boxscore/security
Sunday, August 9, 2026 · all times UTC← 2026-08-08 · archive · 2026-08-10 →

78 CVEs published August 9, 2026: 3 critical, 11 high, 28 medium, 36 low; 0 in KEV; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 53 in the results table.

Standings

League
MTDYTD2025 same span2025 full
CVEs published20481085314012563
KEV catalog size1670

606 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; medians are over each vendor's YTD disclosures.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux46163121111509802730.27.8.0016+34
microsoft3313941209393108378322.37.8.0040-19
google4345572134228187351.16.5.0023+43
red hat422641312111317400.07.0.0024+29
apple1245576711229372.97.1.0028+1
suse551220000.07.3.0022+5
canonical030210000.07.8.00130
android010100161100.08.4.01710
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco305092490961326.07.8.0033+30
fortinet018249028633.36.1.00540
palo alto networks015017514213.34.7.0028-10
vmware01247012100.08.7.00440
checkpoint1541003240.09.3.2062+1
f50540007120.09.2.04020
ivanti051000335100.010.0.81520
zyxel3403101100.07.2.0075+3
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache61198361075414021.07.5.0048+61
mozilla1734226501300.09.1.0031+1
gitlab015021014213.34.9.00290
github240220000.07.0.0040+2
wordpress1412105250.08.8.3700+1
docker030120100.05.7.00150
drupal01100051100.09.8.88320
kubernetes010001000.02.4.00240
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle01113212539304574030.37.6.00310
ibm321403661421710.77.5.0027+32
adobe8481623507548.38.6.0047+7
progress1134111850912.98.1.0030+11
solarwinds0201611011420.09.1.00500
veeam10123720400.08.6.0027+10
atlassian0303001300.08.0.00260
zohocorp031110000.07.1.00480
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
d-link1523150612614.39.3.0209+15
hikvision0704202114.37.2.00250
bosch030300000.08.1.00280
schneider electric031200100.08.7.00200
synology110100000.07.3.0013+1
honeywell010010000.06.9.00310
mitsubishi electric010100000.07.1.00130
rockwell automation011000000.09.2.00300
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
surrealdb057326253000.07.1.00250
netty14262781000.07.5.0046+1
legion of the bouncy castle344152790000.08.7.0026+34
grafana041214223000.06.5.0033-1
open ises037214210000.06.9.00210
mediatek343404300100.06.0.0011+34
erlang032114143100.06.9.0033-6
freerdp233181841000.08.7.0034+23

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-8037.993199.99.8
CVE-2026-63030.956099.99.8
CVE-2026-39808.912199.8—
CVE-2026-34486.829399.67.5
CVE-2026-50522.769899.59.8
CVE-2026-15410.763599.57.2
CVE-2026-15409.742299.410.0
CVE-2026-25089.736099.49.8
CVE-2026-16232.733099.49.3
CVE-2026-60137.731099.45.9
Highest CVSS
CVECVSSEPSSNote
CVE-2026-1540910.0.7422KEV
CVE-2026-898510.0.0660
CVE-2026-651610.0.0473
CVE-2026-4766810.0.0434
CVE-2026-4435910.0.0100
CVE-2025-7138910.0.0093
CVE-2026-4816810.0.0091
CVE-2026-5616310.0.0090
CVE-2026-5710610.0.0090
CVE-2026-1681210.0.0088KEV
Most disclosures (vendor)
VendorCVEs
oracle1109
linux700
microsoft639
google446
apple168
apache166
red hat151
ibm132
mozilla68
surrealdb57
Most KEV additions (YTD)
VendorKEV
microsoft32
cisco13
apple7
fortinet6
google5
ivanti5
adobe4
langflow4
solarwinds4
synacor4
Most-affected ecosystems
EcosystemAdvisories
Maven62
PyPI5
Go3
npm3
crates.io2
NuGet1
Packagist1
Fastest to KEV
CVEVendorDays
CVE-2008-4128Cisco0
CVE-2021-27137DD-WRT0
CVE-2023-4346KNX Association0
CVE-2025-68686Fortinet0
CVE-2026-0770Langflow0
CVE-2026-15409SonicWall0
CVE-2026-15410SonicWall0
CVE-2026-16232checkpoint0
CVE-2026-16812Arista Networks0
CVE-2026-18556N-able0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171726
CVE-2021-27102Accellion2021-11-171726
CVE-2021-27101Accellion2021-11-171726
CVE-2021-27103Accellion2021-11-171726
CVE-2021-21017Adobe2021-11-171726
CVE-2021-28550Adobe2021-11-171726
CVE-2021-42013Apache2021-11-171726
CVE-2021-41773Apache2021-11-171726
CVE-2021-30858Apple2021-11-171726
CVE-2021-30860Apple2021-11-171726

