Security Box Score — June 18, 2026

151 CVEs published, led by mcdope (7).

151 CVEs published June 18, 2026: 27 critical, 59 high, 62 medium, 3 low; 1 in the KEV catalog at press time; 5 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 126 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	4865	9326	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

432 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	96	1063	84	664	314	1	11	2	0.2	7.8	.0013	-119 ▼
google	684	859	83	454	293	29	77	6	0.7	8.1	.0023	+684 ▲
microsoft	212	748	56	516	170	6	286	19	2.5	7.8	.0044	+69 ▲
red hat	67	161	8	67	75	11	2	0	0.0	6.6	.0028	+61 ▲
apple	14	66	1	21	42	2	88	7	10.6	5.7	.0019	-1 ▼
canonical	0	14	0	4	5	5	0	0	0.0	5.5	.0009	0
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	0
suse	3	5	0	4	1	0	0	0	0.0	8.5	.0022	+3 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	9	21	6	5	10	0	56	10	47.6	7.2	.0438	+8 ▲
netgear	17	17	0	0	16	1	0	0	0.0	4.3	.0024	+17 ▲
palo alto networks	9	11	1	2	7	1	13	2	18.2	5.9	.0022	+7 ▲
ivanti	4	9	4	5	0	0	25	5	55.6	8.8	.5187	+3 ▲
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	+3 ▲
fortinet	2	9	4	3	2	0	28	3	33.3	8.3	.0076	+1 ▲
f5	6	8	4	3	1	0	4	1	12.5	8.9	.0225	+5 ▲
ubiquiti	5	8	4	4	0	0	3	0	0.0	8.9	.0052	+5 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	74	108	18	41	46	2	33	1	0.9	7.3	.0050	+70 ▲
mozilla	49	55	11	18	26	0	9	0	0.0	7.3	.0026	+45 ▲
gitlab	11	18	0	4	12	2	4	2	11.1	4.8	.0024	+11 ▲
docker	4	7	0	5	2	0	0	0	0.0	8.2	.0016	+4 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	0
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	242	270	132	116	18	4	27	2	0.7	8.8	.0040	+242 ▲
adobe	129	131	4	50	75	2	19	2	1.5	5.5	.0021	+129 ▲
ibm	11	60	13	29	18	0	6	0	0.0	7.5	.0028	+11 ▲
progress	5	9	1	7	1	0	6	0	0.0	7.5	.0036	+5 ▲
solarwinds	3	6	2	3	1	0	10	4	66.7	7.8	.6082	+3 ▲
veeam	1	4	2	2	0	0	1	0	0.0	9.0	.0052	+1 ▲
zohocorp	0	2	0	1	1	0	0	0	0.0	7.1	.0104	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	5.6	.0025	+5 ▲
d-link	9	11	0	4	2	5	3	5.5	.0058	+9 ▲
siemens	7	8	0	4	4	0	0	7.5	.0020	+6 ▲
rockwell automation	7	7	1	5	1	0	0	8.7	.0030	+7 ▲
abb	5	5	0	4	1	0	0	7.2	.0018	+5 ▲
moxa	5	5	0	3	2	0	0	7.0	.0029	+5 ▲
dahua	3	3	0	1	1	1	0	6.9	.0036	+3 ▲
hitachi energy	0	2	0	0	2	0	0	5.7	.0014	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
spring	71	72	2	30	39	1	0	0	0.0	6.5	.0023	+71 ▲
openclaw	61	67	0	35	22	10	0	0	0.0	7.0	.0021	+61 ▲
sourcecodester	37	59	0	0	25	34	0	0	0.0	2.1	.0026	+37 ▲
themerex	58	58	5	53	0	0	0	0	0.0	8.1	.0043	+58 ▲
edimax	0	51	0	32	0	19	1	0	0.0	7.4	.0059	0
concrete cms	2	46	1	11	13	21	0	0	0.0	6.2	.0015	+2 ▲
dell	26	44	1	20	23	0	2	1	2.3	6.7	.0016	+26 ▲
open ises	0	44	2	21	21	0	0	0	0.0	7.1	.0021	0

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9991	100.0	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-9082	.8832	99.8	9.8
CVE-2026-50751	.8377	99.7	9.3
CVE-2026-48907	.7810	99.5	10.0
CVE-2026-45498	.6308	99.1	7.5
CVE-2026-49160	.5383	98.9	7.5
CVE-2026-10523	.5187	98.9	9.8
CVE-2026-28318	.4001	98.5	7.5

