Security Box Score — May 20, 2026

202 CVEs published, led by Google (16).

202 CVEs published May 20, 2026: 29 critical, 72 high, 98 medium, 3 low; 2 in the KEV catalog at press time; 1 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 177 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	742	1954	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

31 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	217	543	66	440	37	0	11	2	0.4	7.8	.0014	+165 ▲
microsoft	148	518	40	365	111	2	286	19	3.7	7.8	.0046	-24 ▼
red hat	10	62	5	26	24	7	2	0	0.0	6.8	.0041	-6 ▼
apple	15	45	1	15	28	1	88	7	15.6	6.2	.0028	+15 ▲
google	16	23	0	17	6	0	77	4	17.4	8.8	.0034	+15 ▲
suse	2	2	0	2	0	0	0	0	0.0	8.2	.0020	+2 ▲
ubuntu	0	1	0	0	0	1	1	0	0.0	2.7	.0218	0
debian	0	0	0	0	0	0	1	0	—	—	—	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	5	12	5	3	4	56	8	66.7	7.8	.1576	+5 ▲
fortinet	1	7	4	3	0	28	3	42.9	9.1	.8584	-2 ▼
ivanti	1	4	2	2	0	25	4	100.0	9.2	.8104	+1 ▲
palo alto networks	2	2	1	1	0	13	1	50.0	8.6	.6281	+2 ▲
f5	1	1	1	0	0	4	1	100.0	9.2	.6805	+1 ▲
ubiquiti	0	1	0	1	0	3	0	0.0	8.8	.0036	0
vmware	0	1	0	1	0	7	1	100.0	8.1	.1742	0
check point	0	0	0	0	0	1	0	—	—	—	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	4	17	2	10	5	33	1	5.9	7.5	.0093	+1 ▲
mozilla	5	5	3	2	0	9	0	0.0	9.6	.0045	+5 ▲
drupal	0	0	0	0	0	4	0	—	—	—	0
gitlab	0	0	0	0	0	4	2	—	—	—	0
wordpress	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
progress	4	4	0	4	6	0	0.0	7.5	.0036	+4 ▲
oracle	0	3	1	2	27	0	0.0	7.5	.0088	0
solarwinds	0	3	2	1	10	3	100.0	9.8	.8362	0
adobe	0	2	0	2	19	2	100.0	8.6	.0368	-2 ▼
atlassian	0	0	0	0	13	0	—	—	—	0
ibm	0	0	0	0	6	0	—	—	—	0
sap	0	0	0	0	6	0	—	—	—	0
servicenow	0	0	0	0	2	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	H	KEV	KEV/100	Med CVSS	Med EPSS	Δ
siemens	1	1	1	0	0.0	8.7	.0032	+1 ▲
d-link	0	0	0	3	—	—	—	0
tp-link	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
grafana	10	27	2	7	16	2	2	6.5	.0033	+7 ▲
nvidia	16	16	7	9	0	0	0	8.4	.0060	+16 ▲
givanz	11	15	2	7	6	0	0	8.3	.0028	+7 ▲
python software foundation	2	14	1	3	9	1	0	6.0	.0042	-2 ▼
nlnet labs	11	11	1	2	8	0	0	6.9	.0058	+11 ▲
patriksimek	11	11	8	3	0	0	0	9.8	.0081	+11 ▲
watchguard	5	11	0	9	2	0	2	7.1	.0025	+4 ▲
openises	10	10	0	0	10	0	0	5.1	.0022	+10 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-31431	.9991	100.0	7.8
CVE-2026-41940	.9853	99.9	9.3
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-42208	.8942	99.8	9.3
CVE-2024-1708	.8756	99.7	8.4
CVE-2026-42271	.8354	99.7	8.7
CVE-2026-41089	.7962	99.6	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-43997	10.0	.0098
CVE-2026-33819	10.0	.0084
CVE-2026-42826	10.0	.0084
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083
CVE-2026-44006	10.0	.0081
CVE-2026-35431	10.0	.0051
CVE-2026-42822	10.0	.0049
CVE-2026-45444	10.0	.0028

Most disclosures (vendor)
Vendor	CVEs
linux	330
microsoft	160
red hat	17
google	16
nvidia	16
apple	15
givanz	11
grafana	11
nlnet labs	11
patriksimek	11

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	8
apple	7
google	4
ivanti	4
fortinet	3
smartertools	3
solarwinds	3
adobe	2
berriai	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	1

