boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Tuesday, October 13, 2026 · all times UTC← 2026-10-12 · archive

Security Box Score — October 13, 2026

CISA adds 2 to KEV; 2291 CVEs published, led by Microsoft (1407).

2291 CVEs published October 13, 2026: 140 critical, 1297 high, 705 medium, 41 low; 2 in the KEV catalog at press time; 0 with a public exploit reference; 108 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 1891 on continuation pages.

Standings

League
MTDYTD2025 same span2025 full
CVEs published715957195——
KEV catalog size1741

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3620 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux2216426532269275911560.17.8.0018-410 ▼
microsoft142643282692989105317291320.77.8.0047+449 ▲
google3303161382120513991378090.37.3.0026-31 ▼
red hat11710165740449758200.06.5.0032+45 ▲
apple056467166317148991.66.5.00190
suse053827162000.07.5.0035-12 ▼
canonical2521612195000.07.8.0022+2 ▲
freebsd04823673000.07.8.00160
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco36218708463160177.88.4.0044+24 ▲
ubiquiti065362810334.69.1.00510
fortinet1253131421530815.17.2.0040+2 ▲
palo alto networks0461426151324.34.7.0022-9 ▼
netgear64000328000.04.3.0027+4 ▲
ivanti7318194026619.48.8.0152-3 ▼
f502671441527.78.7.0050-7 ▼
sonicwall4238105019417.47.8.0049-1 ▼
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache146853169380262213320.27.5.0057+114 ▲
mozilla854641251741210900.08.8.0031+50 ▲
gitlab261309297715532.35.3.0033+24 ▲
drupal094119668411.15.7.0027-26 ▼
github225212110000.07.4.0052-1 ▼
docker82021080000.07.3.0015+8 ▲
wordpress0614103350.08.7.03630
eclipse022000000.09.3.00500
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle0290558116605631012840.17.8.00360
ibm196121922058639320610.17.5.0036+75 ▲
adobe177100710846542592150.57.5.0036+7 ▲
progress451112170191610.97.7.0035+42 ▲
zohocorp14362980000.08.1.0113-4 ▼
solarwinds0261853010415.49.1.00670
veeam62571170100.08.5.0036+6 ▲
atlassian11028001300.07.8.0043+1 ▲
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
siemens3286951233000.07.3.0025+18 ▲
d-link17522291212300.08.5.0157-7 ▼
synology046510256000.05.6.00320
rockwell automation24553460000.08.7.0029-16 ▼
advantech02021710000.08.6.0071-2 ▼
schneider electric11921250000.08.6.0044-8 ▼
hitachi energy0122460000.07.0.0025-4 ▼
abb0111640000.07.2.00180
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
dell414194318816424210.27.2.0025-93 ▼
nvidia2032127221730000.07.8.0019-12 ▼
sourcecodester3226900162107000.05.5.0040+2 ▲
openclaw022851178521000.07.1.00310
hewlett packard enterprise (hpe)382043992649110.57.3.0042-53 ▼
mongodb221916106727100.07.1.0036-28 ▼
itsourcecode181710042129000.02.1.0033-10 ▼
spring017013608314000.06.5.00330

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-87902.399898.68.1
CVE-2026-76461.295498.29.8
CVE-2026-93616.196597.39.8
CVE-2026-76460.140396.510.0
CVE-2026-12269.069994.08.8
CVE-2026-77692.065693.77.5
CVE-2026-12268.047391.68.8
CVE-2026-74849.046191.59.8
CVE-2026-76698.045391.46.5
CVE-2026-84434.039190.19.8
Highest CVSS
CVECVSSEPSSNote
CVE-2026-7646010.0.1403KEV
CVE-2026-10857610.0.0245
CVE-2026-10548410.0.0213
CVE-2026-7336910.0.0125
CVE-2026-7569910.0.0125
CVE-2026-7570310.0.0125
CVE-2026-7572110.0.0125
CVE-2026-8441210.0.0125
CVE-2026-8927510.0.0125
CVE-2026-8670810.0.0124
Most disclosures (vendor)
VendorCVEs
linux1705
microsoft1451
oracle634
google631
ibm479
apache309
red hat309
apple247
mozilla241
adobe231
Most KEV additions (YTD)
VendorKEV
microsoft32
cisco17
apple9
google9
fortinet8
ivanti6
linux6
adobe5
berriai4
checkpoint4
Most-affected ecosystems
EcosystemAdvisories
Maven134
npm30
NuGet29
PyPI25
Packagist19
Go13
crates.io10
RubyGems4
Fastest to KEV
CVEVendorDays
CVE-2026-58704Google0
CVE-2026-86950Apple0
CVE-2026-88779NetScaler0
CVE-2026-93952Arista Networks0
CVE-2026-102489Zammad GmbH1
CVE-2026-102490Zammad GmbH1
CVE-2026-87902WordPress2
CVE-2026-85102checkpoint12
CVE-2026-67279Mikrotik19
CVE-2026-71362Adobe43
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104n/a2021-11-171791
CVE-2021-27102n/a2021-11-171791
CVE-2021-27101n/a2021-11-171791
CVE-2021-27103n/a2021-11-171791
CVE-2021-21017Adobe2021-11-171791
CVE-2021-28550Adobe2021-11-171791
CVE-2021-42013Apache Software Foundation2021-11-171791
CVE-2021-41773Apache Software Foundation2021-11-171791
CVE-2021-30858Apple2021-11-171791
CVE-2021-30860Apple2021-11-171791

Transactions

ADDED TO KEV — CVE-2026-104935 (Ivanti Connect Secure). Remediation due October 16, 2026.

ADDED TO KEV — CVE-2026-96951 (Microsoft Outlook.com). Remediation due October 16, 2026.

EXPLOIT PUBLISHED — JeecgBoot: 45 CVEs (CVE-2026-108606, CVE-2026-108608, CVE-2026-108611, CVE-2026-108613, CVE-2026-108616, CVE-2026-108618, CVE-2026-108621, CVE-2026-108623, CVE-2026-108626, CVE-2026-108628, CVE-2026-108631, CVE-2026-108633, CVE-2026-108636, CVE-2026-108638, CVE-2026-108641, CVE-2026-108643, CVE-2026-108646, CVE-2026-108648, CVE-2026-108651, CVE-2026-108653, CVE-2026-108656, CVE-2026-108658, CVE-2026-108661, CVE-2026-108663, CVE-2026-108666, CVE-2026-108668, CVE-2026-108671, CVE-2026-108673, CVE-2026-108676, CVE-2026-108678, CVE-2026-108866, CVE-2026-108867, CVE-2026-108868, CVE-2026-108871, CVE-2026-108872, CVE-2026-108873, CVE-2026-108876, CVE-2026-108877, CVE-2026-108878, CVE-2026-108881, CVE-2026-108882, CVE-2026-108883, CVE-2026-108886, CVE-2026-108887, CVE-2026-108888). Public exploit references added.

EXPLOIT PUBLISHED — qax-os excelize: 15 CVEs (CVE-2026-107211, CVE-2026-107212, CVE-2026-107213, CVE-2026-107214, CVE-2026-107215, CVE-2026-107216, CVE-2026-107217, CVE-2026-107218, CVE-2026-107219, CVE-2026-107220, CVE-2026-107221, CVE-2026-107222, CVE-2026-107223, CVE-2026-107224, CVE-2026-107225). Public exploit references added.

EXPLOIT PUBLISHED — jishenghua jshERP: 7 CVEs (CVE-2026-109178, CVE-2026-109179, CVE-2026-109180, CVE-2026-109183, CVE-2026-109184, CVE-2026-109185, CVE-2026-109188). Public exploit references added.

