar Server Missing Authorization via member-ids Endpoint |
| CVE-2026-20289 | 6.5 | 9.2 | Cisco | Cisco RoomOS Software | CWE-532 | Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability |
| CVE-2026-18896 | 2.1 | 9.2 | lavkush-maurya | Student-Registration-System | CWE-74 | lavkush-maurya Student-Registration-System changepass.php sql injection |
| CVE-2026-71276 | 7.1 | 9.0 | absmach | magistrala | CWE-89 | Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Pa… |
| CVE-2026-71240 | 4.3 | 8.9 | DjangoCRM | django-crm | CWE-601 | DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url… |
| CVE-2026-70601 | 7.5 | 8.7 | electron | electron | CWE-693 | Electron: Context isolation bypass via Function.prototype.bind hijack |
| CVE-2026-71203 | 5.3 | 8.6 | dgtlmoon | changedetection.io | CWE-306 | changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Fu… |
| CVE-2026-15656 | 4.3 | 8.6 | IBM | Maximo Application Suite | CWE-614 | IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerab… |
| CVE-2026-64572 | await | 8.5 | Linux | Linux | — | ipv4: fib: free fib_alias with kfree_rcu() on insert error path |
| CVE-2026-16583 | 6.1 | 8.0 | Unknown | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | CWE-79 | Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload |
| CVE-2026-16071 | 5.4 | 8.0 | Red Hat | Red Hat build of Keycloak 26.4 | CWE-269 | Keycloak-services: keycloak-services: ldap entry-dn user search bypasses conf… |
| CVE-2026-21766 | 5.4 | 8.0 | HCLSoftware | HCL Digital Experience and Digital Experience Compose | CWE-522 | HCL Digital Experience and Digital Experience Compose insufficiently protects… |
| CVE-2026-70596 | 4.3 | 7.8 | TryGhost | Ghost | CWE-79 | Ghost: Cross-Site Scripting in Feature Image Captions |
| CVE-2026-70430 | 2.7 | 7.8 | Jenkins Project | Jenkins | CWE-284 | Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the type… |
| CVE-2026-70444 | 4.3 | 7.7 | Jenkins Project | Jenkins Violation Comments to GitLab Plugin | CWE-693 | A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.6… |
| CVE-2026-71280 | 8.5 | 7.6 | go-shiori | shiori | CWE-918 | go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch |
| CVE-2026-70595 | 4.0 | 7.4 | TryGhost | Ghost | CWE-918 | Ghost: Server-Side Request Forgery Mitigation Issue |
| CVE-2026-9130 | 7.1 | 7.3 | IBM | Langflow OSS | CWE-639 | Langflow OSS is affected by arbitrary code execution in custom component vali… |
| CVE-2026-71247 | 6.5 | 7.2 | documenso | documenso | CWE-863 | Documenso - Assistant Recipient Can Forge Another Signer's Signature in Seque… |
| CVE-2026-71274 | 8.5 | 7.1 | openshwprojects | OpenBK7231T_App | CWE-79 | OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels |
| CVE-2026-70437 | 3.7 | 7.0 | Jenkins Project | Jenkins Webhook Secret Credentials Provider Plugin | CWE-208 | Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earl… |
| CVE-2025-15677 | 3.5 | 7.1 | Unknown | GeoDirectory | CWE-79 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories |
| CVE-2026-14304 | 4.6 | 7.0 | Eclipse Foundation | Eclipse Accessibility Tools Framework (ACTF) | CWE-611 | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (includi… |
| CVE-2026-9081 | 7.1 | 6.8 | IBM | Langflow OSS | CWE-918 | Langflow OSS is affected by server-side request forgery in provider validatio… |
| CVE-2026-71211 | 7.1 | 6.8 | mlflow | mlflow | CWE-918 | mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy E… |
| CVE-2026-16993 | 3.7 | 6.8 | Unknown | DHL Shipping Germany for WooCommerce | CWE-200 | DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via U… |
| CVE-2026-70433 | 4.3 | 6.8 | Jenkins Project | Jenkins HCL AppScan Plugin | CWE-862 | Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier all… |
