202 CVEs published August 14, 2026: 25 critical, 81 high, 75 medium, 20 low; 0 in KEV; 2 with a public exploit reference; 1 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 177 in the results table.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 4892 | 13697 | 1414 | 2563 |
| KEV catalog size | 1670 | |||
837 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; medians are over each vendor's YTD disclosures.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 416 | 2001 | 234 | 1296 | 98 | 0 | 27 | 3 | 0.1 | 7.8 | .0017 | +401 |
| microsoft | 442 | 1803 | 131 | 1219 | 428 | 8 | 378 | 33 | 1.8 | 7.8 | .0038 | -182 |
| 49 | 461 | 72 | 140 | 228 | 18 | 73 | 5 | 1.1 | 6.5 | .0023 | +48 | |
| red hat | 142 | 364 | 22 | 166 | 158 | 18 | 4 | 0 | 0.0 | 7.1 | .0025 | +127 |
| apple | 2 | 246 | 57 | 68 | 112 | 2 | 93 | 7 | 2.8 | 7.1 | .0027 | +2 |
| canonical | 11 | 14 | 9 | 3 | 2 | 0 | 0 | 0 | 0.0 | 9.9 | .0029 | +11 |
| suse | 5 | 5 | 1 | 2 | 2 | 0 | 0 | 0 | 0.0 | 7.3 | .0022 | +5 |
| android | 0 | 1 | 0 | 1 | 0 | 0 | 16 | 1 | 100.0 | 8.4 | .0171 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cisco | 31 | 51 | 9 | 25 | 9 | 0 | 96 | 14 | 27.5 | 7.8 | .0033 | +30 |
| palo alto networks | 12 | 27 | 0 | 1 | 14 | 10 | 14 | 2 | 7.4 | 4.5 | .0019 | +2 |
| fortinet | 7 | 25 | 3 | 6 | 12 | 1 | 28 | 6 | 24.0 | 6.0 | .0051 | -1 |
| sonicwall | 10 | 12 | 3 | 5 | 4 | 0 | 17 | 2 | 16.7 | 7.8 | .0024 | +8 |
| vmware | 0 | 12 | 4 | 7 | 0 | 1 | 21 | 0 | 0.0 | 8.7 | .0044 | 0 |
| netgear | 9 | 9 | 0 | 0 | 5 | 4 | 8 | 0 | 0.0 | 4.3 | .0031 | +9 |
| ivanti | 3 | 8 | 1 | 3 | 0 | 0 | 33 | 5 | 62.5 | 7.9 | .5751 | +3 |
| checkpoint | 1 | 5 | 4 | 1 | 0 | 0 | 3 | 2 | 40.0 | 9.3 | .2062 | +1 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 97 | 234 | 45 | 118 | 70 | 1 | 40 | 2 | 0.9 | 7.5 | .0048 | +97 |
| mozilla | 1 | 73 | 42 | 26 | 5 | 0 | 13 | 0 | 0.0 | 9.1 | .0031 | -1 |
| gitlab | 13 | 28 | 0 | 8 | 16 | 2 | 4 | 2 | 7.1 | 5.1 | .0026 | +13 |
| github | 5 | 7 | 0 | 5 | 2 | 0 | 0 | 0 | 0.0 | 8.6 | .0041 | +5 |
| docker | 1 | 4 | 0 | 1 | 3 | 0 | 1 | 0 | 0.0 | 5.7 | .0014 | +1 |
| wordpress | 1 | 4 | 1 | 2 | 1 | 0 | 5 | 2 | 50.0 | 8.8 | .3700 | +1 |
| drupal | 0 | 1 | 1 | 0 | 0 | 0 | 5 | 1 | 100.0 | 9.8 | .8832 | 0 |
| kubernetes | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | 0.0 | 2.4 | .0024 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 0 | 1113 | 212 | 539 | 304 | 57 | 40 | 3 | 0.3 | 7.6 | .0031 | 0 |
| ibm | 192 | 300 | 61 | 139 | 94 | 6 | 7 | 1 | 0.3 | 7.5 | .0030 | +192 |
| adobe | 60 | 100 | 22 | 51 | 22 | 1 | 75 | 4 | 4.0 | 7.8 | .0036 | +46 |
| progress | 16 | 39 | 11 | 20 | 8 | 0 | 9 | 1 | 2.6 | 8.1 | .0027 | +16 |
| solarwinds | 0 | 20 | 16 | 1 | 1 | 0 | 11 | 4 | 20.0 | 9.1 | .0050 | 0 |
| veeam | 10 | 12 | 3 | 7 | 2 | 0 | 4 | 0 | 0.0 | 8.6 | .0027 | +10 |
| zohocorp | 4 | 7 | 2 | 4 | 1 | 0 | 0 | 0 | 0.0 | 8.8 | .0099 | +4 |
| atlassian | 0 | 3 | 0 | 3 | 0 | 0 | 13 | 0 | 0.0 | 8.0 | .0026 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| d-link | 15 | 23 | 15 | 0 | 6 | 1 | 26 | 1 | 4.3 | 9.3 | .0209 | +15 |
| siemens | 19 | 20 | 1 | 16 | 1 | 2 | 1 | 0 | 0.0 | 7.3 | .0011 | +19 |
| hikvision | 0 | 7 | 0 | 4 | 2 | 0 | 2 | 1 | 14.3 | 7.2 | .0025 | 0 |
| bosch | 0 | 3 | 0 | 3 | 0 | 0 | 0 | 0 | 0.0 | 8.1 | .0028 | 0 |
| schneider electric | 0 | 3 | 1 | 2 | 0 | 0 | 1 | 0 | 0.0 | 8.7 | .0020 | 0 |
| synology | 1 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0.0 | 7.3 | .0013 | +1 |
| honeywell | 0 | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 0.0 | 6.9 | .0031 | 0 |
| mitsubishi electric | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0.0 | 7.1 | .0013 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| elastic | 48 | 67 | 0 | 13 | 54 | 0 | 3 | 0 | 0.0 | 6.5 | .0027 | +48 |
| mongodb | 32 | 58 | 3 | 37 | 16 | 2 | 2 | 0 | 0.0 | 7.1 | .0024 | +32 |
| surrealdb | 0 | 57 | 3 | 26 | 25 | 3 | 0 | 0 | 0.0 | 7.1 | .0025 | 0 |
| siyuan-note | 42 | 49 | 21 | 5 | 23 | 0 | 0 | 0 | 0.0 | 7.1 | .0024 | +42 |
| zephyrproject | 27 | 49 | 0 | 17 | 26 | 6 | 0 | 0 | 0.0 | 6.5 | .0016 | +26 |
| gitea | 48 | 48 | 7 | 15 | 22 | 4 | 0 | 0 | 0.0 | 6.5 | .0027 | +48 |
| netty | 3 | 44 | 6 | 28 | 9 | 1 | 0 | 0 | 0.0 | 7.5 | .0046 | +3 |
| grafana | 1 | 42 | 3 | 14 | 22 | 3 | 0 | 0 | 0.0 | 6.5 | .0033 | -3 |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-8037 | .9931 | 99.9 | 9.8 |
| CVE-2026-63030 | .9560 | 99.9 | 9.8 |
| CVE-2026-39808 | .9121 | 99.8 | — |
| CVE-2026-34486 | .8293 | 99.6 | 7.5 |
| CVE-2026-25089 | .7360 | 99.4 | 9.8 |
| CVE-2026-16232 | .7330 | 99.4 | 9.3 |
| CVE-2026-60137 | .7310 | 99.4 | 5.9 |
| CVE-2026-0770 | .5688 | 99.0 | 9.8 |
| CVE-2026-62144 | .2062 | 97.3 | 9.1 |
| CVE-2026-9198 | .1735 | 96.9 | 9.8 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-72898 | 10.0 | .1040 | KEV |
| CVE-2026-8985 | 10.0 | .0660 | |
| CVE-2026-6516 | 10.0 | .0473 | |
| CVE-2026-47668 | 10.0 | .0434 | |
| CVE-2026-48362 | 10.0 | .0207 | |
| CVE-2026-19188 | 10.0 | .0189 | |