EXPLOIT PUBLISHED — 1Panel-dev CordysCRM: 3 CVEs (CVE-2026-108701, CVE-2026-108703, CVE-2026-108704). Public exploit references added.

EXPLOIT PUBLISHED — Borewit music-metadata: 3 CVEs (CVE-2026-107387, CVE-2026-107391, CVE-2026-107392). Public exploit references added.

EXPLOIT PUBLISHED — Edimax BR-6208AC: 3 CVEs (CVE-2026-108915, CVE-2026-108917, CVE-2026-108934). Public exploit references added.

EXPLOIT PUBLISHED — Gitea: 3 CVEs (CVE-2026-86684, CVE-2026-94205, CVE-2026-96404). Public exploit references added.

EXPLOIT PUBLISHED — Netcore NR268: 3 CVEs (CVE-2026-108907, CVE-2026-108909, CVE-2026-108930). Public exploit references added.

EXPLOIT PUBLISHED — pydantic-ai: 3 CVEs (CVE-2026-107289, CVE-2026-107290, CVE-2026-107291). Public exploit references added.

EXPLOIT PUBLISHED — Studio-Saelix Sencho: 3 CVEs (CVE-2026-108521, CVE-2026-108522, CVE-2026-108523). Public exploit references added.

EXPLOIT PUBLISHED — zhayujie CowAgent: 3 CVEs (CVE-2026-108681, CVE-2026-108683, CVE-2026-108768). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2021-22555 (Linux Kernel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-10457 (zephyrproject-rtos Zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-2962 (zephyrproject-rtos Zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-59838 (monkeytypegame monkeytype). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-68613 (n8n-io n8n). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-104045 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-104046 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-104079 (Syed Balkhi Envira Gallery). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-104083 (Smartertools Smartermail). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-106267 (Google Chrome). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-107335 (CISA Malcolm). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-107695 (FFmpeg). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108114 (strapi). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108164 (opensource-socialnetwork). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108539 (GPAC). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108540 (OpenSpug Spug). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108543 (ag2ai ag2). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108546 (spotweb). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108688 (elunez eladmin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108690 (gz-yami mall4j). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108691 (gz-yami mall4j). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108693 (ImageMagick). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108699 (hyper-mcp-rs hyper-mcp). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108706 (elunez eladmin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108708 (WuKongOpenSource Wukong_HRM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108712 (SuiteCRM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108722 (e2b-dev open-computer-use). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108732 (frappe hrms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108742 (DBeaver CloudBeaver). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108783 (PRVTPRO Amnezia-Web-Panel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108785 (macrozheng mall). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108787 (houtini-ai voice-analyser-mcp). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108789 (deepseek-ai deepseek-harness). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108791 (westboy CicadasCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108799 (jackq XCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108801 (prasathmani TinyFileManager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108805 (krupalshah EmployeeRecruitmentSystem). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108807 (krupalshah EmployeeRecruitmentSystem). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108811 (WMCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108813 (SEMCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108815 (idcCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108817 (agno-agi agno). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108819 (agno-agi agno). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108821 (Tencent WeKnora). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108824 (DataEase). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108826 (Zen Cart). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108828 (Zen Cart). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108830 (meetecho janus-gateway). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108836 (Ollama). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108853 (UnicomAI Wanwu). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108856 (UnicomAI Wanwu). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108858 (Predibase LoRAX). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108861 (erpipe-org Odoo MCP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108863 (Katanemo Plano). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108890 (BlackBeltTechnology pi-agent-dashboard). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108893 (Linksys E1700). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108895 (Linksys E1700). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108897 (Smart Media4U Technology SHAREit App). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108899 (tobychui zoraxy). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108901 (Shenzhen HCC Technology MPOS M6 PLUS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108921 (KusalkaSilva Learning-Management-System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108923 (1024-lab smart-admin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108926 (itsourcecode Baptism Information Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108928 (itsourcecode Online Admission System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108938 (code-projects Matrimonial System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108963 (David-Crty databasement). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-108980 (Blinko). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109166 (dromara lamp-cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109168 (dromara lamp-cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109173 (guchengwuyue yshop-crm). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109174 (moxi624 MoguBlog). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109175 (moxi624 MoguBlog). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109391 (Square Squash). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109392 (Pimcore). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109425 (tink-crypto tink-go). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-109570 (Fire-Boltt BSW013). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-21413 (LibRaw). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-61511 (vBulletin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-97147 (OpenStack Mistral). Public exploit reference added.

REJECTED — CVE-2026-22314 (Mesalvo Meona Client Launcher Component). Record withdrawn by the CNA.

REJECTED — CVE-2026-94489 (OctoPrint). Record withdrawn by the CNA.

REJECTED — CVE-2026-94490 (OctoPrint). Record withdrawn by the CNA.

DISPUTED — CVE-2026-19061 (InstaKNXServiceApp). Record marked disputed.

RESCORED — OpenBSD OpenSSH: 6 CVEs (CVE-2026-106552, CVE-2026-106553, CVE-2026-106555, CVE-2026-106583, CVE-2026-106584, CVE-2026-106586). CVSS rescored — before/after on each CVE page.

RESCORED — zephyrproject-rtos Zephyr: 6 CVEs (CVE-2025-1675, CVE-2025-2962, CVE-2025-7403, CVE-2025-9408, CVE-2025-10456, CVE-2025-10457). CVSS rescored — before/after on each CVE page.

RESCORED — Borewit music-metadata: 3 CVEs (CVE-2026-107387, CVE-2026-107391, CVE-2026-107392). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2019-5589 (Fortinet FortiClientWindows). CVSS 8.6 → 8.8 (NVD).

RESCORED — CVE-2020-12811 (Fortinet FortiManager). CVSS 4.9 → 6.1 (NVD).

RESCORED — CVE-2020-9287 (Fortinet FortiClientEMS). CVSS 7.5 → 7.8 (NVD).

RESCORED — CVE-2020-9290 (Fortinet FortiClientWindows). CVSS 7.1 → 7.8 (NVD).

RESCORED — CVE-2021-22555 (Linux Kernel). CVSS 8.3 → 7.8 (NVD).

RESCORED — CVE-2025-68613 (n8n-io n8n). CVSS 10 → 8.8 (NVD).

RESCORED — CVE-2026-108939 (EricLBuehler mistral.rs). CVSS 6.9 → 5.5 (NVD).

RESCORED — CVE-2026-108940 (EricLBuehler Mistral.rs). CVSS 6.9 → 5.5 (NVD).

RESCORED — CVE-2026-63697 (Dell System Update). CVSS 7.6 → 7.2 (NVD).

RESCORED — CVE-2026-66785 (Red Hat Advanced Cluster Management for Kubernetes 2.17). CVSS 2.5 → 8.7 (NVD).

RESCORED — CVE-2026-71168 (Dell System Update). CVSS 7.3 → 7.8 (NVD).

RESCORED — CVE-2026-76769 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 4.3 → 8.8 (NVD).

RESCORED — CVE-2026-76779 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 7.4 → 9.8 (NVD).

RESCORED — CVE-2026-78013 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 5.2 → 6.3 (NVD).

RESCORED — CVE-2026-78015 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 3.7 → 5.3 (NVD).

RESCORED — CVE-2026-78018 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 6.3 → 7.1 (NVD).

RESCORED — CVE-2026-78019 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 7.5 → 8.8 (NVD).

RESCORED — CVE-2026-78022 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 6.8 → 8.1 (NVD).

RESCORED — CVE-2026-78024 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 7.7 → 8.7 (NVD).

RESCORED — CVE-2026-78027 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 5.8 → 6.8 (NVD).

RESCORED — CVE-2026-78339 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 6.3 → 7.1 (NVD).