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9991	KEV
CVE-2026-48907	10.0	.7810	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-49257	10.0	.0093
CVE-2026-20223	10.0	.0083

Most disclosures (vendor)
Vendor	CVEs
google	852
linux	520
oracle	267
microsoft	234
adobe	129
red hat	103
apache	91
spring	72
openclaw	67
ibm	60

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	10
apple	7
google	6
ivanti	5
solarwinds	4
berriai	3
fortinet	3
smartertools	3
adobe	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	42
Packagist	22
PyPI	11
npm	4
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-20245	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-20262	Cisco	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34926	Trend Micro, Inc.	0
CVE-2026-35273	Oracle Corporation	0
CVE-2026-41091	Microsoft	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1674
CVE-2021-27102	n/a	2021-11-17	1674
CVE-2021-27101	n/a	2021-11-17	1674
CVE-2021-27103	n/a	2021-11-17	1674
CVE-2021-21017	Adobe	2021-11-17	1674
CVE-2021-28550	Adobe	2021-11-17	1674
CVE-2021-42013	Apache Software Foundation	2021-11-17	1674
CVE-2021-41773	Apache Software Foundation	2021-11-17	1674
CVE-2021-30858	Apple	2021-11-17	1674
CVE-2021-30860	Apple	2021-11-17	1674

Transactions

EXPLOIT PUBLISHED — CVE-2026-43994 (coturn). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44663 (AcademySoftwareFoundation openexr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45696 (AcademySoftwareFoundation openexr). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

151 CVEs published. 25 box scores, 126 table rows — nothing truncated.

CVE-2026-20253CRITICAL

Splunk Splunk Enterprise — Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9694   99.9   YES

AFFECTED
  Product            Versions  Fixed
  Splunk Enterprise  10.2 –    —

TIMELINE
  Oct 8   Reserved by CNA
  Jun 18  Added to CISA KEV, due Jun 21
  Jun 18  Published (CNA: cisco)

CWE-306 · CNA: cisco · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 21, 2026

CVE-2026-38714CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   82.0     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-38715CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   82.0     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-38716CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   82.0     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-38717CRITICAL

n/a n/a — InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0231   82.0     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 18  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-8461HIGH

FFmpeg FFmpeg — Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0157   73.5     —

AFFECTED
  Product  Versions     Fixed
  FFmpeg   unspecified  —

TIMELINE
  May 13  Reserved by CNA
  Jun 18  Published (CNA: JFROG)

CWE-787 · CNA: JFROG · CVSS v3.1 · 5 references · NVD status: Awaiting Analysis

CVE-2026-54130HIGH

Microsoft Microsoft 365 Copilot — M365 Copilot Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0108   62.7     —

AFFECTED
  Product                Versions  Fixed
  Microsoft 365 Copilot  - –       —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: microsoft)

CWE-306 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2025-27511HIGH

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0107   62.4     —

AFFECTED
  Product                         Versions    Fixed
  org.geoserver.extension:gs-db2  < 2.27.0 –  —

TIMELINE
  Feb 26  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-74, CWE-502 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Analyzed

CVE-2026-47633HIGH

Microsoft Cost Management Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0103   61.0     —

AFFECTED
  Product                    Versions  Fixed
  Microsoft Cost Management  - –       —

TIMELINE
  May 19  Reserved by CNA
  Jun 18  Published (CNA: microsoft)

CWE-200 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-40456HIGH

LMS LMS — OS Command Injection in LMS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   H   H   H    8.6   .0095   58.5     —

AFFECTED
  Product  Versions     Fixed
  LMS      unspecified  —

TIMELINE
  Apr 13  Reserved by CNA
  Jun 18  Published (CNA: CERT-PL)

CWE-78 · CNA: CERT-PL · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-49257CRITICAL

startreedata mcp-pinot — mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0093   57.9     —

AFFECTED
  Product    Versions   Fixed
  mcp-pinot  < 3.1.0 –  —

TIMELINE
  May 28  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-306 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Deferred

CVE-2026-12046CRITICAL

pgadmin.org pgAdmin 4 — pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.5   .0092   57.6     —

AFFECTED
  Product    Versions  Fixed
  pgAdmin 4  6.9 –     —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: PostgreSQL)