| CVE-2026-73299 | 10.0 | .0121 | |
| CVE-2026-44359 | 10.0 | .0100 | |
| CVE-2026-45618 | 10.0 | .0095 | |
| CVE-2025-71389 | 10.0 | .0093 |
| Vendor | CVEs |
|---|---|
| oracle | 1108 |
| linux | 1068 |
| microsoft | 476 |
| 451 | |
| ibm | 292 |
| red hat | 249 |
| apache | 201 |
| apple | 169 |
| adobe | 75 |
| elastic | 67 |
| Vendor | KEV |
|---|---|
| microsoft | 33 |
| cisco | 14 |
| apple | 7 |
| fortinet | 6 |
| 5 | |
| ivanti | 5 |
| adobe | 4 |
| langflow | 4 |
| solarwinds | 4 |
| synacor | 4 |
| Ecosystem | Advisories |
|---|---|
| Maven | 66 |
| PyPI | 5 |
| Go | 3 |
| npm | 3 |
| Packagist | 2 |
| crates.io | 2 |
| NuGet | 1 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2021-27137 | DD-WRT | 0 |
| CVE-2025-68686 | Fortinet | 0 |
| CVE-2026-0770 | Langflow | 0 |
| CVE-2026-16232 | checkpoint | 0 |
| CVE-2026-16812 | Arista Networks | 0 |
| CVE-2026-18556 | N-able | 0 |
| CVE-2026-18577 | N-able | 0 |
| CVE-2026-20316 | Cisco | 0 |
| CVE-2026-20349 | Cisco | 0 |
| CVE-2026-25089 | Fortinet | 0 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | Accellion | 2021-11-17 | 1731 |
| CVE-2021-27102 | Accellion | 2021-11-17 | 1731 |
| CVE-2021-27101 | Accellion | 2021-11-17 | 1731 |
| CVE-2021-27103 | Accellion | 2021-11-17 | 1731 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1731 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1731 |
| CVE-2021-42013 | Apache | 2021-11-17 | 1731 |
| CVE-2021-41773 | Apache | 2021-11-17 | 1731 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1731 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1731 |
EXPLOIT PUBLISHED — CVE-2010-0738. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2010-1428. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2010-2861. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2012-0507. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2016-3351. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2019-25765 (ASP-CMS Project ASP-CMS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-30116. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-30119. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-13328 (Unknown Food Menu). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-13610 (Unknown KiviCare). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-14229 (Unknown ECS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-14230 (Unknown ECS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-16007 (AppFlowy-IO AppFlowy-Cloud). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-16541 (Unknown Simply Schedule Appointments). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-16611 (Unknown Product Feed PRO for WooCommerce by AdTribes). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18216 (Unknown Backup Migration). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18807 (Unknown ECS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19710 (SourceCodester Simple Student Information System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19750 (Tenda CH). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19752 (EnzoVezzaro mcp-dominican-layer). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19753 (Model Context Protocol mcp-rdf-explorer). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19895 (opensourcepos Open Source Point of Sale). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19897 (mangroup dtale). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19900 (LB-LINK X-PRO). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19903 (SourceCodester Online Clothing Store). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19917 (code-projects Online Food Order System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19920 (code-projects Online Shopping System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-34881 (OpenStack Glance). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-39883 (open-telemetry opentelemetry-go). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-4035 (mlflow/mlflow). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-43001 (OpenStack Keystone). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-54297 (lostisland faraday). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-59109 (Zalktis Programmas (SIA "Zalktis Programmas") Zalktis). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-62241 (MohibShaikh clawvet). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-72777 (DayuanJiang next-ai-draw-io). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-73037 (DayuanJiang next-ai-draw-io). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-73481 (phplist3). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-73482 (phplist3). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-73506 (JanDeDobbeleer oh-my-posh). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-73514 (PostGIS address_standardizer). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-73515 (PostGIS). Public exploit reference added.