Fastest to KEV
CVE	Vendor	Days
CVE-2024-1708	ConnectWise	0
CVE-2024-57726	n/a	0
CVE-2024-57728	n/a	0
CVE-2026-31431	Linux	0
CVE-2026-32202	Microsoft	0
CVE-2026-33825	Microsoft	0
CVE-2026-41091	Microsoft	0
CVE-2026-41940	WebPros	0
CVE-2026-42208	BerriAI	0
CVE-2026-42897	Microsoft	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1645
CVE-2021-27102	n/a	2021-11-17	1645
CVE-2021-27101	n/a	2021-11-17	1645
CVE-2021-27103	n/a	2021-11-17	1645
CVE-2021-21017	Adobe	2021-11-17	1645
CVE-2021-28550	Adobe	2021-11-17	1645
CVE-2021-42013	Apache Software Foundation	2021-11-17	1645
CVE-2021-41773	Apache Software Foundation	2021-11-17	1645
CVE-2021-30858	Apple	2021-11-17	1645
CVE-2021-30860	Apple	2021-11-17	1645

Transactions

EXPLOIT PUBLISHED — CVE-2026-40102 (makeplane plane). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

202 CVEs published. 25 box scores, 177 table rows — nothing truncated.

CVE-2026-45498HIGH

Microsoft Defender Denial of Service Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .6308   99.1   YES

AFFECTED
  Product                                  Versions   Fixed
  Microsoft Defender Antimalware Platform  4.0.0.0 –  —

TIMELINE
  May 12  Reserved by CNA
  May 20  Added to CISA KEV, due Jun 3
  May 20  Published (CNA: microsoft)

CWE-400 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due June 3, 2026

CVE-2026-41091HIGH

Microsoft Defender Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0820   94.4   YES

AFFECTED
  Product                              Versions   Fixed
  Microsoft Malware Protection Engine  1.1.0.0 –  —

TIMELINE
  Apr 16  Reserved by CNA
  May 20  Added to CISA KEV, due Jun 3
  May 20  Published (CNA: microsoft)

CWE-59 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due June 3, 2026

CVE-2026-23734CRITICAL

XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .1956   97.2     —

AFFECTED
  Product        Versions                          Fixed
  xwiki-commons  >= 4.2-milestone-2, < 16.10.17 –  —

TIMELINE
  Jan 15  Reserved by CNA
  May 20  Published (CNA: GitHub_M)

CWE-23 · CNA: GitHub_M · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-24208HIGH

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issu…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0518   91.8     —

AFFECTED
  Product                  Versions     Fixed
  Triton Inference Server  unspecified  —

TIMELINE
  Jan 21  Reserved by CNA
  May 20  Published (CNA: nvidia)

CWE-22 · CNA: nvidia · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-8632HIGH

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    8.5   .0411   90.0     —

AFFECTED
  Product                                 Versions     Fixed
  HP Linux Imaging and Printing Software  unspecified  —

TIMELINE
  May 14  Reserved by CNA
  May 20  Published (CNA: hp)

CWE-77, CWE-78 · CNA: hp · CVSS v4.0 · 14 references · NVD status: Modified

CVE-2026-24207CRITICAL

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication byp…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0255   83.8     —

AFFECTED
  Product                  Versions                        Fixed
  Triton Inference Server  All versions prior to r26.03 –  —

TIMELINE
  Jan 21  Reserved by CNA
  May 20  Published (CNA: nvidia)

CWE-288 · CNA: nvidia · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-5946HIGH

ISC BIND 9 — Invalid handling of CLASS != IN

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0187   77.8     —

AFFECTED
  Product  Versions  Fixed
  BIND 9   9.11.0 –  —

TIMELINE
  Apr 9   Reserved by CNA
  May 20  Published (CNA: isc)

CWE-20, CWE-125, CWE-617, CWE-754, CWE-843, CWE-1287 · CNA: isc · CVSS v3.1 · 15 references · NVD status: Modified

CVE-2026-8631CRITICAL

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0181   77.0     —

AFFECTED
  Product                                 Versions     Fixed
  HP Linux Imaging and Printing Software  unspecified  —

TIMELINE
  May 14  Reserved by CNA
  May 20  Published (CNA: hp)

CWE-190, CWE-122 · CNA: hp · CVSS v4.0 · 14 references · NVD status: Modified

CVE-2026-3593CRITICAL

ISC BIND 9 — Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0154   72.9     —

AFFECTED
  Product  Versions  Fixed
  BIND 9   9.20.0 –  9.18.0

TIMELINE
  Mar 5   Reserved by CNA
  May 20  Published (CNA: isc)

CWE-416 · CNA: isc · CVSS v3.1 · 7 references · NVD status: Modified

CVE-2026-5947MEDIUM

ISC BIND 9 — SIG(0) validation during query flood may lead to undefined behavior

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  N  N  H    5.9   .0139   70.1     —

AFFECTED
  Product  Versions  Fixed
  BIND 9   9.20.0 –  9.18.28

TIMELINE
  Apr 9   Reserved by CNA
  May 20  Published (CNA: isc)

CWE-362, CWE-416 · CNA: isc · CVSS v3.1 · 7 references · NVD status: Modified

CVE-2026-39352HIGH

Frappe has an Arbitrary File Read via Path Traversal in render_include

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0128   67.8     —

AFFECTED
  Product  Versions      Fixed
  frappe   < 15.105.0 –  —

TIMELINE
  Apr 6   Reserved by CNA
  May 20  Published (CNA: GitHub_M)

