Security Box Score — June 9, 2026

719 CVEs published, led by Microsoft (200).

719 CVEs published June 9, 2026: 37 critical, 348 high, 314 medium, 20 low; 3 in the KEV catalog at press time; 12 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 319 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	2609	7070	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

331 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	95	1062	84	663	314	1	11	2	0.2	7.8	.0013	-115 ▼
microsoft	207	743	55	512	170	6	286	19	2.6	7.8	.0044	+195 ▲
google	562	737	65	386	267	19	77	6	0.8	8.1	.0023	+562 ▲
red hat	31	125	8	51	55	11	2	0	0.0	6.7	.0032	+26 ▲
apple	0	52	1	17	33	1	88	7	13.5	6.2	.0023	0
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	0	2	0	2	0	0	0	0	0.0	8.2	.0020	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
netgear	17	17	0	0	16	1	0	0	0.0	4.3	.0024	+17 ▲
cisco	3	15	5	4	6	0	56	9	60.0	7.5	.0694	+3 ▲
fortinet	2	9	4	3	2	0	28	3	33.3	8.3	.0076	+2 ▲
ivanti	3	8	3	5	0	0	25	4	50.0	8.8	.4316	+2 ▲
checkpoint	2	8	1	4	3	0	3	1	12.5	7.5	.0423	+2 ▲
vmware	3	4	0	2	2	0	7	1	25.0	6.7	.0036	+3 ▲
zyxel	2	3	0	0	3	0	9	0	0.0	6.5	.0017	+2 ▲
ubiquiti	0	3	1	2	0	0	3	0	0.0	8.8	.0068	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	53	87	12	33	39	2	33	1	1.1	7.2	.0053	+49 ▲
mozilla	5	11	3	4	4	0	9	0	0.0	7.5	.0032	+1 ▲
gitlab	0	7	0	1	6	0	4	2	28.6	4.3	.0024	0
docker	2	5	0	5	0	0	0	0	0.0	8.8	.0021	+2 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
adobe	123	125	4	47	72	2	19	2	1.6	5.5	.0021	+123 ▲
ibm	5	54	13	26	15	0	6	0	0.0	7.5	.0031	+5 ▲
oracle	1	29	9	16	4	0	27	1	3.4	8.1	.0027	+1 ▲
progress	5	9	1	7	1	0	6	0	0.0	7.5	.0036	+5 ▲
solarwinds	3	6	2	3	1	0	10	4	66.7	7.8	.6082	+3 ▲
veeam	1	4	2	2	0	0	1	0	0.0	9.0	.0052	+1 ▲
zohocorp	0	2	0	1	1	0	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	KEV/100	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	0.0	5.6	.0025	+5 ▲
d-link	8	10	0	3	2	5	3	0.0	4.2	.0055	+8 ▲
siemens	7	8	0	4	4	0	0	0.0	7.5	.0020	+7 ▲
abb	4	4	0	4	0	0	0	0.0	7.3	.0024	+4 ▲
hitachi energy	0	2	0	0	2	0	0	0.0	5.7	.0014	0
schneider electric	1	1	0	1	0	0	0	0.0	7.1	.0023	+1 ▲
tp-link	0	0	0	0	0	0	1	—	—	—	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
sourcecodester	35	57	0	0	24	33	0	2.1	.0026	+35 ▲
spring	53	54	1	21	32	0	0	6.5	.0026	+53 ▲
edimax	0	51	0	32	0	19	1	7.4	.0059	0
concrete cms	1	45	1	10	13	21	0	6.0	.0015	+1 ▲
open ises	0	44	2	21	21	0	0	7.1	.0021	0
helmholz	0	42	0	39	3	0	0	7.1	.0026	0
mb connect line	0	42	0	39	3	0	0	7.1	.0026	0
totolink	3	38	0	26	1	11	0	8.9	.0191	+3 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-0257	.9391	99.8	7.8
CVE-2026-43500	.9285	99.8	7.8
CVE-2026-20182	.9152	99.8	10.0
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-50751	.8377	99.7	9.3
CVE-2026-41089	.7962	99.6	9.8
CVE-2026-42897	.7120	99.4	8.1
CVE-2026-42945	.6805	99.3	9.2
CVE-2026-45498	.6308	99.1	7.5
CVE-2026-49160	.5383	98.9	7.5

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-20182	10.0	.9152	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-43997	10.0	.0098
CVE-2026-20223	10.0	.0083
CVE-2026-44005	10.0	.0083

Most disclosures (vendor)
Vendor	CVEs
google	730
linux	526
microsoft	361
adobe	123
apache	70
red hat	68
sourcecodester	57
ibm	54
spring	54
edimax	51

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	9
apple	7
google	6
ivanti	4
solarwinds	4
berriai	3
fortinet	3
smartertools	3
adobe	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	24
Packagist	22
PyPI	11
npm	3
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-11645	Google	0
CVE-2026-20245	Cisco	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-41091	Microsoft	0
CVE-2026-42897	Microsoft	0
CVE-2026-45247	Mirasvit	0
CVE-2026-45321	@tanstack	0
CVE-2026-45498	Microsoft	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1665
CVE-2021-27102	n/a	2021-11-17	1665
CVE-2021-27101	n/a	2021-11-17	1665
CVE-2021-27103	n/a	2021-11-17	1665
CVE-2021-21017	Adobe	2021-11-17	1665
CVE-2021-28550	Adobe	2021-11-17	1665
CVE-2021-42013	Apache Software Foundation	2021-11-17	1665
CVE-2021-41773	Apache Software Foundation	2021-11-17	1665
CVE-2021-30858	Apple	2021-11-17	1665
CVE-2021-30860	Apple	2021-11-17	1665

Transactions

EXPLOIT PUBLISHED — CVE-2025-52292. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-52293. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-55657. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-55658. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-55659. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10520 (ivanti Sentry). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44716 (pipecat-ai pipecat). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-46492 (commenthol md-fileserver). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-46518 (openemr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-5067 (zephyrproject-rtos Zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-5068 (zephyrproject-rtos Zephyr). Public exploit reference added.

PATCH SHIPPED — CVE-2026-10520 (ivanti Sentry). Fixed in Sentry R10.5.2.

Yesterday's Results

How to read these box scores · glossary

719 CVEs published. 25 box scores and 375 table rows below; the remaining 319 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-20245HIGH

Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .2532   97.8   YES

AFFECTED
  Product                           Versions   Fixed
  Cisco Catalyst SD-WAN Controller  20.6.4 –   —
  Cisco Catalyst SD-WAN Manager     20.1.12 –  —

TIMELINE
  Oct 8   Reserved by CNA
  Jun 9   Added to CISA KEV, due Jun 23
  Jun 9   Published (CNA: cisco)

CWE-116 · CNA: cisco · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 23, 2026

CVE-2026-11645HIGH

Google Chromium V8

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0219   81.1   YES

AFFECTED
  Product  Versions          Fixed
  Chrome   149.0.7827.103 –  —

TIMELINE
  Jun 8   Reserved by CNA
  Jun 9   Added to CISA KEV, due Jun 23
  Jun 9   Published (CNA: Chrome)

CWE-125, CWE-787 · CNA: Chrome · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 23, 2026

CVE-2026-7473MEDIUM

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   N    6.9   .0111   63.3   YES

AFFECTED
  Product  Versions  Fixed
  EOS      4.36.0 –  —

TIMELINE
  Apr 29  Reserved by CNA
  Jun 9   Added to CISA KEV, due Jun 23
  Jun 9   Published (CNA: Arista)

