Security Box Score — June 7, 2026

23 CVEs published, led by GL.iNet (6).

23 CVEs published June 7, 2026: 0 critical, 1 high, 9 medium, 13 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 0 awaiting enrichment.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1605	6066	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

260 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	33	1000	81	630	288	1	11	2	0.2	7.8	.0013	-113 ▼
google	488	663	58	335	255	15	77	5	0.8	7.8	.0023	+488 ▲
microsoft	7	543	47	379	115	2	286	19	3.5	7.8	.0047	-5 ▼
red hat	19	113	8	49	46	10	2	0	0.0	7.0	.0033	+14 ▲
apple	0	52	1	17	33	1	88	7	13.5	6.2	.0023	0
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	0	2	0	2	0	0	0	0	0.0	8.2	.0020	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	2	14	5	3	6	56	8	57.1	7.3	.0566	+2 ▲
fortinet	0	7	4	3	0	28	3	42.9	9.1	.8584	0
ivanti	1	6	2	4	0	25	4	66.7	8.8	.5751	0
checkpoint	0	6	0	3	3	3	0	0.0	6.5	.0338	0
zyxel	2	3	0	0	3	9	0	0.0	6.5	.0017	+2 ▲
ubiquiti	0	3	1	2	0	3	0	0.0	8.8	.0068	0
f5	0	2	2	0	0	4	1	50.0	9.2	.3901	0
palo alto networks	0	2	1	1	0	13	2	100.0	8.6	.6281	-1 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	32	66	8	26	29	2	33	1	1.5	7.2	.0052	+28 ▲
mozilla	4	10	3	3	4	0	9	0	0.0	7.4	.0035	0
gitlab	0	7	0	1	6	0	4	2	28.6	4.3	.0024	0
docker	2	5	0	5	0	0	0	0	0.0	8.8	.0021	+2 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ibm	5	54	13	26	15	6	0	0.0	7.5	.0031	+5 ▲
oracle	0	28	9	15	4	27	1	3.6	8.1	.0027	0
progress	5	9	1	7	1	6	0	0.0	7.5	.0036	+5 ▲
solarwinds	2	5	2	3	0	10	4	80.0	8.1	.8162	+2 ▲
veeam	0	3	1	2	0	1	0	0.0	8.6	.0051	0
adobe	0	2	0	2	0	19	2	100.0	8.6	.0368	0
zohocorp	0	2	0	1	1	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0.0	5.6	.0025	+5 ▲
d-link	5	7	0	3	1	3	3	0.0	6.0	.0069	+5 ▲
abb	4	4	0	4	0	0	0	0.0	7.3	.0024	+4 ▲
siemens	1	2	0	1	1	0	0	0.0	7.3	.0026	+1 ▲
hitachi energy	0	2	0	0	2	0	0	0.0	5.7	.0014	0
tp-link	0	0	0	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
edimax	0	51	0	32	0	19	1	7.4	.0059	0
concrete cms	1	45	1	10	13	21	0	6.0	.0015	+1 ▲
sourcecodester	22	44	0	0	14	30	0	2.1	.0025	+22 ▲
open ises	0	44	2	21	21	0	0	7.1	.0021	0
helmholz	0	42	0	39	3	0	0	7.1	.0026	0
mb connect line	0	42	0	39	3	0	0	7.1	.0026	0
acer	26	36	11	19	6	0	0	8.7	.0024	+26 ▲
nvidia	2	35	8	20	7	0	0	7.8	.0029	+2 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-41089	.7962	99.6	9.8
CVE-2026-42897	.7120	99.4	8.1
CVE-2026-42945	.6805	99.3	9.2
CVE-2026-45498	.6308	99.1	7.5
CVE-2026-28318	.4001	98.5	7.5
CVE-2026-44578	.3887	98.5	8.6

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-43997	10.0	.0098
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083

Most disclosures (vendor)
Vendor	CVEs
google	656
linux	464
microsoft	161
red hat	56
ibm	54
edimax	51
apache	49
concrete cms	45
open ises	44
sourcecodester	44

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	8
apple	7
google	5
ivanti	4
solarwinds	4
fortinet	3
smartertools	3
adobe	2
berriai	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	24
PyPI	10
Packagist	7
crates.io	2
npm	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-41091	Microsoft	0
CVE-2026-42897	Microsoft	0
CVE-2026-45247	Mirasvit	0
CVE-2026-45321	@tanstack	0
CVE-2026-45498	Microsoft	0
CVE-2026-48027	nrwl	0
CVE-2026-48172	LiteSpeed Technologies	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1663
CVE-2021-27102	n/a	2021-11-17	1663
CVE-2021-27101	n/a	2021-11-17	1663
CVE-2021-27103	n/a	2021-11-17	1663
CVE-2021-21017	Adobe	2021-11-17	1663
CVE-2021-28550	Adobe	2021-11-17	1663
CVE-2021-42013	Apache Software Foundation	2021-11-17	1663
CVE-2021-41773	Apache Software Foundation	2021-11-17	1663
CVE-2021-30858	Apple	2021-11-17	1663
CVE-2021-30860	Apple	2021-11-17	1663