| CVE-2026-70438 | 4.3 | 6.8 | Jenkins Project | Jenkins Parameterized Remote Trigger Plugin | CWE-862 | A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2… |
| CVE-2026-70442 | 4.3 | 6.8 | Jenkins Project | Jenkins Google Chat Notification Plugin | CWE-285 | Jenkins Google Chat Notification Plugin 166.ve6b_de280f2e8 and earlier does n… |
| CVE-2026-70445 | 4.3 | 6.8 | Jenkins Project | Jenkins Sauce OnDemand Plugin | CWE-862 | Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier … |
| CVE-2026-70446 | 4.3 | 6.8 | Jenkins Project | Jenkins CodeSonar Plugin | CWE-862 | Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow… |
| CVE-2026-7444 | 8.1 | 6.6 | cornelraiu-1 | Search Analytics for WP | CWE-352 | Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery |
| CVE-2026-71201 | 5.0 | 6.5 | OpenStack | Ironic | CWE-863 | In OpenStack Ironic through 38.0.0, a project reader that makes a crafted req… |
| CVE-2026-66298 | 8.6 | 6.4 | livebook-dev | livebook | CWE-346 | JS-view sandboxed output can synthesize keyboard events to trigger unconfirme… |
| CVE-2026-12730 | 3.8 | 6.3 | IBM | Business Automation Workflow containers and traditional | CWE-297 | Improper Validation of Certificate with Host Mismatch in IBM Business Automat… |
| CVE-2026-71272 | 8.5 | 6.2 | usememos | memos | CWE-367 | Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() |
| CVE-2026-63457 | 6.5 | 6.2 | Hewlett Packard Enterprise (HPE) | HPE Integrated Lights-Out 6 (iLO 6) | CWE-400 | A potential denial of service vulnerability exists in HPE Integrated Lights-O… |
| CVE-2026-70443 | 4.3 | 6.0 | Jenkins Project | Jenkins Horreum Plugin | CWE-269 | Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set th… |
| CVE-2026-70447 | 4.3 | 6.0 | Jenkins Project | Jenkins AWS CodeBuild Plugin | CWE-862 | Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier al… |
| CVE-2026-71246 | 4.3 | 5.8 | pixelfed | pixelfed | CWE-918 | Pixelfed - Authenticated SSRF via Remote URL Search |
| CVE-2026-15587 | 9.4 | 5.8 | Google Cloud | Google SecOps (Chronicle SOAR) | CWE-346 | Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentica… |
| CVE-2026-70602 | 6.6 | 5.7 | electron | electron | CWE-284 | Electron: Extension tab APIs operate across session boundaries |
| CVE-2026-70439 | 6.5 | 5.8 | Jenkins Project | Jenkins XML Job to Job DSL Plugin | CWE-862 | Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permiss… |
| CVE-2026-66885 | 6.8 | 5.7 | livebook-dev | livebook | CWE-352 | Livebook Teams identity callback lacks state binding, allowing login CSRF |
| CVE-2026-71205 | 6.5 | 5.6 | dgtlmoon | changedetection.io | CWE-307 | changedetection.io - No Rate Limiting on /login Enables Unlimited Password Br… |
| CVE-2026-20311 | 6.3 | 5.4 | Cisco | Cisco IOS XE Software | CWE-126 | Cisco IOS XE Software Web UI Denial of Service Vulnerability |
| CVE-2026-70606 | 5.9 | 5.4 | electron | electron | CWE-668 | Electron: ProtocolResponse.url reuses the default session cache instead of th… |
| CVE-2026-71210 | 5.3 | 5.3 | mealie-recipes | mealie | CWE-367 | mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud… |
| CVE-2026-64569 | await | 5.3 | Linux | Linux | — | mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n |
| CVE-2026-64571 | await | 5.3 | Linux | Linux | — | wifi: p54: validate RX frame length in p54_rx_eeprom_readback() |
| CVE-2026-64573 | await | 5.3 | Linux | Linux | — | Bluetooth: qca: fix NVM tag length underflow in TLV parser |
| CVE-2026-64579 | await | 5.3 | Linux | Linux | — | xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert |
| CVE-2026-71286 | 6.1 | 5.1 | miguelcobain | ember-dynamic-render-template | CWE-1336 | ember-dynamic-render-template Client-Side Template Injection via Unsanitized … |
