Security Box Score — May 31, 2026

51 CVEs published, led by TRENDnet (10).

51 CVEs published May 31, 2026: 0 critical, 19 high, 10 medium, 22 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 26 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	3249	4461	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

144 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	641	967	79	616	271	1	11	2	0.2	7.8	.0013	+476 ▲
microsoft	166	536	46	374	114	2	286	19	3.5	7.8	.0047	-18 ▼
google	168	175	10	124	35	6	77	4	2.3	8.3	.0022	+167 ▲
red hat	42	94	8	36	42	8	2	0	0.0	6.6	.0040	+19 ▲
apple	22	52	1	17	33	1	88	7	13.5	6.2	.0023	+22 ▲
canonical	14	14	0	4	5	5	0	0	0.0	5.5	.0009	+14 ▲
freebsd	7	7	0	5	2	0	0	0	0.0	7.8	.0020	+7 ▲
suse	2	2	0	2	0	0	0	0	0.0	8.2	.0020	+2 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	5	12	5	3	4	56	8	66.7	7.8	.1576	+5 ▲
fortinet	1	7	4	3	0	28	3	42.9	9.1	.8584	-2 ▼
checkpoint	6	6	0	3	3	3	0	0.0	6.5	.0338	+6 ▲
ivanti	2	5	2	3	0	25	4	80.0	8.8	.8056	+2 ▲
ubiquiti	2	3	1	2	0	3	0	0.0	8.8	.0068	+2 ▲
f5	2	2	2	0	0	4	1	50.0	9.2	.3901	+2 ▲
palo alto networks	2	2	1	1	0	13	2	100.0	8.6	.6281	+2 ▲
zyxel	1	1	0	0	1	9	0	0.0	6.5	.0023	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	21	34	4	15	14	33	1	2.9	7.3	.0062	+12 ▲
gitlab	7	7	0	1	6	4	2	28.6	4.3	.0024	+7 ▲
mozilla	6	6	3	2	1	9	0	0.0	8.8	.0042	+6 ▲
drupal	5	5	1	1	3	4	1	20.0	5.1	.0026	+5 ▲
docker	3	3	0	3	0	0	0	0.0	8.8	.0022	+3 ▲
github	2	2	1	1	0	0	0	0.0	8.1	.0347	+2 ▲
wordpress	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ibm	49	49	10	24	15	6	0	0.0	7.5	.0028	+49 ▲
oracle	25	28	9	15	4	27	0	0.0	8.1	.0027	+25 ▲
progress	4	4	0	4	0	6	0	0.0	7.5	.0036	+4 ▲
veeam	3	3	1	2	0	1	0	0.0	8.6	.0051	+3 ▲
solarwinds	0	3	2	1	0	10	3	100.0	9.8	.8362	0
zohocorp	2	2	0	1	1	0	0	0.0	7.1	.0104	+2 ▲
adobe	0	2	0	2	0	19	2	100.0	8.6	.0368	-2 ▼
atlassian	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV/100	Med CVSS	Med EPSS	Δ
synology	18	18	2	3	10	3	0	0.0	5.6	.0025	+18 ▲
d-link	2	2	0	1	1	0	3	0.0	7.3	.0036	+2 ▲
hitachi energy	2	2	0	0	2	0	0	0.0	5.7	.0014	+2 ▲
siemens	1	1	0	1	0	0	0	0.0	8.7	.0032	+1 ▲
tp-link	0	0	0	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
edimax	51	51	0	32	0	19	1	7.4	.0059	+51 ▲
concrete cms	44	44	1	9	13	21	0	5.7	.0015	+44 ▲
open ises	44	44	2	21	21	0	0	7.1	.0021	+44 ▲
helmholz	42	42	0	39	3	0	0	7.1	.0026	+42 ▲
mb connect line	42	42	0	39	3	0	0	7.1	.0026	+42 ▲
totolink	35	35	0	26	0	9	0	8.9	.0191	+35 ▲
netatalk	33	33	1	13	9	10	0	6.4	.0030	+33 ▲
nvidia	33	33	8	18	7	0	0	7.8	.0038	+33 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-42208	.8942	99.8	9.3
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-42271	.8354	99.7	8.7
CVE-2026-41089	.7962	99.6	9.8
CVE-2026-42897	.7120	99.4	8.1
CVE-2026-42945	.6805	99.3	9.2

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-43997	10.0	.0098
CVE-2026-42826	10.0	.0084
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083
CVE-2026-44006	10.0	.0081

Most disclosures (vendor)
Vendor	CVEs
linux	580
google	168
microsoft	166
edimax	51
ibm	49
concrete cms	44
open ises	44
helmholz	42
mb connect line	42
red hat	42

