Security Box Score — June 21, 2026

73 CVEs published, led by BerriAI (10).

73 CVEs published June 21, 2026: 3 critical, 21 high, 23 medium, 26 low; 0 in the KEV catalog at press time; 14 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 48 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	5174	9635	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

441 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	100	1067	84	668	314	1	11	2	0.2	7.8	.0013	-125 ▼
google	684	859	83	454	293	29	77	6	0.7	8.1	.0023	+668 ▲
microsoft	220	756	58	520	172	6	286	19	2.5	7.8	.0045	+72 ▲
red hat	75	169	8	72	78	11	2	0	0.0	6.7	.0029	+65 ▲
apple	14	66	1	21	42	2	88	7	10.6	5.7	.0019	-1 ▼
canonical	1	15	0	4	6	5	0	0	0.0	5.5	.0009	+1 ▲
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	-7 ▼
suse	4	6	1	4	1	0	0	0	0.0	8.6	.0029	+2 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	9	21	6	5	10	0	56	10	47.6	7.2	.0438	+4 ▲
netgear	17	17	0	0	16	1	0	0	0.0	4.3	.0024	+17 ▲
palo alto networks	9	11	1	2	7	1	13	2	18.2	5.9	.0022	+7 ▲
ivanti	4	9	4	5	0	0	25	5	55.6	8.8	.5187	+3 ▲
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	+3 ▲
fortinet	2	9	4	3	2	0	28	3	33.3	8.3	.0076	+1 ▲
f5	6	8	4	3	1	0	4	1	12.5	8.9	.0225	+5 ▲
ubiquiti	5	8	4	4	0	0	3	0	0.0	8.9	.0052	+5 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	86	120	18	42	52	7	33	1	0.8	6.8	.0050	+80 ▲
mozilla	49	55	11	18	26	0	9	0	0.0	7.3	.0026	+44 ▲
gitlab	11	18	0	4	12	2	4	2	11.1	4.8	.0024	+11 ▲
docker	4	7	0	5	2	0	0	0	0.0	8.2	.0016	+4 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	-2 ▼
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	242	270	132	116	18	4	27	2	0.7	8.8	.0040	+242 ▲
adobe	129	131	4	50	75	2	19	2	1.5	5.5	.0021	+129 ▲
ibm	11	60	13	29	18	0	6	0	0.0	7.5	.0028	+11 ▲
progress	5	9	1	7	1	0	6	0	0.0	7.5	.0036	+1 ▲
solarwinds	3	6	2	3	1	0	10	4	66.7	7.8	.6082	+3 ▲
veeam	1	4	2	2	0	0	1	0	0.0	9.0	.0052	+1 ▲
zohocorp	0	2	0	1	1	0	0	0	0.0	7.1	.0104	-1 ▼
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	5.6	.0025	+5 ▲
d-link	9	11	0	4	2	5	3	5.5	.0058	+9 ▲
siemens	7	8	0	4	4	0	0	7.5	.0020	+6 ▲
rockwell automation	7	7	1	5	1	0	0	8.7	.0030	+7 ▲
abb	5	5	0	4	1	0	0	7.2	.0018	+5 ▲
moxa	5	5	0	3	2	0	0	7.0	.0029	+5 ▲
dahua	3	3	0	1	1	1	0	6.9	.0036	+3 ▲
mitsubishi electric	3	3	0	3	0	0	0	8.7	.0064	+3 ▲

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
spring	71	72	2	30	39	1	0	0	0.0	6.5	.0023	+71 ▲
openclaw	61	67	0	35	22	10	0	0	0.0	7.0	.0021	+61 ▲
sourcecodester	37	59	0	0	25	34	0	0	0.0	2.1	.0026	+37 ▲
themerex	58	58	5	53	0	0	0	0	0.0	8.1	.0043	+58 ▲
edimax	5	56	0	33	0	23	1	0	0.0	7.4	.0070	+5 ▲
concrete cms	2	46	1	11	13	21	0	0	0.0	6.2	.0015	-39 ▼
dell	27	45	1	21	23	0	2	1	2.2	6.7	.0015	+25 ▲
open ises	0	44	2	21	21	0	0	0	0.0	7.1	.0021	-37 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9991	100.0	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-50751	.8377	99.7	9.3
CVE-2026-48907	.7810	99.5	10.0
CVE-2026-49160	.5383	98.9	7.5
CVE-2026-10523	.5187	98.9	9.8
CVE-2026-28318	.4001	98.5	7.5
CVE-2026-53435	.3766	98.4	8.8
CVE-2026-46442	.3634	98.4	9.4