CWE-22 · CNA: GitHub_M · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-33278CRITICAL

NLnet Labs Unbound — Possible arbitrary code execution during DNSSEC validation

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.1   .0127   67.6     —

AFFECTED
  Product  Versions  Fixed
  Unbound  1.19.1 –  —

TIMELINE
  May 7   Reserved by CNA
  May 20  Published (CNA: NLnet Labs)

CWE-416, CWE-672 · CNA: NLnet Labs · CVSS v4.0 · 7 references · NVD status: Modified

CVE-2026-47783HIGH

memcached memcached — In memcached before 1.6.42, username data for SASL password database authentication has a timing side chann…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0126   67.4     —

AFFECTED
  Product    Versions     Fixed
  memcached  unspecified  —

TIMELINE
  May 20  Reserved by CNA
  May 20  Published (CNA: mitre)

CWE-208 · CNA: mitre · CVSS v3.1 · 8 references · NVD status: Modified

CVE-2026-3039HIGH

ISC BIND 9 — BIND 9 server memory exhaustion during GSS-API TKEY negotiation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0105   61.6     —

AFFECTED
  Product  Versions  Fixed
  BIND 9   9.0.0 –   —

TIMELINE
  Feb 23  Reserved by CNA
  May 20  Published (CNA: isc)

CWE-771, CWE-770 · CNA: isc · CVSS v3.1 · 15 references · NVD status: Modified

CVE-2026-6555CRITICAL

ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0098   59.5     —

AFFECTED
  Product                Versions     Fixed
  ProSolution WP Client  unspecified  —

TIMELINE
  Apr 17  Reserved by CNA
  May 20  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Deferred

CVE-2026-8467CRITICAL

phenixdigital phoenix_storybook — Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.5   .0091   57.2     —

AFFECTED
  Product            Versions                                    Fixed
  phoenix_storybook  0.5.0 –                                     —
  phoenix_storybook  e35379dfe2ef1a71b141899e36f431017c55265d –  —

TIMELINE
  May 13  Reserved by CNA
  May 20  Published (CNA: EEF)

CWE-94 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-45584HIGH

Microsoft Defender Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0085   55.5     —

AFFECTED
  Product                              Versions   Fixed
  Microsoft Malware Protection Engine  1.1.0.0 –  —

TIMELINE
  May 12  Reserved by CNA
  May 20  Published (CNA: microsoft)

CWE-122 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-42944HIGH

NLnet Labs Unbound — Heap overflow with multiple NSID, COOKIE, PADDING EDNS options

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0084   55.1     —

AFFECTED
  Product  Versions  Fixed
  Unbound  1.14.0 –  —

TIMELINE
  May 7   Reserved by CNA
  May 20  Published (CNA: NLnet Labs)

CWE-197, CWE-787 · CNA: NLnet Labs · CVSS v4.0 · 8 references · NVD status: Modified

CVE-2026-20223CRITICAL

Cisco Secure Workload Unauthorized API Access Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  N   10.0   .0083   55.0     —

AFFECTED
  Product                Versions    Fixed
  Cisco Secure Workload  2.2.1.41 –  —

TIMELINE
  Oct 8   Reserved by CNA
  May 20  Published (CNA: cisco)

CWE-306 · CNA: cisco · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-9064HIGH

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0081   54.3     —

AFFECTED
  Product                                                Versions     Fixed
  389-ds-base                                            unspecified  —
  Red Hat Directory Server 11.5 E4S for RHEL 8           unspecified  8060020260609102432.0ca98e7e
  Red Hat Directory Server 11.7 E4S for RHEL 8           unspecified  8080020260610130252.f969626e
  Red Hat Directory Server 11.9 for RHEL 8               unspecified  8100020260601104139.37ed7c03
  Red Hat Directory Server 12.2 E4S for RHEL 9           unspecified  9020020260615123354.1674d574
  Red Hat Directory Server 12.4 E4S for RHEL 9           unspecified  9040020260611130021.1674d574
  Red Hat Enterprise Linux 10                            unspecified  0:3.2.0-7.el10_2
  Red Hat Enterprise Linux 10.0 Extended Update Support  unspecified  0:3.0.6-18.el10_0
  Red Hat Enterprise Linux 7 Extended Lifecycle Support  unspecified  0:1.3.11.1-12.el7_9
  Red Hat Enterprise Linux 8                             unspecified  8100020260601102239.25e700aa
  + 14 more

TIMELINE
  May 20  Reserved by CNA
  May 20  Published (CNA: redhat)

CWE-770 · CNA: redhat · CVSS v3.1 · 20 references · NVD status: Modified

CVE-2026-9111HIGH

Google Chrome — Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to exe…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0080   53.7     —