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	8
apple	7
google	4
ivanti	4
fortinet	3
smartertools	3
solarwinds	3
adobe	2
berriai	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	12
Packagist	7
PyPI	2
crates.io	2
npm	2

Fastest to KEV
CVE	Vendor	Days
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-41091	Microsoft	0
CVE-2026-42208	BerriAI	0
CVE-2026-42897	Microsoft	0
CVE-2026-45321	@tanstack	0
CVE-2026-45498	Microsoft	0
CVE-2026-48027	nrwl	0
CVE-2026-48172	LiteSpeed Technologies	0
CVE-2026-9082	Drupal	0
CVE-2026-8398	AVB Disc Soft	12

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1656
CVE-2021-27102	n/a	2021-11-17	1656
CVE-2021-27101	n/a	2021-11-17	1656
CVE-2021-27103	n/a	2021-11-17	1656
CVE-2021-21017	Adobe	2021-11-17	1656
CVE-2021-28550	Adobe	2021-11-17	1656
CVE-2021-42013	Apache Software Foundation	2021-11-17	1656
CVE-2021-41773	Apache Software Foundation	2021-11-17	1656
CVE-2021-30858	Apple	2021-11-17	1656
CVE-2021-30860	Apple	2021-11-17	1656

Transactions

DUE DATE PASSED — CVE-2026-8398 (Daemon Tools Lite). CISA remediation deadline was May 30, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

51 CVEs published. 25 box scores, 26 table rows — nothing truncated.

CVE-2026-10187HIGH

Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0734   93.9     —

AFFECTED
  Product  Versions               Fixed
  N300RH   6.1c.1353_B20190305 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-10179HIGH

TRENDnet TEW-432BRP formSetWlanEncrypt stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0320   87.1     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-10166LOW

Edimax BR-6478AC POST Request formWlbasic command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.3     —

AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10182LOW

TRENDnet TEW-432BRP formWlanSetup command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.3     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-10180LOW

TRENDnet TEW-432BRP formSysCmd command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0105   61.7     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-10189HIGH

Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0050   40.7     —

AFFECTED
  Product  Versions         Fixed
  W12      3.0.0.7(4763) –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-10192HIGH

Tenda W12 httpd set_local_time_0 stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0050   40.7     —

AFFECTED
  Product  Versions         Fixed
  W12      3.0.0.7(4763) –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-10188HIGH

Tenda W12 httpd cgistaKickOff stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0048   39.0     —

AFFECTED
  Product  Versions         Fixed
  W12      3.0.0.7(4763) –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-10191HIGH

Tenda W12 httpd cgiWifiMacFilterSet stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0048   39.0     —

AFFECTED
  Product  Versions         Fixed
  W12      3.0.0.7(4763) –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-10160HIGH

TRENDnet TEW-432BRP formSetEnableWizard stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10161HIGH

TRENDnet TEW-432BRP formResetStatistic stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10162HIGH

TRENDnet TEW-432BRP formSetPassword stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10165HIGH

Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —

AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10181HIGH

TRENDnet TEW-432BRP formSysCmd stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-10183HIGH

TRENDnet TEW-432BRP formWlanSetup stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0047   38.7     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-8382MEDIUM

wpengine Advanced Custom Fields (ACF®) — Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0046   38.1     —

AFFECTED
  Product                        Versions     Fixed
  Advanced Custom Fields (ACF®)  unspecified  —

TIMELINE
  May 12  Reserved by CNA
  May 31  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 3 references · NVD status: Deferred

CVE-2026-10158HIGH

TRENDnet TEW-432BRP formPortFw stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0046   38.1     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10159HIGH

TRENDnet TEW-432BRP formSysLog stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0046   38.1     —

AFFECTED
  Product     Versions   Fixed
  TEW-432BRP  3.10B20 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10163HIGH

Edimax BR-6478AC POST Request formUSBAccount buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0046   38.1     —

AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10164HIGH

Edimax BR-6478AC POST Request formUSBFolder buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0046   38.1     —

AFFECTED
  Product    Versions  Fixed
  BR-6478AC  1.23 –    —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-10157MEDIUM

n/a Open5GS — Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0042   34.7     —

AFFECTED
  Product  Versions  Fixed
  Open5GS  2.7.0 –   —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-287 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-10167MEDIUM

OUSL-GROUP-BrinaryBrains School Student Management System MY_Controller Login.php sign_auth_cookie improper authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —

AFFECTED
  Product                           Versions                                    Fixed
  School Student Management System  1e70e5ad1125b86dca4ee086eb6bb121f17708b6 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-287 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-8796HIGH

YVES Sereal::Decoder — Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  N  H    8.1   .0040   32.8     —

AFFECTED
  Product          Versions     Fixed
  Sereal::Decoder  unspecified  —

TIMELINE
  May 18  Reserved by CNA
  May 31  Published (CNA: CPANSec)