CWE-306, CWE-502 · CNA: PostgreSQL · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2026-56078HIGH

PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0092   57.4     —

AFFECTED
  Product    Versions     Fixed
  PraisonAI  unspecified  1.5.115

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-40624CRITICAL

AVer PTC cameras Files or Directories Accessible to External Parties

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0083   54.9     —

AFFECTED
  Product  Versions     Fixed
  PTC500S  unspecified  —
  PTC115   unspecified  —
  PTC500+  unspecified  —
  PTC115+  unspecified  —

TIMELINE
  May 7   Reserved by CNA
  Jun 18  Published (CNA: icscert)

CWE-552 · CNA: icscert · CVSS v4.0 · 2 references · NVD status: Awaiting Analysis

CVE-2026-47647CRITICAL

Microsoft Microsoft Dynamics 365 — Dynamics 365 Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0078   53.1     —

AFFECTED
  Product                 Versions  Fixed
  Microsoft Dynamics 365  - –       —

TIMELINE
  May 19  Reserved by CNA
  Jun 18  Published (CNA: microsoft)

CWE-284 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-54103CRITICAL

Government Accountability Office Electronic Protest Docketing System (EPDS) — U.S. GAO EPDS and CBCA EDS unauthenticated password change

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0077   52.9     —

AFFECTED
  Product                                     Versions     Fixed
  Electronic Protest Docketing System (EPDS)  unspecified  2026-02-22
  Electronic Docketing System (EDS)           unspecified  2026-03-19

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: cisa-cg)

CWE-306 · CNA: cisa-cg · CVSS v4.0 · 4 references · NVD status: Awaiting Analysis

CVE-2026-32174HIGH

Microsoft Azure AI Bot Service — Azure Bot Service Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0077   52.7     —

AFFECTED
  Product               Versions  Fixed
  Azure AI Bot Service  - –       —

TIMELINE
  Mar 10  Reserved by CNA
  Jun 18  Published (CNA: microsoft)

CWE-287 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-56076HIGH

PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   N    8.6   .0074   51.9     —

AFFECTED
  Product    Versions     Fixed
  PraisonAI  unspecified  1.5.128

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-942 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-54104HIGH

Government Accountability Office Electronic Protest Docketing System (EPDS) — U.S. GAO EPDS and CBCA EDS client-based privilege escalation

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0072   51.3     —

AFFECTED
  Product                                     Versions     Fixed
  Electronic Protest Docketing System (EPDS)  unspecified  2026-02-22
  Electronic Docketing System (EDS)           unspecified  2026-03-19

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: cisa-cg)

CWE-602 · CNA: cisa-cg · CVSS v4.0 · 4 references · NVD status: Awaiting Analysis

CVE-2026-12044HIGH

pgadmin.org pgAdmin 4 — pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0071   50.7     —

AFFECTED
  Product    Versions  Fixed
  pgAdmin 4  1.0 –     —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: PostgreSQL)

CWE-89, CWE-116 · CNA: PostgreSQL · CVSS v4.0 · 3 references · NVD status: Analyzed

CVE-2026-56075HIGH

PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0071   50.6     —

AFFECTED
  Product    Versions     Fixed
  PraisonAI  unspecified  4.5.128

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2025-53114HIGH

CometD has acknowledgement extension out of memory

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0068   49.8     —

AFFECTED
  Product  Versions              Fixed
  cometd   >= 5.0.0, < 5.0.23 –  —

TIMELINE
  Jun 25  Reserved by CNA
  Jun 18  Published (CNA: GitHub_M)

CWE-400 · CNA: GitHub_M · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2026-43994CRITICAL

Coturn: Stack buffer overflow in decode_oauth_token_gcm()

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0067   49.4     —

AFFECTED
  Product  Versions    Fixed
  coturn   < 4.10.0 –  —

TIMELINE
  May 4   Reserved by CNA
  Jun 18  Public exploit reference published
  Jun 18  Published (CNA: GitHub_M)

CWE-120 · CNA: GitHub_M · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-12045CRITICAL

pgadmin.org pgAdmin 4 — pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   P   H   H   H    9.4   .0066   48.7     —

AFFECTED
  Product    Versions  Fixed
  pgAdmin 4  9.13 –    —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 18  Published (CNA: PostgreSQL)

CWE-77, CWE-89 · CNA: PostgreSQL · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2025-15661HIGH

libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   L   N   H    8.3   .0065   48.3     —