AFFECTED
  Product  Versions          Fixed
  Chrome   148.0.7778.179 –  —

TIMELINE
  May 20  Reserved by CNA
  May 20  Published (CNA: Chrome)

CWE-416 · CNA: Chrome · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-43618MEDIUM

RsyncProject rsync — Rsync < 3.4.3 Integer Overflow Information Disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   L   N   H   N   H    6.1   .0078   53.2     —

AFFECTED
  Product  Versions     Fixed
  rsync    unspecified  —

TIMELINE
  May 1   Reserved by CNA
  May 20  Published (CNA: VulnCheck)

CWE-125, CWE-190 · CNA: VulnCheck · CVSS v4.0 · 10 references · NVD status: Modified

CVE-2026-42959HIGH

NLnet Labs Unbound — Crash during DNSSEC validation of malicious content

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0078   53.1     —

AFFECTED
  Product  Versions     Fixed
  Unbound  unspecified  —

TIMELINE
  May 7   Reserved by CNA
  May 20  Published (CNA: NLnet Labs)

CWE-824 · CNA: NLnet Labs · CVSS v4.0 · 8 references · NVD status: Modified

CVE-2026-24217HIGH

NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0076   52.7     —

AFFECTED
  Product            Versions     Fixed
  BioNeMo Framework  unspecified  —

TIMELINE
  Jan 21  Reserved by CNA
  May 20  Published (CNA: nvidia)

CWE-29 · CNA: nvidia · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-24425HIGH

twigphp Twig — Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0076   52.4     —

AFFECTED
  Product  Versions  Fixed
  Twig     3.9.0 –   —

TIMELINE
  Jan 22  Reserved by CNA
  May 20  Published (CNA: VulnCheck)