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9991	KEV
CVE-2026-48907	10.0	.7810	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158
CVE-2026-49199	10.0	.0134
CVE-2026-11429	10.0	.0115
CVE-2026-49257	10.0	.0093
CVE-2026-45480	10.0	.0090

Most disclosures (vendor)
Vendor	CVEs
google	836
linux	516
oracle	267
microsoft	226
adobe	129
red hat	107
apache	98
spring	72
openclaw	67
ibm	60

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	10
apple	7
google	6
ivanti	5
solarwinds	4
berriai	3
fortinet	3
smartertools	3
adobe	2

Most-affected ecosystems
Ecosystem	Advisories
Maven	39
Packagist	22
PyPI	10
npm	3
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-20245	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-20262	Cisco	0
CVE-2026-28318	SolarWinds	0
CVE-2026-35273	Oracle Corporation	0
CVE-2026-45247	Mirasvit	0
CVE-2026-45321	@tanstack	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1677
CVE-2021-27102	n/a	2021-11-17	1677
CVE-2021-27101	n/a	2021-11-17	1677
CVE-2021-27103	n/a	2021-11-17	1677
CVE-2021-21017	Adobe	2021-11-17	1677
CVE-2021-28550	Adobe	2021-11-17	1677
CVE-2021-42013	Apache Software Foundation	2021-11-17	1677
CVE-2021-41773	Apache Software Foundation	2021-11-17	1677
CVE-2021-30858	Apple	2021-11-17	1677
CVE-2021-30860	Apple	2021-11-17	1677

Transactions

EXPLOIT PUBLISHED — picklescan: 3 CVEs (CVE-2025-71348, CVE-2025-71357, CVE-2025-71378). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2026-12822 (langflow-ai langflow). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

73 CVEs published. 25 box scores, 48 table rows — nothing truncated.

CVE-2026-56265CRITICAL

Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0264   84.4     —

AFFECTED
  Product   Versions     Fixed
  Crawl4AI  unspecified  0.8.7

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-798 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Analyzed

CVE-2026-12807LOW

Edimax BR-6478AC V2 POST Request setWAN command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0199   79.1     —

AFFECTED
  Product       Versions  Fixed
  BR-6478AC V2  1.23 –    —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12808LOW

Edimax BR-6478AC V2 POST Request stainfo command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0199   79.1     —

AFFECTED
  Product       Versions  Fixed
  BR-6478AC V2  1.23 –    —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12809LOW

Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0199   79.1     —

AFFECTED
  Product       Versions  Fixed
  BR-6478AC V2  1.23 –    —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12810LOW

Edimax BR-6478AC V2 POST Request mp command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0199   79.1     —

AFFECTED
  Product       Versions  Fixed
  BR-6478AC V2  1.23 –    —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12814LOW

Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0199   79.1     —

AFFECTED
  Product        Versions   Fixed
  CF-WR631AX V3  2.7.0.0 –  —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12815LOW

coollabsio coolify Image Name os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0199   79.1     —

AFFECTED
  Product  Versions  Fixed
  coolify  4.0.0 –   —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12773MEDIUM

BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0102   60.7     —

AFFECTED
  Product  Versions  Fixed
  litellm  1.59.0 –  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-287, CWE-303 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Modified

CVE-2026-56382HIGH

craftcms cms — Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    8.6   .0089   56.5     —

AFFECTED
  Product  Versions  Fixed
  cms      5.5.0 –   5.9.14

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-12806HIGH

Edimax BR-6478AC V2 POST Request formWlSiteSurvey buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0080   54.0     —

AFFECTED
  Product       Versions  Fixed
  BR-6478AC V2  1.23 –    —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-12795MEDIUM

BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0080   53.6     —

AFFECTED
  Product  Versions  Fixed
  litellm  1.82.0 –  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-287, CWE-306 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Analyzed

CVE-2025-71351HIGH

picklescan - Remote Code Execution via timeit.timeit() Detection Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0071   50.7     —

AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.25

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-184 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-56395CRITICAL

SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   A   H   H   H    9.4   .0070   50.4     —

AFFECTED
  Product  Versions     Fixed
  SiYuan   unspecified  3.6.1

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-56397CRITICAL

SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   A   H   H   H    9.4   .0070   50.4     —

AFFECTED
  Product  Versions     Fixed
  SiYuan   unspecified  3.6.1

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-56299MEDIUM

Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    6.9   .0068   49.8     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-52911HIGH

Linux Linux — ksmbd: scope conn->binding slowpath to bound sessions only

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0066   48.9     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    f5a544e3bab78142207e0242d22442db85ba1eff –  —
  Linux    5.15 –                                      5.15.209

TIMELINE
  Jun 9   Reserved by CNA
  Jun 21  Published (CNA: Linux)

CNA: Linux · CVSS v3.1 · 7 references · NVD status: Analyzed

CVE-2026-12796LOW

BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0057   44.6     —

AFFECTED
  Product  Versions  Fixed
  litellm  1.82.0 –  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-613 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Analyzed

CVE-2026-12770LOW

BerriAI litellm Admin Key key_management_endpoints.py improper authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   L   L    2.1   .0057   44.5     —

AFFECTED
  Product  Versions  Fixed
  litellm  1.63.0 –  —

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-266, CWE-285 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Analyzed

CVE-2025-71348HIGH

picklescan - Arbitrary Code Execution via torch.utils._config_module.load_config Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0055   43.7     —

AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.28

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Public exploit reference published
  Jun 21  Published (CNA: VulnCheck)

CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2026-12811LOW

kortix-ai suna Auth Endpoint page.tsx router.push cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0050   40.4     —

AFFECTED
  Product  Versions  Fixed
  suna     0.8.0 –   0.8.39

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-12821LOW

FlowiseAI Flowise S3 Document Loader S3.ts path traversal

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0049   40.1     —

AFFECTED
  Product  Versions  Fixed
  Flowise  3.1.0 –   —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-22 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-56394HIGH

craftcms cms — Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   N   N    7.1   .0049   40.1     —

AFFECTED
  Product  Versions     Fixed
  cms      4.0.0-RC1 –  4.17.7

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2025-71378HIGH

picklescan - Remote Code Execution via Undetected cProfile.runctx in Pickle Files

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0048   39.2     —

AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.30

TIMELINE
  Jun 20  Reserved by CNA
  Jun 21  Public exploit reference published
  Jun 21  Published (CNA: VulnCheck)

CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2026-12805LOW

OFFIS DCMTK ofxml.cc parseFile heap-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   L   L    2.1   .0047   38.4     —

AFFECTED
  Product  Versions  Fixed
  DCMTK    3.0 –     —

TIMELINE
  Jun 21  Reserved by CNA
  Jun 21  Published (CNA: VulDB)

CWE-119, CWE-122 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-56251HIGH

Capgo - Privilege Escalation via Broken Row Level Security in org_users

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   N   H   H    7.0   .0044   36.7     —

AFFECTED
  Product  Versions     Fixed
  Capgo    unspecified  12.128.2

TIMELINE
  Jun 19  Reserved by CNA
  Jun 21  Published (CNA: VulnCheck)

