Security Box Score — June 23, 2026

257 CVEs published, led by nocodb (29).

257 CVEs published June 23, 2026: 28 critical, 98 high, 117 medium, 11 low; 3 in the KEV catalog at press time; 57 with a public exploit reference; 3 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 232 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	5651	10112	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

468 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	100	1067	84	668	314	1	11	2	0.2	7.8	.0013	-127 ▼
google	684	859	83	454	293	29	77	6	0.7	8.1	.0023	+668 ▲
microsoft	220	756	58	520	172	6	286	19	2.5	7.8	.0045	+60 ▲
red hat	91	185	9	75	89	12	2	0	0.0	6.5	.0029	+81 ▲
apple	14	66	1	21	42	2	88	7	10.6	5.7	.0019	-1 ▼
canonical	2	16	1	4	6	5	0	0	0.0	5.5	.0010	+2 ▲
freebsd	0	7	0	5	2	0	0	0	0.0	7.8	.0020	-7 ▼
suse	4	6	1	4	1	0	0	0	0.0	8.6	.0029	+2 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	9	21	6	5	10	0	56	10	47.6	7.2	.0438	+4 ▲
netgear	17	17	0	0	16	1	0	0	0.0	4.3	.0024	+17 ▲
palo alto networks	9	11	1	2	7	1	13	2	18.2	5.9	.0022	+7 ▲
ubiquiti	8	11	7	4	0	0	3	3	27.3	9.9	.0083	+6 ▲
ivanti	4	9	4	5	0	0	25	5	55.6	8.8	.5187	+2 ▲
checkpoint	3	9	1	5	3	0	3	1	11.1	7.5	.0410	+3 ▲
fortinet	2	9	4	3	2	0	28	3	33.3	8.3	.0076	+1 ▲
f5	6	8	4	3	1	0	4	1	12.5	8.9	.0225	+4 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	92	126	18	44	55	8	33	1	0.8	6.5	.0051	+83 ▲
mozilla	49	55	11	18	26	0	9	0	0.0	7.3	.0026	+44 ▲
gitlab	11	18	0	4	12	2	4	2	11.1	4.8	.0024	+11 ▲
docker	4	7	0	5	2	0	0	0	0.0	8.2	.0016	+1 ▲
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	-3 ▼
github	0	2	1	1	0	0	0	0	0.0	8.1	.0347	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	242	270	132	116	18	4	27	2	0.7	8.8	.0040	+242 ▲
adobe	132	134	4	51	77	2	19	2	1.5	5.5	.0021	+132 ▲
ibm	32	81	19	35	27	0	6	0	0.0	7.5	.0031	+32 ▲
progress	5	9	1	7	1	0	6	0	0.0	7.5	.0036	+1 ▲
solarwinds	3	6	2	3	1	0	10	4	66.7	7.8	.6082	+3 ▲
veeam	1	4	2	2	0	0	1	0	0.0	9.0	.0052	+1 ▲
zohocorp	1	3	1	1	1	0	0	0	0.0	8.4	.0170	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
synology	5	23	2	5	13	3	0	5.6	.0025	+5 ▲
d-link	9	11	0	4	2	5	3	5.5	.0058	+8 ▲
siemens	7	8	0	4	4	0	0	7.5	.0020	+6 ▲
rockwell automation	7	7	1	5	1	0	0	8.7	.0030	+7 ▲
abb	6	6	0	4	2	0	0	7.2	.0018	+6 ▲
moxa	5	5	0	3	2	0	0	7.0	.0029	+5 ▲
dahua	3	3	0	1	1	1	0	6.9	.0036	+3 ▲
mitsubishi electric	3	3	0	3	0	0	0	8.7	.0064	+3 ▲