RESCORED — CVE-2016-1019. CVSS 7.8 → 9.8 (NVD).
RESCORED — CVE-2021-30116. CVSS 10 → 9.8 (NVD).
RESCORED — CVE-2021-30120. CVSS 9.9 → 7.5 (NVD).
RESCORED — CVE-2026-13601 (Red Hat Enterprise Linux 8). CVSS 7.1 → 6.5 (NVD).
RESCORED — CVE-2026-19757 (Dromara lamp-cloud). CVSS 6.9 → 5.5 (NVD).
RESCORED — CVE-2026-19758 (dromara lamp-cloud). CVSS 6.9 → 5.5 (NVD).
RESCORED — CVE-2026-20156 (Cisco RoomOS Software). CVSS 8.1 → 9.8 (NVD).
RESCORED — CVE-2026-20157 (Cisco RoomOS Software). CVSS 7.5 → 9.8 (NVD).
RESCORED — CVE-2026-34993 (aio-libs aiohttp). CVSS 6.4 → 7.3 (NVD).
RESCORED — CVE-2026-4035 (mlflow/mlflow). CVSS 9.1 → 7.7 (NVD).
RESCORED — CVE-2026-43001 (OpenStack Keystone). CVSS 7.9 → 8 (NVD).
202 CVEs published. 25 box scores, 177 table rows — nothing truncated.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N H N H H H 7.3 .0279 85.2 —
AFFECTED Product Versions Fixed EG3661M BaiCE_BQ6_2.0.5.3_NA – —
TIMELINE Aug 13 Reserved by CNA Aug 14 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 9.4 .0224 81.3 —
AFFECTED Product Versions Fixed Security Center unspecified —
TIMELINE Aug 12 Reserved by CNA Aug 14 Published (CNA: tenable)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N H N H H H 8.6 .0200 79.2 —
AFFECTED Product Versions Fixed Security Center unspecified —
TIMELINE Aug 12 Reserved by CNA Aug 14 Published (CNA: tenable)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 9.4 .0193 78.3 —
AFFECTED Product Versions Fixed Security Center unspecified —
TIMELINE Aug 12 Reserved by CNA Aug 14 Published (CNA: tenable)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 10.0 .0189 77.8 —
AFFECTED Product Versions Fixed Haiwell IoT Cloud HMI Gateway 3.40.1.12 – 3.50.1.19
TIMELINE Aug 6 Reserved by CNA Aug 14 Published (CNA: icscert)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0156 73.2 —
AFFECTED Product Versions Fixed Security Center unspecified —
TIMELINE Aug 12 Reserved by CNA Aug 14 Published (CNA: tenable)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0156 73.1 —
AFFECTED Product Versions Fixed semaphore unspecified —
TIMELINE Aug 13 Reserved by CNA Aug 14 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0148 71.7 —
AFFECTED Product Versions Fixed Cockpit CMS unspecified —
TIMELINE Aug 13 Reserved by CNA Aug 14 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C N L H 8.5 .0101 60.2 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0085 55.3 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0085 55.3 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Aug 1 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 10.0 .0082 54.1 —
AFFECTED Product Versions Fixed Minds Platform unspecified —
TIMELINE Aug 13 Public exploit reference published Aug 13 Reserved by CNA Aug 14 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0080 53.4 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 9.4 .0079 53.3 —
AFFECTED Product Versions Fixed Security Center unspecified —
TIMELINE Aug 12 Reserved by CNA Aug 14 Published (CNA: tenable)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0077 52.5 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H N N 6.5 .0064 47.7 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N H N H H H 8.6 .0061 46.3 —
AFFECTED Product Versions Fixed ImpressCMS unspecified —
TIMELINE Aug 13 Reserved by CNA Aug 14 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0060 45.9 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0060 45.9 —
AFFECTED Product Versions Fixed A800R 4.1.2cu.5137_B20200730 – —
TIMELINE Aug 14 Reserved by CNA Aug 14 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0060 45.9 —
AFFECTED Product Versions Fixed W20E 15.11.0.6(1068_1546_841)_CN_TDC – —
TIMELINE Aug 14 Reserved by CNA Aug 14 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0060 45.9 —
AFFECTED Product Versions Fixed A800R 4.1.2cu.5137_B20200730 – —
TIMELINE Aug 14 Reserved by CNA Aug 14 Published (CNA: VulDB)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C N H L 9.3 .0059 45.6 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H L 8.2 .0059 45.6 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N H N L N L H H 6.1 .0057 44.5 —
AFFECTED Product Versions Fixed AVEVA Enterprise SCADA 2025 – 2025 P1 AVEVA Enterprise SCADA HMI 2024 – 2024 R2 HF7 AVEVA Pipeline Operations for Gas/Liquids unspecified 2025 P1 AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) unspecified 2025 SP1 P2 AVEVA Pipeline Training Simulator (delivered on Pipeline Simulation media) unspecified 2025 SP1 P2 Measurement Advisor unspecified 2025 P1
