boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Saturday, May 30, 2026 · all times UTC← 2026-05-29 · archive · 2026-05-31 →

51 CVEs published, led by Aiopmsd (8).

51 CVEs published May 30, 2026: 1 critical, 33 high, 6 medium, 11 low; 0 in the KEV catalog at press time; 3 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 26 in the results table.

Standings

League
MTDYTD2025 same span2025 full
CVEs published3194438610272564
KEV catalog size1671

132 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux6419687961626912720.27.8.0013+476 ▲
microsoft170545463741142380275.07.8.0048-17 ▼
google168174101203567442.38.3.0023+167 ▲
red hat4164827263400.07.2.0037+27 ▲
apple204701227194714.96.2.0034+20 ▲
canonical14140455000.05.5.0009+14 ▲
freebsd770520000.07.8.0020+7 ▲
suse220200000.08.2.0020+2 ▲
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco513312096861.58.6.1247+2 ▲
checkpoint660330300.06.5.0338+6 ▲
fortinet16130028350.07.9.4330-2 ▼
ivanti25010033480.08.8.8056+1 ▲
f52320007133.39.2.0996+2 ▲
ubiquiti231200400.08.8.0068+2 ▲
palo alto networks220000142100.0—.6299+2 ▲
broadcom02000042100.0—.19900
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache21324151204013.17.4.0064+12 ▲
gitlab7901604222.24.3.0032+7 ▲
mozilla6632101300.08.8.0042+6 ▲
drupal5511305120.05.1.0026+5 ▲
docker330300100.08.8.0022+3 ▲
github221100000.08.1.0347+2 ▲
jenkins00000060———0
joomla00000010———0
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
ibm49491024150700.07.5.0028+49 ▲
oracle2527815404000.08.1.0027+25 ▲
progress440400900.07.5.0036+4 ▲
adobe14010075375.08.6.2776-2 ▼
veeam331200400.08.6.0040+3 ▲
solarwinds031000113100.09.8.83620
zohocorp220110000.07.1.0104+2 ▲
atlassian000000130———0
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
synology181823103000.05.6.0025+18 ▲
d-link23011026133.37.3.0059+1 ▲
hitachi energy220020000.05.7.0014+2 ▲
siemens110100100.08.7.0032+1 ▲
hikvision01000021100.0—1.00000
dahua00000020———0
qnap00000080———0
schneider electric00000010———0
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
edimax4747029018100.07.4.0059+47 ▲
concrete cms4444191321000.05.7.0015+44 ▲
open ises4444221210000.07.1.0021+44 ▲
helmholz424203930000.07.1.0026+42 ▲
mb connect line424203930000.07.1.0026+42 ▲
totolink343402509000.08.9.0191+34 ▲
netatalk3333113910000.06.4.0030+33 ▲
nvidia333381870000.07.8.0038+33 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-31431.9991100.07.8
CVE-2008-4250.987599.9—
CVE-2026-0257.939199.8—
CVE-2026-43284.932499.88.8
CVE-2026-43500.928599.87.8
CVE-2010-0249.918899.8—
CVE-2026-20182.915299.8—
CVE-2026-42208.894299.8—
CVE-2026-9082.883299.89.8
CVE-2009-3459.865899.7—
Highest CVSS
CVECVSSEPSSNote
CVE-2026-4817210.0.1891KEV
CVE-2026-805410.0.0158
CVE-2026-4508710.0.0147
CVE-2026-4919910.0.0134
CVE-2026-4399710.0.0098
CVE-2026-4282610.0.0084
CVE-2026-2022310.0.0083
CVE-2026-4400510.0.0083
CVE-2026-4400610.0.0081
CVE-2026-4684010.0.0073
Most disclosures (vendor)
VendorCVEs
linux641
microsoft170
google168
ibm49
edimax47
concrete cms44
open ises44
helmholz42
mb connect line42
red hat41
Most KEV additions (YTD)
VendorKEV
microsoft27
cisco8
apple7
google4
ivanti4
synacor4
adobe3
fortinet3
smartertools3
solarwinds3
Most-affected ecosystems
EcosystemAdvisories
Maven12
Packagist7
PyPI2
crates.io2
npm2
Fastest to KEV
CVEVendorDays
CVE-2008-4250Microsoft0
CVE-2009-1537Microsoft0
CVE-2009-3459Adobe0
CVE-2010-0249Microsoft0
CVE-2010-0806Microsoft0
CVE-2025-34291Langflow0
CVE-2026-0257Palo Alto Networks0
CVE-2026-0300Palo Alto Networks0
CVE-2026-20182Cisco0
CVE-2026-31431Linux0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171655
CVE-2021-27102Accellion2021-11-171655
CVE-2021-27101Accellion2021-11-171655
CVE-2021-27103Accellion2021-11-171655
CVE-2021-21017Adobe2021-11-171655
CVE-2021-28550Adobe2021-11-171655
CVE-2021-42013Apache2021-11-171655
CVE-2021-41773Apache2021-11-171655
CVE-2021-30858Apple2021-11-171655
CVE-2021-30860Apple2021-11-171655