Transactions

EXPLOIT PUBLISHED — CVE-2025-9242 (WatchGuard Fireware OS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10849 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-11974 (Unknown wp-media-folder-addon). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13692 (Unknown PayU CommercePro Plugin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14188 (Unknown Easy Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14221 (Unknown Easy Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14222 (Unknown Easy Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14223 (Unknown Easy Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14224 (Unknown Easy Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14226 (Unknown Easy Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16535 (Unknown Link Library). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16558 (Unknown YMC Filter). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16562 (Unknown WP Statistics). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16578 (Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16590 (Unknown WP Directory Kit). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16594 (Unknown WP Directory Kit). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16595 (Unknown WP Directory Kit). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19211 (SourceCodester Photo Share Website). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19231 (SourceCodester Simple Doctors Appointment System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19245 (HKUDS nanobot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19259 (MZ Automation libiec61850). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19268 (abdullah1854 MCPGateway). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67620 (FlowiseAI Flowise). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71959 (bitwarden server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71969 (OP-TEE optee_os). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72743 (dataease SQLBot). Public exploit reference added.

DUE DATE PASSED — CVE-2026-63077 (JetBrains TeamCity). CISA remediation deadline was August 8, 2026; still in catalog.

RESCORED — CVE-2026-16089 (Red Hat Build of Keycloak). CVSS 5.4 → 5.9 (NVD).

PATCH SHIPPED — CVE-2026-72898 (Metabase). Fixed in Metabase x.58.24.