CWE-1023 · CNA: Arista · CVSS v4.0 · 3 references · NVD status: Analyzed · KEV due June 23, 2026

CVE-2026-49160HIGH

Microsoft Windows 10 Version 1607 — HTTP.sys Denial of Service Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .5383   98.9     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2016      10.0.14393.0 –  —
  + 6 more

TIMELINE
  May 27  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-400 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-10523CRITICAL

ivanti Sentry — An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 v…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .5187   98.9     —

AFFECTED
  Product  Versions     Fixed
  Sentry   unspecified  R10.5.2

TIMELINE
  Jun 1   Reserved by CNA
  Jun 9   Published (CNA: ivanti)

CWE-288 · CNA: ivanti · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45484HIGH

Microsoft SharePoint Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .3522   98.3     —

AFFECTED
  Product                                           Versions  Fixed
  Microsoft SharePoint Enterprise Server 2016       16.0.0 –  —
  Microsoft SharePoint Server 2019                  16.0.0 –  —
  Microsoft SharePoint Server Subscription Edition  16.0.0 –  —

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-502 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-47291CRITICAL

Microsoft Windows 10 Version 1607 — HTTP.sys Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .2275   97.5     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012      6.2.9200.0 –    —
  + 10 more

TIMELINE
  May 18  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-190, CWE-122 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45502MEDIUM

Microsoft Exchange Server Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  N  N    5.0   .2026   97.3     —

AFFECTED
  Product                                              Versions     Fixed
  Microsoft Exchange Server 2016 Cumulative Update 23  15.01.0.0 –  —
  Microsoft Exchange Server 2019 Cumulative Update 14  15.02.0.0 –  —
  Microsoft Exchange Server 2019 Cumulative Update 15  15.02.0.0 –  —
  Microsoft Exchange Server Subscription Edition RTM   15.02.0.0 –  —

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-918 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45657CRITICAL

Microsoft Windows 11 version 23H2 — Windows Kernel Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .1548   96.5     —

AFFECTED
  Product                                         Versions        Fixed
  Windows 11 version 23H2                         10.0.22631.0 –  —
  Windows 11 Version 23H2                         10.0.22631.0 –  —
  Windows 11 Version 24H2                         10.0.26100.0 –  —
  Windows 11 Version 25H2                         10.0.26200.0 –  —
  Windows 11 version 26H1                         10.0.28000.0 –  —
  Windows Server 2022                             10.0.20348.0 –  —
  Windows Server 2025                             10.0.26100.0 –  —
  Windows Server 2025 (Server Core installation)  10.0.26100.0 –  —

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-416, CWE-122 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-10727HIGH

Ivanti Endpoint Manager Mobile — An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .1363   96.2     —

AFFECTED
  Product                  Versions     Fixed
  Endpoint Manager Mobile  unspecified  12.9.0.1

TIMELINE
  Jun 3   Reserved by CNA
  Jun 9   Published (CNA: ivanti)

CWE-78 · CNA: ivanti · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-50508HIGH

Microsoft Windows 10 Version 1607 — Windows NTLM Spoofing Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0868   94.7     —

AFFECTED
  Product                                            Versions        Fixed
  Windows 10 Version 1607                            10.0.14393.0 –  —
  Windows 11 version 22H2                            10.0.22621.0 –  —
  Windows Server 2012                                6.2.9200.0 –    —
  Windows Server 2012 (Server Core installation)     6.2.9200.0 –    —
  Windows Server 2012 R2                             6.3.9600.0 –    —
  Windows Server 2012 R2 (Server Core installation)  6.3.9600.0 –    —
  Windows Server 2016                                10.0.14393.0 –  —
  Windows Server 2016 (Server Core installation)     10.0.14393.0 –  —
  Windows Server 2022                                10.0.20348.0 –  —
  Windows Server version 2004                        10.0.0 –        —

TIMELINE
  Jun 4   Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-200 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-42980HIGH

Microsoft Windows 10 Version 1607 — NT OS Kernel Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0695   93.6     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012      6.2.9200.0 –    —
  + 10 more

TIMELINE
  Apr 30  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-191, CWE-122 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-50507MEDIUM

Microsoft Windows 10 Version 1607 — Windows BitLocker Security Feature Bypass Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   P   L   N   N  U  H  H  H    6.8   .0501   91.6     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012 R2   6.3.9600.0 –    —
  + 8 more

TIMELINE
  Jun 4   Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-306 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Modified

CVE-2026-45586HIGH

Microsoft Windows 10 Version 1607 — Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0363   88.6     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012      6.2.9200.0 –    —
  + 10 more

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-59 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45447HIGH

OpenSSL OpenSSL — Heap Use-After-Free in the PKCS7_verify() Function

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0357   88.5     —

AFFECTED
  Product  Versions  Fixed
  OpenSSL  4.0.0 –   —

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: openssl)

CWE-416 · CNA: openssl · CVSS v3.1 · 25 references · NVD status: Modified

CVE-2026-47932HIGH

Adobe ColdFusion — ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   R  C  H  H  H    8.8   .0255   83.8     —

AFFECTED
  Product     Versions     Fixed
  ColdFusion  unspecified  —

TIMELINE
  May 20  Reserved by CNA
  Jun 9   Published (CNA: adobe)

CWE-22 · CNA: adobe · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45591HIGH

Microsoft .NET 10.0 — ASP.NET Core Denial of Service Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0248   83.3     —

AFFECTED
  Product                                    Versions  Fixed
  .NET 10.0                                  10.0.0 –  —
  .NET 8.0                                   8.0.0 –   —
  .NET 9.0                                   9.0.0 –   —
  ASP.NET Core 10.0                          10.0 –    —
  ASP.NET Core 8.0                           8.0 –     —
  ASP.NET Core 9.0                           9.0 –     —
  Microsoft Visual Studio 2026 version 18.6  18.6.0 –  —

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-400 · CNA: microsoft · CVSS v3.1 · 21 references · NVD status: Modified

CVE-2026-44963CRITICAL

Veeam Backup and Replication — A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4   .0235   82.4     —

AFFECTED
  Product                 Versions     Fixed
  Backup and Replication  unspecified  —

TIMELINE
  May 8   Reserved by CNA
  Jun 9   Published (CNA: hackerone)

CWE-502 · CNA: hackerone · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-47928CRITICAL

Adobe ColdFusion — ColdFusion | Improper Input Validation (CWE-20)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   N  C  H  H  H    9.6   .0232   82.1     —

AFFECTED
  Product     Versions     Fixed
  ColdFusion  unspecified  —

TIMELINE
  May 20  Reserved by CNA
  Jun 9   Published (CNA: adobe)

CWE-20 · CNA: adobe · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-42989HIGH

Microsoft Windows 10 Version 1607 — Winlogon Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0227   81.7     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012      6.2.9200.0 –    —
  + 10 more

TIMELINE
  Apr 30  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-59 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-47929HIGH

Adobe ColdFusion — ColdFusion | Incorrect Authorization (CWE-863)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   H   N  C  H  H  H    8.4   .0209   80.2     —

AFFECTED
  Product     Versions     Fixed
  ColdFusion  unspecified  —

TIMELINE
  May 20  Reserved by CNA
  Jun 9   Published (CNA: adobe)

CWE-863 · CNA: adobe · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-42905HIGH

Microsoft Windows 10 Version 1607 — Windows DWM Core Library Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0200   79.3     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012      6.2.9200.0 –    —
  + 10 more

TIMELINE
  Apr 30  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-416 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-42986HIGH

Microsoft Graphics Component Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0200   79.3     —