AFFECTED
  Product  Versions     Fixed
  libssh2  unspecified  2dae3024897e1898d389835151f4e9606227721d

TIMELINE
  Jun 18  Reserved by CNA
  Jun 18  Published (CNA: VulnCheck)

CWE-125 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-54223	8.6	47.4	UBB Systems	UBB.threads	CWE-22	Remote Code Execution via arbitrary file read and write in UBB.threads
CVE-2025-52465	7.2	46.8	geoserver	org.geoserver.web:gs-web-app	CWE-73	GeoServer has an arbitrary file write vulnerability in its Master Password Du…
CVE-2026-54390	9.3	46.2	JTL Software	JTL Shop	CWE-1336	JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer
CVE-2026-9158	5.2	46.1	Eclipse Foundation	Eclipse 4diac	CWE-416	In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE co…
CVE-2026-48937	7.5	44.7	nodejs	node	CWE-400	A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data …
CVE-2026-49248	8.3	44.6	theonedev	onedev	CWE-61	OneDev: RCE through absolute-path symlink following allows low-privileged use…
CVE-2026-9860	8.8	44.1	vanyukov	Offload, AI & Optimize with Cloudflare Images	CWE-434	Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Auth…
CVE-2026-56022	6.9	43.8	Webmin	Webmin	CWE-308	Webmin MFA bypass
CVE-2026-8024	9.3	43.7	iba	ibaPDA	CWE-502	Deserialization vulnerability in ibaPDA and ibaDatCoordinator
CVE-2026-8100	8.6	43.5	Progress Chef	Chef360	CWE-23	Impact A security issue has been identified in Chef 360 that could allow unau…
CVE-2025-32392	8.7	42.5	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in LoopVideoBlock
CVE-2026-55205	6.9	42.0	nesquena	hermes-webui	CWE-770	Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow …
CVE-2026-54017	7.7	41.9	open-webui	open-webui	CWE-22	Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path t…
CVE-2026-44688	8.4	40.9	Eclipse Foundation	Eclipse Theia	CWE-829	In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed worksp…
CVE-2026-46580	8.4	40.9	Eclipse Foundation	Eclipse Theia	CWE-829	In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompt…
CVE-2026-54105	6.9	40.8	Government Accountability Office	Electronic Protest Docketing System (EPDS)	CWE-639	U.S. GAO EPDS and CBCA EDS user information disclosure
CVE-2026-56099	6.9	40.6	openbsd	src	CWE-125	OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input
CVE-2026-56020	9.2	40.2	Webmin	Webmin	CWE-290	Webmin HTTP header authentication bypass
CVE-2026-54106	5.1	40.0	Government Accountability Office	Electronic Protest Docketing System (EPDS)	CWE-940	U.S. GAO EPDS and CBCA EDS network access control bypass
CVE-2026-10736	4.9	39.9	themeum	Tutor LMS – eLearning and online course solution	CWE-89	Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data'…
CVE-2026-55204	8.7	39.5	haproxy	haproxy	CWE-476	HAProxy - NULL Pointer Dereference in hpack_dht_insert Function
CVE-2026-47846	9.8	39.4	Bitnami	bitnami/cassandra	CWE-798	Bitnami Cassandra container images are affected by a retained default superus…
CVE-2026-56021	6.9	39.0	Webmin	Webmin	CWE-185	Webmin information disclosure via regex pattern
CVE-2026-11982	5.1	38.9	Grav	grav-plugin-api	CWE-79	Stored XSS via missing XSS safety check in Admin2 Pages API partial validation
CVE-2026-11360	4.9	38.9	algolplus	Advanced Order Export For WooCommerce	CWE-89	Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager…
CVE-2025-58175	8.2	38.7	geoserver	org.geoserver.web:gs-web-app	CWE-20	GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML E…
CVE-2026-49252	9.9	38.6	deepstreamIO	deepstream.io	CWE-1321	deepstream is vulnerable to prototype pollution
CVE-2026-38718	7.5	37.7	n/a	n/a	CWE-120	InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlie…
CVE-2026-56077	7.1	36.9	PraisonAI	PraisonAI	CWE-668	PraisonAI - Information Disclosure via Shared MultiAgentLedger State
CVE-2026-54419	9.3	36.7	claudiopizzillo	PIAF-HMS	CWE-89	PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query
CVE-2025-32422	8.7	35.4	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock
CVE-2025-32424	8.7	35.4	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock
CVE-2025-32437	8.7	35.4	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in MediaDurationBlock
CVE-2026-50141	7.1	35.4	woodpecker-ci	woodpecker	CWE-290	Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent imperson…
CVE-2026-12050	5.3	35.3	pgadmin.org	pgAdmin 4	CWE-89	pgAdmin 4: SQL injection in named restore point endpoint
CVE-2026-48716	8.7	34.9	HKUDS	nanobot	CWE-22	nanobot: Path traversal via unsanitized WhatsApp document fileName enables ar…
CVE-2026-9692	5.3	34.7	HAYAJO	Mojolicious::Sessions::Storable	CWE-338	Mojolicious::Sessions::Storable versions through 0.05 for Perl generate sessi…
CVE-2026-45696	8.3	34.5	AcademySoftwareFoundation	openexr	CWE-122	OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS)
CVE-2026-44942	6.5	34.4	SUSE	libzypp	CWE-24	libzypp .repo files can have an optional path which can lead to path traversa…
CVE-2026-44691	8.4	33.7	Eclipse Foundation	Eclipse Theia	CWE-829	In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspa…
CVE-2025-10560	9.3	31.6	Silver Leaf Technologies, Inc.	Worksnaps.net Worksnaps	CWE-798	Hardcoded cloud credentials in Worksnaps client application binaries expose p…
CVE-2026-49205	6.5	31.2	thorsten	phpMyFAQ	CWE-862	phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-2442…
CVE-2025-32436	7.1	30.9	Significant-Gravitas	AutoGPT	CWE-400	AutoGPT has a DoS vulnerability in AddAudioToVideoBlock
CVE-2026-12407	8.8	30.3	oleksandrz	E2Pdf – Export Pdf Tool for WordPress	CWE-862	E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary…
CVE-2026-56012	8.5	28.4	David Lingren	Media LIbrary Assistant	CWE-89	WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability
CVE-2026-12049	5.3	28.2	pgadmin.org	pgAdmin 4	CWE-601	pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated …
CVE-2026-42488	8.1	28.0	Xen	Xen	CWE-119	x86: mismatched mapcache metadata
CVE-2026-12093	5.3	27.8	wpinsider-1	Simple Membership	CWE-862	Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitra…
CVE-2026-52866	7.1	27.3	Apollo Pharmacy	Blood Glucose Monitoring System (Model No. APG-01 BT)	CWE-862	Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization
CVE-2026-55203	9.0	27.3	haproxy	haproxy	CWE-190	HAProxy - Integer Overflow in FCGI Demux Record Length Field
CVE-2026-11776	4.9	27.1	10web	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	CWE-89	Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection…
CVE-2026-11777	4.9	27.1	10web	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	CWE-89	Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection…
CVE-2026-12120	5.3	25.5	fireplugins	FireBox Popups – Increase Sales and Grow Your Email List	CWE-200	FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in '…
CVE-2026-46699	7.6	25.4	conda-forge	conda-smithy	CWE-284	conda-smithy vulnerable to misrouted repository invitation by conda-forge-web…
CVE-2026-11357	4.3	24.5	stellarwp	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor	CWE-200	Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information …
CVE-2026-55237	8.8	24.1	Significant-Gravitas	AutoGPT	CWE-87	AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
CVE-2026-8811	7.1	24.1	SEPPmail AG	Secure Email Gateway	CWE-22	Path traversal in PDF generation module
CVE-2026-40457	2.1	24.0	LMS	LMS	CWE-79	Reflected XSS in LMS
CVE-2026-48617	8.2	23.8	nodejs	node	CWE-284	A flaw in Node.js Permission Model enforcement allows Bypass via `process.rep…
CVE-2026-47847	5.3	23.4	Bitnami	bitnami/mariadb-galera	CWE-798	Bitnami MariaDB Galera container images and Helm chart are affected by a hard…
CVE-2026-22551	6.7	23.4	Eclipse Foundation	Eclipse Theia	CWE-201	In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown imag…
CVE-2026-10029	5.3	23.2	eventkoi	Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets	CWE-862	Event Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensiti…
