boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Saturday, May 30, 2026 · all times UTC← 2026-05-29 · archive · 2026-05-31 →

Security Box Score — May 30, 2026

51 CVEs published, led by Aiopmsd (8).

51 CVEs published May 30, 2026: 1 critical, 33 high, 6 medium, 11 low; 0 in the KEV catalog at press time; 3 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 26 in the results table.

Standings

League
MTDYTD2025 same span2025 full
CVEs published31984410——
KEV catalog size1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

134 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux6419677961627111120.27.8.0013+476 ▲
microsoft166536463741142286193.57.8.0047-18 ▼
google168175101243567742.38.3.0022+167 ▲
red hat4294836428200.06.6.0040+19 ▲
apple225211733188713.56.2.0023+22 ▲
canonical14140455000.05.5.0009+14 ▲
freebsd770520000.07.8.0020+7 ▲
suse220200000.08.2.0020+2 ▲
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco512534056866.77.8.1576+5 ▲
fortinet17430028342.99.1.8584-2 ▼
checkpoint660330300.06.5.0338+6 ▲
ivanti25230025480.08.8.8056+2 ▲
ubiquiti231200300.08.8.0068+2 ▲
f52220004150.09.2.3901+2 ▲
palo alto networks221100132100.08.6.6281+2 ▲
zyxel110010900.06.5.0023+1 ▲
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache21344151403312.97.3.0062+12 ▲
gitlab7701604228.64.3.0024+7 ▲
mozilla663210900.08.8.0042+6 ▲
drupal5511304120.05.1.0026+5 ▲
docker330300000.08.8.0022+3 ▲
github221100000.08.1.0347+2 ▲
wordpress00000020———0
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
ibm49491024150600.07.5.0028+49 ▲
oracle2528915402700.08.1.0027+25 ▲
progress440400600.07.5.0036+4 ▲
veeam331200100.08.6.0051+3 ▲
solarwinds032100103100.09.8.83620
zohocorp220110000.07.1.0104+2 ▲
adobe020200192100.08.6.0368-2 ▼
atlassian000000130———0
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
synology181823103000.05.6.0025+18 ▲
d-link220110300.07.3.0036+2 ▲
hitachi energy220020000.05.7.0014+2 ▲
siemens110100000.08.7.0032+1 ▲
tp-link00000010———0
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
edimax4747029018100.07.4.0059+47 ▲
concrete cms4444191321000.05.7.0015+44 ▲
open ises4444221210000.07.1.0021+44 ▲
helmholz424203930000.07.1.0026+42 ▲
mb connect line424203930000.07.1.0026+42 ▲
totolink343402509000.08.9.0191+34 ▲
netatalk3333113910000.06.4.0030+33 ▲
nvidia333381870000.07.8.0038+33 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-31431.9991100.07.8
CVE-2026-0257.939199.87.8
CVE-2026-43284.932499.88.8
CVE-2026-43500.928599.87.8
CVE-2026-20182.915299.810.0
CVE-2026-42208.894299.89.3
CVE-2026-9082.883299.89.8
CVE-2026-42271.835499.78.7
CVE-2026-41089.796299.69.8
CVE-2026-42897.712099.48.1
Highest CVSS
CVECVSSEPSSNote
CVE-2026-2018210.0.9152KEV
CVE-2026-4817210.0.1891KEV
CVE-2026-4508710.0.1296
CVE-2026-805410.0.0158
CVE-2026-4919910.0.0134
CVE-2026-4399710.0.0098
CVE-2026-4282610.0.0084
CVE-2026-2022310.0.0083
CVE-2026-4400510.0.0083
CVE-2026-4400610.0.0081
Most disclosures (vendor)
VendorCVEs
linux641
google168
microsoft166
ibm49
edimax47
concrete cms44
open ises44
helmholz42
mb connect line42
red hat42
Most KEV additions (YTD)
VendorKEV
microsoft19
cisco8
apple7
google4
ivanti4
fortinet3
smartertools3
solarwinds3
adobe2
berriai2
Most-affected ecosystems
EcosystemAdvisories
Maven12
Packagist7
PyPI2
crates.io2
npm2
Fastest to KEV
CVEVendorDays
CVE-2026-31431Linux0
CVE-2026-34926Trend Micro, Inc.0
CVE-2026-41091Microsoft0
CVE-2026-42208BerriAI0
CVE-2026-42897Microsoft0
CVE-2026-45321@tanstack0
CVE-2026-45498Microsoft0
CVE-2026-48027nrwl0
CVE-2026-48172LiteSpeed Technologies0
CVE-2026-9082Drupal0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104n/a2021-11-171655
CVE-2021-27102n/a2021-11-171655
CVE-2021-27101n/a2021-11-171655
CVE-2021-27103n/a2021-11-171655
CVE-2021-21017Adobe2021-11-171655
CVE-2021-28550Adobe2021-11-171655
CVE-2021-42013Apache Software Foundation2021-11-171655
CVE-2021-41773Apache Software Foundation2021-11-171655
CVE-2021-30858Apple2021-11-171655
CVE-2021-30860Apple2021-11-171655