AFFECTED
  Product                  Versions        Fixed
  Windows 10 Version 1607  10.0.14393.0 –  —
  Windows 10 Version 1809  10.0.17763.0 –  —
  Windows 10 Version 21H2  10.0.19044.0 –  —
  Windows 10 Version 22H2  10.0.19045.0 –  —
  Windows 11 version 23H2  10.0.22631.0 –  —
  Windows 11 Version 23H2  10.0.22631.0 –  —
  Windows 11 Version 24H2  10.0.26100.0 –  —
  Windows 11 Version 25H2  10.0.26200.0 –  —
  Windows 11 version 26H1  10.0.28000.0 –  —
  Windows Server 2012      6.2.9200.0 –    —
  + 10 more

TIMELINE
  Apr 30  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-416 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-26142CRITICAL

Microsoft Nuance PowerScribe 360 4.0 — Nuance PowerScribe Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0191   78.2     —

AFFECTED
  Product                               Versions  Fixed
  Nuance PowerScribe 360 4.0            4.0 –     —
  Nuance PowerScribe 360 version 4.0.1  4.0.1 –   —
  Nuance PowerScribe 360 version 4.0.2  4.0.2 –   —
  Nuance PowerScribe 360 version 4.0.3  4.0.3 –   —
  Nuance PowerScribe 360 version 4.0.4  4.0.4 –   —
  Nuance PowerScribe 360 version 4.0.5  4.0.5 –   —
  Nuance PowerScribe 360 version 4.0.6  4.0.6 –   —
  Nuance PowerScribe 360 version 4.0.7  4.0.7 –   —
  Nuance PowerScribe 360 version 4.0.8  4.0.8 –   —
  Nuance PowerScribe 360 version 4.0.9  4.0.9 –   —
  + 12 more

TIMELINE
  Feb 11  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-502 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45454HIGH

Microsoft SharePoint Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0163   74.4     —

AFFECTED
  Product                                           Versions  Fixed
  Microsoft SharePoint Enterprise Server 2016       16.0.0 –  —
  Microsoft SharePoint Server 2019                  16.0.0 –  —
  Microsoft SharePoint Server Subscription Edition  16.0.0 –  —

TIMELINE
  May 12  Reserved by CNA
  Jun 9   Published (CNA: microsoft)