CWE-693 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-7522	8.8	52.3	SigmaPlugin	Advanced Database Cleaner – Premium	CWE-98	Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Lo…
CVE-2026-41292	6.6	51.2	NLnet Labs	Unbound	CWE-407	Long list of incoming EDNS options degrades performance
CVE-2026-24214	9.8	51.1	NVIDIA	Triton Inference Server	CWE-190	NVIDIA Triton Inference Server contains a vulnerability in the DALI backend w…
CVE-2026-24213	9.8	51.0	NVIDIA	Triton Inference Server	CWE-125	NVIDIA Triton Inference Server contains a vulnerability in the DALI backend w…
CVE-2026-5950	5.3	48.8	ISC	BIND 9	CWE-606	Unbounded resend loop in BIND 9 resolver
CVE-2026-24209	7.5	48.4	NVIDIA	Triton Inference Server	CWE-22	NVIDIA Triton Inference Server contains a vulnerability where an attacker cou…
CVE-2026-39047	7.5	48.3	n/a	n/a	CWE-121	Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker…
CVE-2026-40092	7.5	47.3	nimiq	core-rs-albatross	CWE-252	nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify cau…
CVE-2026-44390	6.9	47.3	NLnet Labs	Unbound	CWE-407	Unbounded name compression in certain cases causes degradation of service
CVE-2026-24210	7.5	46.1	NVIDIA	Triton Inference Server	CWE-190	NVIDIA Triton Inference Server contains a vulnerability where an attacker cou…
CVE-2026-24218	8.1	45.9	NVIDIA	DGX Spark	CWE-321	NVIDIA DGX OS contains a vulnerability in the factory provisioning process, w…
CVE-2026-24163	9.8	45.7	NVIDIA	TensorRT-LLM	CWE-502	NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, wher…
CVE-2026-33137	9.3	45.8	xwiki	xwiki-platform	CWE-862	XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
CVE-2026-42534	6.9	45.2	NLnet Labs	Unbound	CWE-440	Jostle logic bypass degrades resolution performance
CVE-2026-7637	9.8	44.7	PixelYourSite	Boost	CWE-502	Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_…
CVE-2025-33255	9.8	44.4	NVIDIA	TensorRT-LLM	CWE-502	NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where…
CVE-2026-9102	9.4	44.2	Altium	Altium Enterprise Server	CWE-22	Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary…
CVE-2026-47784	8.1	43.5	memcached	memcached	CWE-208	In memcached before 1.6.42, password data for SASL password database authenti…
CVE-2026-24206	9.8	43.5	NVIDIA	Triton Inference Server	CWE-288	NVIDIA Triton Inference Server contains a vulnerability where an attacker cou…
CVE-2026-9003	8.7	43.0	TONNET	TPR7308	CWE-89	TONNET｜E-LAN Hybrid Recording System - SQL Injection
CVE-2026-9119	8.8	42.9	Google	Chrome	CWE-122	Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 al…
CVE-2026-8469	8.2	42.8	phenixdigital	phoenix_storybook	CWE-770	Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_s…
CVE-2026-8598	9.1	40.9	ZKTeco	SSC335-GC2063-Face-0b77 Solution Camera	CWE-288	Unauthenticated Export Service in ZKTeco CCTV Cameras
CVE-2026-40165	8.7	40.6	goauthentik	authentik	CWE-91	authentik: SAML NameID XML Comment Injection Enables Authentication Bypass vi…
CVE-2026-9120	8.8	40.6	Google	Chrome	CWE-416	Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a r…
CVE-2026-7284	9.8	40.1	themewant	Easy Elements for Elementor – Addons & Website Templates	CWE-269	Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation v…
CVE-2026-20239	6.5	39.5	Splunk	Splunk Enterprise	CWE-532	Sensitive Information Disclosure through Log Files in Splunk Enterprise
CVE-2026-9141	9.3	39.3	Taiko Network Communications Pte Ltd.	AG1000-01A SMS Alert Gateway	CWE-306	Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface
CVE-2026-6072	6.5	38.9	oliverpos	Oliver POS – A WooCommerce Point of Sale (POS)	CWE-639	Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Con…
CVE-2026-24160	7.5	38.4	NVIDIA	TensorRT-LLM	CWE-690	NVIDIA TRT-LLM for any platform contains a vulnerability where an attacker co…
CVE-2026-20171	6.8	38.3	Cisco	Cisco NX-OS Software	CWE-670	Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vu…
CVE-2026-39850	7.4	37.6	yiisoft	yii2	CWE-20	Yii 2: Local file inclusion via view parameter name collision
CVE-2026-9139	9.3	37.4	Taiko Network Communications Pte Ltd.	AG1000-01A SMS Alert Gateway	CWE-798	Taiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml
CVE-2026-35070	6.7	37.3	Dell	SmartFabric Storage Software	CWE-77	Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Impro…
CVE-2026-47068	2.3	37.1	phenixdigital	phoenix_storybook	CWE-639	Cross-session PubSub topic injection via URL parameter in phoenix_storybook
CVE-2026-7472	4.9	37.1	edmonparker	Read More & Accordion	CWE-89	Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection…
CVE-2026-9144	8.4	36.5	Taiko Network Communications Pte Ltd.	AG1000-01A SMS Alert Gateway	CWE-79	Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration Interface
CVE-2026-20199	7.2	36.3	Cisco	Cisco ThousandEyes Enterprise Agent	CWE-74	A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual…
CVE-2026-43620	6.9	35.4	RsyncProject	rsync	CWE-125	Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files()
CVE-2026-20206	6.3	34.4	Cisco	Cisco ThousandEyes Enterprise Agent	CWE-78	Cisco ThousandEyes BrowserBot Command Injection Vulnerability
CVE-2026-24215	7.5	33.9	NVIDIA	Triton Inference Server	CWE-400	NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, …
CVE-2026-9101	5.3	33.9	MongoDB, Inc.	Compass	CWE-1321	Prototype pollution in csv parsing