Transactions

EXPLOIT PUBLISHED — CVE-2026-5071 (zephyrproject-rtos Zephyr). Public exploit reference added.

DUE DATE PASSED — CVE-2026-42897 (Microsoft Exchange Server 2016 Cumulative Update 23). CISA remediation deadline was May 29, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-48172 (LiteSpeed Technologies cPanel Plugin). CISA remediation deadline was May 29, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

51 CVEs published. 25 box scores, 26 table rows — nothing truncated.

CVE-2026-46242HIGH
Linux Linux — eventpoll: fix ep_remove struct eventpoll / struct file UAF
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0315   87.0     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    a1f93804449d13f97dabd4b996817de4bf1ed67a –  —
  Linux    6.4 –                                       6.1.178
TIMELINE
  May 13  Reserved by CNA
  May 30  Published (CNA: Linux)
CWE-416 · CNA: Linux · CVSS v3.1 · 7 references · NVD status: Modified
CVE-2026-10127LOW
Edimax BR-6478AC POST Request formStaDrvSetup command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0126   67.4     —
AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-7465HIGH
brainstormforce Spectra Gutenberg Blocks – Website Builder for the Block Editor — Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0117   65.1     —
AFFECTED
  Product                                                          Versions     Fixed
  Spectra Gutenberg Blocks – Website Builder for the Block Editor  unspecified  —
TIMELINE
  Apr 29  Reserved by CNA
  May 30  Published (CNA: Wordfence)
CWE-269 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred
CVE-2018-25412CRITICAL
Deltasql Delta Sql — Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0077   52.9     —
AFFECTED
  Product    Versions  Fixed
  Delta Sql  1.8.2 –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-306 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Analyzed
CVE-2026-10126HIGH
Edimax BR-6478AC POST Request formQoS buffer overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0075   52.3     —
AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2018-25408HIGH
Openises Open ISES Project — The Open ISES Project 3.30A Path Traversal Arbitrary File Download
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0064   47.8     —
AFFECTED
  Product            Versions  Fixed
  Open ISES Project  3.30A –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-22 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-7459HIGH
eskapism Simple History – Track, Log, and Audit WordPress Changes — Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  U  H  H  H    7.5   .0059   45.7     —
AFFECTED
  Product                                                   Versions     Fixed
  Simple History – Track, Log, and Audit WordPress Changes  unspecified  —
TIMELINE
  Apr 29  Reserved by CNA
  May 30  Published (CNA: Wordfence)
CWE-640 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Deferred
CVE-2018-25426HIGH
WinMTR 0.91 Denial of Service via Buffer Overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0051   41.4     —
AFFECTED
  Product  Versions  Fixed
  WinMTR   0.91 –    —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-120 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed
CVE-2026-10119HIGH
TRENDnet TEW-432BRP formSetMACFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10122HIGH
TRENDnet TEW-432BRP formSetProtocolFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10123HIGH
TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10124HIGH
Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —
AFFECTED
  Product  Versions  Fixed
  Tomato   1.0 –     —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10120HIGH
TRENDnet TEW-432BRP formSetFirewallRule stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0046   38.1     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10121HIGH
TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0045   37.0     —
AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10125HIGH
Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0045   37.0     —
AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10116LOW
n/a Open5GS — Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0039   31.9     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-9757HIGH
ninjew GEO my WP — GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0034   27.0     —
AFFECTED
  Product    Versions     Fixed
  GEO my WP  unspecified  —
TIMELINE
  May 27  Reserved by CNA
  May 30  Published (CNA: Wordfence)
CWE-89 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred
CVE-2018-25421HIGH
Openstamanager Open STA Manager — Open STA Manager 2.3 Arbitrary File Download via Path Traversal
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   N   N    7.1   .0033   25.8     —
AFFECTED
  Product           Versions  Fixed