CWE-22 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-42985	8.8	67.3	Microsoft	Remote Desktop client for Windows Desktop	CWE-416	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-42835	8.1	67.3	Microsoft	Microsoft Teams for Android	CWE-74	Microsoft Teams for Android Information Disclosure Vulnerability
CVE-2026-42764	7.5	64.9	OpenSSL	OpenSSL	CWE-476	NULL Pointer Dereference in QUIC Server Initial Packet Handling
CVE-2026-45648	8.8	63.8	Microsoft	Windows Server 2022	CWE-121	Windows Active Directory Domain Services Remote Code Execution Vulnerability
CVE-2026-8365	8.8	63.7	creativethemeshq	Blocksy	CWE-502	Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Des…
CVE-2026-44815	9.8	63.2	Microsoft	Windows 10 Version 1607	CWE-121	DHCP Client Service Remote Code Execution Vulnerability
CVE-2026-42766	5.9	62.0	OpenSSL	OpenSSL	CWE-476	Possible NULL Dereference in Password-Based CMS Decryption
CVE-2026-34183	7.5	61.7	OpenSSL	OpenSSL	CWE-1325	Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
CVE-2026-11572	7.4	61.5	n/a	degit	CWE-78	Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are v…
CVE-2026-48573	7.9	61.0	Microsoft	Windows 10 Version 1607	CWE-1329	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-48576	7.9	61.0	Microsoft	Windows 10 Version 1607	CWE-1329	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-34180	7.5	61.0	OpenSSL	OpenSSL	CWE-125	Heap Buffer Over-read in ASN.1 Content Parsing
CVE-2026-36723	8.8	60.1	n/a	n/a	CWE-22	An unrestricted file rename vulnerability in the /api/create-user component o…
CVE-2026-47289	8.8	58.7	Microsoft	Windows 10 Version 1607	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-49959	8.7	58.4	nesquena	hermes-webui	CWE-78	Hermes WebUI < 0.51.311 RCE via Git Configuration Injection
CVE-2026-48560	5.4	58.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-502	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-47284	6.5	57.6	Microsoft	Visual Studio Code	CWE-200	Visual Studio Code Information Disclosure Vulnerability
CVE-2026-42903	6.5	57.1	Microsoft	Windows 10 Version 1607	CWE-476	Windows Kerberos Denial of Service Vulnerability
CVE-2026-42908	7.5	56.1	Microsoft	Windows 10 Version 1607	CWE-125	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
CVE-2026-45639	7.5	56.1	Microsoft	Remote Desktop client for Windows Desktop	CWE-125	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
CVE-2026-45504	8.8	55.3	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-918	Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-41098	8.4	54.8	Microsoft	Azure Stack Edge	CWE-79	Azure Stack Edge Spoofing Vulnerability
CVE-2026-38615	9.8	54.4	n/a	n/a	CWE-78	DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
CVE-2026-42907	6.5	54.4	Microsoft	Windows 10 Version 1809	CWE-200	Windows Shell Information Disclosure Vulnerability
CVE-2026-7383	8.1	54.0	OpenSSL	OpenSSL	CWE-787	Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
CVE-2026-42914	5.3	53.6	Microsoft	Windows 10 Version 1607	CWE-125	Windows Kerberos Denial of Service Vulnerability
CVE-2026-47287	6.5	53.4	Microsoft	Visual Studio Code	CWE-23	Visual Studio Code Tampering Vulnerability
CVE-2026-40984	7.5	52.6	Spring	Micrometer	CWE-400	Micrometer HTTP server instrumentations DoS vulnerability
CVE-2026-47281	9.6	52.5	Microsoft	Visual Studio Code	CWE-862	Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-47643	9.8	52.3	Microsoft	Azure Stack Edge	CWE-73	Azure Stack Edge Remote Code Execution Vulnerability
CVE-2025-71319	8.7	51.4	image-size	image-size	CWE-835	image-size 2.0.2 Denial of Service via Infinite Loop in JXL/HEIF Parser
CVE-2026-9076	7.5	50.7	OpenSSL	OpenSSL	CWE-125	Out-of-Bounds Read in CMS Password-Based Decryption
CVE-2026-45481	5.4	49.9	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-40376	8.1	49.2	Microsoft	Visual Studio Code	CWE-20	Visual Studio Code Elevation of Privilege Vulnerability
CVE-2016-20064	6.9	49.2	myasui	WP Vault	CWE-98	WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter
CVE-2026-47298	8.0	49.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-285	Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2026-5067	9.8	48.0	zephyrproject-rtos	Zephyr	CWE-787	Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Se…
CVE-2017-20248	8.7	47.9	Apptha	Apptha Slider Gallery	CWE-22	WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download
CVE-2017-20250	8.7	47.9	Apptha	Mac Photo Gallery	CWE-22	WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download
CVE-2026-42974	8.1	47.9	Microsoft	Windows 11 version 23H2	CWE-190	Windows Performance Monitor Remote Code Execution Vulnerability
CVE-2026-42981	8.1	47.9	Microsoft	Windows 11 version 23H2	CWE-191	Windows Performance Monitor Remote Code Execution Vulnerability
CVE-2026-40371	8.8	47.5	Microsoft	Microsoft Dynamics 365 (on-premises) version 9.1	CWE-280	Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability
CVE-2026-45455	4.3	47.4	Microsoft	Microsoft 365 Apps for Enterprise	CWE-125	Microsoft Excel Information Disclosure Vulnerability
CVE-2026-49818	6.5	47.2	Apache Software Foundation	Apache Airflow Samba provider	CWE-22	Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS o…
CVE-2026-45650	4.3	47.0	Microsoft	Microsoft Bing Search for Android	CWE-451	Microsoft Bing Search Spoofing Vulnerability
CVE-2026-40983	7.5	46.7	Spring	Micrometer	CWE-400	Micrometer gRPC server instrumentation DoS vulnerability
CVE-2026-45445	7.5	46.2	OpenSSL	OpenSSL	CWE-325	AES-OCB IV Ignored on EVP_Cipher() Path
CVE-2026-47653	8.8	46.1	Microsoft	Windows 10 Version 1607	CWE-416	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-42987	8.1	45.5	Microsoft	Windows Server 2012	CWE-416	Windows Deployment Services (WDS) Remote Code Execution
CVE-2026-49955	6.9	45.4	nesquena	hermes-webui	CWE-770	Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options
CVE-2026-42768	3.7	45.1	OpenSSL	OpenSSL	CWE-514	Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
CVE-2026-30141	9.8	44.7	n/a	n/a	CWE-120	An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in …
CVE-2025-10263	9.1	44.6	Arm	C1-Ultra	CWE-362	Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neove…
CVE-2026-47930	8.1	44.5	Adobe	ColdFusion	CWE-20	ColdFusion \| Improper Input Validation (CWE-20)
CVE-2026-11788	7.5	44.1	Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	CWE-476	389-ds-base: 389-ds-base: null pointer dereference in deref control plugin be…
CVE-2017-20251	9.3	44.0	Themeisle	Woody Code Snippets	CWE-94	WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API
CVE-2026-47634	5.4	44.0	Microsoft	Microsoft SharePoint Server 2019	CWE-74	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-42767	5.9	43.9	OpenSSL	OpenSSL	CWE-476	NULL Pointer Dereference in CRMF EncryptedValue Decryption
CVE-2026-45644	8.0	43.7	Microsoft	Microsoft Live Share Canvas SDK	CWE-79	Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability
CVE-2026-48303	10.0	43.7	Adobe	Adobe Campaign Classic (ACC)	CWE-863	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)
CVE-2026-9662	8.1	43.6	plasmatizemedia	Recover Exit For WooCommerce	CWE-98	Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion …
CVE-2026-47654	7.5	43.5	Microsoft	Windows Server 2016	CWE-416	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-48563	7.5	43.5	Microsoft	Windows 10 Version 1809	CWE-416	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-44803	7.8	42.0	Microsoft	Microsoft Excel for Android	CWE-190	Windows Graphics Component Remote Code Execution Vulnerability
CVE-2026-44812	7.8	42.0	Microsoft	Microsoft Excel for Android	CWE-190	Windows Graphics Component Remote Code Execution Vulnerability
CVE-2026-33113	6.1	41.9	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45599	8.1	41.8	Microsoft	Windows 10 Version 1607	CWE-416	Windows UPnP Device Host Remote Code Execution Vulnerability
CVE-2026-45635	8.1	41.8	Microsoft	Windows 10 Version 1607	CWE-843	Windows UPnP Device Host Remote Code Execution Vulnerability
CVE-2026-44822	8.2	41.7	Microsoft	Microsoft 365 Apps for Enterprise	CWE-125	Microsoft Excel Information Disclosure Vulnerability
CVE-2026-36726	5.3	41.3	n/a	n/a	CWE-22	An arbitrary file deletion vulnerability in the /api/delete-temp-license/{fil…
CVE-2026-41731	8.1	41.1	Spring	Spring for Apache Kafka	CWE-502	In Spring for Apache Kafka, overly broad trusted-package matching in header m…