CVE-2026-9150	6.5	33.7	Red Hat	Red Hat Enterprise Linux 10	CWE-121	Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when…
CVE-2026-42834	7.8	33.7	Microsoft	Windows Admin Center in Azure Portal	CWE-59	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
CVE-2026-3592	5.3	33.4	ISC	BIND 9	CWE-408	Amplification vulnerabilities via self-pointed glue records
CVE-2026-3985	7.5	33.4	constantcontact	Creative Mail – Easier WordPress & WooCommerce Email Marketing	CWE-89	Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Una…
CVE-2026-47372	9.1	32.5	RRWO	Crypt::SaltedHash	CWE-338	Crypt::SaltedHash versions through 0.09 for Perl generate insecure random val…
CVE-2026-9112	8.8	32.4	Google	Chrome	CWE-416	Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 all…
CVE-2026-9118	8.8	32.4	Google	Chrome	CWE-416	Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allo…
CVE-2026-9126	8.8	32.4	Google	Chrome	CWE-416	Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a r…
CVE-2026-20240	6.5	32.5	Splunk	Splunk Enterprise	CWE-20	Denial of Service through coldToFrozen.sh Script in Splunk Enterprise
CVE-2026-8486	7.5	32.3	Progress Software	MOVEit Automation	CWE-770	Allocation of resources without limits or throttling vulnerability in Progres…
CVE-2026-47373	7.5	32.1	RRWO	Crypt::SaltedHash	CWE-208	Crypt::SaltedHash versions through 0.09 for Perl is susceptible to timing att…
CVE-2026-39310	8.6	31.9	TriliumNext	Trilium	CWE-284	Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Bu…
CVE-2026-22314	9.0	31.4	Mesalvo	Meona Client Launcher Component	CWE-94	Improper Control of Generation of Code ('Code Injection') vulnerability in Me…
CVE-2026-6456	8.8	31.3	beycanpress	Account Switcher	CWE-287	Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass…
CVE-2026-24188	7.5	31.2	NVIDIA	TensorRT	CWE-787	NVIDIA TensorRT contains a vulnerability where an attacker could cause an out…
CVE-2026-24142	9.8	30.7	NVIDIA	TensorRT-LLM	CWE-502	NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and …
CVE-2026-44926	8.8	30.2	n/a	n/a	CWE-284	InfoScale CmdServer before 7.4.2 mishandles access control.
CVE-2026-9010	7.5	29.3	PixelYourSite	Boost	CWE-89	Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters
CVE-2026-9114	8.8	29.2	Google	Chrome	CWE-416	Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a …
CVE-2026-9137	5.1	29.2	misp	misp	CWE-400	CSP Report Endpoint Log Flooding in MISP via Incorrect Size Limit
CVE-2026-8488	7.5	29.0	Progress Software	MOVEit Automation	CWE-770	Allocation of resources without limits or throttling vulnerability in Progres…
CVE-2026-2812	5.3	28.6	Esri	ArcGIS Server	CWE-287	Improper Authentication issue in ArcGIS Server
CVE-2026-8685	6.5	28.5	infility	Infility Global	CWE-89	Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'o…
CVE-2026-47099	2.1	28.4	storybookjs	telejson	CWE-79	TeleJSON < 6.0.0 DOM-based XSS via parse() Function
CVE-2026-7467	8.8	28.3	edmonparker	Read More & Accordion	CWE-269	Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
CVE-2025-32750	7.5	27.6	Dell	PowerFlex Manager (Appliance)	CWE-548	Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Informa…
CVE-2026-22315	7.2	27.5	Mesalvo	Meona Client Launcher Component	CWE-266	Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher…
CVE-2026-8485	7.5	27.3	Progress Software	MOVEit Automation	CWE-789	Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Auto…
CVE-2026-9133	8.3	27.0	AWS	RabbitMQ AWS	CWE-489	Arbitrary file read in rabbitmq-aws plugin
CVE-2026-42923	6.9	26.3	NLnet Labs	Unbound	CWE-407	Degradation of service with unbounded NSEC3 hash calculations
CVE-2026-9065	9.3	26.2	brainstormforce	Surecart	CWE-89	Surecart - SQL Injection
CVE-2026-32792	4.6	26.1	NLnet Labs	Unbound	CWE-125	Packet of death with DNSCrypt
CVE-2026-9110	4.2	26.2	Google	Chrome	CWE-451	Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0…
CVE-2026-45232	2.1	26.2	RsyncProject	rsync	CWE-193	Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy
CVE-2026-5200	8.8	26.0	acyba	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress	CWE-862	AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) P…
CVE-2026-6728	5.3	25.5	Revolution Slider	Slider Revolution	CWE-200	Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure v…
CVE-2026-9121	8.8	25.4	Google	Chrome	CWE-125	Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed…
CVE-2026-7460	7.4	24.2	mailcow	mailcow-dockerized	CWE-79	mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped
CVE-2026-20238	6.5	24.2	Splunk	Splunk AI Toolkit	CWE-863	Improper Access Control through Role Inheritance in Splunk AI Toolkit app
CVE-2026-6394	5.4	23.7	wpdive	Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE	CWE-918	Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via …
CVE-2026-9087	8.1	23.3	Red Hat	Red Hat build of Keycloak 26.4	CWE-639	Keycloak: cross-session email verification proof not bound to upstream identi…
CVE-2026-9149	6.5	23.4	Red Hat	Red Hat Enterprise Linux 10	CWE-122	Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize f…
CVE-2026-44923	6.5	23.0	n/a	n/a	CWE-89	SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to esca…
CVE-2026-5293	6.4	22.9	olivesystem	診断ジェネレータ作成プラグイン	CWE-79	診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scr…
CVE-2026-27405	6.5	22.8	Magepeople inc.	WpBookingly	CWE-862	WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability
CVE-2026-39405	9.4	22.4	frappe	lms	CWE-22	Frappe has Path Transversal via SCORM
CVE-2026-40094	4.3	22.2	nimiq	core-rs-albatross	CWE-754	nimiq-blockchain: network-libp2p untrusted peer can crash address book via em…
CVE-2026-2813	4.1	22.0	Esri	ArcGIS Server	CWE-601	Unvalidated Redirect in ArcGIS Server
CVE-2026-30691	6.1	21.9	n/a	n/a	CWE-79	Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1…
CVE-2026-40102	6.5	21.5	makeplane	plane	CWE-943	Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics
CVE-2026-9100	6.0	21.4	MongoDB, Inc.	C Driver	CWE-1285	Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
CVE-2026-8610	4.3	21.4	conoha	TypeSquare Webfonts for ConoHa	CWE-862	TypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authentica…
CVE-2026-24216	7.8	20.9	NVIDIA	BioNeMo Framework	CWE-502	NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a …
CVE-2026-42383	7.6	20.8	YITH	YITH WooCommerce Product Add-Ons	CWE-89	WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection v…
CVE-2026-39311	6.8	20.7	TriliumNext	Trilium	CWE-79	Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) v…
CVE-2026-9059	9.3	20.6	awesomemotive	NextGEN Gallery	CWE-89	NextGEN Gallery - SQL Injection
CVE-2026-5075	4.3	20.4	smub	All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic	CWE-200	All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information …
CVE-2026-45444	10.0	20.1	WP Swings	Gift Cards For WooCommerce Pro	CWE-434	WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upl…
CVE-2026-43617	6.3	20.1	RsyncProject	rsync	CWE-289	Rsync < 3.4.3 Authorization Bypass via Hostname Resolution
CVE-2026-8487	7.5	19.9	Progress Software	MOVEit Automation	CWE-276	Incorrect default permissions vulnerability in Progress Software MOVEit Autom…
CVE-2026-7462	6.1	19.4	vatanyazilim	VatanSMS WP SMS	CWE-79	VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter
CVE-2026-7385	5.8	18.8	Unknown	Decent Comments	—	Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure
CVE-2026-4293	5.3	18.8	Kieback & Peter	DDC4002	CWE-79	Kieback & Peter DDC Building Controllers Cross-site Scripting
CVE-2026-9122	6.5	18.5	Google	Chrome	CWE-125	Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 all…
CVE-2026-8624	6.1	18.3	etspring	LJ comments import: reloaded	CWE-79	LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via P…
CVE-2026-8626	6.1	18.3	owencutajar	SponsorMe	CWE-79	SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter
CVE-2026-9117	7.5	17.9	Google	Chrome	CWE-843	Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778…
CVE-2026-21836	6.5	17.8	HCLSoftware	DominoIQ	CWE-862	HCL DominoIQ is affected by broken access control
CVE-2026-6566	4.3	17.9	smub	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery	CWE-639	Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object…
CVE-2026-9057	8.2	17.4	Talend	Talend Administration Center	—	Security fix for Qlik Talend Administration Center URL access control vulnera…
CVE-2026-9124	5.3	17.4	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Input in Google Chrome on prior…
CVE-2026-7613	7.2	16.8	pixelyoursite	Cost of Goods by PixelYourSite	CWE-79	Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site …
CVE-2026-44608	4.6	16.8	NLnet Labs	Unbound	CWE-413	Use after free and crash under special conditions in RPZ code
CVE-2026-5776	6.1	16.3	Unknown	Email Encoder	—	Email Encoder < 2.4.7 - Unauthenticated Stored XSS
CVE-2026-42960	5.7	16.0	NLnet Labs	Unbound	CWE-349	Possible cache poisoning via promiscuous records for the authority section
CVE-2026-44392	5.3	16.0	Six Apart Ltd.	Movable Type	CWE-862	Missing authorization vulnerability exists in Movable Type. Under certain con…
CVE-2025-15369	5.3	15.9	xpro	Xpro Addons — 140+ Widgets for Elementor	CWE-862	Xpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to …
CVE-2026-8038	6.4	15.5	mcinvale	Faces of Users	CWE-79	Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-6397	6.4	15.5	cvmh	Sticky	CWE-79	Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vi…
CVE-2026-6549	6.4	15.5	goback2	Logo Manager For Enamad	CWE-79	Logo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-…
CVE-2026-26028	6.1	15.1	cryptpad	cryptpad	CWE-79	CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection a…
CVE-2026-9129	9.4	14.7	Altium	Altium Enterprise Server	CWE-22	Path Traversal in Altium Enterprise Server Viewer StorageController Allows Ar…
CVE-2026-6404	4.4	14.7	simonholliday	Anomify AI – Anomaly Detection and Alerting	CWE-79	Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Script…
CVE-2026-22554	7.8	14.4	MediaArea	MediaInfoLib	CWE-122	MediaArea MediaInfoLib Channel Splitting heap-based buffer overflow vulnerabi…
CVE-2026-39960	5.4	13.6	mantisbt	mantisbt	CWE-79	MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values
CVE-2026-6399	4.4	13.6	yog2515	General Options	CWE-79	General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site S…
CVE-2026-9136	8.3	13.5	misp	misp	CWE-639	Unauthorized ShadowAttribute modification in MISP via client-supplied identifier
CVE-2026-35014	5.1	13.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter
CVE-2026-5783	7.6	13.0	Beyaz Computer Software Design Industry and Trade Ltd. Co.	CityPLus	CWE-79	Reflected XSS in Beyaz Computer's CityPLus