Transactions

EXPLOIT PUBLISHED — CVE-2026-5071 (zephyrproject-rtos Zephyr). Public exploit reference added.

DUE DATE PASSED — CVE-2026-42897 (Microsoft Exchange Server 2016 Cumulative Update 23). CISA remediation deadline was May 29, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-48172 (LiteSpeed Technologies cPanel Plugin). CISA remediation deadline was May 29, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

51 CVEs published. 25 box scores, 26 table rows — nothing truncated.

CVE-2026-46242HIGH
Linux Linux — eventpoll: fix ep_remove struct eventpoll / struct file UAF
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0323   87.3     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    a1f93804449d13f97dabd4b996817de4bf1ed67a –  —
  Linux    6.4 –                                       6.1.178
TIMELINE
  May 13  Reserved by CNA
  May 30  Published (CNA: Linux)
CWE-416 · CNA: Linux · CVSS v3.1 · 7 references · NVD status: Modified
CVE-2026-10127LOW
Edimax BR-6478AC POST Request formStaDrvSetup command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0126   67.3     —
AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-7465HIGH
brainstormforce Spectra Gutenberg Blocks – Website Builder for the Block Editor — Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0117   65.0     —
AFFECTED
  Product                                                          Versions     Fixed
  Spectra Gutenberg Blocks – Website Builder for the Block Editor  unspecified  —
TIMELINE
  Apr 29  Reserved by CNA
  May 30  Published (CNA: Wordfence)
CWE-269 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred
CVE-2018-25412CRITICAL
Deltasql Delta Sql — Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0077   52.8     —
AFFECTED
  Product    Versions  Fixed
  Delta Sql  1.8.2 –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-306 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Analyzed
CVE-2026-10126HIGH
Edimax BR-6478AC POST Request formQoS buffer overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0075   52.2     —
AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2018-25408HIGH
Openises Open ISES Project — The Open ISES Project 3.30A Path Traversal Arbitrary File Download
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0064   47.9     —
AFFECTED
  Product            Versions  Fixed
  Open ISES Project  3.30A –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-22 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-7459HIGH
eskapism Simple History – Track, Log, and Audit WordPress Changes — Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  U  H  H  H    7.5   .0059   45.8     —
AFFECTED
  Product                                                   Versions     Fixed
  Simple History – Track, Log, and Audit WordPress Changes  unspecified  —
TIMELINE
  Apr 29  Reserved by CNA
  May 30  Published (CNA: Wordfence)
CWE-640 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Deferred
CVE-2018-25426HIGH
WinMTR 0.91 Denial of Service via Buffer Overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0051   41.6     —
AFFECTED
  Product  Versions  Fixed
  WinMTR   0.91 –    —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-120 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed
CVE-2026-10119HIGH
TRENDnet TEW-432BRP formSetMACFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   39.0     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10122HIGH
TRENDnet TEW-432BRP formSetProtocolFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   39.0     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10123HIGH
TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   39.0     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10124HIGH
Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   39.0     —
AFFECTED
  Product  Versions  Fixed
  Tomato   1.0 –     —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10120HIGH
TRENDnet TEW-432BRP formSetFirewallRule stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0046   38.4     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10121HIGH
TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0045   37.4     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10125HIGH
Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0045   37.4     —
AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10116LOW
n/a Open5GS — Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0039   32.4     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-9757HIGH
ninjew GEO my WP — GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0034   27.6     —
AFFECTED
  Product    Versions     Fixed
  GEO my WP  unspecified  —
TIMELINE
  May 27  Reserved by CNA
  May 30  Published (CNA: Wordfence)
CWE-89 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred
CVE-2018-25421HIGH
Openstamanager Open STA Manager — Open STA Manager 2.3 Arbitrary File Download via Path Traversal