TIMELINE Jul 14 Reserved by CNA Aug 14 Published (CNA: icscert)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0055 43.4 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 14 Published (CNA: ibm)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-73673 | 8.7 | 43.2 | Netis Systems Co., Ltd. | Netis NC63 Wireless AC1200 Router | CWE-306 | Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptogra… |
| CVE-2026-50523 | 7.8 | 42.7 | Microsoft | PowerShell 7.4 | CWE-77 | Microsoft PowerShell Remote Code Execution Vulnerability |
| CVE-2026-16879 | 8.8 | 42.3 | IBM | Db2 Mirror for i | CWE-285 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-66271 | 7.2 | 41.9 | Dell | Wyse Management Suite (WMS) | CWE-434 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unre… |
| CVE-2026-72970 | 8.3 | 41.3 | Microsoft | Microsoft Edge (Chromium-based) | CWE-122 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-50027 | 9.8 | 40.7 | doobidoo | mcp-memory-service | CWE-306 | mcp-memory-service: Missing Authentication on Document API Endpoints Allows U… |
| CVE-2026-72819 | 8.7 | 40.7 | getgrav | grav | CWE-94 | Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload |
| CVE-2026-19812 | 7.4 | 40.2 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow |
| CVE-2026-19844 | 7.4 | 40.2 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow |
| CVE-2026-73849 | 9.8 | 39.6 | emlog | emlog | CWE-306 | emlog allows unauthenticated reinstallation via `install.php?action=reinstall`. |
| CVE-2026-19827 | 5.5 | 39.3 | alldatacenter | alldata | CWE-22 | alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputSt… |
| CVE-2026-19830 | 5.5 | 39.0 | TRENDnet | TEW-816DRM | CWE-400 | TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources |
| CVE-2026-72827 | 8.7 | 38.9 | getgrav | grav | CWE-1336 | Grav CMS before 2.0.13 Remote Code Execution via Twig |
| CVE-2026-16905 | 5.3 | 38.6 | IBM | Db2 Mirror for i | CWE-287 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-17186 | 9.9 | 38.6 | IBM | Db2 Mirror for i | CWE-78 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-72824 | 9.3 | 38.5 | getgrav | grav | CWE-862 | Grav before 1.0.13 API Key Scope Bypass via PagesController |
| CVE-2026-19788 | 7.4 | 38.4 | Tenda | AC1206 | CWE-119 | Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name … |
| CVE-2026-19789 | 7.4 | 38.4 | Tenda | AC1206 | CWE-119 | Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist … |
| CVE-2026-19790 | 7.4 | 38.4 | Tenda | G0 | CWE-119 | Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow |
| CVE-2026-19791 | 7.4 | 38.4 | Tenda | G0 | CWE-119 | Tenda G0 httpd web management interface module addStaticRoute stack-based ove… |
| CVE-2026-19792 | 7.4 | 38.4 | Tenda | G0 | CWE-119 | Tenda G0 httpd web management interface module setPortMapping buffer overflow |
| CVE-2026-19811 | 7.4 | 38.4 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow |
| CVE-2026-19814 | 7.4 | 38.4 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow |
| CVE-2026-19815 | 7.4 | 38.4 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow |
| CVE-2026-19821 | 7.4 | 38.4 | Tenda | AC12 | CWE-119 | Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTi… |
| CVE-2026-19823 | 7.4 | 38.4 | Tenda | W20E | CWE-119 | Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow |
| CVE-2026-19824 | 7.4 | 38.4 | Tenda | W20E | CWE-119 | Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow |
| CVE-2026-19845 | 7.4 | 38.4 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-19846 | 7.4 | 38.4 | TOTOLINK | A800R | CWE-119 | TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow |
| CVE-2026-18178 | 5.4 | 36.9 | IBM | Db2 Mirror for i | CWE-22 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-73683 | 9.2 | 36.7 | Laravel | Socialite | CWE-294 | Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay |
| CVE-2026-72830 | 9.3 | 36.7 | getgrav | grav | CWE-269 | Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass |
| CVE-2026-34492 | 7.0 | 35.7 | Johnson Controls | Airwall | CWE-73 | Airwall - Arbitrary file read |
| CVE-2026-17209 | 6.3 | 35.5 | IBM | Db2 Mirror for i | CWE-79 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-19762 | 5.5 | 35.4 | DTStack | Taier | CWE-22 | DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path tra… |
| CVE-2026-66270 | 7.2 | 35.3 | Dell | Wyse Management Suite (WMS) | CWE-434 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unre… |
| CVE-2026-46603 | 7.5 | 34.8 | golang.org/x/image | golang.org/x/image/vp8l | CWE-789 | Excessive memory allocation during VP8L decoding in golang.org/x/image |
| CVE-2026-19825 | 5.5 | 34.4 | SourceCodester | Simple Client Management System | CWE-74 | SourceCodester Simple Client Management System Master.php save_service sql in… |
| CVE-2026-16708 | 8.3 | 34.1 | IBM | Db2 Mirror for i | CWE-15 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-58224 | 6.5 | 33.7 | Red Hat | Red Hat Enterprise Linux 10 | CWE-353 | Samba: ctdb fails to do integrity checking of received packets |
| CVE-2026-48528 | 9.8 | 33.6 | NCEAS | metacat | CWE-89 | Metacat has an unauthenticated SQL injection vulnerability |
| CVE-2026-72815 | 6.9 | 32.9 | go-chi | chi | CWE-290 | go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header |
| CVE-2026-72813 | 6.9 | 32.6 | actix | actix-web | CWE-248 | actix-files before 0.6.10 Denial of Service via empty Range header |
| CVE-2026-19631 | 6.9 | 32.3 | Tenable, Inc. | Security Center | CWE-89 | SQL Injection |
| CVE-2026-19871 | 9.3 | 31.8 | Roskus | Prospero Flow CRM | CWE-798 | Use of hard-coded credentials in Prospero Flow CRM employee onboarding |
| CVE-2026-72814 | 6.3 | 31.4 | actix | actix-web | CWE-22 | actix-web before 0.6.10 Information Disclosure via Files |
| CVE-2026-19763 | 5.1 | 31.3 | DTStack | Taier | CWE-22 | DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirecto… |
| CVE-2026-19837 | 2.0 | 30.4 | Webkul | Bagisto | CWE-200 | Webkul Bagisto Customer Search search information disclosure |
| CVE-2026-19629 | 8.6 | 30.3 | Tenable, Inc. | Security Center | CWE-863 | Privilege Escalation |
| CVE-2026-17079 | 6.3 | 29.7 | IBM | Db2 Mirror for i | CWE-693 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-19829 | 2.1 | 29.6 | 648540858 | wvp-GB28181-pro | CWE-22 | 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path … |
| CVE-2026-63650 | 2.0 | 29.5 | OpenVPN | OpenVPN | CWE-295 | OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated us… |
| CVE-2026-72822 | 9.3 | 27.6 | getgrav | grav | CWE-306 | Grav before 1.0.13 Authentication Bypass via disable2fa |
| CVE-2026-69101 | 8.3 | 27.0 | datavane | tis | CWE-611 | Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint |
| CVE-2026-12949 | 9.8 | 26.9 | Wishlist Member | Wishlist Member | CWE-640 | Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith… |
| CVE-2026-72820 | 6.9 | 26.9 | getgrav | grav | CWE-22 | Grav 2.0.11 Path Traversal via Backup Profile Configuration |
| CVE-2026-72835 | 7.6 | 26.7 | filebrowser | filebrowser | CWE-41 | filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization |
| CVE-2026-45699 | 7.5 | 26.4 | Netatalk | netatalk | CWE-191 | Netatalk has Integer Underflow → Stack Buffer Overflow in copydir() |
| CVE-2026-73051 | 6.3 | 26.4 | actix | actix-web | CWE-444 | actix-http before 3.12.1 HTTP Request Smuggling via CL.TE |
| CVE-2026-19909 | 7.5 | 26.3 | PAX Technology | Q80 | CWE-59 | PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vuln… |
| CVE-2026-17227 | 5.4 | 26.1 | IBM | Db2 Mirror for i | CWE-89 | IBM Db2 Mirror for i is affected by multiple vulnerabilities |
| CVE-2026-19880 | 6.3 | 26.0 | QOS.CH Sarl | Logback-classic | CWE-22 | Incomplete protection against CVE-2025-11226 |
| CVE-2026-63649 | 4.1 | 25.7 | OpenVPN | OpenVPN | CWE-183 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha… |
| CVE-2026-19826 | 5.5 | 25.7 | alldatacenter | alldata | CWE-20 | alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.r… |
| CVE-2026-15205 | 8.6 | 25.2 | Unknown | Paymob for WooCommerce | CWE-89 | Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Cal… |
| CVE-2026-73633 | 7.5 | 25.2 | Apache Software Foundation | Apache Struts | CWE-400 | Apache Struts: Unbounded read of a JSON request body |
| CVE-2026-72836 | 9.2 | 24.9 | filebrowser | filebrowser | CWE-178 | FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass |
| CVE-2026-72810 | 9.2 | 24.0 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket |
| CVE-2026-19680 | 7.1 | 23.8 | Tenable, Inc. | Security Center | CWE-89 | SQL Injection |
| CVE-2026-19834 | 2.0 | 23.5 | Webkul | Bagisto | CWE-285 | Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authori… |
| CVE-2025-71405 | 5.1 | 23.3 | go-chi | chi | CWE-601 | go-chi chi before v5.2.2 Open Redirect via RedirectSlashes |
| CVE-2026-74245 | 5.9 | 23.2 | Red Hat | Red Hat OpenShift Update Service | CWE-306 | Quay: unauthenticated exported logs download in quay |
| CVE-2026-63361 | 8.5 | 23.1 | LimeSurvey | LimeSurvey | CWE-79 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup |
| CVE-2026-72826 | 9.3 | 22.8 | getgrav | grav | CWE-266 | Grav before 1.0.13 Scope Bypass via createApiKey |
| CVE-2026-72829 | 9.3 | 22.8 | getgrav | grav | CWE-269 | Grav before 1.0.13 API Key Scope Bypass via UsersController |
| CVE-2026-72831 | 8.7 | 22.8 | getgrav | grav | CWE-863 | Grav through 2.0.11 Authentication Bypass via Flex Objects |
| CVE-2026-72837 | 8.7 | 22.6 | filebrowser | filebrowser | CWE-284 | File Browser before 2.63.20 Privilege Escalation via Proxy Authentication |
| CVE-2026-49826 | 0.0 | 22.4 | concourse | concourse | CWE-601 | Concourse login flow has an open redirect issue |
| CVE-2026-72838 | 7.1 | 22.0 | filebrowser | filebrowser | CWE-770 | FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload |
| CVE-2026-19639 | 5.3 | 22.0 | Tenable, Inc. | Security Center | CWE-1284 | Improper Access Control |
| CVE-2026-19836 | 2.1 | 21.9 | Webkul | Bagisto | CWE-285 | Webkul Bagisto Backend Customer Detail Feature view authorization |
| CVE-2026-19838 | 2.1 | 21.9 | Webkul | Bagisto | CWE-285 | Webkul Bagisto Backend Reporting Endpoint sales authorization |
| CVE-2026-14290 | 6.8 | 21.5 | Unknown | Embed Google Photos album | CWE-79 | Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link … |
| CVE-2026-19828 | 2.1 | 21.3 | 648540858 | wvp-GB28181-pro | CWE-22 | 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal |
| CVE-2026-1621 | 5.3 | 21.1 | Universal Software Inc. | E-Municipality | CWE-305 | Register Bypass in Universal Sotware's E-Municipality |
| CVE-2026-19870 | 8.6 | 20.6 | Roskus | Prospero Flow CRM | CWE-639 | IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation |
| CVE-2026-18403 | 6.0 | 20.5 | LimeSurvey | LimeSurvey | CWE-89 | LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB |
| CVE-2026-18039 | 8.1 | 20.4 | Unknown | Essential Addons for Elementor | CWE-269 | Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation… |
| CVE-2026-19768 | 8.1 | 20.2 | Devolutions | PowerShell Universal | CWE-94 | Improper control of generation of code ('Code Injection') in the settings fea… |
| CVE-2026-72812 | 6.9 | 19.9 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Missing Authorization via refreshBacklink |
| CVE-2026-72828 | 8.6 | 19.6 | getgrav | grav | CWE-269 | Grav before 1.0.13 API Key Scope Bypass via InvitationsController |
| CVE-2026-73850 | 8.6 | 19.1 | emlog | emlog | CWE-89 | Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase()… |
| CVE-2026-49989 | 7.1 | 19.1 | crate | crate | CWE-863 | CrateDB's Blob HTTP handler bypasses authorization |
| CVE-2026-27871 | 2.9 | 19.1 | Johnson Controls | TL280 | CWE-327 | TL280 |
| CVE-2026-19784 | 2.1 | 19.0 | francoisjacquet | RosarioSIS | CWE-285 | francoisjacquet RosarioSIS Referrals.php DBUpdate authorization |
| CVE-2026-16810 | 6.5 | 18.8 | bitpressadmin | Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | CWE-89 | Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterT… |
| CVE-2026-12743 | 4.9 | 18.8 | cservit | affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | CWE-89 | affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via… |
| CVE-2026-18109 | 7.2 | 18.4 | boldgrid | W3 Total Cache | CWE-79 | W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Co… |
| CVE-2026-19835 | 2.0 | 18.1 | Webkul | Bagisto | CWE-266 | Webkul Bagisto Customer Item Deletion Endpoint access control |
| CVE-2026-72833 | 8.7 | 18.0 | getgrav | grav | CWE-269 | Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys |
| CVE-2026-19636 | 6.0 | 17.5 | Tenable, Inc. | Security Center | CWE-1270 | Insuffucient Protections Lead to Brute Force |
| CVE-2026-74242 | 5.3 | 17.5 | Red Hat | Red Hat OpenShift Update Service | CWE-639 | Quay: repository notification uuid idor in quay api |
| CVE-2026-74243 | 6.5 | 17.4 | Red Hat | Red Hat OpenShift Update Service | CWE-306 | Quay: unauthenticated secscan notification endpoint in quay when psk is unset |
| CVE-2026-74250 | 6.3 | 17.1 | OpenStack | Ironic | CWE-226 | In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail t… |
| CVE-2026-19764 | 5.5 | 17.1 | Raisecom | Communication Command and Dispatch Management Platform | CWE-74 | Raisecom Communication Command and Dispatch Management Platform getpwd.php sq… |
| CVE-2026-66272 | 5.3 | 17.1 | Dell | Wyse Management Suite (WMS) | CWE-200 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missi… |
| CVE-2026-72811 | 9.9 | 16.7 | siyuan-note | siyuan | CWE-89 | SiYuan before v3.7.4 SQL Injection via backlink search |
| CVE-2026-19767 | 2.1 | 16.6 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System viewdoctortimings.php sql injection |