Transactions

DUE DATE PASSED — CVE-2026-45247 (Mirasvit Full Page Cache Warmer for Magento 2). CISA remediation deadline was June 6, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

23 CVEs published. 23 box scores, 0 table rows — nothing truncated.

CVE-2026-11451MEDIUM

GL.iNet GL-MT3000 FTP Protocol glc snprintf command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0203   79.5     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.5 –   4.8.1

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11452MEDIUM

GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0168   75.1     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.8.1

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11448MEDIUM

GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    5.1   .0158   73.6     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11450MEDIUM

GL.iNet GL-MT3000 Path Normalization dlopen command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0157   73.5     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.5 –   4.7

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11449MEDIUM

GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0110   63.2     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.5 –   4.8.1

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11447LOW

GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.4     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11455LOW

FoundationAgents MetaGPT common.py check_cmd_exists command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   L   L   L    1.3   .0094   58.1     —

AFFECTED
  Product  Versions  Fixed
  MetaGPT  0.8.0 –   —

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-49494HIGH

Xcitium Client Security / Comodo Internet Security Remote Denial of Service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0054   43.1     —

AFFECTED
  Product                        Versions     Fixed
  Comodo Internet Security       unspecified  —
  Xcitium Client Security (XCS)  unspecified  —

TIMELINE
  May 31  Reserved by CNA
  Jun 7   Published (CNA: VulnCheck)

CWE-191 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-11457MEDIUM

erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0033   25.2     —

AFFECTED
  Product  Versions                                    Fixed
  JeeWMS   141740afb2ba14d441c82a833d0a418d07ca2d69 –  —

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-707 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11467LOW

jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   L   L    2.1   .0032   24.5     —

AFFECTED
  Product  Versions  Fixed
  jshERP   3.0 –     —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-22 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11463LOW

USCiLab Cereal Shared Pointer type confusion

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   L   L   L    2.9   .0031   23.5     —

AFFECTED
  Product  Versions  Fixed
  Cereal   1.3.0 –   —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-843 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-11460LOW

Boost Serialization improper validation of specified type of input

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   L   L   L    2.9   .0031   23.2     —

AFFECTED
  Product        Versions  Fixed
  Serialization  1.0 –     —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-20, CWE-1287 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11462MEDIUM

Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0029   21.4     —

AFFECTED
  Product    Versions   Fixed
  BeikeShop  1.6.0.0 –  —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-266, CWE-285 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11458MEDIUM

erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   21.2     —

AFFECTED
  Product  Versions                                    Fixed
  JeeWMS   141740afb2ba14d441c82a833d0a418d07ca2d69 –  —

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11456MEDIUM

Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   17.3     —

AFFECTED
  Product  Versions  Fixed
  CRM      1.0 –     —

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11466LOW

zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   L    2.1   .0025   16.4     —

AFFECTED
  Product        Versions  Fixed
  deep-searcher  0.0.1 –   —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-266, CWE-284 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-11469LOW

jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    2.0   .0023   13.8     —

AFFECTED
  Product  Versions  Fixed
  jshERP   3.0 –     —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11461LOW

NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0022   12.9     —

AFFECTED
  Product       Versions  Fixed
  hermes-agent  0.1 –     —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11464LOW

n/a JeecgBoot — JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   L   N   N    1.3   .0022   12.4     —

AFFECTED
  Product    Versions  Fixed
  JeecgBoot  3.9.0 –   —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-11465LOW

songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   L   N   N   L   N    1.3   .0022   12.3     —

AFFECTED
  Product  Versions            Fixed
  one-api  0.6.11-preview.0 –  —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-840 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-11468LOW

SourceCodester Hospitals Patient Records Management System page room_types cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   P   N   L   N    1.9   .0021   11.6     —

AFFECTED
  Product                                      Versions  Fixed
  Hospitals Patient Records Management System  1.0 –     —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11453LOW

Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0019    8.9     —

AFFECTED
  Product                       Versions  Fixed
  Employee Self-Service System  7.0 –     —

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-11459LOW

SecureAge CatchPulse IOCTL saappctl.sys information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   N   N    1.9   .0011    1.2     —

AFFECTED
  Product     Versions  Fixed
  CatchPulse  10.9.0 –  —

TIMELINE
  Jun 6   Reserved by CNA
  Jun 7   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-07 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.