RESCORED — CVE-2026-78340 (Dell Secure Connect Gateway (SCG) Policy Manager). CVSS 6.3 → 6.7 (NVD).

RESCORED — CVE-2026-82162 (Dell Command | Configure (DCC)). CVSS 7.4 → 9.8 (NVD).

PATCH SHIPPED — Red Hat Hardened Images: 4 CVEs (CVE-2026-19548, CVE-2026-78367, CVE-2026-84837, CVE-2026-84838). Fix versions published.

PATCH SHIPPED — CVE-2023-54404 (colinhacks zod). Fixed in zod e06a510b6fc1e6e28e3201fd116ca2a76212f6be.

PATCH SHIPPED — CVE-2026-88763 (Red Hat Service Interconnect 2 for RHEL 8). Fixed in Service Interconnect 2 for RHEL 8 0:3.5.3-1.el8.

ENRICHED — Linux: 12 CVEs (CVE-2025-68725, CVE-2026-63997, CVE-2026-63998, CVE-2026-64006, CVE-2026-64012, CVE-2026-64013, CVE-2026-64014, CVE-2026-64019, CVE-2026-64021, CVE-2026-64022, CVE-2026-64028, CVE-2026-64038). Received CVSS/CPE analysis.

ENRICHED — CVE-2026-106327 (Google Chrome). Received CVSS 6.1 and CPE data from NVD.

ENRICHED — CVE-2026-76285 (Splunk Enterprise). Received CVSS 9.8 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

2291 CVEs published. 25 box scores and 375 table rows below; the remaining 1891 continue on page 2 · page 3 · page 4 · page 5 — every CVE is listed, nothing truncated.