CVE-2026-9115	4.3	12.9	Google	Chrome	CWE-693	Insufficient policy enforcement in Service Worker in Google Chrome on prior t…
CVE-2026-2955	6.4	12.7	wupsales	AI Chatbot & Workflow Automation by AIWU	CWE-79	AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored C…
CVE-2026-8627	6.1	12.5	lykich	Correct Prices	CWE-79	Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
CVE-2026-35007	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter
CVE-2026-35008	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter
CVE-2026-35009	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter
CVE-2026-35010	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter
CVE-2026-35011	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter
CVE-2026-35012	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter
CVE-2026-35013	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and theln…
CVE-2026-35015	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Para…
CVE-2026-35016	5.1	12.4	openises	tickets	CWE-79	Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter
CVE-2026-44933	8.5	12.3	SUSE	SUSE Linux Enterprise	CWE-35	Path Traversal in Plugin Loading in libzypp
CVE-2026-9113	4.3	12.0	Google	Chrome	CWE-125	Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 all…
CVE-2026-9116	4.3	12.0	Google	Chrome	CWE-693	Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to…
CVE-2026-44924	5.4	10.8	n/a	n/a	CWE-79	InfoScale VIOM 9.1.3 allows XSS.
CVE-2026-27424	4.3	10.6	WP Chill	Image Photo Gallery Final Tiles Grid	CWE-862	WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Acce…
CVE-2026-44925	8.8	9.6	n/a	n/a	CWE-352	Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operatio…
CVE-2026-45443	5.0	9.1	ADD-ONS.ORG	PDF for Elementor Forms + Drag And Drop Template Builder	CWE-862	WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= …
CVE-2026-8419	4.3	8.7	submone	Amazon Scraper	CWE-352	Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scrip…
CVE-2026-9123	7.5	8.3	Google	Chrome	CWE-122	Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, Chrome…
CVE-2026-6401	4.3	8.3	svil4ok	Bottom Bar	CWE-352	Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
CVE-2026-41054	7.8	8.0	SUSE	Container suse/sle-micro-rancher/5.3:latest	CWE-305	Missing exit out of permission check in haveged could lead to root exploit
CVE-2026-9084	6.0	7.8	misp	misp	CWE-287	MISP OIDC authentication bypass via automatic email-based account linking und…
CVE-2026-8423	4.3	7.5	javibola	JaviBola Custom Theme Test	CWE-352	JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
CVE-2025-31973	9.8	7.3	HCL	BigFix Service Management (SM)	CWE-1395	HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insec…
CVE-2026-9056	5.4	7.4	Talend	Talend Administration Center	—	Security fix for Qlik Talend Administration Center cross-site scripting vulne…
CVE-2026-6391	6.1	6.9	eazyserver	Sentence To SEO (keywords, description and tags)	CWE-352	Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request …
CVE-2026-8420	6.1	6.9	rdbeach	BLOGCHAT Chat System	CWE-352	BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-…
CVE-2026-6405	4.3	6.3	simonholliday	Anomify AI – Anomaly Detection and Alerting	CWE-352	Anomify AI <= 0.3.6 - Cross-Site Request Forgery
CVE-2025-11954	8.0	6.0	Sitemio Information Technologies Trade Ltd. Co.	WISECP	CWE-352	CSRF in Sitemio's WISECP
CVE-2026-24573	6.5	6.1	Themeisle	Visualizer	CWE-79	WordPress Visualizer plugin < 4.0.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-6400	4.3	5.7	helpstring	Child Height Predictor by Ostheimer	CWE-352	Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Se…
CVE-2026-8418	4.3	5.7	askywhale	Games Catalog	CWE-352	Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post De…
CVE-2026-6452	4.3	5.2	ktulhu	Bigfishgames Syndicate	CWE-352	Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset …
CVE-2026-8424	4.3	5.2	jay_patel	Remove Yellow BGBOX	CWE-352	Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
CVE-2025-31985	6.5	5.1	HCL	BigFix Service Management (SM)	CWE-200	HCL BigFix Service Management (SM) is affected by a security misconfiguration…
CVE-2026-6395	6.1	4.7	winking	Word 2 Cash	CWE-352	Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripti…
CVE-2026-29518	7.3	4.6	RsyncProject	rsync	CWE-367	Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write
CVE-2023-7346	4.1	3.6	Ledger	Ledger Bitcoin app	CWE-682	Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript
CVE-2026-43619	7.2	3.2	RsyncProject	rsync	CWE-59	Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls
CVE-2026-40622	6.6	3.2	NLnet Labs	Unbound	CWE-346	Another 'ghost domain names' attack variant
CVE-2026-47782	4.6	3.0	Siber Systems, Inc.	Android App "RoboForm Password Manager"	CWE-357	Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handl…
CVE-2026-0856	7.8	2.5	Mesalvo	Meona Client Launcher Component	CWE-284	Improper Access Control vulnerability in Mesalvo Meona Client Launcher Compon…
CVE-2026-0857	6.0	1.0	Mesalvo	Meona Client Launcher Component	CWE-316	Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo…
CVE-2026-25602	4.4	0.5	Mesalvo	Meona Client Launcher Component	CWE-345	Insufficient Verification of Data Authenticity vulnerability in Mesalvo Meona…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-20 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.