ENRICHED — CVE-2026-23385 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

78 CVEs published. 25 box scores, 53 table rows — nothing truncated.

CVE-2026-19348HIGH
Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0246   83.1     —
AFFECTED
  Product              Versions      Fixed
  M300 Wi-Fi Repeater  r0-ea7890a –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-19346HIGH
Tenda CH22 CertListInfo formCertListInfo command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0222   81.2     —
AFFECTED
  Product  Versions   Fixed
  CH22     1.0.0.1 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-71993CRITICAL
MSI Radix AXE6600 v781521 Command Injection via openvpn function
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.2     —
AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · 3 references · NVD status: Received
CVE-2026-19329LOW
andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   46.9     —
AFFECTED
  Product    Versions                                    Fixed
  codex_mcp  1ff521cc6cc57cfe56ddef946c644b8534771390 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19332LOW
NellyW8 MCP4EDA run_openlane/view_waveform command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   46.9     —
AFFECTED
  Product  Versions  Fixed
  MCP4EDA  1.0.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19333LOW
NightTrek Supabase-MCP generate_types command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   46.9     —
AFFECTED
  Product       Versions                                    Fixed
  Supabase-MCP  cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19334LOW
NightTrek Ollama-mcp index.ts command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   46.9     —
AFFECTED
  Product     Versions                                    Fixed
  Ollama-mcp  80cf2e17cfc144963a475b619093a2d13c13dbc9 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19345MEDIUM
code-projects Task Management System UpdateTaskStatus.php authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0052   42.0     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-862, CWE-863 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19351MEDIUM
dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0050   40.8     —
AFFECTED
  Product         Versions  Fixed
  node-sql-query  0.1.25 –  0.1.29
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · 9 references · NVD status: Deferred
CVE-2026-10595HIGH
parisneo parisneo/lollms — Path Traversal Vulnerability in parisneo/lollms
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0049   40.0     —
AFFECTED
  Product          Versions       Fixed
  parisneo/lollms  unspecified –  —
TIMELINE
  Jun 1   Reserved by CNA
  Aug 9   Published (CNA: @huntr_ai)
CWE-23 · CNA: @huntr_ai · 2 references · NVD status: Received
CVE-2026-17510HIGH
JONASBN Crypt::OpenSSL::PKCS12 — Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0045   37.1     —
AFFECTED
  Product                 Versions     Fixed
  Crypt::OpenSSL::PKCS12  unspecified  —
TIMELINE
  Jul 27  Reserved by CNA
  Aug 9   Published (CNA: CPANSec)
CWE-476 · CNA: CPANSec · 3 references · NVD status: Received
CVE-2026-19341HIGH
UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0044   36.7     —
AFFECTED
  Product       Versions        Fixed
  HiPER 1200GW  2.5.3-170306 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-15038CRITICAL
Unknown InfiniteWP Client — InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0042   35.2     —
AFFECTED
  Product            Versions     Fixed
  InfiniteWP Client  unspecified  —
TIMELINE
  Jul 8   Reserved by CNA
  Aug 9   Published (CNA: WPScan)
CWE-287 · CNA: WPScan · 1 reference · NVD status: Received
CVE-2026-19344MEDIUM
code-projects Task Management System comment_count_user.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.4     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19342MEDIUM
code-projects Task Management System Login index.php improper authentication
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0040   33.7     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-287 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19363MEDIUM
lmammino oidc-authorizer Lambda Authorizer handler.rs log file
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0039   32.2     —
AFFECTED
  Product          Versions  Fixed
  oidc-authorizer  0.1 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-200, CWE-532 · CNA: VulDB · 4 references · NVD status: Deferred
CVE-2026-19362MEDIUM
lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    5.5   .0037   30.4     —
AFFECTED
  Product          Versions  Fixed
  oidc-authorizer  0.4.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-404 · CNA: VulDB · 4 references · NVD status: Deferred
CVE-2026-19374MEDIUM
adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0037   30.3     —
AFFECTED
  Product  Versions                                    Fixed
  api-mcp  92b9a5d04acfec165c7d4ef852496593aa87be06 –  —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-918 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19375LOW
dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0036   29.5     —
AFFECTED
  Product              Versions  Fixed
  article-scraper-mcp  1.0.0 –   —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-918 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19359MEDIUM
nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    5.1   .0036   29.1     —
AFFECTED
  Product  Versions  Fixed
  gvip     1.0 –     1.15.0
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-266, CWE-284 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-19376MEDIUM
Uasoft Badaso File API api.php class permission
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0035   28.5     —
AFFECTED
  Product  Versions       Fixed
  Badaso   3.0.0-alpha –  —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-266, CWE-275 · CNA: VulDB · 5 references · NVD status: Deferred
CVE-2026-19350MEDIUM
Dolibarr ERP TakePOS invoice.php fail authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0035   28.1     —
AFFECTED
  Product  Versions  Fixed
  ERP      23.0.0 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-862, CWE-863 · CNA: VulDB · 7 references · NVD status: Deferred
CVE-2026-19378LOW
code-projects Task Management System CommentSave.php cross site scripting
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0035   27.8     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-79, CWE-94 · CNA: VulDB · 6 references · NVD status: Deferred