CVE-2026-96951HIGH
Microsoft Outlook.com — Windows Shell Security Feature Bypass Vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8      —      —   YES
AFFECTED
  Product                  Versions        Fixed
  Outlook.com              1.0.0 –         —
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  + 10 more
TIMELINE
  Sep 23  Reserved by CNA
  Oct 13  Added to CISA KEV, due Oct 16
  Oct 13  Published (CNA: microsoft)
CWE-77 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Undergoing Analysis · KEV due October 16, 2026
CVE-2026-104935HIGH
Ivanti Connect Secure — Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker t…
  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  L  L    8.6      —      —   YES
AFFECTED
  Product         Versions     Fixed
  Connect Secure  unspecified  25.1.3.0
TIMELINE
  Oct 2   Reserved by CNA
  Oct 13  Added to CISA KEV, due Oct 16
  Oct 13  Published (CNA: ivanti)
CWE-290 · CNA: ivanti · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due October 16, 2026
CVE-2026-109108HIGH
Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0226   82.6     —
AFFECTED
  Product        Versions  Fixed
  WL-WN530BE1-A  251117 –  —
TIMELINE
  Oct 12  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-109110CRITICAL
Wavlink WL-WN592AX6 wmapd system os command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0203   80.5     —
AFFECTED
  Product      Versions  Fixed
  WL-WN592AX6  250422 –  —
TIMELINE
  Oct 12  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-75826HIGH
Teltonika Command Injection in Backup function
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   H   N   H   H   H    8.5   .0094   59.9     —
AFFECTED
  Product  Versions  Fixed
  RUT      7.22 –    —
  RUTX     7.22 –    —
  RUTM     7.22 –    —
  RUTC     7.22 –    —
  ATRM     7.22 –    —
  TAP      7.22 –    —
  CAP      7.22 –    —
  OXA      7.22 –    —
  DAP      7.22 –    —
  TRB      7.22 –    —
  + 4 more
TIMELINE
  Aug 18  Reserved by CNA
  Oct 13  Published (CNA: tlt_net)
CWE-78 · CNA: tlt_net · CVSS v4.0 · 1 reference · NVD status: Received
CVE-2026-108972MEDIUM
SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0066   50.1     —
AFFECTED
  Product                           Versions  Fixed
  Human Resource Management System  1.0 –     —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-287 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-109109CRITICAL
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0058   46.4     —
AFFECTED
  Product        Versions  Fixed
  WL-WN530BE1-A  251117 –  —
TIMELINE
  Oct 12  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-97229CRITICAL
GitLab GitLab — Integer Overflow or Wraparound in GitLab
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0056   45.0     —
AFFECTED
  Product  Versions  Fixed
  GitLab   19.2 –    —
TIMELINE
  Sep 24  Reserved by CNA
  Oct 13  Published (CNA: GitLab)
CWE-190 · CNA: GitLab · CVSS v3.1 · 4 references · NVD status: Undergoing Analysis
CVE-2026-96893HIGH
GitLab GitLab — Improper Neutralization of Input Used for LLM Prompting in GitLab
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   R  U  H  H  N    7.3   .0054   44.2     —
AFFECTED
  Product  Versions  Fixed
  GitLab   19.1 –    —
TIMELINE
  Sep 23  Reserved by CNA
  Oct 13  Published (CNA: GitLab)
CWE-1427 · CNA: GitLab · CVSS v3.1 · 2 references · NVD status: Undergoing Analysis
CVE-2026-109107MEDIUM
Wavlink WL-WN592AX6 upload.cgi main null pointer dereference
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0053   43.1     —
AFFECTED
  Product      Versions  Fixed
  WL-WN592AX6  250422 –  —
TIMELINE
  Oct 12  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-404, CWE-476 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-109758CRITICAL
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token a…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0053   43.0     —
AFFECTED
  Product                       Versions  Fixed
  Helix Authentication Service  2022.1 –  2026.1
TIMELINE
  Oct 13  Reserved by CNA
  Oct 13  Published (CNA: Perforce)
CWE-798, CWE-1321 · CNA: Perforce · CVSS v4.0 · 1 reference · NVD status: Received
CVE-2026-109114MEDIUM
AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0051   42.2     —
AFFECTED
  Product                       Versions                                    Fixed
  Restaurant-Management-System  7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c –  —
TIMELINE
  Oct 12  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-287 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-108969MEDIUM
itsmeravitejak Online-Examination-System Session session.php checkLogin comparison
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0050   41.2     —
AFFECTED
  Product                    Versions                                    Fixed
  Online-Examination-System  e6208e630b14657999bbfe4c9912302d2a1e2449 –  —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-697 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-108964MEDIUM
SourceCodester Performance Indicator System addproduct.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —
AFFECTED
  Product                       Versions  Fixed
  Performance Indicator System  1.0 –     —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-108966MEDIUM
SourceCodester Performance Indicator System product.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —
AFFECTED
  Product                       Versions  Fixed
  Performance Indicator System  1.0 –     —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-108967MEDIUM
SourceCodester Performance Indicator System edit_credit.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —
AFFECTED
  Product                       Versions  Fixed
  Performance Indicator System  1.0 –     —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-108968MEDIUM
SourceCodester Performance Indicator System sales_history.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —
AFFECTED
  Product                       Versions  Fixed
  Performance Indicator System  1.0 –     —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-108970MEDIUM
itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —
AFFECTED
  Product                    Versions                                    Fixed
  Online-Examination-System  e6208e630b14657999bbfe4c9912302d2a1e2449 –  —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-14308MEDIUM
Zohocorp ManageEngine Malware Protection Plus — Insufficient Signature Validation
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   P   L   H   N  C  N  N  H    4.9   .0041   33.2     —
AFFECTED
  Product                               Versions     Fixed
  ManageEngine Malware Protection Plus  unspecified  —
TIMELINE
  Jul 1   Reserved by CNA
  Oct 13  Published (CNA: Zohocorp)
CWE-20 · CNA: Zohocorp · CVSS v3.1 · 1 reference · NVD status: Received
CVE-2026-108961MEDIUM
PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   L   L    5.3   .0040   32.6     —
AFFECTED
  Product  Versions  Fixed
  PaddleX  3.7.0 –   —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-94 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2026-108962MEDIUM
storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   L   L    5.3   .0040   32.2     —
AFFECTED
  Product                   Versions                                    Fixed
  comfyui_segment_anything  ab6395596399d5048639cdab7e44ec9fae857a93 –  —
TIMELINE
  Oct 11  Reserved by CNA
  Oct 13  Published (CNA: VulDB)
CWE-74, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-89107CRITICAL
SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules) — Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0037   29.6     —
AFFECTED
  Product                                             Versions      Fixed
  SAP S/4HANA (Manage Substitution/Validation Rules)  S4CORE 105 –  —
TIMELINE
  Sep 10  Reserved by CNA
  Oct 13  Published (CNA: sap)
CWE-94 · CNA: sap · CVSS v3.1 · 2 references · NVD status: Received
CVE-2026-87689CRITICAL
Rapid7 Metasploit Framework — Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0037   28.7     —
AFFECTED
  Product               Versions     Fixed
  Metasploit Framework  unspecified  6.5.5
TIMELINE
  Sep 8   Reserved by CNA
  Oct 13  Published (CNA: rapid7)
CWE-306 · CNA: rapid7 · CVSS v3.1 · 2 references · NVD status: Received
CVE-2026-15399MEDIUM
wpmart Animated Number Counters — Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0036   27.4     —
AFFECTED
  Product                   Versions     Fixed
  Animated Number Counters  unspecified  —
TIMELINE
  Jul 10  Reserved by CNA
  Oct 13  Published (CNA: Wordfence)
CWE-89 · CNA: Wordfence · CVSS v3.1 · 11 references · NVD status: Deferred
CVE-2026-89113HIGH
SAP_SE SAP Commerce Cloud (OOTB Code) — SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0035   26.4     —
AFFECTED
  Product                         Versions                Fixed
  SAP Commerce Cloud (OOTB Code)  COM_CLOUD 2211-JDK21 –  —
TIMELINE
  Sep 10  Reserved by CNA
  Oct 13  Published (CNA: sap)
CWE-89 · CNA: sap · CVSS v3.1 · 2 references · NVD status: Received
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-582497.523.4SAP_SESAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)CWE-191Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Inte…
CVE-2026-1097865.322.5fail2banfail2banCWE-117In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filt…
CVE-2026-891109.922.3SAP_SESAP NetWeaver Visual ComposerCWE-749Broken Access Control in SAP NetWeaver Visual Composer
CVE-2026-1091165.521.3AdithyaYellojuRestaurant-Management-SystemCWE-285AdithyaYelloju Restaurant-Management-System Order Management mysqli_query aut…
CVE-2026-891089.121.1SAP_SESAP Manufacturing Integration and Intelligence (Configuration Service)CWE-862Missing Authorization check in SAP Manufacturing Integration and Intelligence…