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   N   N    7.1   .0033   26.4     —
AFFECTED
  Product           Versions  Fixed
  Open STA Manager  2.3 –     —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-22 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2018-25409HIGH
Simpkh SIM-PKH — SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0032   25.5     —
AFFECTED
  Product  Versions  Fixed
  SIM-PKH  2.4.1 –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-434 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2018-25424HIGH
Livebms Gate Pass Management System — Gate Pass Management System 2.1 SQL Injection via login-exec.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0032   24.9     —
AFFECTED
  Product                      Versions  Fixed
  Gate Pass Management System  2.1 –     —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10110MEDIUM
code-projects Student Details Management System index.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0031   24.2     —
AFFECTED
  Product                            Versions  Fixed
  Student Details Management System  1.0 –     —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-10115LOW
n/a Open5GS — Open5GS Shared NF-profile nnrf-handler.c denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0031   23.6     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2026-10113LOW
n/a Open5GS — Open5GS Shared NF-profile nnrf-handler.c denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0030   22.2     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-10153LOW
westboy CicadasCMS AbstractCacheManager.java search cross site scripting
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0028   20.6     —
AFFECTED
  Product     Versions                                    Fixed
  CicadasCMS  2431154dac8d0735e04f1fd2a3c3556668fc8dab –  —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-10156LOW
n/a Open5GS — Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0028   20.2     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-400, CWE-404 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2018-254138.820.1AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via search.php
CVE-2018-254188.820.1AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via year.php
CVE-2026-101142.120.2n/aOpen5GSCWE-119Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write
CVE-2026-101172.119.4n/aOpen5GSCWE-404Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service
CVE-2018-254058.819.3EndonesiaeNdonesia PortalCWE-89eNdonesia Portal 8.7 SQL Injection via mod.php
CVE-2018-254068.819.3EndonesiaeNdonesia PortalCWE-89eNdonesia Portal 8.7 SQL Injection via mod.php
CVE-2018-254078.819.3EndonesiaeNdonesia PortalCWE-89eNdonesia Portal 8.7 SQL Injection via mod.php
CVE-2018-254118.819.3M-GbMGB OpenSource GuestbookCWE-89MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php
CVE-2018-254148.819.3AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via actor.php
CVE-2018-254158.819.3AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via director Parameter
CVE-2018-254168.819.3AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via country.php
CVE-2018-254178.819.3AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via quality.php
CVE-2018-254198.819.3AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via genre.php
CVE-2018-254208.819.3AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via watch.php
CVE-2018-254258.819.3YotYot CMSCWE-89Yot CMS 3.3.1 SQL Injection via aid and cid Parameters
CVE-2026-488405.318.4EximEximCWE-839Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain sho…
CVE-2018-254228.818.1spider312MOGG web simulator ScriptCWE-89MOGG web simulator Script All Version SQL Injection via play.php
CVE-2026-101115.517.8sambitrajSTUDENT-MANAGEMENT-SYSTEMCWE-74sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection
CVE-2026-101545.313.2DolibarrERP CRMCWE-285Dolibarr ERP CRM messaging.php authorization
CVE-2018-254107.112.9SimpkhSIM-PKHCWE-89SIM-PKH 2.4.1 SQL Injection via media.php id Parameter
CVE-2026-101522.111.0TaleLinlin-cms-spring-bootCWE-266TaleLin lin-cms-spring-boot book Endpoint BookController.java access control
CVE-2026-101552.011.0BdtaskMulti-Store Inventory Management SystemCWE-74Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php a…
CVE-2026-101121.911.0sambitrajSTUDENT-MANAGEMENT-SYSTEMCWE-79sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting
CVE-2026-85946.29.9NEZUMIText::LineFoldCWE-405Text::LineFold versions through 2019.001 for Perl duplicate the output based …
CVE-2026-50717.86.5zephyrproject-rtosZephyrCWE-125can: Local Denial of Service via SocketCAN Send
CVE-2018-254236.93.8ArmcodeArm WhoisCWE-120Arm Whois 3.11 Denial of Service via Buffer Overflow

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-30 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion.