Security Box Score — June 6, 2026

39 CVEs published, led by theonedev (4).

39 CVEs published June 6, 2026: 0 critical, 7 high, 26 medium, 6 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 14 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1582	6043	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

259 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	33	1000	81	630	288	1	11	2	0.2	7.8	.0013	-113 ▼
google	488	663	58	335	255	15	77	5	0.8	7.8	.0023	+488 ▲
microsoft	7	543	47	379	115	2	286	19	3.5	7.8	.0047	+7 ▲
red hat	19	113	8	49	46	10	2	0	0.0	7.0	.0033	+16 ▲
apple	0	52	1	17	33	1	88	7	13.5	6.2	.0023	0
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	0	2	0	2	0	0	0	0	0.0	8.2	.0020	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	2	14	5	3	6	56	8	57.1	7.3	.0566	+2 ▲
fortinet	0	7	4	3	0	28	3	42.9	9.1	.8584	0
ivanti	1	6	2	4	0	25	4	66.7	8.8	.5751	+1 ▲
checkpoint	0	6	0	3	3	3	0	0.0	6.5	.0338	0
zyxel	2	3	0	0	3	9	0	0.0	6.5	.0017	+2 ▲
ubiquiti	0	3	1	2	0	3	0	0.0	8.8	.0068	0
f5	0	2	2	0	0	4	1	50.0	9.2	.3901	0
palo alto networks	0	2	1	1	0	13	2	100.0	8.6	.6281	-1 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	32	66	8	26	29	2	33	1	1.5	7.2	.0052	+28 ▲
mozilla	4	10	3	3	4	0	9	0	0.0	7.4	.0035	+4 ▲
gitlab	0	7	0	1	6	0	4	2	28.6	4.3	.0024	0
docker	2	5	0	5	0	0	0	0	0.0	8.8	.0021	+2 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ibm	5	54	13	26	15	6	0	0.0	7.5	.0031	+5 ▲
oracle	0	28	9	15	4	27	1	3.6	8.1	.0027	0
progress	5	9	1	7	1	6	0	0.0	7.5	.0036	+5 ▲
solarwinds	2	5	2	3	0	10	4	80.0	8.1	.8162	+2 ▲
veeam	0	3	1	2	0	1	0	0.0	8.6	.0051	0
adobe	0	2	0	2	0	19	2	100.0	8.6	.0368	0
zohocorp	0	2	0	1	1	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0.0	5.6	.0025	+5 ▲
d-link	5	7	0	3	1	3	3	0.0	6.0	.0069	+5 ▲
abb	4	4	0	4	0	0	0	0.0	7.3	.0024	+4 ▲
siemens	1	2	0	1	1	0	0	0.0	7.3	.0026	+1 ▲
hitachi energy	0	2	0	0	2	0	0	0.0	5.7	.0014	0
tp-link	0	0	0	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
edimax	0	51	0	32	0	19	1	7.4	.0059	0
concrete cms	1	45	1	10	13	21	0	6.0	.0015	+1 ▲
open ises	0	44	2	21	21	0	0	7.1	.0021	0
sourcecodester	21	43	0	0	14	29	0	2.1	.0025	+21 ▲
helmholz	0	42	0	39	3	0	0	7.1	.0026	0
mb connect line	0	42	0	39	3	0	0	7.1	.0026	0
acer	26	36	11	19	6	0	0	8.7	.0024	+26 ▲
nvidia	2	35	8	20	7	0	0	7.8	.0029	+2 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43284	.9324	99.8	8.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-42208	.8942	99.8	9.3
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-42271	.8354	99.7	8.7
CVE-2026-41089	.7962	99.6	9.8
CVE-2026-42897	.7120	99.4	8.1
CVE-2026-42945	.6805	99.3	9.2

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-43997	10.0	.0098
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083

Most disclosures (vendor)
Vendor	CVEs
google	656
linux	528
microsoft	161
red hat	56
ibm	54
edimax	51
apache	49
concrete cms	45
open ises	44
sourcecodester	43

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	8
apple	7
google	5
ivanti	4
solarwinds	4
fortinet	3
smartertools	3
adobe	2
berriai	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	24
PyPI	10
Packagist	7
crates.io	2
npm	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-41091	Microsoft	0
CVE-2026-42208	BerriAI	0
CVE-2026-42897	Microsoft	0
CVE-2026-45247	Mirasvit	0
CVE-2026-45321	@tanstack	0
CVE-2026-45498	Microsoft	0
CVE-2026-48027	nrwl	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1662
CVE-2021-27102	n/a	2021-11-17	1662
CVE-2021-27101	n/a	2021-11-17	1662
CVE-2021-27103	n/a	2021-11-17	1662
CVE-2021-21017	Adobe	2021-11-17	1662
CVE-2021-28550	Adobe	2021-11-17	1662
CVE-2021-42013	Apache Software Foundation	2021-11-17	1662
CVE-2021-41773	Apache Software Foundation	2021-11-17	1662
CVE-2021-30858	Apple	2021-11-17	1662
CVE-2021-30860	Apple	2021-11-17	1662

Transactions

DUE DATE PASSED — CVE-2022-0492 (Linux Kernel). CISA remediation deadline was June 5, 2026; still in catalog.

