Security Box Score — May 24, 2026

64 CVEs published, led by Edimax (20).

64 CVEs published May 24, 2026: 0 critical, 26 high, 16 medium, 22 low; 0 in the KEV catalog at press time; 1 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 39 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1181	2393	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

45 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	227	553	67	448	38	0	11	2	0.4	7.8	.0014	+74 ▲
microsoft	160	530	46	371	111	2	286	19	3.6	7.8	.0047	-23 ▼
red hat	10	62	5	26	24	7	2	0	0.0	6.8	.0041	-9 ▼
apple	15	45	1	15	28	1	88	7	15.6	6.2	.0028	+15 ▲
google	16	23	0	17	6	0	77	4	17.4	8.8	.0034	+15 ▲
freebsd	7	7	0	5	2	0	0	0	0.0	7.8	.0020	+7 ▲
suse	2	2	0	2	0	0	0	0	0.0	8.2	.0020	+2 ▲
ubuntu	0	1	0	0	0	1	1	0	0.0	2.7	.0218	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	5	12	5	3	4	56	8	66.7	7.8	.1576	+5 ▲
fortinet	1	7	4	3	0	28	3	42.9	9.1	.8584	-2 ▼
ivanti	2	5	2	3	0	25	4	80.0	8.8	.8056	+2 ▲
ubiquiti	2	3	1	2	0	3	0	0.0	8.8	.0068	+2 ▲
f5	2	2	2	0	0	4	1	50.0	9.2	.3901	+2 ▲
palo alto networks	2	2	1	1	0	13	1	50.0	8.6	.6281	+2 ▲
vmware	0	1	0	1	0	7	1	100.0	8.1	.1742	0
check point	0	0	0	0	0	1	0	—	—	—	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	9	22	4	12	6	33	1	4.5	7.5	.0080	+6 ▲
mozilla	5	5	3	2	0	9	0	0.0	9.6	.0045	+5 ▲
docker	3	3	0	3	0	0	0	0.0	8.8	.0022	+3 ▲
drupal	3	3	1	0	2	4	1	33.3	5.1	.0021	+3 ▲
gitlab	0	0	0	0	0	4	2	—	—	—	0
wordpress	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
progress	4	4	0	4	6	0	0.0	7.5	.0036	+4 ▲
oracle	0	3	1	2	27	0	0.0	7.5	.0088	0
solarwinds	0	3	2	1	10	3	100.0	9.8	.8362	0
adobe	0	2	0	2	19	2	100.0	8.6	.0368	-2 ▼
zohocorp	1	1	0	1	0	0	0.0	8.4	.0170	+1 ▲
atlassian	0	0	0	0	13	0	—	—	—	0
ibm	0	0	0	0	6	0	—	—	—	0
sap	0	0	0	0	6	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	H	KEV	KEV/100	Med CVSS	Med EPSS	Δ
d-link	1	1	1	3	0.0	8.7	.0059	+1 ▲
siemens	1	1	1	0	0.0	8.7	.0032	+1 ▲
tp-link	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
concrete cms	44	44	1	9	13	21	0	0	0.0	5.7	.0015	+44 ▲
open ises	37	37	2	14	21	0	0	0	0.0	6.9	.0021	+37 ▲
netatalk	33	33	1	13	9	10	0	0	0.0	6.4	.0030	+33 ▲
grafana	10	27	2	7	16	2	2	0	0.0	6.5	.0033	+6 ▲
edimax	25	25	0	13	0	12	1	0	0.0	7.4	.0054	+25 ▲
dell	12	18	1	6	11	0	2	1	5.6	6.7	.0019	+7 ▲
nvidia	16	16	7	9	0	0	0	0	0.0	8.4	.0060	+16 ▲
trend micro	16	16	2	13	1	0	12	1	6.3	7.8	.0030	+16 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-31431	.9991	100.0	7.8
CVE-2026-41940	.9853	99.9	9.3
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-42208	.8942	99.8	9.3
CVE-2026-9082	.8832	99.8	9.8
CVE-2024-1708	.8756	99.7	8.4
CVE-2026-42271	.8354	99.7	8.7

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-43997	10.0	.0098
CVE-2026-42826	10.0	.0084
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083
CVE-2026-44006	10.0	.0081
CVE-2026-46595	10.0	.0050
CVE-2026-42822	10.0	.0049
CVE-2026-33712	10.0	.0035
CVE-2026-9152	10.0	.0034

Most disclosures (vendor)
Vendor	CVEs
linux	239
microsoft	161
concrete cms	44
open ises	37
netatalk	33
edimax	25
google	16
nvidia	16
trend micro	16
apache	15

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	8
apple	7
google	4
ivanti	4
fortinet	3
smartertools	3
solarwinds	3
adobe	2
berriai	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	4
PyPI	1
npm	1

Fastest to KEV
CVE	Vendor	Days
CVE-2024-1708	ConnectWise	0
CVE-2026-31431	Linux	0
CVE-2026-32202	Microsoft	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-41091	Microsoft	0
CVE-2026-41940	WebPros	0
CVE-2026-42208	BerriAI	0
CVE-2026-42897	Microsoft	0
CVE-2026-45498	Microsoft	0
CVE-2026-9082	Drupal	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1649
CVE-2021-27102	n/a	2021-11-17	1649
CVE-2021-27101	n/a	2021-11-17	1649
CVE-2021-27103	n/a	2021-11-17	1649
CVE-2021-21017	Adobe	2021-11-17	1649
CVE-2021-28550	Adobe	2021-11-17	1649
CVE-2021-42013	Apache Software Foundation	2021-11-17	1649
CVE-2021-41773	Apache Software Foundation	2021-11-17	1649
CVE-2021-30858	Apple	2021-11-17	1649
CVE-2021-30860	Apple	2021-11-17	1649

Transactions

EXPLOIT PUBLISHED — CVE-2026-4372 (huggingface/transformers). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

64 CVEs published. 25 box scores, 39 table rows — nothing truncated.

CVE-2026-9388HIGH

Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0209   80.2     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9384HIGH

Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9385HIGH

Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9386HIGH

Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9387HIGH

Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9404HIGH

Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9405HIGH

Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9406HIGH

Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9407HIGH

Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0173   75.9     —

AFFECTED
  Product  Versions               Fixed
  A8000RU  7.1cu.643_b20200521 –  —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9367MEDIUM

NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0166   74.8     —

AFFECTED
  Product       Versions                                    Fixed
  hermes-agent  5157f5427f19488b31c6fdebbacd15d798ce7f63 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9347LOW

Edimax EW-7438RPn webs formWizSurvey os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0152   72.6     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.0 –     —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9359LOW

Edimax EW-7438RPn POST Request formHwSet command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0140   70.3     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.28a –   —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9378LOW

Edimax BR-6675nD POST Request formHwSet command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0117   65.0     —

AFFECTED
  Product    Versions  Fixed
  BR-6675nD  1.12 –    —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9361LOW

Edimax EW-7438RPn POST Request formAccep formAccept command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.7     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.12 –    —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9362LOW

Edimax EW-7438RPn Setting formConnectionSetting command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.6     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.12 –    —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9363LOW

Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.6     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.12 –    —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9379LOW

Edimax BR-6675nD POST Request formWpsStart command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.6     —

AFFECTED
  Product    Versions  Fixed
  BR-6675nD  1.12 –    —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9400LOW

Edimax BR-6675nD POST Request formUSBStorage command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.6     —

AFFECTED
  Product    Versions  Fixed
  BR-6675nD  1.12 –    —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9402LOW

Edimax BR-6675nD POST Request formWlanMP command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0116   64.6     —

AFFECTED
  Product    Versions  Fixed
  BR-6675nD  1.12 –    —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9351MEDIUM

NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0068   49.4     —

AFFECTED
  Product       Versions    Fixed
  hermes-agent  2026.4.0 –  —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-22 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-9345HIGH

Edimax EW-7438RPn webs formWizSurvey buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0054   43.1     —

AFFECTED
  Product     Versions  Fixed
  EW-7438RPn  1.0 –     —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9382HIGH

Edimax BR-6675nD POST Request formPPTPSetup buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0054   43.1     —

AFFECTED
  Product    Versions  Fixed
  BR-6675nD  1.12 –    —

TIMELINE
  May 23  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-4372HIGH

huggingface huggingface/transformers — Arbitrary Remote Code Execution via `_attn_implementation_internal` Config Injection in huggingface/transformers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0048   39.2     —

AFFECTED
  Product                   Versions       Fixed
  huggingface/transformers  unspecified –  —

TIMELINE
  Mar 18  Reserved by CNA
  May 24  Public exploit reference published
  May 24  Published (CNA: @huntr_ai)

CWE-502, CWE-1066 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Analyzed

CVE-2026-48829HIGH

GNU GNU SASL — In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0046   37.6     —

AFFECTED
  Product   Versions     Fixed
  GNU SASL  unspecified  —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: mitre)

CWE-476 · CNA: mitre · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-9397HIGH

Besen BS20 EV Charging Station OTA Update Installation improper authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   H   H   H    8.2   .0045   37.5     —

AFFECTED
  Product                   Versions    Fixed
  BS20 EV Charging Station  20260426 –  —

TIMELINE
  May 24  Reserved by CNA
  May 24  Published (CNA: VulDB)