CVE-2026-1089735.519.8SourceCodesterContact Tracing SystemCWE-284SourceCodester Contact Tracing System Users.php move_uploaded_file unrestrict…
CVE-2026-1089745.519.8SourceCodesterE-Learning SystemCWE-284SourceCodester E-Learning System Users.php save_users unrestricted upload
CVE-2026-1089755.519.8SourceCodesterLibrary Management SystemCWE-284SourceCodester Library Management System add_admin.php move_uploaded_file unr…
CVE-2026-928838.718.5GitLabGitLabCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scri…
CVE-2026-1089471.918.5yoshitomo-matsubaratorchdistillCWE-20yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization
CVE-2026-8911110.018.4SAP_SESAP CloudCWE-918OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CVE-2026-1089482.117.8code-projectsOnline Reviewer SystemCWE-913code-projects Online Reviewer System User Profile Update btn_functions.php dy…
CVE-2026-1089542.117.5k2-fsasherpa-onnxCWE-119k2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transduce…
CVE-2026-1089655.517.1SourceCodesterPerformance Indicator SystemCWE-74SourceCodester Performance Indicator System edit_quantity.php sql injection
CVE-2026-1089565.516.8code-projectsOnline Reviewer SystemCWE-74code-projects Online Reviewer System User Update btn_functions.php sql injection
CVE-2026-1091155.516.8AdithyaYellojuRestaurant-Management-SystemCWE-74AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql in…
CVE-2026-1089582.116.3n/aTensorLayerCWE-20TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
CVE-2026-1025627.214.8acybaAcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPressCWE-79AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'custo…
CVE-2026-148148.214.4GitLabGitLabCWE-625Permissive Regular Expression in GitLab
CVE-2026-1089572.114.3TinyLLaVATinyLLaVA_FactoryCWE-74TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_…
CVE-2026-1020077.214.1bitpressadminBit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email AutomationCWE-79Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via …
CVE-2026-891207.113.7SAP_SESAP ABAP PlatformCWE-1188Missing authorization check in SAP ABAP Platform
CVE-2026-890974.313.7spacetimeAd Inserter – Ad Manager & AdSense AdsCWE-200Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Dis…
CVE-2026-131388.613.5Divasoft Software and E-Commerce Inc.Biletiva Ticketing PlatformCWE-602Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
CVE-2026-1081797.613.5PluginUs.NetWOLFCWE-89WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability
CVE-2026-77675.813.2GitLabGitLabCWE-601URL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVE-2026-965355.113.2YouMindYouMind web applicationCWE-79Cross-Site Scripting in the YouMind web application
CVE-2026-818397.712.9GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-162755.312.9GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-842845.312.9GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-855295.312.9GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-1096877.612.3Link Whisper INCLink Whisper FreeCWE-89WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
CVE-2026-1089718.612.2D-LinkDCS-930LCWE-345D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_dec…
CVE-2026-163018.512.2GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-1035492.711.9GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-1091432.111.7calcomcal.comCWE-266calcom cal.com/cal.diy Credentials delete credentials.delete privileges manag…
CVE-2026-891185.310.9SAP_SESAP NetWeaver Enterprise PortalCWE-552Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal
CVE-2026-92682.710.4GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-891126.510.2SAP_SECLA-AssistantCWE-862Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure
CVE-2026-1084895.39.9PluginUs.NetActive Products Tables for WooCommerceCWE-201WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive …
CVE-2026-350018.49.7OpenS100 ProjectOpenS100CWE-122OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
CVE-2026-1089592.19.2itsourcecodeOnline Cake Ordering SystemCWE-74itsourcecode Online Cake Ordering System addtransacdetail.php sql injection
CVE-2026-1089425.19.0philz1337xclarity-upscalerCWE-79philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.p…
CVE-2026-1065975.38.6ThemeGrillUser RegistrationCWE-862WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerabi…
CVE-2026-1084965.38.6WP User ManagerWP User ManagerCWE-862WordPress WP User Manager plugin <= 2.9.23 - Broken Access Control vulnerability
CVE-2026-65674.38.3GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-145524.38.3GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-1054584.38.3GitLabGitLabCWE-807Reliance on Untrusted Inputs in a Security Decision in GitLab
CVE-2026-1046614.38.3GitLabGitLabCWE-266Incorrect Privilege Assignment in GitLab
CVE-2026-142104.38.0GitLabGitLabCWE-1220Insufficient Granularity of Access Control in GitLab
CVE-2026-1001043.57.8GitLabGitLabCWE-918Server-Side Request Forgery (SSRF) in GitLab
CVE-2026-1065985.37.7ThemeGrillUser RegistrationCWE-862WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnera…
CVE-2026-1097035.37.7WPGraphQLWPGraphQLCWE-862WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability
CVE-2026-1081745.37.4PluginUs.NetFOXCWE-862WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability
CVE-2026-1084925.37.4Fullworks PluginsQuick Paypal PaymentsCWE-862WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulne…
CVE-2026-1084935.37.4Karolína VyskočilováPay for Payment for WooCommerceCWE-862WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Con…
CVE-2026-1096845.37.4TMSAmeliaCWE-862WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
CVE-2026-826323.16.9GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-892696.86.9UnknownWP TestimonialsCWE-79WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
CVE-2026-891165.96.4SAP_SESAP yeoman-uiCWE-78OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code
CVE-2026-1096995.45.8ThemeGrillUser RegistrationCWE-862WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerabi…
CVE-2026-769756.15.7SAP_SESAPUI5 (Support Assistant Overlay)CWE-79Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)
CVE-2026-891176.15.7SAP_SESAP NetWeaver Enterprise PortalCWE-79Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
CVE-2026-891244.35.7SAP_SESAP HANA (Display Product Catalog Based on Customs Declaration)CWE-863Missing Authorization Check in SAP Global Trade Services, edition for SAP HAN…
CVE-2026-1091061.95.3PolarisOffice AppCWE-22Polaris Office App Document Intake com.infraware.service.m.n.a path traversal
CVE-2026-1011686.25.2GitLabGitLabCWE-532Insertion of Sensitive Information into Log File in GitLab
CVE-2026-892715.34.8UnknownWP-BusinessDirectoryCWE-434WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uplo…
CVE-2026-59544.24.8GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-783354.24.8GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-769726.54.7SAP_SESAP Manufacturing Integration and IntelligenceCWE-79Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and…
CVE-2026-582423.54.4SAP_SESAP Cloud ConnectorCWE-191Improper Authorization check in SAP Cloud Connector
CVE-2026-1034188.84.1MozillaFirefox for iOSCWE-79Universal XSS via the HTML language attribute in Translation Services
CVE-2026-671655.43.8HCLSoftwareConnectionsCWE-79HCL Connections is vulnerable to cross-site scripting (XSS)
CVE-2026-1089601.93.9Tiiny-AIPowerInferCWE-119Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_g…
CVE-2026-891226.13.5SAP_SESAP NetWeaver Enterprise PortalCWE-601Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal
CVE-2026-1096965.43.2WP ManageNinja LLCFluentBoardsCWE-862WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability
CVE-2026-891054.23.2SAP_SESAP/cloud-security-services-integration-libraryCWE-1188Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-ser…
CVE-2026-1089431.92.9ModelTCLightX2VCWE-74ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained co…
CVE-2026-8930910.02.9JTL SW GmbHJTL-WMSCWE-306Missing Authentication Vulnerability in JTL-WMS
CVE-2026-1058816.52.8ThemeGrillUser RegistrationCWE-79WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vuln…
CVE-2026-1084886.52.8IdeaBox CreationsPowerPack Addons for ElementorCWE-79WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripti…
CVE-2026-1084906.52.8LeapWorxPremium Addons for ElementorCWE-79WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Script…
CVE-2026-1084956.52.8Brainstorm ForceSureFormsCWE-79WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1096916.52.8BdThemesPrime Slider – Addons For ElementorCWE-79WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Sc…
CVE-2026-1096976.52.8Brainstorm ForceSureCartCWE-79WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
CVE-2026-769765.42.8SAP_SESAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)CWE-79Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server …
CVE-2026-1089454.82.8iMoonLabyolov13CWE-74iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection
CVE-2026-548686.52.5FolioVisionFV Simpler SEOCWE-79WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnera…
CVE-2026-548696.52.5IDX BrokerIMPress for IDX BrokerCWE-79WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS)…
CVE-2026-1034175.52.5MozillaFirefox for iOSCWE-346Saved credentials can be autofilled after cross-origin navigation
CVE-2026-925284.22.4GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-548676.52.3GridenResponsive SliderCWE-79WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vuln…
CVE-2026-548706.52.3wpweaverWeaver Xtreme Theme SupportCWE-79WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting …
CVE-2026-1084876.52.3Hossni MubarakBooks GalleryCWE-79WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerab…