CVE-2026-45453	5.4	41.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45464	5.4	41.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45465	5.4	41.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-47636	5.4	41.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-47639	5.4	41.2	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-42765	7.5	41.1	OpenSSL	OpenSSL	CWE-476	NULL Dereference in Certificate Verification with OCSP Checking
CVE-2026-45462	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45467	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45468	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45479	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-45483	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft Office Project Server Spoofing Vulnerability
CVE-2026-47637	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-47638	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-47640	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-47641	5.4	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-20	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2026-48562	4.6	40.8	Microsoft	Microsoft SharePoint Enterprise Server 2016	CWE-79	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2025-52292	7.5	40.5	n/a	n/a	CWE-121	A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP…
CVE-2026-47288	7.1	40.5	Microsoft	Windows Server 2012	CWE-190	Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
CVE-2026-33582	6.5	39.2	Apache Software Foundation	Apache Answer	CWE-434	Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory…
CVE-2026-45583	8.1	38.9	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-94	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2026-42913	7.5	38.8	Microsoft	Remote Desktop client for Windows Desktop	CWE-362	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-42770	3.7	38.4	OpenSSL	OpenSSL	CWE-325	FFC-DH Peer Validation Uses Attacker-Supplied q
CVE-2025-52293	7.5	38.3	n/a	n/a	CWE-400	A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_t…
CVE-2025-55657	7.5	38.3	n/a	n/a	CWE-476	A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descr…
CVE-2026-44821	5.5	38.2	Microsoft	Microsoft 365 Apps for Enterprise	CWE-125	Microsoft Office Information Disclosure Vulnerability
CVE-2026-9698	9.8	38.1	HMBRAND	DBI	CWE-787	DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
CVE-2026-42992	7.5	38.0	Microsoft	Windows 10 Version 1607	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-44799	7.5	38.0	Microsoft	Remote Desktop client for Windows Desktop	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-44801	7.5	38.0	Microsoft	Remote Desktop client for Windows Desktop	CWE-416	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-44083	8.7	37.9	QNAP Systems Inc.	QuMagie	CWE-639	QuMagie
CVE-2026-42971	5.5	37.8	Microsoft	Windows 10 Version 1607	CWE-200	Windows Push Notification Information Disclosure Vulnerability
CVE-2026-42972	5.5	37.8	Microsoft	Windows 10 Version 1607	CWE-200	Windows Hyper-V Information Disclosure Vulnerability
CVE-2026-47960	7.4	37.7	Adobe	ColdFusion	CWE-611	ColdFusion \| Improper Restriction of XML External Entity Reference ('XXE') (C…
CVE-2026-44819	7.8	37.5	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-44824	7.8	37.5	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-45471	7.8	37.5	Microsoft	Microsoft 365 Apps for Enterprise	CWE-822	Microsoft Word Remote Code Execution Vulnerability
CVE-2026-45475	7.8	37.5	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-40128	9.0	37.5	SAP_SE	SAP NetWeaver Application Server Java (Web Container)	CWE-35	Directory Traversal vulnerability in SAP NetWeaver Application Server Java (W…
CVE-2026-5068	8.8	37.3	zephyrproject-rtos	Zephyr	CWE-787	bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
CVE-2026-42567	5.9	37.3	sveltejs	svelte	CWE-1333	Svelte: ReDoS in `<svelte:element>` Tag Validation
CVE-2026-47938	10.0	37.1	Adobe	Adobe Campaign Classic (ACC)	CWE-918	Adobe Campaign Classic (ACC) \| Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-49842	7.5	37.1	signalwire	freeswitch	CWE-400	FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-…
CVE-2026-48574	7.8	36.9	Microsoft	Windows 10 Version 1607	CWE-122	Windows Media Remote Code Execution Vulnerability
CVE-2026-45503	6.5	36.9	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-285	Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2025-62858	5.1	36.9	QNAP Systems Inc.	QTS	CWE-121	QTS, QuTS hero
CVE-2026-46316	9.3	36.6	Linux	Linux	CWE-911	KVM: arm64: vgic-its: Drop the translation cache reference only for the erase…
CVE-2026-47292	7.8	36.4	Microsoft	Visual Studio Code - MSSQL Extension	CWE-829	Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability
CVE-2026-42904	9.6	36.3	Microsoft	Windows 10 Version 21H2	CWE-122	Windows TCP/IP Elevation of Privilege Vulnerability
CVE-2026-45456	8.4	36.3	Microsoft	Microsoft 365 Apps for Enterprise	CWE-843	Microsoft Outlook and Word Remote Code Execution Vulnerability
CVE-2026-45458	8.4	36.3	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Outlook and Word Remote Code Execution Vulnerability
CVE-2026-27671	9.8	36.2	SAP_SE	SAP NetWeaver AS ABAP and ABAP Platform	CWE-121	Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver a…
CVE-2026-45485	3.3	36.2	Microsoft	Microsoft 365 Apps for Enterprise	CWE-125	Microsoft Office Information Disclosure Vulnerability
CVE-2026-34182	9.1	36.1	OpenSSL	OpenSSL	CWE-354	CMS AuthEnvelopedData Processing May Accept Forged Messages
CVE-2026-42993	7.5	36.0	Microsoft	Windows 10 Version 21H2	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-46746	8.7	35.7	Siemens	SINEC INS	CWE-78	A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Upd…
CVE-2026-48565	7.8	35.8	Microsoft	Windows Narrator Braille	CWE-426	Windows Narrator Braille Elevation of Privilege Vulnerability
CVE-2026-34711	7.5	35.6	Adobe	CAI Content Credentials	CWE-190	CAI Content Credentials \| Integer Overflow or Wraparound (CWE-190)
CVE-2026-45649	7.1	35.4	Microsoft	Microsoft Excel for Android	CWE-284	Office for Android Spoofing Vulnerability
CVE-2026-44716	7.5	35.0	pipecat-ai	pipecat	CWE-22	Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File …
CVE-2026-45595	5.4	35.0	Microsoft	Windows 10 Version 1607	CWE-693	Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2026-46491	8.6	35.0	simplesamlphp	simplesamlphp-module-casserver	CWE-22	SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ti…
CVE-2026-49957	6.3	34.8	nesquena	hermes-webui	CWE-22	Hermes WebUI < 0.51.296 Workspace Boundary Bypass via api/workspace.py
CVE-2026-49847	7.5	34.2	signalwire	freeswitch	CWE-674	FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON
CVE-2026-45655	5.3	34.1	Microsoft	Windows 10 Version 1607	CWE-693	Windows BitLocker Security Feature Bypass Vulnerability
CVE-2026-45636	7.8	33.9	Microsoft	Windows 10 Version 1607	CWE-122	Windows NTFS Remote Code Execution Vulnerability
CVE-2026-34712	7.5	33.6	Adobe	CAI Content Credentials	CWE-20	CAI Content Credentials \| Improper Input Validation (CWE-20)
CVE-2026-34713	7.5	33.6	Adobe	CAI Content Credentials	CWE-400	CAI Content Credentials \| Uncontrolled Resource Consumption (CWE-400)
CVE-2026-25688	6.1	33.5	Apache Software Foundation	Apache Answer	CWE-87	Apache Answer: XSS in AI Answer Rendering
CVE-2026-25699	6.1	33.5	Apache Software Foundation	Apache Answer	CWE-359	Apache Answer: Authorization Bypass in Timeline API
CVE-2026-42906	5.5	33.3	Microsoft	Windows 10 Version 21H2	CWE-200	Windows Shell Information Disclosure Vulnerability
CVE-2026-42970	5.5	33.3	Microsoft	Windows 10 Version 1607	CWE-200	Windows Push Notification Information Disclosure Vulnerability
CVE-2026-42973	5.5	33.3	Microsoft	Windows 10 Version 1607	CWE-200	Windows Push Notification Information Disclosure Vulnerability
CVE-2026-45594	5.5	33.3	Microsoft	Windows 10 Version 1607	CWE-200	Windows Application Identity (AppID) Information Disclosure Vulnerability
CVE-2026-9185	7.5	33.1	sixstorage	6Storage Rentals	CWE-639	6Storage Rentals <= 2.22.0 - Unauthenticated Insecure Direct Object Reference…
CVE-2026-11618	5.5	32.9	DTStack	Taier	CWE-287	DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle…
CVE-2026-42769	5.3	33.0	OpenSSL	OpenSSL	CWE-295	Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
