{
  "day": "2026-05-30",
  "boundary": "UTC calendar day",
  "published_count": 51,
  "by_severity": {
    "CRITICAL": 1,
    "HIGH": 33,
    "MEDIUM": 6,
    "LOW": 11
  },
  "kev_count": 0,
  "exploit_reference_count": 3,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-46242",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.03234,
      "epss_percentile": 0.8726,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "eventpoll: fix ep_remove struct eventpoll / struct file UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46242"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-10127",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.01262,
      "epss_percentile": 0.673,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6478AC",
      "cwe": "CWE-74",
      "title": "Edimax BR-6478AC POST Request formStaDrvSetup command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10127"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-7465",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01174,
      "epss_percentile": 0.6503,
      "kev": false,
      "kev_due_at": null,
      "vendor": "brainstormforce",
      "product": "Spectra Gutenberg Blocks – Website Builder for the Block Editor",
      "cwe": "CWE-269",
      "title": "Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7465"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2018-25412",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00771,
      "epss_percentile": 0.52825,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Deltasql",
      "product": "Delta Sql",
      "cwe": "CWE-306",
      "title": "Delta Sql 1.8.2 Arbitrary File Upload via docs_upload.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25412"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-10126",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00753,
      "epss_percentile": 0.52231,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6478AC",
      "cwe": "CWE-119",
      "title": "Edimax BR-6478AC POST Request formQoS buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10126"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2018-25408",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00638,
      "epss_percentile": 0.47854,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Openises",
      "product": "Open ISES Project",
      "cwe": "CWE-22",
      "title": "The Open ISES Project 3.30A Path Traversal Arbitrary File Download",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25408"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-7459",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00593,
      "epss_percentile": 0.4575,
      "kev": false,
      "kev_due_at": null,
      "vendor": "eskapism",
      "product": "Simple History – Track, Log, and Audit WordPress Changes",
      "cwe": "CWE-640",
      "title": "Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7459"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2018-25426",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00514,
      "epss_percentile": 0.41611,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Winmtr",
      "product": "WinMTR",
      "cwe": "CWE-120",
      "title": "WinMTR 0.91 Denial of Service via Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25426"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-10119",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00472,
      "epss_percentile": 0.39033,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-432BRP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-432BRP formSetMACFilter stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10119"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-10122",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00472,
      "epss_percentile": 0.39036,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-432BRP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-432BRP formSetProtocolFilter stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10122"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-10123",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00472,
      "epss_percentile": 0.39036,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-432BRP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10123"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-10124",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00472,
      "epss_percentile": 0.39033,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shibby",
      "product": "Tomato",
      "cwe": "CWE-119",
      "title": "Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10124"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-10120",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00463,
      "epss_percentile": 0.38421,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-432BRP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-432BRP formSetFirewallRule stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10120"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-10121",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00447,
      "epss_percentile": 0.37361,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-432BRP",
      "cwe": "CWE-119",
      "title": "TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10121"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-10125",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00447,
      "epss_percentile": 0.37363,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6478AC",
      "cwe": "CWE-119",
      "title": "Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10125"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-10116",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00391,
      "epss_percentile": 0.32382,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-404",
      "title": "Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10116"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-9757",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00344,
      "epss_percentile": 0.2759,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ninjew",
      "product": "GEO my WP",
      "cwe": "CWE-89",
      "title": "GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9757"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2018-25421",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00334,
      "epss_percentile": 0.26425,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Openstamanager",
      "product": "Open STA Manager",
      "cwe": "CWE-22",
      "title": "Open STA Manager 2.3 Arbitrary File Download via Path Traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25421"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2018-25409",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00325,
      "epss_percentile": 0.25494,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Simpkh",
      "product": "SIM-PKH",
      "cwe": "CWE-434",
      "title": "SIM-PKH 2.4.1 Arbitrary File Upload via aksi_pengurus.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25409"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2018-25424",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0032,
      "epss_percentile": 0.24866,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Livebms",
      "product": "Gate Pass Management System",
      "cwe": "CWE-89",
      "title": "Gate Pass Management System 2.1 SQL Injection via login-exec.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25424"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-10110",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00313,
      "epss_percentile": 0.24165,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Student Details Management System",
      "cwe": "CWE-74",
      "title": "code-projects Student Details Management System index.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10110"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-10115",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00309,
      "epss_percentile": 0.23636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-404",
      "title": "Open5GS Shared NF-profile nnrf-handler.c denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10115"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-10113",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00296,
      "epss_percentile": 0.22225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-404",
      "title": "Open5GS Shared NF-profile nnrf-handler.c denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10113"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-10153",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0028,
      "epss_percentile": 0.20582,
      "kev": false,
      "kev_due_at": null,
      "vendor": "westboy",
      "product": "CicadasCMS",
      "cwe": "CWE-79",
      "title": "westboy CicadasCMS AbstractCacheManager.java search cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10153"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-10156",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00277,
      "epss_percentile": 0.20196,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-400",