CWE-266, CWE-285 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-9344	7.4	36.9	Edimax	EW-7438RPn	CWE-119	Edimax EW-7438RPn webs formWpsStart stack-based overflow
CVE-2026-9346	7.4	36.9	Edimax	EW-7438RPn	CWE-119	Edimax EW-7438RPn webs formWirelessTbl buffer overflow
CVE-2026-9348	7.4	36.9	Edimax	EW-7438RPn	CWE-119	Edimax EW-7438RPn webs mp stack-based overflow
CVE-2026-9360	7.4	36.9	Edimax	EW-7438RPn	CWE-119	Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflow
CVE-2026-9380	7.4	36.9	Edimax	BR-6675nD	CWE-119	Edimax BR-6675nD POST Request formL2TPSetup buffer overflow
CVE-2026-9381	7.4	36.9	Edimax	BR-6675nD	CWE-119	Edimax BR-6675nD POST Request formPPPoESetup buffer overflow
CVE-2026-9393	7.4	36.9	H3C	Magic B0	CWE-119	H3C Magic B0 aspForm Edit_BasicSSID_5G buffer overflow
CVE-2026-9399	7.4	36.9	Edimax	BR-6675nD	CWE-119	Edimax BR-6675nD POST Request formsetPPPoE buffer overflow
CVE-2026-9401	7.4	36.9	Edimax	BR-6675nD	CWE-119	Edimax BR-6675nD POST Request formWanTcpipSetup buffer overflow
CVE-2026-9403	7.4	36.9	Edimax	BR-6675nD	CWE-119	Edimax BR-6675nD POST Request formWlSiteSurvey buffer overflow
CVE-2026-9389	7.4	36.3	Tenda	F456	CWE-119	Tenda F456 L7Im frmL7ImForm buffer overflow
CVE-2026-9371	2.9	36.2	ItzCrazyKns	Vane	CWE-287	ItzCrazyKns Vane API route.ts missing authentication
CVE-2026-9349	5.5	33.8	calcom	cal.diy	CWE-200	calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx …
CVE-2026-9368	5.5	30.8	NousResearch	hermes-agent	CWE-264	NousResearch hermes-agent Environment Variable code_execution_tool.py execute…
CVE-2026-9373	6.3	28.4	n/a	JeecgBoot	CWE-287	JeecgBoot OpenAPI Endpoint call improper authentication
CVE-2026-9354	5.5	26.1	NousResearch	hermes-agent	CWE-74	NousResearch hermes-agent Slack Agent/Mattermost Agent escape output
CVE-2026-9358	2.1	24.8	n/a	postcss-selector-parser	CWE-404	postcss-selector-parser AST Serialization container.js toString recursion
CVE-2026-9365	2.9	24.1	n/a	Ettercap	CWE-119	Ettercap GG Dissector ec_gg.c FUNC_DECODER heap-based overflow
CVE-2026-9353	5.5	22.5	NousResearch	hermes-agent	CWE-74	NousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py inje…
CVE-2026-9366	5.5	22.5	NousResearch	hermes-agent	CWE-74	NousResearch hermes-agent prompt_builder.py _scan_context_content injection
CVE-2026-3515	8.5	21.8	prefecthq	prefecthq/prefect	CWE-88	Argument Injection in prefecthq/prefect
CVE-2026-9398	1.3	21.4	Besen	BS20 EV Charging Station	CWE-287	Besen BS20 EV Charging Station BLE/WiFi authentication replay
CVE-2026-9352	5.5	20.5	NousResearch	hermes-agent	CWE-200	NousResearch hermes-agent Messaging Gateway local.py _make_run_env informatio…
CVE-2026-9357	2.0	19.8	n/a	vBulletin	CWE-79	vBulletin Login cross site scripting
CVE-2026-9350	5.5	19.7	NousResearch	hermes-agent	CWE-862	NousResearch hermes-agent Batch Runner approval.py check_all_command_guards a…
CVE-2026-9372	5.5	19.7	ItzCrazyKns	Vane	CWE-918	ItzCrazyKns Vane Model Provider API route.ts server-side request forgery
CVE-2026-9396	2.9	18.4	Besen	BS20 EV Charging Station	CWE-1021	Besen BS20 EV Charging Station Firmware Version Check ui layer
CVE-2026-9355	5.5	16.6	SourceCodester	Hospitals Patient Records Management System	CWE-74	SourceCodester Hospitals Patient Records Management System Master.php save_pa…
CVE-2026-9356	5.5	16.6	SourceCodester	Hospitals Patient Records Management System	CWE-74	SourceCodester Hospitals Patient Records Management System manage_history.php…
CVE-2026-9364	5.5	16.6	projectworlds	Online Art Gallery Shop	CWE-74	projectworlds Online Art Gallery Shop adminHome.php sql injection
CVE-2026-9383	5.5	16.6	itsourcecode	Electronic Judging System	CWE-74	itsourcecode Electronic Judging System login.php sql injection
CVE-2026-9376	2.1	16.4	n/a	JPress	CWE-266	JPress UCenter Article Submission Endpoint doWriteSave improper authorization
CVE-2026-9369	1.9	13.4	NousResearch	hermes-agent	CWE-697	NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard…
CVE-2026-9370	2.9	10.0	ulisesbocchio	jasypt-spring-boot	CWE-759	ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecret…
CVE-2026-9377	1.9	10.0	SourceCodester	SUP Online Shopping	CWE-79	SourceCodester SUP Online Shopping productedit.php cross site scripting
CVE-2026-9374	5.3	9.2	yangzongzhuan	RuoYi-Vue	CWE-284	yangzongzhuan RuoYi-Vue Common Upload Endpoint upload FileUploadUtils.upload …
CVE-2026-9394	1.3	8.9	Besen	BS20 EV Charging Station	CWE-521	Besen BS20 EV Charging Station Bluetooth Low Energy weak password
CVE-2026-48832	3.5	8.1	SPIP	SPIP	CWE-601	action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirec…
CVE-2026-9395	2.0	5.2	Besen	BS20 EV Charging Station	CWE-522	Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-24 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.