CWE-266 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-56396	8.7	36.6	phpMyFAQ	phpMyFAQ	CWE-862	phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and u…
CVE-2026-56242	8.7	36.4	Capgo	Capgo	CWE-200	Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure …
CVE-2026-12771	1.3	35.7	BerriAI	litellm	CWE-266	BerriAI litellm M2M JWT user_api_key_auth.py improper authorization
CVE-2026-12799	2.1	35.3	BerriAI	litellm	CWE-266	BerriAI litellm Incomplete Fix CVE-2025-0628 internal_user_endpoints.py ui_vi…
CVE-2026-56253	8.7	35.0	Capgo	Capgo	CWE-284	Capgo - Unauthenticated Organization Member Email Disclosure via get_org_memb…
CVE-2026-56367	6.3	34.5	ImageMagick	ImageMagick	CWE-125	ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding
CVE-2026-12775	5.5	33.9	Montodel	House-Rental-Management	CWE-74	Montodel House-Rental-Management login.php sql injection
CVE-2026-56316	6.9	33.7	Cap-go	capgo	CWE-203	Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*
CVE-2026-12787	2.1	33.7	zhilink 智互联(深圳)科技有限公司	ADP Application Developer Platform 应用开发者平台	CWE-20	zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnecti…
CVE-2026-12772	2.1	32.8	BerriAI	litellm	CWE-613	BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authent…
CVE-2026-12774	2.1	32.8	BerriAI	litellm	CWE-918	BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with…
CVE-2026-12788	2.1	32.8	zhilink 智互联(深圳)科技有限公司	ADP Application Developer Platform 应用开发者平台	CWE-610	zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser i…
CVE-2026-12797	2.1	32.8	BerriAI	litellm	CWE-285	BerriAI litellm Completions banned_keywords.py async_pre_call_hook authorization
CVE-2026-12798	2.1	32.8	BerriAI	litellm	CWE-918	BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_open…
CVE-2025-71357	7.6	32.0	picklescan	picklescan	CWE-502	picklescan - Arbitrary Code Execution via Undetected idlelib.pyshell.Modified…
CVE-2026-56378	6.3	31.7	ImageMagick	ImageMagick	CWE-125	ImageMagick - Heap Out-of-Bounds Read in PCD Decoder
CVE-2026-56229	7.1	30.3	Capgo	Capgo	CWE-639	Capgo - Cross-App Build Job Access via app_id/job_id Mismatch in /build/statu…
CVE-2026-56385	5.3	28.6	craftcms	cms	CWE-639	Craft CMS - Authorization Bypass in assets/preview-file Endpoint
CVE-2026-12813	2.1	27.3	n/a	activepieces	CWE-918	activepieces File URL file.ts handleUrlFile server-side request forgery
CVE-2026-56239	7.2	27.2	Capgo	Capgo	CWE-269	Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage
CVE-2026-12789	2.0	25.5	ILIAS	Learning Management System	CWE-74	ILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.p…
CVE-2026-56384	5.3	25.4	craftcms	cms	CWE-862	Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
CVE-2026-12812	2.0	25.4	Radware	Cyber Controller	CWE-74	Radware Cyber Controller HTML Report Generation HTML injection
CVE-2026-56393	4.6	24.2	craftcms	cms	CWE-79	Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field …
CVE-2026-12776	2.1	23.8	Montodel	House-Rental-Management	CWE-74	Montodel House-Rental-Management index.php houses sql injection
CVE-2026-56383	4.6	23.0	craftcms	cms	CWE-79	Craft CMS - Stored XSS in Table Field via Row Heading Column Type
CVE-2026-12822	1.9	19.5	langflow-ai	langflow	CWE-74	langflow-ai langflow Bundle URL Loader code injection
CVE-2026-12804	2.1	17.4	n/a	lemonldap-ng	CWE-601	lemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect
CVE-2026-56381	4.6	16.3	craftcms	cms	CWE-79	Craft CMS - Stored XSS via User Group Name in User Permissions Page
CVE-2026-56412	5.9	8.1	libexpat project	libexpat	CWE-416	libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection …
CVE-2026-56236	6.8	7.9	capgo	cli	CWE-59	Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credentia…
CVE-2026-12778	7.1	5.6	AOMEI	Partition Assistant	CWE-266	AOMEI Partition Assistant Kernel Driver ampa10.sys access control
CVE-2026-12779	7.1	5.6	AOMEI	Dynamic Disk Manager	CWE-266	AOMEI Dynamic Disk Manager Kernel Driver ddmdrv.sys access control
CVE-2026-12780	7.1	5.6	AOMEI	Backupper	CWE-266	AOMEI Backupper Kernel Driver amwrtdrv.sys access control
CVE-2026-12784	7.1	5.6	IM-Magic	Partition Resizer	CWE-266	IM-Magic Partition Resizer Kernel Driver MDA_NTDRV.sys access control
CVE-2026-12786	7.1	5.6	Ezbsystems	UltraISO Premium Edition	CWE-266	Ezbsystems UltraISO Premium Edition Kernel Driver bootpt64.sys access control
CVE-2026-12781	7.1	5.4	EaseUS	Partition Master	CWE-266	EaseUS Partition Master Kernel Driver epmntdrv.sys access control
CVE-2026-12782	7.1	5.4	EaseUS	Partition Master	CWE-266	EaseUS Partition Master Kernel Driver EUEDKEPM.sys access control
CVE-2026-12823	1.9	5.4	Browserbase	Skills	CWE-266	Browserbase Skills Autobrowse Trace Artifact default permission
CVE-2026-56403	6.9	3.6	libexpat project	libexpat	CWE-190	libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404	6.9	3.6	libexpat project	libexpat	CWE-190	libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405	6.9	3.6	libexpat project	libexpat	CWE-190	libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56408	6.9	3.6	libexpat project	libexpat	CWE-190	libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56406	6.9	3.5	libexpat project	libexpat	CWE-190	libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it l…
CVE-2026-56407	6.9	3.5	libexpat project	libexpat	CWE-190	libexpat before 2.8.2 has an integer overflow in doProlog that is related to …
CVE-2026-56410	6.9	3.5	libexpat project	libexpat	CWE-190	xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411	6.9	3.5	libexpat project	libexpat	CWE-190	xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via …
CVE-2026-56409	6.5	3.1	libexpat project	libexpat	CWE-190	xmlwf in libexpat before 2.8.2 has an integer overflow for the output filenam…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-21 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.