DUE DATE PASSED — CVE-2025-48595 (Google Android). CISA remediation deadline was June 5, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

39 CVEs published. 25 box scores, 14 table rows — nothing truncated.

CVE-2026-7665MEDIUM

wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets — Essential Addons for Elementor <= 6.6.4 - Missing Authorization to Unauthenticated Information Exposure via 'load_more' AJAX Handler

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0724   93.8     —

AFFECTED
  Product                                                                 Versions     Fixed
  Essential Addons for Elementor – Popular Elementor Templates & Widgets  unspecified  —

TIMELINE
  May 1   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · CVSS v3.1 · 14 references · NVD status: Deferred

CVE-2026-11406LOW

GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0123   66.6     —

AFFECTED
  Product  Versions  Fixed
  MT3000   4.4.0 –   4.9.0_beta3-1012-0513-1778656146

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11408LOW

vertex-app vertex Log Viewer Endpoint LogMod.js os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0111   63.5     —

AFFECTED
  Product  Versions     Fixed
  vertex   2026.02.0 –  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-8839MEDIUM

chrisvrichardson MapPress Maps for WordPress — MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0102   60.7     —

AFFECTED
  Product                      Versions     Fixed
  MapPress Maps for WordPress  unspecified  —

TIMELINE
  May 18  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · CVSS v3.1 · 24 references · NVD status: Deferred

CVE-2026-7537HIGH

MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0066   48.8     —

AFFECTED
  Product                Versions     Fixed
  MDJM Event Management  unspecified  —

TIMELINE
  Apr 30  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Deferred

CVE-2026-7565MEDIUM

thimpress LearnPress – Backup & Migration Tool — LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0065   48.2     —

AFFECTED
  Product                               Versions     Fixed
  LearnPress – Backup & Migration Tool  unspecified  —

TIMELINE
  Apr 30  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-9197MEDIUM

nextendweb Smart Slider 3 — Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0060   46.1     —

AFFECTED
  Product         Versions     Fixed
  Smart Slider 3  unspecified  —

TIMELINE
  May 21  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-8502MEDIUM

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0053   42.3     —

AFFECTED
  Product                                                               Versions     Fixed
  LearnPress – WordPress LMS Plugin for Create and Sell Online Courses  unspecified  —

TIMELINE
  May 13  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 14 references · NVD status: Deferred

CVE-2026-8438HIGH

davidanderson All-In-One Security (AIOS) – Security and Firewall — All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0049   39.6     —

AFFECTED
  Product                                             Versions     Fixed
  All-In-One Security (AIOS) – Security and Firewall  unspecified  —

TIMELINE
  May 12  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Deferred

CVE-2026-11413HIGH

JingDong JD Cloud Box AX6600 jdcweb_rpc set_macfilter stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0048   39.3     —

AFFECTED
  Product              Versions       Fixed
  JD Cloud Box AX6600  4.5.3.r4546 –  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-9829MEDIUM

10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery — Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0047   38.5     —

AFFECTED
  Product                                                 Versions     Fixed
  Photo Gallery by 10Web – Mobile-Friendly Image Gallery  unspecified  —

TIMELINE
  May 28  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Deferred

CVE-2026-7566MEDIUM

thimpress LearnPress – Backup & Migration Tool — LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  H  H    6.6   .0045   37.2     —

AFFECTED
  Product                               Versions     Fixed
  LearnPress – Backup & Migration Tool  unspecified  —

TIMELINE
  Apr 30  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-10725HIGH

CRUX Protocol::HTTP2 — Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0041   34.2     —

AFFECTED
  Product          Versions     Fixed
  Protocol::HTTP2  unspecified  —

TIMELINE
  Jun 3   Reserved by CNA
  Jun 6   Published (CNA: CPANSec)

CWE-409 · CNA: CPANSec · CVSS v3.1 · 6 references · NVD status: Analyzed

CVE-2026-11437MEDIUM

perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   33.7     —

AFFECTED
  Product         Versions  Fixed
  go-fastdfs-web  1.3.0 –   —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-7795MEDIUM

holithemes Click to Chat – HoliThemes — Click to Chat <= 4.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0041   33.6     —

AFFECTED
  Product                     Versions     Fixed
  Click to Chat – HoliThemes  unspecified  —

TIMELINE
  May 4   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 11 references · NVD status: Deferred