CVE-2026-22674	4.8	23.0	hashgraph	guardian	CWE-79	Hashgraph Guardian Stored XSS via branding companyName field
CVE-2026-54222	8.6	22.6	UBB Systems	UBB.threads	CWE-89	Blind SQL Injection in UBB.threads
CVE-2026-54219	5.1	21.3	UBB Systems	UBB.threads	CWE-79	Stored XSS in UBB.threads
CVE-2026-54221	5.1	21.2	UBB Systems	UBB.threads	CWE-79	Reflected XSS in UBB.threads
CVE-2026-11395	7.2	20.9	mariovalney	CF7 to Webhook	CWE-918	CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7…
CVE-2026-55740	9.3	20.1	Nur-Alam39	bus-ticket	CWE-89	SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter
CVE-2026-12111	4.3	19.6	codepeople	Appointment Booking Calendar	CWE-200	Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensiti…
CVE-2026-54224	7.1	19.0	UBB Systems	UBB.threads	CWE-405	Denial of Service in UBB.threads
CVE-2026-12102	2.7	19.0	stiofansisland	UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP	CWE-639	UsersWP <= 1.2.63 - Insecure Direct Object Reference to Authenticated (Editor…
CVE-2026-8668	2.3	18.8	Progress Chef	Chef360	CWE-523	Hardcoded credentials in embedded content
CVE-2026-12048	9.3	18.5	pgadmin.org	pgAdmin 4	CWE-79	pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through…
CVE-2026-11358	4.4	17.9	themeisle	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More	CWE-79	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fon…
CVE-2026-10623	4.3	16.4	pressprimer	PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin	CWE-639	PressPrimer Quiz <= 2.3.0 - Insecure Direct Object Reference to Authenticated…
CVE-2026-12527	6.0	15.2	Shenzhen Liandian Communication Technology LTD	V380 IP Camera / AppFHE1_V1.0.6.0	CWE-306	A broken authorization boundary in the RTSP media delivery pipeline of Shenzh…
CVE-2026-10023	4.3	15.2	dokaninc	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy	CWE-639	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.0.3 - Ins…
CVE-2026-43915	5.4	14.8	coturn	coturn	CWE-79	Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN use…
CVE-2026-9199	4.3	14.6	equalizedigital	Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance	CWE-862	Equalize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to A…
CVE-2026-11784	4.3	13.4	optimole	Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization	CWE-352	Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Op…
CVE-2026-49454	9.1	13.1	szTheory	relyra	CWE-287	Relyra SAML SignatureValue not cryptographically verified -> authentication b…
CVE-2026-12047	4.8	12.4	pgadmin.org	pgAdmin 4	CWE-79	pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via …
CVE-2026-40455	8.6	11.8	LMS	LMS	CWE-89	SQL Injection in LMS
CVE-2026-9815	6.5	11.7	Unknown	MagicForm	—	MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
CVE-2026-11791	5.0	11.4	Red Hat	Red Hat Directory Server 11	CWE-416	389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swa…
CVE-2026-44663	7.1	11.3	AcademySoftwareFoundation	openexr	CWE-190	OpenEXR: Integer overflow in the HTJ2K decoder leads to heap-buffer-overflow
CVE-2026-12137	6.1	11.2	phppoet	SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager	CWE-79	SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Sit…
CVE-2026-50034	7.1	10.9	Apollo Pharmacy	Blood Glucose Monitoring System (Model No. APG-01 BT)	CWE-319	Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmiss…
CVE-2026-11402	6.4	10.5	bplugins	Services Section Block – Showcase Service Details in Grid or Columns	CWE-79	Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-S…
CVE-2026-42490	6.5	9.8	Xen	Xen	CWE-667	domctl lock open to abuse
CVE-2026-2021	6.4	9.7	contrid	Slideshow Gallery LITE	CWE-79	Slideshow Gallery LITE <= 1.8.5 - Authenticated (Contributor+) Stored Cross-S…
CVE-2026-25865	8.5	9.6	Yandex	Punto Switcher	CWE-428	Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
CVE-2026-12098	6.4	9.3	blubrry	PowerPress Podcasting plugin by Blubrry	CWE-79	PowerPress Podcasting plugin by Blubrry <= 11.16.8 - Authenticated (Author+) …
