Security Box Score — June 14, 2026

17 CVEs published, led by GL.iNet (2).

17 CVEs published June 14, 2026: 1 critical, 10 high, 4 medium, 2 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 0 awaiting enrichment.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	3372	7833	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

349 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	95	1062	84	663	314	1	11	2	0.2	7.8	.0013	-118 ▼
google	591	766	67	406	272	21	77	6	0.8	8.1	.0023	+591 ▲
microsoft	207	743	55	512	170	6	286	19	2.6	7.8	.0044	+69 ▲
red hat	44	138	8	57	62	11	2	0	0.0	6.7	.0030	+39 ▲
apple	14	66	1	21	42	2	88	7	10.6	5.7	.0019	-1 ▼
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
debian	2	2	0	0	2	0	1	0	0.0	6.5	.0023	+2 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
netgear	17	17	0	0	16	1	0	0	0.0	4.3	.0024	+17 ▲
cisco	3	15	5	4	6	0	56	9	60.0	7.5	.0694	+2 ▲
palo alto networks	9	11	1	2	7	1	13	2	18.2	5.9	.0022	+7 ▲
ivanti	4	9	4	5	0	0	25	5	55.6	8.8	.5187	+3 ▲
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	+3 ▲
fortinet	2	9	4	3	2	0	28	3	33.3	8.3	.0076	+1 ▲
ubiquiti	5	8	4	4	0	0	3	0	0.0	8.9	.0052	+5 ▲
vmware	3	4	0	2	2	0	7	1	25.0	6.7	.0036	+3 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	67	101	15	40	43	2	33	1	1.0	7.3	.0052	+63 ▲
gitlab	11	18	0	4	12	2	4	2	11.1	4.8	.0024	+11 ▲
mozilla	5	11	3	4	4	0	9	0	0.0	7.5	.0032	+1 ▲
docker	2	5	0	5	0	0	0	0	0.0	8.8	.0021	+2 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
adobe	124	126	4	48	72	2	19	2	1.6	5.5	.0021	+124 ▲
ibm	11	60	13	29	18	0	6	0	0.0	7.5	.0028	+11 ▲
oracle	2	30	10	16	4	0	27	2	6.7	8.1	.0027	+2 ▲
progress	5	9	1	7	1	0	6	0	0.0	7.5	.0036	+5 ▲
solarwinds	3	6	2	3	1	0	10	4	66.7	7.8	.6082	+3 ▲
veeam	1	4	2	2	0	0	1	0	0.0	9.0	.0052	+1 ▲
zohocorp	0	2	0	1	1	0	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	5.6	.0025	+5 ▲
d-link	9	11	0	4	2	5	3	5.5	.0058	+9 ▲
siemens	7	8	0	4	4	0	0	7.5	.0020	+6 ▲
abb	5	5	0	4	1	0	0	7.2	.0018	+5 ▲
dahua	3	3	0	1	1	1	0	6.9	.0036	+3 ▲
hitachi energy	0	2	0	0	2	0	0	5.7	.0014	0
moxa	1	1	0	1	0	0	0	7.0	.0007	+1 ▲
schneider electric	1	1	0	1	0	0	0	7.1	.0023	+1 ▲

Other
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
spring	68	69	2	27	39	1	0	6.5	.0023	+68 ▲
sourcecodester	36	58	0	0	24	34	0	2.1	.0026	+36 ▲
edimax	0	51	0	32	0	19	1	7.4	.0059	0
concrete cms	2	46	1	11	13	21	0	6.2	.0015	+2 ▲
open ises	0	44	2	21	21	0	0	7.1	.0021	0
helmholz	0	42	0	39	3	0	0	7.1	.0026	0
mb connect line	0	42	0	39	3	0	0	7.1	.0026	0
openclaw	34	40	0	24	12	4	0	7.4	.0022	+34 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9991	100.0	10.0
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-50751	.8377	99.7	9.3
CVE-2026-45498	.6308	99.1	7.5
CVE-2026-49160	.5383	98.9	7.5
CVE-2026-10523	.5187	98.9	9.8
CVE-2026-28318	.4001	98.5	7.5
CVE-2026-53435	.3766	98.4	8.8
CVE-2026-46442	.3634	98.4	9.4

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9991	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-20223	10.0	.0083
CVE-2026-47140	10.0	.0082
CVE-2026-47208	10.0	.0076

Most disclosures (vendor)
Vendor	CVEs
google	759
linux	521
microsoft	234
adobe	124
apache	84
red hat	81
spring	69
ibm	60
sourcecodester	58
edimax	51

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	9
apple	7
google	6
ivanti	5
solarwinds	4
berriai	3
fortinet	3
smartertools	3
adobe	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	35
Packagist	22
PyPI	11
npm	4
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-20245	Cisco	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-35273	Oracle Corporation	0
CVE-2026-41091	Microsoft	0
CVE-2026-45247	Mirasvit	0
CVE-2026-45321	@tanstack	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1670
CVE-2021-27102	n/a	2021-11-17	1670
CVE-2021-27101	n/a	2021-11-17	1670
CVE-2021-27103	n/a	2021-11-17	1670
CVE-2021-21017	Adobe	2021-11-17	1670
CVE-2021-28550	Adobe	2021-11-17	1670
CVE-2021-42013	Apache Software Foundation	2021-11-17	1670
CVE-2021-41773	Apache Software Foundation	2021-11-17	1670
CVE-2021-30858	Apple	2021-11-17	1670
CVE-2021-30860	Apple	2021-11-17	1670