CVE-2026-19356MEDIUM
MingSoft MCMS ms-mdiy list information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   21.1     —
AFFECTED
  Product  Versions  Fixed
  MCMS     3.0.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · 4 references · NVD status: Deferred
CVE-2026-19357MEDIUM
MingSoft MCMS ms-mdiy get information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   21.1     —
AFFECTED
  Product  Versions  Fixed
  MCMS     3.0.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · 4 references · NVD status: Deferred
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-193402.120.7anubissbeProjectHub-McpCWE-918anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request…
CVE-2026-193612.920.1macrozhengmallCWE-640macrozheng mall mall-portal getAuthCode password recovery
CVE-2026-184647.519.8UnknownWP MAPS PROCWE-400WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
CVE-2026-193435.518.2code-projectsTask Management SystemCWE-74code-projects Task Management System AdminLogin.php sql injection
CVE-2026-184739.118.1UnknownWP Directory KitCWE-89WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' P…
CVE-2026-170448.618.1UnknownIptanus File UploadCWE-89WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid
CVE-2026-123723.717.8nltknltk/nltkCWE-918Server-Side Request Forgery (SSRF) in nltk/nltk
CVE-2026-169887.517.4UnknownGeoDirectoryCWE-200GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via…
CVE-2026-180327.517.4UnknownWP Data AccessCWE-200WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autoc…
CVE-2026-183577.517.4UnknownWPC Order Tip for WooCommerceCWE-200WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
CVE-2026-193555.517.1MingSoftMCMSCWE-74MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection
CVE-2026-193531.315.4n/aDedeCMSCWE-73DedeCMS Installation Wizard index.php _4_Setup file inclusion
CVE-2026-184656.513.8UnknownWP MAPS PROCWE-22WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion
CVE-2026-186036.513.0UnknownPiWeb Cancel order / Refund request for WooCommerceCWE-862Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content…
CVE-2026-170178.112.9UnknownCubeWP FrameworkCWE-89CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
CVE-2026-193605.112.5wongcyrusExcelLexBotCWE-266wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges…
CVE-2026-193392.111.4aliyunalibabacloud-dataworks-mcp-serverCWE-918aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequest…
CVE-2026-193672.111.4NocteDefensorLudusMCPCWE-918NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request f…
CVE-2026-193521.311.1mifilossless-cutCWE-918mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request…
CVE-2026-193585.310.43CORESecTrapdoorCWE-2663CORESec Trapdoor DefaultFunction access control
CVE-2026-193472.110.2itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System viewdoctor.php sql injection
CVE-2026-193642.110.2itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql i…
CVE-2026-170145.39.4UnknownWP Photo Album PlusCWE-73WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion v…
CVE-2026-193545.39.3lock-upmeOPMSCWE-74lock-upme OPMS IN Clause message.go sql injection
CVE-2026-169572.77.7UnknownSlim SEOCWE-639Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
CVE-2026-193351.97.1Jane-xiaoerskill-vision-controlCWE-22Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal
CVE-2026-169926.56.1UnknownCreateCWE-862Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure …
CVE-2026-180376.56.1UnknownCreateCWE-862Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure …
CVE-2026-160326.15.9UnknownLWS OptimizeCWE-79LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
CVE-2026-155345.75.8LEONTperlCWE-125Perl versions through 5.45.1 have out-of-bounds heap reads and writes during …
CVE-2026-193661.94.0NocteDefensorLudusMCPCWE-22NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts pa…
CVE-2026-193721.93.9Handwriting-OCRhandwriting-ocr-mcp-serverCWE-22Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFi…
CVE-2026-193684.83.6PV-Bhatgemsuite-mcpCWE-22PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal
CVE-2026-703952.13.7ash-projectashCWE-943Predicate injection in manage_relationship belongs_to lookup discloses secret…
CVE-2026-193241.93.7HelloGGXshadcn-vue-mcpCWE-22HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
CVE-2026-193281.93.6aktsmmskill-ninja-mcp-serverCWE-22aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
CVE-2026-193311.93.6bazylhorseyobsidian-mcp-serverCWE-22bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal
CVE-2026-193381.93.6automateyournetworkMCPyATSCWE-22automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerat…
CVE-2026-193701.93.6bartekke8it56w2new-mcpCWE-22bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal
CVE-2026-193711.93.6Nikolaibiboclaude-comfyui-mcpCWE-22Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path …
CVE-2026-193364.83.6Pimzinospec-workflow-mcpCWE-22Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path tr…
CVE-2026-193231.93.6azerreact-analyzer-mcpCWE-22azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path trav…
CVE-2026-193251.93.6IncomeStreamSurferroo-code-memory-bank-mcp-serverCWE-22IncomeStreamSurfer roo-code-memory-bank-mcp-server read_memory_bank_file/appe…
CVE-2026-193261.93.6Jevon-ZhongAi-doctorCWE-22Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal
CVE-2026-193271.93.6abracadabra50claude-seshCWE-22abracadabra50 claude-sesh enricher.ts enrichSession path traversal
CVE-2026-193301.93.6angrysky56advanced-reasoning-mcpCWE-22angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversal
CVE-2026-193651.93.6Ichigo3766image-gen-mcpCWE-22Ichigo3766 image-gen-mcp upscale_images index.ts path traversal
CVE-2026-696595.93.5ash-projectashCWE-502Memory exhaustion via unbounded deserialization of keyset pagination cursors …
CVE-2026-170113.82.1UnknownNexter BlocksCWE-345Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
CVE-2026-193371.91.7adenotmcp-google-searchCWE-918adenot mcp-google-search read_webpage index.ts server-side request forgery
CVE-2026-193731.91.5PhialsBasementKoboldCPP-MCP-ServerCWE-918PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest ser…
CVE-2026-193691.91.1KS-GEN-AIjira-mcp-serverCWE-918KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get s…
CVE-2026-169654.31.0UnknownSolace ExtraCWE-352Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebui…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-09 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.