CWE-125 · CNA: CPANSec · CVSS v3.1 · 3 references · NVD status: Deferred

CVE-2026-10190MEDIUM

Tenda W12 Web Management httpd cgiSysWebTimeoutSet denial of service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   H    5.7   .0037   29.4     —

AFFECTED
  Product  Versions         Fixed
  W12      3.0.0.7(4763) –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-404 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-10169LOW

OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   N   L   N    2.9   .0029   20.5     —

AFFECTED
  Product                           Versions                                    Fixed
  School Student Management System  1e70e5ad1125b86dca4ee086eb6bb121f17708b6 –  —

TIMELINE
  May 30  Reserved by CNA
  May 31  Published (CNA: VulDB)

CWE-640 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-10173	2.1	19.7	Orthanc	Explorer 2	CWE-79	Orthanc Explorer 2 URL StudyList.vue cross site scripting
CVE-2026-10178	5.5	18.5	code-projects	Online Music Site	CWE-74	code-projects Online Music Site AdminEditAlbum.php sql injection
CVE-2026-10184	5.5	18.5	SourceCodester	Hospitals Patient Records Management System	CWE-74	SourceCodester Hospitals Patient Records Management System Users.php delete s…
CVE-2026-10185	5.5	18.5	SourceCodester	Hospitals Patient Records Management System	CWE-74	SourceCodester Hospitals Patient Records Management System Users.php save sql…
CVE-2026-10186	5.5	18.5	code-projects	Online Hospital Management System	CWE-74	code-projects Online Hospital Management System patient.php sql injection
CVE-2026-49489	8.4	17.7	OpenCATS	OpenCATS	CWE-89	OpenCATS - SQL Injection in DataGrid sortDirection Parameter
CVE-2026-49490	8.6	16.0	OpenCATS	OpenCATS	CWE-89	OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column
CVE-2026-48210	5.7	15.8	OTRS AG	OTRS	CWE-200	Possible information disclosure via External Interface
CVE-2026-10194	5.3	15.8	OFFIS	DCMTK	CWE-119	OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow
CVE-2026-10170	2.1	15.3	code-projects	Visitor Management System	CWE-74	code-projects Visitor Management System phone_0.php sql injection
CVE-2026-10168	2.1	15.2	OUSL-GROUP-BrinaryBrains	School Student Management System	CWE-99	OUSL-GROUP-BrinaryBrains School Student Management System Parents.php marks r…
CVE-2026-10175	2.1	15.1	Aider-AI	Aider	CWE-74	Aider-AI Aider Architect Mode auth.py editor_coder.run code injection
CVE-2026-10174	2.1	13.4	Aider-AI	Aider	CWE-693	Aider-AI Aider Pre-commit Hook args.py protection mechanism
CVE-2026-10177	2.1	11.0	Aider-AI	Aider	CWE-918	Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side…
CVE-2026-10172	2.1	10.5	Bdtask	Multi-Store Inventory Management System	CWE-284	Bdtask Multi-Store Inventory Management System Component Module.php upload un…
CVE-2026-10171	2.0	10.5	code-projects	Online Music Site	CWE-74	code-projects Online Music Site AdminUpdateAlbum.php sql injection
CVE-2026-10176	2.1	10.3	Aider-AI	Aider	CWE-74	Aider-AI Aider Code Generation Workflow sql injection
CVE-2026-10193	2.1	9.3	n/a	OFCMS	CWE-74	OFCMS ComnController ComnController.java query sql injection
CVE-2026-10203	2.1	9.3	n/a	OFCMS	CWE-74	OFCMS JSON Query SystemParamController.java query sql injection
CVE-2026-10202	2.1	8.9	n/a	OFCMS	CWE-74	OFCMS JSON Query SystemDictController.java query sql injection
CVE-2026-10204	2.1	8.9	n/a	OFCMS	CWE-74	OFCMS JSON Query SysUserController.java query sql injection
CVE-2026-10200	1.9	2.4	n/a	Assimp	CWE-119	Assimp 4x4 Matrix glTFCommon.h CopyValue heap-based overflow
CVE-2026-10199	1.9	1.9	n/a	Assimp	CWE-404	Assimp glTF2Asset.h LazyDict null pointer dereference
CVE-2026-10197	1.9	1.7	n/a	Assimp	CWE-404	Assimp TF File glTF2Importer.cpp ImportEmbeddedTextures null pointer dereference
CVE-2026-10198	1.9	1.6	n/a	Assimp	CWE-404	Assimp glTFImporter glTFImporter.cpp ImportMeshes null pointer dereference
CVE-2026-10201	1.9	1.5	n/a	Assimp	CWE-369	Assimp UV Channel FBXExporter.cpp WriteObjects divide by zero

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-05-31 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.