      "title": "Open5GS nf-instances Endpoint nnrf-handler.c handle_amf_info resource consumption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10156"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2018-25413",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00276,
      "epss_percentile": 0.20121,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via search.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25413"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2018-25418",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00276,
      "epss_percentile": 0.2012,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via year.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25418"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-10114",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00276,
      "epss_percentile": 0.20164,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-119",
      "title": "Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10114"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-10117",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00271,
      "epss_percentile": 0.19392,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-404",
      "title": "Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10117"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2018-25405",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19324,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Endonesia",
      "product": "eNdonesia Portal",
      "cwe": "CWE-89",
      "title": "eNdonesia Portal 8.7 SQL Injection via mod.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25405"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2018-25406",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19324,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Endonesia",
      "product": "eNdonesia Portal",
      "cwe": "CWE-89",
      "title": "eNdonesia Portal 8.7 SQL Injection via mod.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25406"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2018-25407",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19324,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Endonesia",
      "product": "eNdonesia Portal",
      "cwe": "CWE-89",
      "title": "eNdonesia Portal 8.7 SQL Injection via mod.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25407"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2018-25411",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "M-Gb",
      "product": "MGB OpenSource Guestbook",
      "cwe": "CWE-89",
      "title": "MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25411"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2018-25414",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via actor.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25414"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2018-25415",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19325,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via director Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25415"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2018-25416",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via country.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25416"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2018-25417",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via quality.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25417"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2018-25419",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19324,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via genre.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25419"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2018-25420",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Aiopmsd",
      "product": "AiOPMSD Final",
      "cwe": "CWE-89",
      "title": "AiOPMSD Final 1.0.0 SQL Injection via watch.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25420"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2018-25425",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0027,
      "epss_percentile": 0.19323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Yot",
      "product": "Yot CMS",
      "cwe": "CWE-89",
      "title": "Yot CMS 3.3.1 SQL Injection via aid and cid Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25425"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-48840",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00264,
      "epss_percentile": 0.18427,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Exim",
      "product": "Exim",
      "cwe": "CWE-839",
      "title": "Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48840"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2018-25422",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.18105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "spider312",
      "product": "MOGG web simulator Script",
      "cwe": "CWE-89",
      "title": "MOGG web simulator Script All Version SQL Injection via play.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25422"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-10111",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00259,
      "epss_percentile": 0.17817,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sambitraj",
      "product": "STUDENT-MANAGEMENT-SYSTEM",
      "cwe": "CWE-74",
      "title": "sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10111"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-10154",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00223,
      "epss_percentile": 0.13169,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dolibarr",
      "product": "ERP CRM",
      "cwe": "CWE-285",
      "title": "Dolibarr ERP CRM messaging.php authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10154"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2018-25410",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00221,
      "epss_percentile": 0.12928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Simpkh",
      "product": "SIM-PKH",
      "cwe": "CWE-89",
      "title": "SIM-PKH 2.4.1 SQL Injection via media.php id Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25410"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-10152",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00206,
      "epss_percentile": 0.10962,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TaleLin",
      "product": "lin-cms-spring-boot",
      "cwe": "CWE-266",
      "title": "TaleLin lin-cms-spring-boot book Endpoint BookController.java access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10152"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-10155",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00206,
      "epss_percentile": 0.11023,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bdtask",
      "product": "Multi-Store Inventory Management System",
      "cwe": "CWE-74",
      "title": "Bdtask Multi-Store Inventory Management System Accounts Report Accounts.php accounts_report_search sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10155"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-10112",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00206,
      "epss_percentile": 0.11004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sambitraj",
      "product": "STUDENT-MANAGEMENT-SYSTEM",
      "cwe": "CWE-79",
      "title": "sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10112"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-8594",
      "cvss_base": 6.2,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00197,
      "epss_percentile": 0.09859,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NEZUMI",
      "product": "Text::LineFold",
      "cwe": "CWE-405",
      "title": "Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8594"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-5071",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00167,
      "epss_percentile": 0.06462,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject-rtos",
      "product": "Zephyr",
      "cwe": "CWE-125",
      "title": "can: Local Denial of Service via SocketCAN Send",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5071"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2018-25423",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0014,
      "epss_percentile": 0.03811,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Armcode",
      "product": "Arm Whois",
      "cwe": "CWE-120",
      "title": "Arm Whois 3.11 Denial of Service via Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-25423"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-5071",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-5071 (zephyrproject-rtos Zephyr). Public exploit reference added."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-42897",
      "detail": "DUE DATE PASSED — CVE-2026-42897 (Microsoft Exchange Server 2016 Cumulative Update 23). CISA remediation deadline was May 29, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-48172",
      "detail": "DUE DATE PASSED — CVE-2026-48172 (LiteSpeed Technologies cPanel Plugin). CISA remediation deadline was May 29, 2026; still in catalog."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}