CVE-2026-891064.42.1SAP_SESAPUI5CWE-183Cross Site Scripting (XSS) vulnerability in SAPUI5
CVE-2026-1089442.41.9repositoryRAECWE-74repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_…
CVE-2026-1033167.11.3LogiusDigiD for macOS—The macOS version of the DigiD app is not signed with Hardened Runtime
CVE-2026-1089551.91.3Tiiny-AIPowerInferCWE-119Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
CVE-2026-1010208.51.0Hammock CorporationAssetViewCWE-732An incorrect permission assignment for critical resource issue exists in Asse…
CVE-2026-1030765.40.9ThemeGrillUser RegistrationCWE-352WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSR…
CVE-2026-891214.70.5SAP_SESAP S/4HANA (Linear Asset Management RAP Business Object)CWE-862Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Busin…
CVE-2026-1007554.60.3GitLabGitLabCWE-349Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
CVE-2024-3432310.0—n/an/aCWE-639ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Dir…
CVE-2026-4838210.0—AdobeAdobe Experience Manager as a Cloud ServiceCWE-863Adobe Experience Manager | Incorrect Authorization (CWE-863)
CVE-2026-4838310.0—AdobeAdobe Experience Manager as a Cloud ServiceCWE-863Adobe Experience Manager | Incorrect Authorization (CWE-863)
CVE-2026-5567510.0—saltyorgdocsCWE-94Salty documentation workflow executes fork-controlled Python build hooks with…
CVE-2026-6516210.0—NVIDIAAIStore frameworkCWE-250NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernete…
CVE-2026-9053210.0—AdobeAdobe Experience Manager as a Cloud ServiceCWE-863Adobe Experience Manager | Incorrect Authorization (CWE-863)
CVE-2026-9460310.0—podman-container-toolspodmanCWE-693Podman: The `podman run` command can be instructed to disable almost all sand…
CVE-2026-10384910.0—AdobeAdobe CommerceCWE-1336Adobe Commerce | Improper Neutralization of Special Elements Used in a Templa…
CVE-2026-10589910.0—AdobeColdFusion 2025CWE-434ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
CVE-2026-10662210.0—AdobeColdFusion 2025CWE-918ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-10662410.0—AdobeColdFusion 2025CWE-94ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CVE-2026-11013010.0—FinsysdockhandCWE-288Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
CVE-2026-757329.9—AdobeAdobe Experience Manager 6.5 LTSCWE-863Adobe Experience Manager | Incorrect Authorization (CWE-863)
CVE-2026-774599.9—argoprojargo-cdCWE-863Argo CD: AppProject destination-namespace and resource restrictions bypassed …
CVE-2026-973819.9—LegacyUpdateLegacyUpdateCWE-346Legacy Update ActiveX control accepts unauthorized hosting origins
CVE-2026-1038489.9—AdobeAdobe Experience Manager 6.5 LTSCWE-78Adobe Experience Manager | Improper Neutralization of Special Elements used i…
CVE-2026-1058959.9—AdobeAdobe Experience Manager 6.5CWE-20Adobe Experience Manager | Improper Input Validation (CWE-20)
CVE-2026-1059039.9—AdobeColdFusion 2025CWE-94ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CVE-2026-1060429.9—IvantiXtractionCWE-73An External Control of File Name or Path vulnerability in Ivanti Xtraction be…
CVE-2026-1066129.9—AdobeColdFusion 2025CWE-863ColdFusion | Incorrect Authorization (CWE-863)
CVE-2026-1094129.9—IvantiNeurons Patch for IntuneCWE-749An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a rem…
CVE-2026-537099.8—IBMmcp-context-forgeCWE-287MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .en…
CVE-2026-692279.8—EsriPortal for ArcGISCWE-306BUG-000187331 Portal for ArcGIS has a security vulnerability
CVE-2026-696349.8—MicrosoftWindows 10 Version 1607CWE-122Windows iSCSI Remote Code Execution Vulnerability
CVE-2026-696399.8—MicrosoftWindows 10 Version 1809CWE-122Windows libarchive Remote Code Execution Vulnerability
CVE-2026-697059.8—MicrosoftWindows 10 Version 1607CWE-787Windows iSCSI Remote Code Execution Vulnerability
CVE-2026-698839.8—MicrosoftWindows 10 Version 1607CWE-416Windows iSCSI Remote Code Execution Vulnerability
CVE-2026-698869.8—MicrosoftWindows 10 Version 1607CWE-122Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-700249.8—MicrosoftWindows 10 Version 1607CWE-20Windows Internet Information Services Remote Code Execution Vulnerability
CVE-2026-700969.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Windows Rich Text Edit Control Remote Code Execution Vulnerability
CVE-2026-701479.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
CVE-2026-701539.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
CVE-2026-701579.8—MicrosoftWindows 10 Version 1607CWE-122Windows System Information Console Remote Code Execution Vulnerability
CVE-2026-702429.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-702919.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-703009.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-822Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-835179.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-835199.8—MicrosoftWindows 10 Version 1607CWE-122Windows Error Reporting Remote Code Execution Vulnerability
CVE-2026-835789.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft PowerShell Remote Code Execution Vulnerability
CVE-2026-836939.8—MicrosoftWindows 10 Version 1607CWE-122Windows Error Reporting Remote Code Execution Vulnerability
CVE-2026-837489.8—MicrosoftWindows 10 Version 1607CWE-122Windows Error Reporting Remote Code Execution Vulnerability
CVE-2026-837709.8—MicrosoftWindows 10 Version 1607CWE-122Windows Text Shaping Remote Code Execution Vulnerability
CVE-2026-837809.8—MicrosoftWindows 10 Version 1607CWE-416Windows CCFFilter Driver Remote Code Execution Vulnerability
CVE-2026-837829.8—MicrosoftWindows 10 Version 1607CWE-122Windows Shell Remote Code Execution Vulnerability
CVE-2026-838629.8—MicrosoftWindows 10 Version 1607CWE-416Windows Network Load Balancing Remote Code Execution Vulnerability
CVE-2026-838699.8—MicrosoftWindows 10 Version 1607CWE-191Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-839109.8—MicrosoftWindows 10 Version 1607CWE-787RPC Runtime Library Remote Code Execution Vulnerability
CVE-2026-839359.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft XML Remote Code Execution Vulnerability
CVE-2026-840159.8—MicrosoftWindows 10 Version 1607CWE-122Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vul…
CVE-2026-857929.8—MicrosoftWindows 10 Version 1607CWE-416Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-858069.8—MicrosoftWindows 10 Version 1607CWE-121Network Policy Server (NPS) Remote Code Execution Vulnerability
CVE-2026-858099.8—MicrosoftWindows 10 Version 1607CWE-122Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-858149.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-859289.8—MicrosoftWindows 10 Version 1607CWE-122Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
CVE-2026-881029.8—MicrosoftWindows Server 2019CWE-416Microsoft Failover Cluster Remote Code Execution Vulnerability
CVE-2026-881569.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-121Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-881789.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-929099.8—AdobeAdobe CommerceCWE-863Adobe Commerce | Incorrect Authorization (CWE-863)
CVE-2026-960969.8—MicrosoftWindows 10 Version 1607CWE-122Windows Media Player Remote Code Execution Vulnerability
CVE-2026-961139.8—MicrosoftWindows 10 Version 1607CWE-122Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-962199.8—MicrosoftWindows 10 Version 1809CWE-787Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execut…
CVE-2026-963209.8—MicrosoftWindows 10 Version 1607CWE-122Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-968649.8—MicrosoftWindows 10 Version 1607CWE-415Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability
CVE-2026-969099.8—MicrosoftWindows 11 version 23H2CWE-122Windows BitLocker Remote Code Execution Vulnerability
CVE-2026-969249.8—MicrosoftWindows 10 Version 1607CWE-822Windows OLE Remote Code Execution Vulnerability
CVE-2026-969349.8—MicrosoftWindows 10 Version 1607CWE-416Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-970169.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-977499.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-415Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-978059.8—MicrosoftWindows 10 Version 1607CWE-20Windows Partition Management Driver Remote Code Execution Vulnerability
CVE-2026-978149.8—MicrosoftWindows 10 Version 1607CWE-122Windows Text Shaping Remote Code Execution Vulnerability
CVE-2026-978159.8—MicrosoftWindows 10 Version 1607CWE-122Windows Error Reporting Remote Code Execution Vulnerability
CVE-2026-978169.8—MicrosoftWindows 10 Version 1809CWE-416Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2026-1002029.8—MicrosoftWindows 10 Version 1607CWE-416Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
CVE-2026-1002199.8—MicrosoftWindows 11 version 23H2CWE-416Microsoft QUIC Remote Code Execution Vulnerability
CVE-2026-1002229.8—MicrosoftWindows 10 Version 1607CWE-122Network Policy Server (NPS) Remote Code Execution Vulnerability
CVE-2026-1022109.8—MicrosoftWindows 10 Version 1809CWE-122Windows Text Shaping Remote Code Execution Vulnerability
CVE-2026-1042529.8—vitessiovitessCWE-79Vitess vttablet /twopcz reflected XSS
CVE-2026-1050109.8—MicrosoftWindows 10 Version 1607CWE-416Microsoft Windows Search Component Elevation of Privilege Vulnerability
CVE-2026-1050169.8—Microsoft.NET 10.0CWE-122Microsoft QUIC Remote Code Execution Vulnerability
CVE-2026-1061739.8—FortinetFortiSIEMCWE-22A improper limitation of a pathname to a restricted directory ('path traversa…
CVE-2026-551839.6—Zarestia-Devrclone-managerCWE-306RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malic…
CVE-2026-759949.6—AdobeColdFusion 2025CWE-863ColdFusion | Incorrect Authorization (CWE-863)
CVE-2026-905319.6—AdobeAdobe Experience Manager as a Cloud ServiceCWE-611Adobe Experience Manager | Improper Restriction of XML External Entity Refere…
CVE-2026-1022389.6—MicrosoftVisual Studio CodeCWE-22Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-1041929.6—dragonflydbdragonflyCWE-415DragonflyDB stream RDB deserialization double-free
CVE-2026-1066209.6—AdobeColdFusion 2025CWE-863ColdFusion | Incorrect Authorization (CWE-863)
CVE-2026-1097059.6—MozillaFirefoxCWE-416Sandbox escape, site isolation issue due to incorrect boundary conditions, us…
CVE-2026-1097079.6—MozillaFirefoxCWE-416Sandbox escape due to use-after-free in the Networking component
CVE-2026-633509.4—SiemensSIMATIC Drive Controller CPU 1504D TFCWE-95Affected devices do not properly restrict executable content contained in imp…
CVE-2026-633539.4—SiemensSIMATIC Drive Controller CPU 1504D TFCWE-79Affected devices do not properly sanitize comment fields contained in importe…
CVE-2026-633549.4—SiemensSIMATIC Drive Controller CPU 1504D TFCWE-79Affected devices do not properly validate and sanitize visual marker data con…
CVE-2026-740409.4—Wazuhwazuh-managerCWE-862Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from…
CVE-2026-740419.4—Wazuhwazuh-managerCWE-178Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
CVE-2026-880929.4—MicrosoftASP.NET Core 10.0CWE-444ASP.NET Core Tampering Vulnerability
CVE-2026-1054459.4—DockerDocker HubCWE-266Docker Hub account conversion could reassign an active personal access token …
CVE-2026-499509.3—xorbitsaixoscarCWE-502Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
CVE-2026-631469.3—OmnispaceAgora ProjectCWE-94Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php
CVE-2026-702799.3—MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 23CWE-79Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-751209.3—OpenTextEndpoint InvestigatorCWE-290Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase …
CVE-2026-770999.3—CommvaultCommvault CloudCWE-78CVFS Command Execution
CVE-2026-836629.3—AdobeAdobe Experience Manager as a Cloud ServiceCWE-79Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
CVE-2026-905309.3—AdobeColdFusion 2025CWE-22ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Pa…
CVE-2026-910139.3—AdobeAdobe CommerceCWE-79Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-1001339.3—AdobeAdobe CommerceCWE-79Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-1029899.3—TanStackrouterCWE-79TanStack Router: Unauthenticated reflected XSS in TanStack Start server-funct…
CVE-2026-1039289.3—metabasemetabaseCWE-73Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
CVE-2026-1066299.3—AdobeAdobe Experience Manager 6.5 LTSCWE-79Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-1066309.3—AdobeAdobe Experience Manager 6.5 LTSCWE-79Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-1095209.3—ColorfuliGameCenterCWE-266Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege…
CVE-2026-1101129.2—FinsysdockhandCWE-863Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Vali…
CVE-2026-523949.1—n/an/aCWE-201DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.
CVE-2026-544549.1—opencatsOpenCATSCWE-434OpenCATS: Authenticated RCE in the Import module
CVE-2026-556959.1—fearlessgeekmediaFearlessCMSCWE-94FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in S…
CVE-2026-631499.1—OmnispaceAgora ProjectCWE-330Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()
CVE-2026-631589.1—OmnispaceAgora ProjectCWE-836Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Coo…
CVE-2026-631599.1—OmnispaceAgora ProjectCWE-640Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Ta…
CVE-2026-631609.1—OmnispaceAgora ProjectCWE-522Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage
CVE-2026-651739.1—NVIDIAAIStore frameworkCWE-306NVIDIA AIStore for Linux contains a missing authentication vulnerability in t…
CVE-2026-701889.1—MicrosoftASP.NET Core 10.0CWE-444ASP.NET Core Security Feature Bypass Vulnerability
CVE-2026-924649.1—AdobeAdobe CommerceCWE-20Adobe Commerce | Improper Input Validation (CWE-20)
CVE-2026-938959.1—IBMWebSphere Application Server - LibertyCWE-284IBM WebSphere Application Server Liberty Improper Access Control
CVE-2026-939099.1—IBMWebSphere Application Server - LibertyCWE-384IBM WebSphere Application Server Liberty is affected by an authentication bypass
CVE-2026-962529.1—MicrosoftWindows 10 Version 1607CWE-347Active Directory Federation Services (AD FS) Spoofing Vulnerability
CVE-2026-1066219.1—AdobeColdFusion 2025CWE-94ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CVE-2026-1066269.1—AdobeAdobe Experience Manager as a Cloud ServiceCWE-20Adobe Experience Manager | Improper Input Validation (CWE-20)
CVE-2026-555629.0—jhuckabyCronicleCWE-79Cronicle: Stored XSS in admin Activity Log via account full_name field
CVE-2026-858189.0—MicrosoftWindows 11 version 23H2CWE-347Windows Schannel Spoofing Vulnerability
CVE-2026-928929.0—jfrogjfrog-cliCWE-88Potential command execution on the host running JFrog CLI.
CVE-2026-1050089.0—MicrosoftWindows 10 Version 1607CWE-290Windows Schannel Spoofing Vulnerability
CVE-2026-1066199.0—AdobeColdFusion 2025CWE-20ColdFusion | Improper Input Validation (CWE-20)
CVE-2026-444158.9—SiemensIndustrial Edge Device Kit - arm64 V1.10CWE-35Affected systems do not properly restrict access to internal APIs and paths f…
CVE-2025-467738.8—FortinetFortiAnalyzer CloudCWE-89An Improper Neutralization of Special Elements used in an SQL Command ('SQL I…
CVE-2025-577398.8—FortinetFortiMailCWE-89An improper neutralization of special elements used in an SQL Command ("SQL I…
CVE-2026-126558.8—Rockwell Automation1732E ArmorBlock® I/OCWE-2941732E ArmorBlock® - Multiple Vulnerabilities
CVE-2026-553768.8—heymrunheymCWE-78heym Python Tool Sandbox Escape
CVE-2026-656748.8—MicrosoftMicrosoft SQL Server 2019 (GDR)CWE-502Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-693268.8—MicrosoftWindows 10 Version 1607CWE-122Graphic Fonts Remote Code Execution Vulnerability
CVE-2026-693708.8—MicrosoftVisual Studio CodeCWE-77Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-695218.8—MicrosoftWindows 10 Version 1607CWE-190Windows iSCSI Remote Code Execution Vulnerability
CVE-2026-697658.8—MicrosoftWindows Server 2025CWE-416Windows Storport Miniport Driver Remote Code Execution Vulnerability
CVE-2026-699188.8—MicrosoftWindows 10 Version 1607CWE-122Windows Core Messaging Elevation of Privilege Vulnerability
CVE-2026-699438.8—MicrosoftMicrosoft SharePoint Enterprise Server 2016CWE-22Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-699458.8—MicrosoftWindows 10 Version 21H2CWE-862Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
CVE-2026-699858.8—MicrosoftWindows 10 Version 1809CWE-122Windows libarchive Remote Code Execution Vulnerability
CVE-2026-700078.8—Microsoft.NET 10.0CWE-787.NET Framework Remote Code Execution Vulnerability
CVE-2026-700358.8—Microsoft.NET 10.0CWE-502.NET Framework Remote Code Execution Vulnerability
CVE-2026-700688.8—MicrosoftWindows 10 Version 1607CWE-122Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
CVE-2026-700698.8—MicrosoftWindows 10 Version 1607CWE-121Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-700898.8—MicrosoftWindows 10 Version 1607CWE-122Windows GDI Remote Code Execution Vulnerability
CVE-2026-700988.8—MicrosoftVisual Studio CodeCWE-862Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-701498.8—MicrosoftWindows 10 Version 1607CWE-122Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerabi…
CVE-2026-701588.8—MicrosoftWindows 10 Version 1607CWE-415Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-701678.8—MicrosoftWindows Server 2022CWE-822Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-701748.8—Microsoft.NET 10.0CWE-358.NET Remote Code Execution Vulnerability
CVE-2026-701858.8—MicrosoftWindows 10 Version 1607CWE-639Microsoft PowerShell Security Feature Bypass Vulnerability
CVE-2026-702108.8—MicrosoftWindows 10 Version 1607CWE-122Windows OLE DB Elevation of Privilege Vulnerability
CVE-2026-702158.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-702468.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-863Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-702508.8—MicrosoftWindows Server 2012CWE-362Windows DHCP Client Remote Code Execution Vulnerability
CVE-2026-702548.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-125Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-702568.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-702578.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-702588.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-702628.8—MicrosoftWindows 10 Version 1607CWE-122WebDAV Elevation of Privilege Vulnerability
CVE-2026-702668.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-89Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-702688.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-702758.8—MicrosoftWindows 10 Version 1607CWE-822Windows CD-ROM File System Driver Remote Code Execution Vulnerability
CVE-2026-702828.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-702878.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-702978.8—MicrosoftSkype for Business Server 2015 CU13CWE-36Skype for Business Remote Code Execution Vulnerability
CVE-2026-702998.8—MicrosoftWindows 11 version 23H2CWE-863Windows Bind Filter Driver Elevation of Privilege Vulnerability
CVE-2026-703018.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-703028.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-703438.8—MicrosoftMPEG-2 Video ExtensionCWE-122Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability
CVE-2026-705808.8—MicrosoftWindows 10 Version 1809CWE-306Windows Credential Guard Spoofing Vulnerability
CVE-2026-774968.8—MicrosoftWindows 10 Version 1607CWE-122Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-779028.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-779108.8—MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 23CWE-863Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-835208.8—Microsoft.NET 10.0CWE-502.NET Remote Code Execution Vulnerability
