Security Box Score — May 23, 2026

41 CVEs published, led by Edimax (5).

41 CVEs published May 23, 2026: 2 critical, 23 high, 3 medium, 13 low; 0 in the KEV catalog at press time; 1 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 16 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1117	2329	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

40 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	227	553	67	448	38	0	11	2	0.4	7.8	.0014	+130 ▲
microsoft	160	530	46	371	111	2	286	19	3.6	7.8	.0047	-22 ▼
red hat	10	62	5	26	24	7	2	0	0.0	6.8	.0041	-9 ▼
apple	15	45	1	15	28	1	88	7	15.6	6.2	.0028	+15 ▲
google	16	23	0	17	6	0	77	4	17.4	8.8	.0034	+15 ▲
freebsd	7	7	0	5	2	0	0	0	0.0	7.8	.0020	+7 ▲
suse	2	2	0	2	0	0	0	0	0.0	8.2	.0020	+2 ▲
ubuntu	0	1	0	0	0	1	1	0	0.0	2.7	.0218	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	5	12	5	3	4	56	8	66.7	7.8	.1576	+5 ▲
fortinet	1	7	4	3	0	28	3	42.9	9.1	.8584	-2 ▼
ivanti	2	5	2	3	0	25	4	80.0	8.8	.8056	+2 ▲
ubiquiti	2	3	1	2	0	3	0	0.0	8.8	.0068	+2 ▲
f5	2	2	2	0	0	4	1	50.0	9.2	.3901	+2 ▲
palo alto networks	2	2	1	1	0	13	1	50.0	8.6	.6281	+2 ▲
vmware	0	1	0	1	0	7	1	100.0	8.1	.1742	0
check point	0	0	0	0	0	1	0	—	—	—	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	9	22	4	12	6	33	1	4.5	7.5	.0080	+6 ▲
mozilla	5	5	3	2	0	9	0	0.0	9.6	.0045	+5 ▲
docker	3	3	0	3	0	0	0	0.0	8.8	.0022	+3 ▲
drupal	3	3	1	0	2	4	1	33.3	5.1	.0021	+3 ▲
gitlab	0	0	0	0	0	4	2	—	—	—	0
wordpress	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
progress	4	4	0	4	6	0	0.0	7.5	.0036	+4 ▲
oracle	0	3	1	2	27	0	0.0	7.5	.0088	0
solarwinds	0	3	2	1	10	3	100.0	9.8	.8362	0
adobe	0	2	0	2	19	2	100.0	8.6	.0368	-2 ▼
zohocorp	1	1	0	1	0	0	0.0	8.4	.0170	+1 ▲
atlassian	0	0	0	0	13	0	—	—	—	0
ibm	0	0	0	0	6	0	—	—	—	0
sap	0	0	0	0	6	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	H	KEV	KEV/100	Med CVSS	Med EPSS	Δ
d-link	1	1	1	3	0.0	8.7	.0059	+1 ▲
siemens	1	1	1	0	0.0	8.7	.0032	+1 ▲
tp-link	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
concrete cms	44	44	1	9	13	21	0	0	0.0	5.7	.0015	+44 ▲
open ises	37	37	2	14	21	0	0	0	0.0	6.9	.0021	+37 ▲
netatalk	33	33	1	13	9	10	0	0	0.0	6.4	.0030	+33 ▲
grafana	10	27	2	7	16	2	2	0	0.0	6.5	.0033	+7 ▲
dell	12	18	1	6	11	0	2	1	5.6	6.7	.0019	+7 ▲
nvidia	16	16	7	9	0	0	0	0	0.0	8.4	.0060	+16 ▲
trend micro	16	16	2	13	1	0	12	1	6.3	7.8	.0030	+16 ▲
givanz	11	15	2	7	6	0	0	0	0.0	8.3	.0028	+7 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-31431	.9991	100.0	7.8
CVE-2026-41940	.9853	99.9	9.3
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-42208	.8942	99.8	9.3
CVE-2026-9082	.8832	99.8	9.8
CVE-2024-1708	.8756	99.7	8.4
CVE-2026-42271	.8354	99.7	8.7

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-43997	10.0	.0098
CVE-2026-42826	10.0	.0084
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083
CVE-2026-44006	10.0	.0081
CVE-2026-46595	10.0	.0050
CVE-2026-42822	10.0	.0049
CVE-2026-33712	10.0	.0035
CVE-2026-9152	10.0	.0034

Most disclosures (vendor)
Vendor	CVEs
linux	295
microsoft	162
concrete cms	44
open ises	37
netatalk	33
google	16
nvidia	16
trend micro	16
apache	15
apple	15