CVE-2026-9280MEDIUM

spacetime Ad Inserter – Ad Manager & AdSense Ads — Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  N    6.1   .0036   28.7     —

AFFECTED
  Product                                 Versions     Fixed
  Ad Inserter – Ad Manager & AdSense Ads  unspecified  —

TIMELINE
  May 22  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-9851HIGH

masaakitanaka Booking Package — Booking Package <= 1.7.16 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0036   28.5     —

AFFECTED
  Product          Versions     Fixed
  Booking Package  unspecified  —

TIMELINE
  May 28  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-7796MEDIUM

wpdevteam EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more — EmbedPress <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block 'url' Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0033   25.5     —

AFFECTED
  Product                                                                                        Versions     Fixed
  EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more  unspecified  —

TIMELINE
  May 4   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 11 references · NVD status: Deferred

CVE-2026-2500MEDIUM

davidfcarr Quick Playground — Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  N  N    4.4   .0032   23.7     —

AFFECTED
  Product           Versions     Fixed
  Quick Playground  unspecified  —

TIMELINE
  Feb 13  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 4 references · NVD status: Deferred

CVE-2026-8901HIGH

plugcrux Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More — Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0031   23.5     —

AFFECTED
  Product                                                                                  Versions     Fixed
  Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More  unspecified  —

TIMELINE
  May 18  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Deferred

CVE-2026-8991MEDIUM

glenwpcoder Drag and Drop Multiple File Upload for Contact Form 7 — Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'drag_n_drop_text' and 'drag_n_drop_browse_text' Settings

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  L  L  N    4.4   .0031   23.3     —

AFFECTED
  Product                                                Versions     Fixed
  Drag and Drop Multiple File Upload for Contact Form 7  unspecified  —

TIMELINE
  May 19  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-7792MEDIUM

smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More — WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0030   22.2     —

AFFECTED
  Product                                                                                    Versions     Fixed
  WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More  unspecified  —

TIMELINE
  May 4   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-345 · CNA: Wordfence · CVSS v3.1 · 14 references · NVD status: Deferred

CVE-2026-7624MEDIUM

cifi SEO Plugin by Squirrly SEO — SEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0030   21.6     —

AFFECTED
  Product                     Versions     Fixed
  SEO Plugin by Squirrly SEO  unspecified  —

TIMELINE
  May 1   Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 14 references · NVD status: Deferred

CVE-2026-9594MEDIUM

flippercode WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters — WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  C  L  L  N    4.4   .0029   21.3     —

AFFECTED
  Product                                                                               Versions     Fixed
  WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters  unspecified  —

TIMELINE
  May 26  Reserved by CNA
  Jun 6   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2026-11434LOW

n/a FluentCMS — FluentCMS Blocks Plugin blocks cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   P   N   L   N    1.9   .0027   19.3     —

AFFECTED
  Product    Versions  Fixed
  FluentCMS  0.0.5 –   —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 6   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-11436	2.1	17.7	n/a	Mage AI	CWE-79	Mage AI Sign-in Flow index.tsx useMutation cross site scripting
CVE-2026-9016	5.3	17.5	qriouslad	Debug Log Manager – Conveniently Monitor and Inspect Errors	CWE-117	Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization f…
CVE-2026-11435	5.5	17.2	Jinher	OA	CWE-74	Jinher OA nextselectplan.aspx sql injection
CVE-2026-8978	4.9	17.2	crafium	OptinCraft – Drag & Drop Optins & Popup Builder for WordPress	CWE-89	OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order…
CVE-2026-8611	4.3	14.0	klamra22	Klamra Paycal for Aspaclaria	CWE-639	Klamra Paycal for Aspaclaria <= 1.1.4 - Insecure Direct Object Reference to A…
CVE-2026-9008	4.3	12.8	webvitaly	Page-list	CWE-862	Page-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sens…
CVE-2026-9281	6.4	11.6	litonice13	Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits	CWE-79	Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-S…
CVE-2026-11438	5.3	11.5	theonedev	onedev	CWE-266	theonedev projects improper authorization
CVE-2026-11439	5.3	11.5	theonedev	onedev	CWE-266	theonedev Parent Project projects improper authorization
CVE-2026-11440	5.3	11.5	theonedev	onedev	CWE-266	theonedev REST API default-branch improper authorization
CVE-2026-11441	5.3	11.5	theonedev	onedev	CWE-266	theonedev Pull Request issues canAccessIssue improper authorization
CVE-2026-11412	2.1	9.3	Jinher	OA	CWE-74	Jinher OA GetFormSn.aspx sql injection
CVE-2026-11411	1.9	6.5	iAI Lab	PDF AI App	CWE-22	iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal
CVE-2026-26422	8.4	5.7	Clash Verge Rev	clash-verge-service-ipc	CWE-732	clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, lead…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-06 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.