CVE-2026-41842	7.5	32.7	Spring	Spring Framework	CWE-400	Spring Framework Denial of Service via Versioned Resources in Spring MVC and …
CVE-2026-36779	7.5	32.6	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) wa…
CVE-2026-36783	7.5	32.6	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) wa…
CVE-2026-36791	7.5	32.6	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda O3v3 v1.0.0.5 was discovered to cont…
CVE-2026-36792	7.5	32.6	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) wa…
CVE-2026-36793	7.5	32.6	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) wa…
CVE-2026-36794	7.5	32.6	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) wa…
CVE-2026-36796	7.5	32.6	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-36797	7.5	32.6	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-36799	7.5	32.6	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-42570	7.5	32.5	sveltejs	devalue	CWE-770	Svelte devalue: DoS via sparse array deserialization
CVE-2026-42909	7.5	32.5	Microsoft	Remote Desktop client for Windows Desktop	CWE-362	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-9213	6.9	32.6	NETGEAR	MR70	CWE-20	Insufficient input validation in certain NETGEAR routers
CVE-2026-49841	9.8	32.3	signalwire	freeswitch	CWE-122	FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST …
CVE-2026-41729	8.1	32.1	Spring	Spring Data REST	CWE-917	Spring Data REST SpEL Injection via Map Key in JSON Patch
CVE-2026-45461	8.4	31.8	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-42968	5.5	31.6	Microsoft	Windows 10 Version 1607	CWE-125	Windows Telephony Server Information Disclosure Vulnerability
CVE-2026-42969	5.5	31.6	Microsoft	Windows 10 Version 1607	CWE-908	Windows Push Notification Information Disclosure Vulnerability
CVE-2026-45491	5.5	31.6	Microsoft	.NET 10.0	CWE-59	.NET Tampering Vulnerability
CVE-2026-48566	5.5	31.6	Microsoft	Windows 11 Version 24H2	CWE-125	Windows DWM Core Library Information Disclosure Vulnerability
CVE-2026-45466	3.3	31.3	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Word Information Disclosure Vulnerability
CVE-2026-45490	7.8	31.1	Microsoft	.NET 10.0	CWE-285	.NET SDK Elevation of Privilege Vulnerability
CVE-2026-42915	5.5	31.0	Microsoft	Windows 10 Version 21H2	CWE-131	Microsoft Windows VMSwitch Denial of Service Vulnerability
CVE-2026-45606	5.5	31.0	Microsoft	Windows 10 Version 1607	CWE-125	Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability
CVE-2026-45500	6.1	30.2	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-79	Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-45446	4.8	30.1	OpenSSL	OpenSSL	CWE-325	Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes
CVE-2026-50635	8.7	29.9	LimeSurvey	LimeSurvey	CWE-640	LimeSurvey Password Reset Host Header Injection Discloses Reset Token
CVE-2026-44817	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-843	Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-44820	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-125	Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-44823	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-197	Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-45457	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-125	Microsoft Word Remote Code Execution Vulnerability
CVE-2026-45469	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-191	Microsoft Excel Remote Code Execution Vulnerability
CVE-2026-45486	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Word Remote Code Execution Vulnerability
CVE-2026-45643	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-822	Microsoft Word Remote Code Execution Vulnerability
CVE-2026-45645	7.8	29.9	Microsoft	Microsoft 365 Apps for Enterprise	CWE-822	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-53673	8.6	29.8	BuddyPress	BuddyPress	CWE-639	BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter
CVE-2026-45459	3.3	29.8	Microsoft	Microsoft 365 Apps for Enterprise	CWE-693	Microsoft Excel Security Feature Bypass Vulnerability
CVE-2026-36778	4.9	29.7	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) wa…
CVE-2026-45460	4.7	29.7	Microsoft	Microsoft 365 Apps for Enterprise	CWE-126	Microsoft Office Information Disclosure Vulnerability
CVE-2009-10007	9.1	29.6	ETHER	Catalyst::Plugin::Authentication	CWE-384	Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is suscept…
CVE-2026-41843	5.9	29.5	Spring	Spring Framework	CWE-22	Spring Framework Path Traversal via Versioned Static Resources in Spring MVC …
CVE-2026-9750	7.1	29.5	MongoDB	MongoDB Server	CWE-617	Metadata name collision on $-prefixed fields causes post-auth server crash
CVE-2026-53674	7.1	29.4	BuddyPress	BuddyPress	CWE-943	BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution
CVE-2026-45602	9.1	29.3	Microsoft	Windows 10 Version 1607	CWE-349	Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
CVE-2026-36727	9.1	29.1	n/a	n/a	CWE-287	An insecure authentication vulnerability in the /api/social-sign-in endpoint …
CVE-2026-45463	8.4	29.0	Microsoft	Microsoft 365 Apps for Enterprise	CWE-191	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-45472	8.4	29.0	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-45474	8.4	29.1	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-41695	7.5	29.1	Spring	Spring Data Commons	CWE-400	Denial of Service in Spring Data Commons Property Path Resolution
CVE-2026-41716	7.5	29.0	Spring	Spring Data Commons	CWE-770	Spring Data web support unbounded negative-result cache keyed on attacker-sup…
CVE-2026-34031	6.5	28.9	Apache Software Foundation	Apache Answer	CWE-434	Apache Answer: The custom avatar was not properly validated
CVE-2026-45634	5.5	28.9	Microsoft	Windows 10 Version 1607	CWE-125	Windows DHCP Client Information Disclosure Vulnerability
CVE-2026-41850	7.5	28.6	Spring	Spring Framework	CWE-407	Spring Framework Algorithmic Denial of Service via SpEL Expressions
CVE-2026-41851	7.5	28.6	Spring	Spring Framework	CWE-770	Spring Framework Denial of Service via Unbounded Cache in SpEL
CVE-2026-48288	3.5	28.7	Adobe	Adobe Experience Manager	CWE-20	Adobe Experience Manager \| Improper Input Validation (CWE-20)
CVE-2026-34691	9.3	28.5	Adobe	Adobe Experience Manager Forms JEE	CWE-79	Adobe Experience Manager Forms JEE \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-50636	8.7	28.4	LimeSurvey	LimeSurvey	CWE-89	LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection
CVE-2026-45607	7.8	28.3	Microsoft	Windows 10 Version 1607	CWE-125	Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-3088	4.9	28.4	NETGEAR	RBR860	CWE-787	Unauthenticated users can disrupt router operation
CVE-2026-44805	5.5	28.3	Microsoft	Windows Server 2019	CWE-416	Windows Network Controller (NC) Host Agent Denial of Service Vulnerability
CVE-2026-49738	2.1	28.2	TYPO3	TYPO3 CMS	CWE-22	TYPO3 CMS - Broken Access Control in File Abstraction Layer
CVE-2026-45658	6.8	27.9	Microsoft	Windows 10 Version 1607	CWE-284	Windows BitLocker Security Feature Bypass Vulnerability
CVE-2026-47631	5.4	28.0	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-79	Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-48569	5.5	27.6	Microsoft	Visual Studio Code	CWE-20	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-10731	9.3	27.5	Nemon	Nemon Trade Energy	CWE-89	SQL injection in Nemon products
CVE-2026-46325	9.8	27.3	Linux	Linux	—	RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
CVE-2026-9742	8.2	27.2	MongoDB	MongoDB Server	CWE-1287	Authenticate command with specific mechanism parameter can trigger server crash
CVE-2026-41732	8.1	27.3	Spring	Spring for Apache Pulsar	CWE-502	In Spring for Apache Pulsar, overly broad trusted-package matching in header …
CVE-2026-46541	7.5	27.1	nimiq	core-rs-albatross	CWE-754	Nimiq network-libp2p: DHT query poisoning via first-record verification failure
CVE-2026-9740	8.7	27.0	MongoDB	MongoDB Server	CWE-674	Unbounded recursion in BSONColumn interleaved-reference causes pre-auth stack…
CVE-2026-45482	8.4	27.0	Microsoft	Microsoft Visual Studio Code CoPilot Chat Extension	CWE-22	Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
CVE-2025-55659	6.5	27.1	n/a	n/a	CWE-476	A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_…
CVE-2026-45771	7.5	26.9	signalwire	freeswitch	CWE-776	Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion
CVE-2026-42573	5.3	26.7	sveltejs	svelte	CWE-79	Svelte: XSS via DOM Clobbering of Internal Framework State
CVE-2026-47652	8.2	26.6	Microsoft	Windows 11 version 23H2	CWE-122	Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-45604	5.5	26.6	Microsoft	Windows 11 version 23H2	CWE-125	Windows Managed Installer Information Disclosure Vulnerability
CVE-2026-40404	7.8	26.3	Microsoft	Windows 10 Version 1607	CWE-122	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privileg…
CVE-2026-46545	7.5	26.3	nimiq	core-rs-albatross	CWE-248	nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item
CVE-2026-41841	5.9	26.3	Spring	Spring Framework	CWE-524	Spring Framework Information Disclosure via Static Resource Cache in Spring M…
CVE-2026-45608	6.8	26.2	Microsoft	Windows 10 Version 1607	CWE-125	Windows DHCP Client Information Disclosure Vulnerability
CVE-2026-32193	8.8	26.0	Microsoft	Azure Kubernetes Service	CWE-22	Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability
CVE-2026-34033	5.4	25.9	Apache Software Foundation	Apache Answer	CWE-79	Apache Answer: HTML Content Injection in Email
CVE-2026-44634	8.7	25.6	simpleble	simpleble	CWE-121	Stack buffer overflows in SimpleBLE
CVE-2026-47635	8.4	25.7	Microsoft	Microsoft Office LTSC 2024	CWE-122	Microsoft Outlook and Word Remote Code Execution Vulnerability
CVE-2026-40988	7.5	25.5	Spring	Spring Security	CWE-400	Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
CVE-2026-41721	5.9	25.4	Spring	Spring Data Commons	CWE-400	Spring Data Commons Denial of Service via Data Binding
CVE-2026-47912	7.8	25.2	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-47913	7.8	25.2	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-47914	7.8	25.2	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-50511	7.8	25.3	Microsoft	Microsoft PC Manager	CWE-59	Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2026-36770	7.5	25.2	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered …
CVE-2026-36771	7.5	25.2	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) wa…
CVE-2026-36784	7.5	25.2	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) wa…
CVE-2026-41717	8.1	25.2	Spring	Spring Data MongoDB	CWE-917	Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter…
CVE-2026-42828	7.8	24.9	Microsoft	Windows 10 Version 1809	CWE-126	Windows Projected File System Elevation of Privilege Vulnerability
CVE-2026-42837	7.8	24.9	Microsoft	Windows 10 Version 1809	CWE-125	Windows Projected File System Elevation of Privilege Vulnerability
CVE-2026-42916	7.8	24.9	Microsoft	Windows 10 Version 1607	CWE-190	NT OS Kernel Elevation of Privilege Vulnerability
CVE-2026-45476	8.2	24.7	Microsoft	Linux kernel - Microsoft MANA Network Driver	CWE-416	Microsoft Azure Network Adapter Elevation of Privilege Vulnerability
CVE-2026-24065	8.1	24.5	Waves Audio Ltd.	Waves Central	CWE-367	Local Privilege Escalation via Insecure XPC Client Validation in Waves Centra…
CVE-2026-9748	7.1	24.6	MongoDB	MongoDB Server	CWE-617	$_internalConvertBucketIndexStats may crash the mongod server when working on…
CVE-2026-0413	4.3	24.5	NETGEAR	RBE370	CWE-121	Buffer overflow vulnerability in certain NETGEAR Nighthawk routers
CVE-2026-26236	6.6	24.4	QNAP Systems Inc.	QuMagie	CWE-862	QuMagie
CVE-2026-36719	7.5	24.4	n/a	n/a	CWE-200	An information disclosure vulnerability in the /api/v1/user/info endpoint of …
CVE-2026-45656	7.8	24.1	Microsoft	Windows 10 Version 1607	CWE-693	UEFI Secure Boot Security Feature Bypass Vulnerability
CVE-2026-45642	3.9	24.1	Microsoft	Windows 10 Version 1607	CWE-20	Microsoft Azure Attestation service and Device Health Attestation Service Spo…
CVE-2026-44814	5.5	23.9	Microsoft	Windows 11 version 26H1	CWE-125	Windows DWM Core Library Information Disclosure Vulnerability
CVE-2026-41848	7.5	23.8	Spring	Spring Framework	CWE-1333	Spring Framework Denial of Service via AntPathMatcher
CVE-2026-49742	7.1	23.4	TYPO3	TYPO3 CMS	CWE-22	TYPO3 CMS - Broken Access Control in Media Module
CVE-2026-34905	6.5	23.5	Apache Software Foundation	Apache Answer	CWE-200	Apache Answer: Unlisted Questions Accessible via Direct API Access
CVE-2026-49840	9.1	23.1	signalwire	freeswitch	CWE-20	FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length…
CVE-2026-33828	7.8	23.1	Microsoft	Windows 10 Version 1607	CWE-501	Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
CVE-2026-45654	7.9	22.9	Microsoft	Windows 11 Version 24H2	CWE-284	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-36800	7.5	23.0	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-36801	7.5	23.0	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-36802	7.5	23.0	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to cont…
CVE-2026-36803	7.5	23.0	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to cont…
CVE-2026-36805	7.5	23.0	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-36806	7.5	23.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36807	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36808	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36809	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36810	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36811	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36813	7.5	23.0	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36815	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36816	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36817	7.5	23.0	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to c…
CVE-2026-36818	7.5	23.1	n/a	n/a	CWE-120	Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to co…
CVE-2026-36819	7.5	23.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to co…
CVE-2026-36820	7.5	23.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to co…
CVE-2026-36821	7.5	23.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to co…
CVE-2026-36822	7.5	23.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to co…
CVE-2026-36823	7.5	23.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to co…
CVE-2026-45501	6.1	22.9	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-918	Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-45641	7.8	22.8	Microsoft	Windows 10 Version 21H2	CWE-843	Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-47915	7.8	22.7	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-47917	7.8	22.7	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-9743	7.1	22.7	MongoDB	MongoDB server	CWE-476	Aggregation sub-pipeline null dereference may allow DoS via crafted getMore
CVE-2026-41728	7.5	22.6	Spring	Spring Data REST	CWE-284	Spring Data REST JSON Patch bypasses Jackson read-only property protection on…
CVE-2026-45588	7.9	22.4	Microsoft	Windows 10 Version 1607	CWE-693	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-47656	7.9	22.4	Microsoft	Windows 10 Version 1607	CWE-693	Windows Boot Manager Security Feature Bypass Vulnerability
CVE-2026-48568	7.9	22.4	Microsoft	Windows 10 Version 1607	CWE-693	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-48570	7.9	22.4	Microsoft	Windows 10 Version 1607	CWE-693	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-48575	7.9	22.4	Microsoft	Windows 10 Version 1607	CWE-693	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-41711	5.9	22.3	Spring	Spring Data Commons	CWE-400	Potential Denial of Service through crafted Sort Parameters
CVE-2026-35188	5.0	22.2	OpenSSL	OpenSSL	CWE-415	Double-free When Checking OCSP Stapled Response
CVE-2026-36798	6.5	22.1	n/a	n/a	CWE-121	Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to cont…
CVE-2026-46411	6.5	22.1	halfgaar	FlashMQ	CWE-248	FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older
CVE-2026-41007	7.5	21.9	Spring	Spring HATEOAS	CWE-770	Spring HATEOAS heap exhaustion through unbounded internal caching
CVE-2026-34693	8.0	21.8	Adobe	Adobe Experience Manager Forms JEE	CWE-79	Adobe Experience Manager Forms JEE \| Cross-site Scripting (Reflected XSS) (CW…
CVE-2026-40409	7.8	21.8	Microsoft	Windows 10 Version 1607	CWE-197	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privileg…
CVE-2026-9753	7.2	21.8	MongoDB	MongoDB Server	CWE-787	Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
CVE-2026-47918	7.8	21.7	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-47919	7.8	21.7	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-44505	5.3	21.8	nimiq	core-rs-albatross	CWE-755	Nimiq network-libp2p: Untrusted peer can wedge DHT