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	8
apple	7
google	4
ivanti	4
fortinet	3
smartertools	3
solarwinds	3
adobe	2
berriai	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	4
PyPI	1
npm	1

Fastest to KEV
CVE	Vendor	Days
CVE-2024-1708	ConnectWise	0
CVE-2024-57726	n/a	0
CVE-2024-57728	n/a	0
CVE-2026-31431	Linux	0
CVE-2026-32202	Microsoft	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-41091	Microsoft	0
CVE-2026-41940	WebPros	0
CVE-2026-42208	BerriAI	0
CVE-2026-42897	Microsoft	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1648
CVE-2021-27102	n/a	2021-11-17	1648
CVE-2021-27101	n/a	2021-11-17	1648
CVE-2021-27103	n/a	2021-11-17	1648
CVE-2021-21017	Adobe	2021-11-17	1648
CVE-2021-28550	Adobe	2021-11-17	1648
CVE-2021-42013	Apache Software Foundation	2021-11-17	1648
CVE-2021-41773	Apache Software Foundation	2021-11-17	1648
CVE-2021-30858	Apple	2021-11-17	1648
CVE-2021-30860	Apple	2021-11-17	1648

Transactions

No status changes recorded.

Yesterday's Results

How to read these box scores · glossary

41 CVEs published. 25 box scores, 16 table rows — nothing truncated.

CVE-2026-46300HIGH

Linux Linux — net: skbuff: preserve shared-frag marker during coalescing

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0948   95.0     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    cef401de7be8c4e155c6746bfccf721a4fa5fab9 –  —
  Linux    3.9 –                                       5.10.257

TIMELINE
  May 13  Reserved by CNA
  May 23  Published (CNA: Linux)

CWE-123 · CNA: Linux · CVSS v3.1 · 50 references · NVD status: Modified

CVE-2018-25357CRITICAL

Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0170   75.4     —

AFFECTED
  Product           Versions     Fixed
  Dolibarr ERP CRM  unspecified  —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed

CVE-2026-9343LOW

Edimax EW-7438RPn webs formWpsStart os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0152   72.6     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.0 –     —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9297LOW

Edimax BR-6428NS POST Request formWlbasic command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0140   70.3     —

AFFECTED
  Product    Versions  Fixed
  BR-6428NS  1.10 –    —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9296LOW

Edimax BR-6428NS POST Request formWlanM system command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.6     —

AFFECTED
  Product    Versions  Fixed
  BR-6428NS  1.10 –    —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2018-25358HIGH

D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0059   45.4     —

AFFECTED
  Product  Versions     Fixed
  DIR-601  unspecified  —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-497 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Awaiting Analysis

CVE-2026-9294HIGH

Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0054   43.1     —

AFFECTED
  Product    Versions  Fixed
  BR-6428NS  1.10 –    —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9295HIGH

Edimax BR-6428NS POST Request formWirelessTbl buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0054   43.1     —

AFFECTED
  Product    Versions  Fixed
  BR-6428NS  1.10 –    —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2018-25353HIGH

Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0045   37.4     —

AFFECTED
  Product               Versions     Fixed
  Redaxo CMS Mediapool  unspecified  —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2018-25350CRITICAL

userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0043   35.9     —

AFFECTED
  Product    Versions  Fixed
  userSpice  4.3.24 –  —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-204 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-9284HIGH

WooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  L  N    8.2   .0040   32.9     —

AFFECTED
  Product                      Versions     Fixed
  WooCommerce PayPal Payments  unspecified  —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2018-25348HIGH

harmistechnology Ek Rishta — Joomla! Component Ek Rishta 2.10 SQL Injection via user_detail

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0036   28.5     —

AFFECTED
  Product    Versions  Fixed
  Ek Rishta  2.10 –    —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2018-25351HIGH

harmistechnology EkRishta — Joomla! Component EkRishta 2.10 SQL Injection via username

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0036   28.5     —

AFFECTED
  Product   Versions  Fixed
  EkRishta  2.10 –    —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-43503HIGH

Linux Linux — net: skbuff: propagate shared-frag marker through frag-transfer helpers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  C  H  H  H    8.8   .0034   26.1     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    cef401de7be8c4e155c6746bfccf721a4fa5fab9 –  —
  Linux    3.9 –                                       5.10.257

TIMELINE
  May 1   Reserved by CNA
  May 23  Published (CNA: Linux)

CWE-664 · CNA: Linux · CVSS v3.1 · 41 references · NVD status: Modified

CVE-2018-25340HIGH

Behance Smartshop — Smartshop 1 SQL Injection via category.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0033   25.8     —