| CVE-2026-53472 | 6.3 | 16.4 | — | migration-planner | CWE-79 | Migration-planner: credentialurl validator accepts javascript: urls |
| CVE-2026-71570 | 5.1 | 15.7 | icagenda.com | iCagenda extension for Joomla | CWE-284 | Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumerat… |
| CVE-2026-69414 | 7.8 | 15.0 | Microsoft | Microsoft Malware Protection Engine | CWE-269 | Microsoft Defender Elevation of Privilege Vulnerability |
| CVE-2026-19879 | 5.3 | 14.7 | Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | CWE-681 | Io.undertow/undertow: undertow: http response header integrity issue due to c… |
| CVE-2026-50029 | 5.3 | 14.3 | sunnyadn | js-toml | CWE-697 | js-toml has silent type confusion via falsy-primitive duplicate-key bypass |
| CVE-2026-67365 | 9.2 | 13.7 | icagenda.com | iCagenda extension for Joomla | CWE-89 | Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda <… |
| CVE-2026-72834 | 5.3 | 13.8 | filebrowser | filebrowser | CWE-200 | filebrowser before 2.63.19 Permission Bypass via checksum |
| CVE-2026-19839 | 2.0 | 13.6 | SourceCodester | Simple Doctors Appointment System | CWE-284 | SourceCodester Simple Doctors Appointment System save_file.php save_doctor un… |
| CVE-2026-19908 | 7.1 | 13.3 | PAX Technology | Q80 | CWE-306 | PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability |
| CVE-2026-73845 | 5.3 | 13.3 | ondata | ckan-mcp-server | CWE-20 | CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMq… |
| CVE-2026-57469 | 5.1 | 13.3 | KUNBUS | PiCtory | CWE-352 | Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory |
| CVE-2026-73844 | 3.7 | 13.1 | ondata | ckan-mcp-server | CWE-209 | CKAN MCP Server: Information disclosure via verbose error reflection |
| CVE-2026-16739 | 5.9 | 12.8 | Unknown | Epeken All Kurir for Woocommerce | CWE-287 | Epeken All Kurir <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery |
| CVE-2026-72816 | 6.9 | 12.6 | go-chi | chi | CWE-290 | go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware |
| CVE-2026-71571 | 8.6 | 12.5 | icagenda.com | iCagenda extension for Joomla | CWE-89 | Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped n… |
| CVE-2026-19787 | 2.0 | 11.5 | SourceCodester | Air Cargo Management System | CWE-74 | SourceCodester Air Cargo Management System Master.php save_cargo_type sql inj… |
| CVE-2026-19765 | 2.1 | 11.4 | eyaushev | swagger-testcase-mcp | CWE-918 | eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource serv… |
| CVE-2026-73630 | 6.9 | 10.8 | siyuan-note | siyuan | CWE-203 | SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess |
| CVE-2026-19785 | 5.3 | 10.8 | francoisjacquet | RosarioSIS | CWE-74 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection |
| CVE-2026-16772 | 8.1 | 10.3 | Akaunting | Akaunting | CWE-269 | CVE-2026-16772 |
| CVE-2026-72825 | 7.2 | 10.0 | getgrav | grav | CWE-862 | Grav before 1.0.13 API-key scope cap bypass via ReportsController |
| CVE-2026-73048 | 6.9 | 9.5 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID |
| CVE-2026-73049 | 6.9 | 9.5 | siyuan-note | siyuan | CWE-863 | SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks |
| CVE-2026-72823 | 5.3 | 9.3 | getgrav | grav | CWE-862 | Grav before 1.0.13 API-key scope cap bypass via DemoController |
| CVE-2026-19635 | 8.5 | 9.1 | Tenable, Inc. | Security Center | CWE-78 | Local Privilege Escalation |
| CVE-2026-19794 | 7.2 | 9.0 | gamerz | WP-Stats | CWE-79 | WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-74240 | 5.4 | 8.9 | Red Hat | Red Hat OpenShift Update Service | CWE-287 | Quay: jwt claim validation bypasses in quay federated robot and sso authentic… |
| CVE-2026-74248 | 4.3 | 8.9 | OpenStack | Octavia | CWE-863 | OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy a… |
| CVE-2026-19910 | 7.5 | 8.5 | PAX Technology | Q80 | CWE-347 | PAX Technology Q80 Application Installer Signature Verification Bypass Remote… |
| CVE-2026-19841 | 2.3 | 8.4 | TRENDNET | TEW-813DRU | CWE-266 | TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission |
| CVE-2026-74241 | 4.8 | 8.2 | Red Hat | Red Hat OpenShift Update Service | CWE-90 | Quay: ldap referral filter injection in quay external ldap authentication |
| CVE-2026-72859 | 8.3 | 8.0 | budibase | server | CWE-863 | Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL |
| CVE-2026-72832 | 5.1 | 7.9 | getgrav | grav | CWE-79 | Grav before 2.0.12 Stored XSS via quoted-attribute bypass |
| CVE-2026-46439 | 7.8 | 7.5 | oscal-compass | compliance-trestle | CWE-94 | compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-S… |
| CVE-2026-53970 | 7.5 | 6.8 | lucasgelfond | ZeroBrew | CWE-494 | ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb |
| CVE-2026-12363 | 4.2 | 6.5 | zephyrproject | zephyr | CWE-787 | Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0 |
| CVE-2026-73847 | 6.8 | 6.4 | emlog | emlog | CWE-352 | Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full dat… |
| CVE-2026-19786 | 5.3 | 6.3 | francoisjacquet | RosarioSIS | CWE-352 | francoisjacquet RosarioSIS Modules.php cross-site request forgery |
| CVE-2026-47192 | 2.1 | 6.1 | siemens | kas | CWE-347 | kas's late signature validation may allow unnoticed repository manipulations |
| CVE-2026-47766 | 5.1 | 5.8 | containers | crun | CWE-61 | crun follows rootfs /dev symlink while creating default devices |
| CVE-2026-47191 | 2.1 | 5.6 | siemens | kas | CWE-347 | kas checks out SHA-like git branches as valid commits |
| CVE-2026-64887 | 7.0 | 5.5 | Johnson Controls | Airwall | CWE-321 | Airwall - Hardcoded Secrets |
| CVE-2026-67366 | 5.3 | 4.8 | icagenda.com | iCagenda extension for Joomla | CWE-352 | Joomla Extension - icagenda.com - CSRF on frontend registration actions in iC… |
| CVE-2025-10308 | 4.3 | 4.8 | alian | Astro Booking Engine | CWE-352 | Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset |
| CVE-2026-72817 | 6.9 | 4.7 | go-chi | chi | CWE-345 | go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For |
| CVE-2026-49457 | 9.1 | 4.6 | benoitc | erlang_quic | CWE-295 | QUIC has Broken TLS verification |
| CVE-2026-74244 | 5.9 | 4.0 | Red Hat | Red Hat OpenShift Update Service | CWE-347 | Quay: stripe webhook accepts forged events without signature verification in … |
| CVE-2026-72821 | 5.1 | 3.7 | getgrav | grav | CWE-79 | Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle |
| CVE-2026-73846 | 6.5 | 3.6 | ondata | ckan-mcp-server | CWE-345 | CKAN MCP Server: Cache-key canonicalization collision enables cache confusion… |
| CVE-2026-49282 | 5.1 | 3.2 | capstone-engine | capstone | CWE-125 | Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bound… |
| CVE-2026-74247 | 4.2 | 3.2 | Red Hat | Red Hat OpenShift Update Service | CWE-918 | Quay: ssrf via build archive_url in quay build api |
| CVE-2026-19884 | 8.4 | 3.1 | Eclipse Foundation | Eclipse Theia | CWE-829 | In Eclipse Theia versions up to and including 1.69.0, opening a folder starts… |
| CVE-2026-49263 | 2.0 | 2.9 | capstone-engine | capstone | CWE-197 | Capstone WASM `br_table` instruction-size truncation can cause no-progress di… |
| CVE-2026-57472 | 6.9 | 2.5 | KUNBUS | RevPiPyLoad | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'… |
| CVE-2026-57471 | 6.8 | 2.5 | KUNBUS | RevPiPyLoad | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'… |
| CVE-2026-12366 | 8.8 | 2.2 | zephyrproject | zephyr | CWE-416 | Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr users… |
| CVE-2026-12364 | 8.4 | 2.1 | zephyrproject | zephyr | CWE-822 | Missing user-space pointer validation in logging syscall z_log_msg_static_cre… |
| CVE-2026-49986 | 7.1 | 1.6 | cdeust | Cortex | CWE-829 | Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR` |
| CVE-2026-19617 | 5.5 | 1.5 | Red Hat | Red Hat Enterprise Linux 10 | CWE-770 | Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config pa… |
| CVE-2026-19770 | 1.9 | 1.5 | feedmob | fm-mcp-servers | CWE-918 | feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side … |
| CVE-2026-13002 | 4.4 | 1.4 | Red Hat | Red Hat Enterprise Linux 10 | CWE-835 | Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing |
| CVE-2026-46380 | 6.7 | 1.0 | oscal-compass | compliance-trestle | CWE-918 | compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem |
| CVE-2026-12365 | 5.8 | 1.0 | zephyrproject | zephyr | CWE-416 | Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race |
| CVE-2026-13196 | 7.3 | 0.9 | KUNBUS | piControl | CWE-787 | Out-of-bounds Write in KUNBUS piControl |
| CVE-2026-13197 | 7.3 | 0.8 | KUNBUS | piControl | CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Ra… |
| CVE-2026-13198 | 5.9 | 0.8 | KUNBUS | piControl | CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Ra… |
| CVE-2026-63700 | 7.8 | 0.4 | Dell | Wyse Management Suite (WMS) | CWE-269 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Inco… |
| CVE-2026-63701 | 7.8 | 0.2 | Dell | Wyse Management Suite (WMS) | CWE-269 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Impr… |
| CVE-2026-63702 | 5.5 | 0.2 | Dell | Wyse Management Suite (WMS) | CWE-798 | Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use o… |
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-08-14 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.