  Open STA Manager  2.3 –     —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-22 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2018-25409HIGH
Simpkh SIM-PKH — SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0032   24.8     —
AFFECTED
  Product  Versions  Fixed
  SIM-PKH  2.4.1 –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-434 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2018-25424HIGH
Livebms Gate Pass Management System — Gate Pass Management System 2.1 SQL Injection via login-exec.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   L   N    8.8   .0032   24.2     —
AFFECTED
  Product                      Versions  Fixed
  Gate Pass Management System  2.1 –     —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulnCheck)
CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-10110MEDIUM
code-projects Student Details Management System index.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0031   23.5     —
AFFECTED
  Product                            Versions  Fixed
  Student Details Management System  1.0 –     —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-10115LOW
n/a Open5GS — Open5GS Shared NF-profile nnrf-handler.c denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0031   23.0     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2026-10113LOW
n/a Open5GS — Open5GS Shared NF-profile nnrf-handler.c denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0030   21.6     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 29  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-10153LOW
westboy CicadasCMS AbstractCacheManager.java search cross site scripting
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0028   19.9     —
AFFECTED
  Product     Versions                                    Fixed
  CicadasCMS  2431154dac8d0735e04f1fd2a3c3556668fc8dab –  —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-10156LOW
n/a Open5GS — Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0028   19.6     —
AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —
TIMELINE
  May 30  Reserved by CNA
  May 30  Published (CNA: VulDB)
CWE-400, CWE-404 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2018-254138.819.5AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via search.php
CVE-2018-254188.819.5AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via year.php
CVE-2026-101142.119.5n/aOpen5GSCWE-119Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write
CVE-2026-101172.118.8n/aOpen5GSCWE-404Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service
CVE-2018-254058.818.7EndonesiaeNdonesia PortalCWE-89eNdonesia Portal 8.7 SQL Injection via mod.php
CVE-2018-254068.818.7EndonesiaeNdonesia PortalCWE-89eNdonesia Portal 8.7 SQL Injection via mod.php
CVE-2018-254078.818.7EndonesiaeNdonesia PortalCWE-89eNdonesia Portal 8.7 SQL Injection via mod.php
CVE-2018-254118.818.7M-GbMGB OpenSource GuestbookCWE-89MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php
CVE-2018-254148.818.7AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via actor.php
CVE-2018-254158.818.7AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via director Parameter
CVE-2018-254168.818.7AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via country.php
CVE-2018-254178.818.7AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via quality.php
CVE-2018-254198.818.7AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via genre.php
CVE-2018-254208.818.7AiopmsdAiOPMSD FinalCWE-89AiOPMSD Final 1.0.0 SQL Injection via watch.php
CVE-2018-254258.818.7YotYot CMSCWE-89Yot CMS 3.3.1 SQL Injection via aid and cid Parameters
CVE-2026-488405.317.8EximEximCWE-839Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain sho…
CVE-2018-254228.817.5spider312MOGG web simulator ScriptCWE-89MOGG web simulator Script All Version SQL Injection via play.php
CVE-2026-101115.517.2sambitrajSTUDENT-MANAGEMENT-SYSTEMCWE-74sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection
CVE-2026-101545.312.7DolibarrERP CRMCWE-285Dolibarr ERP CRM messaging.php authorization
CVE-2018-254107.112.4SimpkhSIM-PKHCWE-89SIM-PKH 2.4.1 SQL Injection via media.php id Parameter
CVE-2026-101522.110.5TaleLinlin-cms-spring-bootCWE-266TaleLin lin-cms-spring-boot book Endpoint BookController.java access control
CVE-2026-101552.010.6BdtaskMulti-Store Inventory Management SystemCWE-74Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php a…
CVE-2026-101121.910.6sambitrajSTUDENT-MANAGEMENT-SYSTEMCWE-79sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting
CVE-2026-85946.29.5NEZUMIText::LineFoldCWE-405Text::LineFold versions through 2019.001 for Perl duplicate the output based …
CVE-2026-50717.86.1zephyrproject-rtosZephyrCWE-125can: Local Denial of Service via SocketCAN Send
CVE-2018-254236.93.5ArmcodeArm WhoisCWE-120Arm Whois 3.11 Denial of Service via Buffer Overflow

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-30 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.