CVE-2025-55658	6.5	21.6	n/a	n/a	CWE-1077	GPAC MP4Box v2.4 was discovered to contain a floating point exception in the …
CVE-2026-41726	6.5	21.6	Spring	Spring for Apache Kafka	CWE-770	In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled…
CVE-2017-20249	8.8	21.4	apptha	Apptha Slider Gallery	CWE-89	WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection
CVE-2026-47347	5.3	21.4	TYPO3	TYPO3 CMS	CWE-601	TYPO3 CMS - Open Redirect in Core Utilities
CVE-2026-47924	5.5	21.2	Adobe	Acrobat Reader	CWE-416	Acrobat Reader \| Use After Free (CWE-416)
CVE-2026-25860	5.3	21.3	frankverbeke	OpenClinic GA	CWE-79	OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler
CVE-2026-41092	7.8	21.1	Microsoft	Windows 10 Version 1607	CWE-284	Microsoft Kinect Elevation of Privilege Vulnerability
CVE-2026-42829	7.8	21.1	Microsoft	Windows 11 Version 24H2	CWE-284	Windows Administrator Protection Secure Feature Bypass Vulnerability
CVE-2026-42902	7.8	21.1	Microsoft	Microsoft PowerToys	CWE-285	Microsoft PowerToys Elevation of Privilege Vulnerability
CVE-2026-46543	5.3	21.1	nimiq	core-rs-albatross	CWE-617	nimiq-blockchain: Genesis batch set request
CVE-2026-11790	4.9	21.1	Red Hat	Red Hat Directory Server 11	CWE-400	389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration …
CVE-2026-49948	8.6	20.9	mem0ai	mem0	CWE-862	Mem0 0.2.8 Missing Authorization via POST /configure Endpoint
CVE-2026-36724	6.5	20.9	n/a	n/a	CWE-400	An uncaught exception in the /application/job/update/{id} endpoint of Fastapi…
CVE-2026-0419	4.4	20.9	NETGEAR	JR6150	CWE-20	Insufficient input validation vulnerability in NETGEAR JR6150
CVE-2026-41855	9.8	20.8	Spring	Spring Framework	CWE-502	Spring Framework Unsafe Deserialization via Jackson JMS Converters
CVE-2026-42910	7.8	20.6	Microsoft	Windows 11 Version 24H2	CWE-787	Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability
CVE-2026-42983	7.8	20.6	Microsoft	Windows 10 Version 1809	CWE-416	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-45592	7.8	20.6	Microsoft	Windows 10 Version 1607	CWE-190	Windows Internet (wininet.dll) Elevation of Privilege Vulnerability
CVE-2026-45593	7.8	20.6	Microsoft	Windows 10 Version 1809	CWE-416	Windows SDK Elevation of Privilege Vulnerability
CVE-2026-45600	7.8	20.6	Microsoft	Windows 11 Version 24H2	CWE-843	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2026-45605	7.8	20.6	Microsoft	Windows 10 Version 1607	CWE-416	Windows Bluetooth Service Elevation of Privilege Vulnerability
CVE-2026-45637	7.8	20.6	Microsoft	Windows 10 Version 1809	CWE-416	Microsoft DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-45638	7.8	20.6	Microsoft	Windows 10 Version 1607	CWE-122	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerab…
CVE-2026-11620	5.5	20.5	TOTOLINK	EX200	CWE-266	TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation
CVE-2026-49843	5.3	20.3	signalwire	freeswitch	CWE-287	FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` …
CVE-2026-11789	6.5	20.1	Red Hat	Red Hat Directory Server 11	CWE-191	389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer un…
CVE-2026-47939	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47941	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47942	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47943	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47945	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47948	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-47970	5.4	20.1	Adobe	Adobe Experience Manager	CWE-79	Adobe Experience Manager \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-11793	4.9	20.1	Red Hat	Red Hat Directory Server 11	CWE-121	389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id…
CVE-2026-48291	7.8	20.0	Adobe	Format Plugins	CWE-122	Format Plugins \| Heap-based Buffer Overflow (CWE-122)
CVE-2026-48292	7.8	20.0	Adobe	Format Plugins	CWE-122	Format Plugins \| Heap-based Buffer Overflow (CWE-122)
CVE-2026-47923	5.5	20.0	Adobe	Acrobat Reader	CWE-125	Acrobat Reader \| Out-of-bounds Read (CWE-125)
CVE-2026-41710	5.9	19.9	Spring	Spring Retry	CWE-770	Cache Exhaustion in Stateful Retries leads to Denial of Service
CVE-2026-6445	8.7	19.8	Everpure	FlashArray	CWE-939	A flaw exists in FlashArray Purity where insufficient filtering of certain da…
CVE-2026-6444	8.6	19.8	Everpure	FlashArray	CWE-639	A flaw exists in the FlashArray Purity management interface where an authenti…
CVE-2026-49475	7.5	19.7	signalwire	freeswitch	CWE-20	FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing
CVE-2026-0411	4.2	19.7	NETGEAR	RBE970	CWE-200	A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites
CVE-2026-41006	7.5	19.6	Spring	Spring HATEOAS	CWE-284	Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson config…
CVE-2026-47911	7.8	19.4	Adobe	Acrobat Reader	CWE-787	Acrobat Reader \| Out-of-bounds Write (CWE-787)
CVE-2026-7486	9.8	19.3	Netcad Software Inc.	E-İmar	CWE-89	SQLi in Netcad's E-İmar
CVE-2026-8025	9.8	19.3	MOSK Information Technologies Ltd.	CBS Platform	CWE-89	SQLi in MOSK Informatics' CBS Platform
CVE-2026-11616	8.8	19.4	stiofansisland	Events Calendar for GeoDirectory	CWE-269	Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Priv…
CVE-2026-41108	7.0	19.2	Microsoft	Windows 10 Version 1607	CWE-122	Windows DNS Client Elevation of Privilege Vulnerability
CVE-2026-8499	5.3	19.1	helpfulcrowd	Helpfulcrowd Product Reviews	CWE-843	Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Jugg…
CVE-2026-49956	7.1	19.0	nesquena	hermes-webui	CWE-862	Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search
CVE-2016-20062	8.8	18.7	Ollie Armstrong	Simply Poll	CWE-89	Simply Poll 1.4.1 Plugin for WordPress SQL Injection
CVE-2016-20065	8.8	18.7	EvWill	Product Catalog 8	CWE-89	Product Catalog 8 1.2 Plugin WordPress SQL Injection
CVE-2017-20244	8.8	18.7	Wow-Company	Wow Forms	CWE-89	Wow Forms WordPress Plugin 2.1 SQL Injection
CVE-2017-20245	8.8	18.7	Wow-Company	Wow Viral Signups	CWE-89	Wow Viral Signups 2.1 WordPress Plugin SQL Injection
CVE-2017-20246	8.8	18.7	Missilesilo	KittyCatfish	CWE-89	KittyCatfish 2.2 Plugin for WordPress SQL Injection
CVE-2026-9279	8.7	18.7	logseq	logseq	CWE-78	Shell command injection in Logseq
CVE-2026-9746	7.1	18.6	MongoDB	MongoDB Server	CWE-617	Server crashes in case of the use of exchange
CVE-2026-9747	7.1	18.6	MongoDB	MongoDB Server	CWE-617	Crafted cross-shard merge aggregation crashes MongoDB Server
CVE-2026-9749	7.1	18.6	MongoDB	MongoDB Server	CWE-617	Using MaxKey() may crash the server
CVE-2026-9752	7.1	18.6	MongoDB	MongoDB Server	CWE-476	GeometryCollection with strict-winding polygon causes server crash during 2ds…
CVE-2026-9212	5.6	18.6	NETGEAR	LBR1020	CWE-20	Insufficient authentication and input validation in certain NETGEAR products
CVE-2026-47348	5.1	18.5	TYPO3	TYPO3 CMS	CWE-79	TYPO3 CMS - Cross-Site Scripting in Indexed Search
CVE-2026-36721	9.8	18.5	n/a	n/a	CWE-347	A lack of cryptographic signature verification in the validateAccessToken fun…
CVE-2026-48578	7.9	18.4	Microsoft	Windows 10 Version 1607	CWE-284	Secure Boot Security Feature Bypass Vulnerability
CVE-2026-44802	7.8	18.3	Microsoft	Windows 10 Version 1809	CWE-416	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-44804	7.8	18.3	Microsoft	Windows 11 version 26H1	CWE-416	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-44807	7.8	18.3	Microsoft	Windows 11 version 26H1	CWE-416	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-44808	7.8	18.3	Microsoft	Windows 11 version 26H1	CWE-122	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-44809	7.8	18.3	Microsoft	Windows 11 Version 24H2	CWE-416	Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-44811	7.8	18.3	Microsoft	Windows 11 version 26H1	CWE-122	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-44813	7.8	18.3	Microsoft	Windows 11 version 26H1	CWE-416	Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2026-48583	7.8	18.3	Microsoft	Windows 10 Version 1607	CWE-416	Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-41840	5.9	18.4	Spring	Spring Framework	CWE-401	Spring WebFlux applications are vulnerable to Denial of Service (DoS) attacks…

Results continue: ranks 401–719.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-09 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.