| CVE-2026-16443 | 9.1 | 5.1 | Red Hat | Red Hat build of Keycloak 26.4 | CWE-347 | Keycloak-services: keycloak-services: saml broker metadata import disables re… |
| CVE-2026-55522 | 7.8 | 4.9 | MervinPraison | PraisonAI | CWE-94 | PraisonAI workflow include bypasses tools.py autoload opt-in and executes inc… |
| CVE-2026-64570 | 7.8 | 4.9 | Linux | Linux | — | wifi: mac80211: fix fils_discovery double free on alloc failure |
| CVE-2026-55996 | 4.3 | 4.7 | SUSE | Rancher | CWE-770 | Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-… |
| CVE-2026-17578 | 2.3 | 4.7 | Kong | Kong Event Gateway | CWE-323 | Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement |
| CVE-2026-71249 | 6.1 | 4.6 | 299ko | 299Ko | CWE-79 | 299Ko - Unauthenticated Reflected XSS in Public Contact Form |
| CVE-2026-18953 | 6.3 | 4.2 | AWS | aws-transform-mcp-server | CWE-22 | Improper limitation of a pathname to a restricted directory in aws-transform-… |
| CVE-2026-70599 | 5.9 | 4.0 | electron | electron | CWE-346 | Electron: Permission Check Handler Receives Main Frame Origin Instead of Requ… |
| CVE-2026-70440 | 5.4 | 3.9 | Jenkins Project | Jenkins Qualys Container Scanning Connector Plugin | CWE-79 | Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does n… |
| CVE-2026-70441 | 5.4 | 3.9 | Jenkins Project | Jenkins Summary Display Plugin | CWE-79 | Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name … |
| CVE-2026-7326 | 7.5 | 3.6 | Progress Software Corporation | MarkLogic Server | CWE-352 | Cross-site request forgery in Progress MarkLogic Server Admin UI |
| CVE-2026-17583 | 8.3 | 3.5 | Thermo Fisher | Applied Biosystems 3500/3500xL Series Data Collection Software | CWE-353 | Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integr… |
| CVE-2026-70600 | 3.1 | 3.5 | electron | electron | CWE-1021 | Electron: Cross-origin iframe can position native autofill popup |
| CVE-2026-66839 | 8.4 | 3.5 | Integrated Systems Technologies, Inc. | NetKids iMark | CWE-428 | NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an… |
| CVE-2026-44605 | 5.5 | 3.5 | Red Hat | Red Hat Hardened Images | CWE-190 | Rpm: heap buffer overflow in ndb slot table parsing |
| CVE-2026-70611 | 6.9 | 3.3 | electron | electron | CWE-78 | Electron: DevTools embedder handler executes arbitrary files via shell open |
| CVE-2026-20294 | 6.5 | 3.4 | Cisco | Cisco Catalyst SD-WAN Manager | CWE-319 | Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability |
| CVE-2026-8029 | 3.9 | 3.3 | ZTE | SmartLife | CWE-89 | SQL Injection Vulnerability in ZTE SmartLife App |
| CVE-2026-16942 | 5.4 | 3.3 | Unknown | WP Custom HTML Page | CWE-79 | WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS |
| CVE-2026-71275 | 5.4 | 3.3 | openshwprojects | OpenBK7231T_App | CWE-79 | OpenBK7231T - Reflected XSS via OTA host Parameter |
| CVE-2026-70376 | 9.6 | 3.1 | pluck-cms | Pluck CMS | CWE-352 | Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and… |
| CVE-2026-49331 | 6.5 | 3.1 | Red Hat | Red Hat OpenShift Container Platform 4 | CWE-345 | Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header… |
| CVE-2026-16613 | 4.3 | 3.0 | Unknown | GDPR Cookie Compliance | CWE-352 | GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF |
| CVE-2026-12410 | 7.8 | 2.8 | Gen Digital | CCleaner | CWE-59 | CCleaner local privilege escalation via link following on uninstall |
| CVE-2026-71261 | 7.8 | 2.8 | mackron | dr_libs | CWE-190 | dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buff… |
Results continue: ranks 401–432.
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-08-05 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.