CVE-2026-835238.8—MicrosoftWindows 11 Version 24H2CWE-122Windows Image Acquisition Remote Code Execution Vulnerability
CVE-2026-836428.8—MicrosoftWindows 10 Version 1607CWE-843Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-836438.8—MicrosoftWindows 10 Version 1607CWE-121Windows Error Reporting Remote Code Execution Vulnerability
CVE-2026-836888.8—MicrosoftWindows 10 Version 1607CWE-122Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-837168.8—MicrosoftWindows 10 Version 1607CWE-122Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-837258.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft Windows Search Component Remote Code Execution Vulnerability
CVE-2026-837288.8—MicrosoftWindows 10 Version 1607CWE-1286Windows Hyper-V Spoofing Vulnerability
CVE-2026-837598.8—MicrosoftWindows 10 Version 1607CWE-94Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
CVE-2026-837718.8—MicrosoftWindows 11 version 23H2CWE-416Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability
CVE-2026-837778.8—MicrosoftWindows 10 Version 1607CWE-122Windows Bluetooth Service Elevation of Privilege Vulnerability
CVE-2026-837788.8—MicrosoftWindows 10 Version 1607CWE-122Microsoft Internet Messaging API Remote Code Execution Vulnerability
CVE-2026-837848.8—MicrosoftWindows 10 Version 1607CWE-36Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
CVE-2026-837898.8—MicrosoftWindows 10 Version 1607CWE-122Windows SMB Client Elevation of Privilege Vulnerability
CVE-2026-837978.8—MicrosoftWindows 10 Version 1809CWE-125Windows Partition Management Driver Remote Code Execution Vulnerability
CVE-2026-838518.8—MicrosoftWindows 10 Version 1809CWE-122Windows Partition Management Driver Elevation of Privilege Vulnerability
CVE-2026-838748.8—MicrosoftWindows 10 Version 1607CWE-122Windows Event Tracing Remote Code Execution Vulnerability
CVE-2026-838898.8—MicrosoftWindows 10 Version 1607CWE-763Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-838918.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-20Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-839238.8—MicrosoftWindows 10 Version 1809CWE-23Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2026-839288.8—MicrosoftWindows 10 Version 1607CWE-306Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execut…
CVE-2026-839298.8—MicrosoftWindows 10 Version 1607CWE-787Windows GDI Remote Code Execution Vulnerability
CVE-2026-839348.8—MicrosoftWindows 10 Version 1607CWE-121Windows GDI+ Remote Code Execution Vulnerability
CVE-2026-853398.8—MicrosoftWindows 10 Version 1607CWE-122Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-853638.8—Microsoft.NET 10.0CWE-190.NET Framework Elevation of Privilege Vulnerability
CVE-2026-858178.8—MicrosoftWindows 10 Version 1607CWE-807Microsoft PowerShell Remote Code Execution Vulnerability
CVE-2026-859008.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-502Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-859038.8—MicrosoftWindows 10 Version 1607CWE-822Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-859058.8—MicrosoftWindows 10 Version 1607CWE-122Windows UI Immersive Server API Elevation of Privilege Vulnerability
CVE-2026-859318.8—MicrosoftWindows 10 Version 1607CWE-122Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2026-859368.8—MicrosoftWindows 10 Version 1607CWE-122Windows Shell Remote Code Execution Vulnerability
CVE-2026-859908.8—LeantimeleantimeCWE-269Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized …
CVE-2026-876978.8—Microsoft.NET 10.0CWE-502.NET Remote Code Execution Vulnerability
CVE-2026-880738.8—MicrosoftWindows 10 Version 21H2CWE-416Windows Graphics Kernel Elevation of Privilege Vulnerability
CVE-2026-880758.8—MicrosoftMicrosoft Configuration ManagerCWE-89Configuration Manager Elevation of Privilege Vulnerability
CVE-2026-881128.8—MicrosoftWindows 10 Version 1607CWE-822Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-881148.8—MicrosoftWindows 10 Version 1607CWE-822Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-881158.8—MicrosoftWindows 10 Version 1607CWE-125Windows Server for NFS Remote Code Execution Vulnerability
CVE-2026-881168.8—MicrosoftWindows 10 Version 1607CWE-822Windows Domain Name Service Remote Code Execution Vulnerability
CVE-2026-881368.8—MicrosoftWindows 10 Version 1607CWE-41Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulne…
CVE-2026-881428.8—MicrosoftWindows 10 Version 1607CWE-122Windows Background Intelligent Transfer Service (BITS) Remote Code Execution …
CVE-2026-881448.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-881458.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-881508.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-908Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-881558.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-122Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-881578.8—MicrosoftWindows 10 Version 1809CWE-122Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
CVE-2026-881598.8—MicrosoftWindows 10 Version 1607CWE-125Windows Background Intelligent Transfer Service (BITS) Remote Code Execution …
CVE-2026-881638.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-122Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-881658.8—MicrosoftWindows 10 Version 1607CWE-787Windows Active Directory Domain Services Remote Code Execution Vulnerability
CVE-2026-881668.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-121Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-881868.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-881968.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Remote Code Execution Vulnerability
CVE-2026-881978.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Remote Code Execution Vulnerability
CVE-2026-881988.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-862Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-882008.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-270Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-882028.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-882198.8—MicrosoftWindows 10 Version 1607CWE-822RPC Runtime Library Remote Code Execution Vulnerability
CVE-2026-945128.8—MicrosoftMicrosoft SQL Server 2017 (GDR)CWE-122SQL Server Remote Code Execution Vulnerability
CVE-2026-960448.8—MicrosoftMicrosoft SharePoint Server Subscription EditionCWE-269Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-962028.8—MicrosoftRaw Image ExtensionCWE-122Windows Raw Image Extension Remote Code Execution Vulnerability
CVE-2026-962248.8—Microsoft.NET 10.0CWE-787.NET Remote Code Execution Vulnerability
CVE-2026-962308.8—MicrosoftMicrosoft Visual Studio 2022 version 17.14CWE-79ASP.NET Core Remote Code Execution Vulnerability
CVE-2026-962358.8—Microsoft.NET 10.0CWE-787.NET Remote Code Execution Vulnerability
CVE-2026-962518.8—MicrosoftPowerShell 7.4CWE-807Microsoft PowerShell Remote Code Execution Vulnerability
CVE-2026-969138.8—MicrosoftWindows 10 Version 1809CWE-122Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-969148.8—MicrosoftWindows 10 Version 1607CWE-122Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vu…
CVE-2026-969178.8—MicrosoftWindows 10 Version 1809CWE-122Windows PCI Bus Driver Elevation of Privilege Vulnerability
CVE-2026-969438.8—MicrosoftRaw Image ExtensionCWE-122Windows Raw Image Extension Remote Code Execution Vulnerability
CVE-2026-969528.8—MicrosoftWindows 10 Version 1809CWE-122Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-969578.8—Microsoft.NET 10.0CWE-347.NET Security Feature Bypass Vulnerability
CVE-2026-970038.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-970048.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-970078.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-970088.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-124Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-970108.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-970118.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-763Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-970128.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-121Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-970178.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977388.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977398.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977418.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977428.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-121Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977458.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977468.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-191Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977478.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977488.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977508.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-121Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977518.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977528.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977538.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977548.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977558.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-125Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977568.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977578.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-977588.8—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-122Microsoft Office Excel Remote Code Execution Vulnerability

Results continue: ranks 401–2291.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-10-13 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.