Transactions

EXPLOIT PUBLISHED — CVE-2026-12188 (Grit42 Grit). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

17 CVEs published. 17 box scores, 0 table rows — nothing truncated.

CVE-2026-12197HIGH

Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    7.3   .0238   82.6     —

AFFECTED
  Product   Versions  Fixed
  EG105G-P  2.340 –   —

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12186HIGH

GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0197   78.8     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-12187HIGH

GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0194   78.6     —

AFFECTED
  Product    Versions  Fixed
  GL-MT3000  4.4.0 –   4.7

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-11526CRITICAL

RURBAN GD — GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0135   69.4     —

AFFECTED
  Product  Versions     Fixed
  GD       unspecified  —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 14  Published (CNA: CPANSec)

CWE-73, CWE-78 · CNA: CPANSec · CVSS v3.1 · 4 references · NVD status: Deferred

CVE-2026-11527HIGH

SHLOMIF Config::IniFiles — Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  C  H  H  H    8.6   .0107   62.2     —

AFFECTED
  Product           Versions     Fixed
  Config::IniFiles  unspecified  —

TIMELINE
  Jun 7   Reserved by CNA
  Jun 14  Published (CNA: CPANSec)

CWE-73, CWE-78 · CNA: CPANSec · CVSS v3.1 · 4 references · NVD status: Deferred

CVE-2026-54410HIGH

debevv nanoMODBUS — nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   H    7.8   .0054   43.0     —

AFFECTED
  Product     Versions     Fixed
  nanoMODBUS  unspecified  —

TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)

CWE-193, CWE-787 · CNA: TuranSec · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-54412HIGH

LiamBindle MQTT-C — MQTT-C Heap Out-of-Bounds Read and Integer Underflow in mqtt_unpack_publish_response()

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   H    7.8   .0041   33.6     —

AFFECTED
  Product  Versions     Fixed
  MQTT-C   unspecified  —

TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)

CWE-125, CWE-191 · CNA: TuranSec · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-54413HIGH

driftregion iso14229 — iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   H    7.8   .0041   33.6     —

AFFECTED
  Product   Versions     Fixed
  iso14229  unspecified  —

TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)

CWE-125, CWE-191 · CNA: TuranSec · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-54411MEDIUM

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   N   N    6.9   .0033   25.6     —

AFFECTED
  Product    Versions     Fixed
  Linux-PAM  unspecified  —

TIMELINE
  Jun 13  Reserved by CNA
  Jun 14  Published (CNA: TuranSec)

CWE-208 · CNA: TuranSec · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-12192HIGH

GALAYOU Y4 Web Server buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    7.4   .0032   23.8     —

AFFECTED
  Product  Versions  Fixed
  Y4       1.0.0 –   —

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-54421MEDIUM

OpenStack Ironic — In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  C  H  N  N    6.8   .0029   21.0     —

AFFECTED
  Product  Versions  Fixed
  Ironic   17.0.0 –  —

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: mitre)

CWE-212 · CNA: mitre · CVSS v3.1 · 3 references · NVD status: Deferred

CVE-2026-12188LOW

Grit42 Grit GritEntityController grit_entity_controller.rb sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0020    9.4     —

AFFECTED
  Product  Versions  Fixed
  Grit     0.1 –     —

TIMELINE
  Jun 14  Public exploit reference published
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2025-15546MEDIUM

Unknown Iptanus File Upload — Iptanus File Upload < 5.1.7 - File Overwrite via Race Condition

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   R  U  N  H  L    5.4   .0016    5.2     —

AFFECTED
  Product              Versions     Fixed
  Iptanus File Upload  unspecified  —

TIMELINE
  Jan 26  Reserved by CNA
  Jun 14  Published (CNA: WPScan)

CWE-362 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-12193HIGH

VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    7.1   .0014    3.7     —

AFFECTED
  Product          Versions  Fixed
  RevoUninstaller  2.5.* –   2.7.0

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-119, CWE-122 · CNA: VulDB · CVSS v4.0 · 10 references · NVD status: Deferred

CVE-2026-12191HIGH

Comma AI Openpilot Pickle modeld.py pickle.loads deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    7.1   .0014    3.3     —

AFFECTED
  Product    Versions  Fixed
  Openpilot  0.11 –    —

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-20, CWE-502 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-12190MEDIUM

Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    4.8   .0010    1.2     —

AFFECTED
  Product           Versions  Fixed
  AI Workspace App  2.8.4 –   —

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-285, CWE-939 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12189LOW

Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0010    1.2     —

AFFECTED
  Product                   Versions  Fixed
  Bus & Public Transit App  1.18 –    —

TIMELINE
  Jun 14  Reserved by CNA
  Jun 14  Published (CNA: VulDB)

CWE-285, CWE-939 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-14 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.