CVE-2026-12136	6.4	8.4	phppoet	SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager	CWE-79	SysBasics Customize My Account for WooCommerce <= 4.3.6 - Authenticated (Cont…
CVE-2026-54220	8.6	8.3	UBB Systems	UBB.threads	CWE-352	Cross-Site Request Forgery in UBB.threads
CVE-2026-11718	9.3	8.1	Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	CWE-287	An authentication bypass vulnerability exists in the generic opaque token val…
CVE-2026-12390	8.4	8.1	AzeoTech	DAQFactory	CWE-843	Access of resource using incompatible type ('type confusion') in AzeoTech DAQ…
CVE-2026-8039	6.4	7.7	dijitul	Fancy Testimonials	CWE-79	Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
CVE-2026-11717	9.3	7.2	Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	CWE-287	An authentication bypass vulnerability exists in the generic opaque token val…
CVE-2026-56024	6.5	7.1	Saad Iqbal	WP EasyPay	CWE-352	WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vuln…
CVE-2026-48980	6.3	7.1	mcdope	pam_usb	CWE-454	pam_usb: getenv() used in PAM context allows environment variable injection i…
CVE-2026-55746	7.0	6.6	Cotonti	Cotonti	CWE-79	Cotonti stored XSS via PFS folder title
CVE-2026-47833	6.9	6.1	Cloud Foundry Foundation	bpm-release	CWE-59	setupBpmLogs follows symlink for bpm.log open and chown — container-to-host p…
CVE-2026-56074	6.8	6.0	PraisonAI	PraisonAI	CWE-863	PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching
CVE-2026-48985	5.5	5.7	mcdope	pam_usb	CWE-476	pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Retur…
CVE-2026-12505	7.8	5.0	Red Hat	Red Hat Enterprise Linux 10	CWE-250	Cifs-utils: local privilege escalation via forged cifs.spnego key description…
CVE-2026-48981	6.7	4.8	mcdope	pam_usb	CWE-611	pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c
CVE-2026-55742	9.4	4.5	Cotonti	Cotonti	CWE-352	Cotonti CSRF in admin.rights.php allows privilege escalation
CVE-2026-55392	6.7	4.5	nilfs-dev	nilfs-utils	CWE-1284	NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_…
CVE-2026-55741	8.7	4.2	Cotonti	Cotonti	CWE-352	Cotonti CSRF in admin.config.php allows unauthorized configuration changes
CVE-2026-55744	8.6	4.3	Cotonti	Cotonti	CWE-352	Cotonti CSRF in PFS allows forced arbitrary file upload
CVE-2026-12039	5.7	4.3	Docker	Docker Sandboxes	CWE-923	Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
CVE-2026-48984	4.7	4.2	mcdope	pam_usb	CWE-14	pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic mater…
CVE-2026-11719	8.6	4.0	Google	MCP Toolbox for Databases (googleapis/mcp-toolbox)	CWE-862	An authenticated authorization bypass vulnerability exists in MCP Toolbox for…
CVE-2026-48986	4.7	3.6	mcdope	pam_usb	CWE-835	pam_usb: Infinite loop DoS in process-tree walk when parent process exits dur…
CVE-2026-12539	5.7	3.5	Docker	Docker Sandboxes	CWE-665	Docker Sandboxes ICMP egress restriction bypass after daemon restart
CVE-2026-28573	10.0	3.4	Google	Android	CWE-862	In AndroidManifest.xml, there is a possible persistent denial of service due …
CVE-2026-56007	5.9	3.4	OceanWP	Ocean Product Sharing	CWE-79	WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) …
CVE-2026-50643	5.1	3.4	rui314	8cc	CWE-125	Out‑of‑Bounds Read in 8cc
CVE-2026-56009	5.9	3.2	Bricksable	Bricksable for Bricks Builder	CWE-79	WordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripti…
CVE-2026-48982	5.8	1.9	mcdope	pam_usb	CWE-362	pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race
CVE-2026-48983	5.8	1.2	mcdope	pam_usb	CWE-367	pam_usb: TOCTOU race condition in pad directory creation allows symlink subst…
CVE-2026-11958	7.3	1.0	ANSSI	DFIR-ORC	CWE-427	Local privilege escalation in ANSSI’s DFIR-ORC
CVE-2026-55745	5.3	0.8	Cotonti	Cotonti	CWE-352	Cotonti CSRF in PFS folder edit allows unauthorized folder modification
CVE-2026-42487	7.9	0.7	Xen	Xen	CWE-362	x86 HVM I/O port list traversal
CVE-2026-42489	5.3	0.1	Xen	Xen	CWE-667	domctl lock open to abuse

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-18 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.