AFFECTED
  Product    Versions  Fixed
  Smartshop  1.0 –     —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2018-25341HIGH

Behance Smartshop — Smartshop 1 SQL Injection via product.php id Parameter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0033   25.8     —

AFFECTED
  Product    Versions  Fixed
  Smartshop  1.0 –     —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2018-25342HIGH

Behance Smartshop — Smartshop 1 SQL Injection via search.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0033   25.8     —

AFFECTED
  Product    Versions  Fixed
  Smartshop  1.0 –     —

TIMELINE
  May 23  Reserved by CNA
  May 23  Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9306LOW

QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   L   N   N    2.9   .0029   21.1     —

AFFECTED
  Product  Versions  Fixed
  new-api  0.12.0 –  —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-6419HIGH

Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_get_screen' AJAX action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0026   17.1     —

AFFECTED
  Product          Versions     Fixed
  Wishlist Member  unspecified  —

TIMELINE
  Apr 16  Reserved by CNA
  May 23  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-6895HIGH

Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0025   15.8     —

AFFECTED
  Product          Versions     Fixed
  Wishlist Member  unspecified  —

TIMELINE
  Apr 23  Reserved by CNA
  May 23  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-6897HIGH

Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0024   15.3     —

AFFECTED
  Product          Versions     Fixed
  Wishlist Member  unspecified  —

TIMELINE
  Apr 23  Reserved by CNA
  May 23  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-6898HIGH

WishList Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Generate API Secret Key via 'wlm3_generate_api_key' AJAX action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0024   15.3     —

AFFECTED
  Product          Versions     Fixed
  Wishlist Member  unspecified  —

TIMELINE
  Apr 23  Reserved by CNA
  May 23  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-9302LOW

546669204 vps-inventory-monitoring VpsTest Console VpsTest.php eval code injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0024   14.4     —

AFFECTED
  Product                   Versions                                    Fixed
  vps-inventory-monitoring  98c00b370668c96ae75e91c15548d9ea113652d9 –  —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-74, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-9299LOW

omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0023   13.4     —

AFFECTED
  Product  Versions  Fixed
  amf      2.1.0 –   —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-119 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-9300LOW

omec-project amf NGSetupRequest memory corruption

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0023   13.4     —

AFFECTED
  Product  Versions  Fixed
  amf      2.1.0 –   —

TIMELINE
  May 22  Reserved by CNA
  May 23  Published (CNA: VulDB)

CWE-119 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-9301	2.1	13.4	omec-project	amf	CWE-119	omec-project amf NGReset Message memory corruption
CVE-2026-9298	2.1	13.4	omec-project	amf	CWE-119	omec-project amf PathSwitchRequest memory corruption
CVE-2018-25347	7.1	11.5	web-dorado	Contact Form Maker	CWE-89	WordPress Contact Form Maker Plugin 1.12.20 SQL Injection
CVE-2018-25352	7.1	11.5	ultimate-form-builder-lite	Ultimate Form Builder Lite	CWE-89	WordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id
CVE-2026-9304	1.3	9.6	calcom	cal.diy	CWE-918	calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
CVE-2018-25346	7.1	9.4	10Web	Form Maker	CWE-89	WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php
CVE-2026-9303	2.1	9.0	calcom	cal.diy	CWE-352	calcom cal.diy cross-site request forgery
CVE-2026-9305	2.1	8.9	QuantumNous	new-api	CWE-74	QuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection
CVE-2026-9342	2.1	8.9	SourceCodester	Hospitals Patient Records Management System	CWE-74	SourceCodester Hospitals Patient Records Management System view_history.php s…
CVE-2018-25345	8.6	6.0	10-Strike	Network Scanner	CWE-120	10-Strike Network Scanner 3.0 Local Buffer Overflow SEH
CVE-2018-25344	8.6	5.6	10-Strike	Network Inventory Explorer	CWE-121	10-Strike Network Inventory Explorer 8.54 Buffer Overflow SEH
CVE-2018-25355	8.6	5.6	Audiograbber	Audiograbber	CWE-120	Audiograbber 1.83 Local Buffer Overflow via SEH
CVE-2018-25356	8.6	5.6	Sipp	SIPp	CWE-120	SIPp 3.6 Local Buffer Overflow via Command-line Arguments
CVE-2018-25349	5.1	4.8	UserSpice	userSpice	CWE-79	userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header
CVE-2018-25343	5.3	3.0	Behance	Smartshop	CWE-352	Smartshop 1 Cross-Site Request Forgery via editprofile.php
CVE-2018-25354	5.3	3.0	Jomres	Jomres	CWE-352	Joomla Component jomres 9.11.2 Cross-Site Request Forgery

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-23 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.