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
spring	72	73	2	31	39	1	0	0	0.0	6.5	.0024	+72 ▲
openclaw	61	67	0	35	22	10	0	0	0.0	7.0	.0021	+61 ▲
sourcecodester	37	59	0	0	25	34	0	0	0.0	2.1	.0026	+36 ▲
themerex	58	58	5	53	0	0	0	0	0.0	8.1	.0043	+58 ▲
edimax	5	56	0	33	0	23	1	0	0.0	7.4	.0070	0
dell	31	49	1	24	24	0	2	1	2.0	7.0	.0017	+19 ▲
concrete cms	2	46	1	11	13	21	0	0	0.0	6.2	.0015	-42 ▼
open ises	0	44	2	21	21	0	0	0	0.0	7.1	.0021	-37 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9991	100.0	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-34910	.8747	99.7	10.0
CVE-2026-34908	.8519	99.7	10.0
CVE-2026-50751	.8377	99.7	9.3
CVE-2026-48907	.7810	99.5	10.0
CVE-2026-34909	.6390	99.2	10.0
CVE-2026-49160	.5383	98.9	7.5
CVE-2026-10523	.5187	98.9	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9991	KEV
CVE-2026-34910	10.0	.8747	KEV
CVE-2026-34908	10.0	.8519	KEV
CVE-2026-48907	10.0	.7810	KEV
CVE-2026-34909	10.0	.6390	KEV
CVE-2026-48172	10.0	.1891	KEV
CVE-2026-45087	10.0	.1296
CVE-2026-53753	10.0	.0290
CVE-2026-49777	10.0	.0166
CVE-2026-8054	10.0	.0158

Most disclosures (vendor)
Vendor	CVEs
google	836
linux	514
oracle	267
microsoft	226
adobe	132
red hat	123
apache	104
ibm	81
spring	73
openclaw	67

Most KEV additions (YTD)
Vendor	KEV
microsoft	19
cisco	10
apple	7
google	6
ivanti	5
solarwinds	4
berriai	3
fortinet	3
smartertools	3
ubiquiti	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	43
Packagist	22
PyPI	10
npm	3
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2025-48595	Google	0
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-20245	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-20262	Cisco	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34908	Ubiquiti Inc	0
CVE-2026-34909	Ubiquiti Inc	0
CVE-2026-34910	Ubiquiti Inc	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1679
CVE-2021-27102	n/a	2021-11-17	1679
CVE-2021-27101	n/a	2021-11-17	1679
CVE-2021-27103	n/a	2021-11-17	1679
CVE-2021-21017	Adobe	2021-11-17	1679
CVE-2021-28550	Adobe	2021-11-17	1679
CVE-2021-42013	Apache Software Foundation	2021-11-17	1679
CVE-2021-41773	Apache Software Foundation	2021-11-17	1679
CVE-2021-30858	Apple	2021-11-17	1679
CVE-2021-30860	Apple	2021-11-17	1679

Transactions

EXPLOIT PUBLISHED — open-webui: 14 CVEs (CVE-2026-54006, CVE-2026-54007, CVE-2026-54008, CVE-2026-54009, CVE-2026-54010, CVE-2026-54011, CVE-2026-54012, CVE-2026-54013, CVE-2026-54014, CVE-2026-54015, CVE-2026-54016, CVE-2026-54018, CVE-2026-54019, CVE-2026-54022). Public exploit references added.

EXPLOIT PUBLISHED — langflow-ai langflow: 8 CVEs (CVE-2026-33760, CVE-2026-42867, CVE-2026-48519, CVE-2026-48520, CVE-2026-55423, CVE-2026-55446, CVE-2026-55447, CVE-2026-55450). Public exploit references added.

EXPLOIT PUBLISHED — caddyserver caddy: 5 CVEs (CVE-2026-45135, CVE-2026-45692, CVE-2026-52844, CVE-2026-52845, CVE-2026-52846). Public exploit references added.

EXPLOIT PUBLISHED — denoland deno: 5 CVEs (CVE-2026-44726, CVE-2026-49401, CVE-2026-49402, CVE-2026-49406, CVE-2026-49411). Public exploit references added.

EXPLOIT PUBLISHED — traefik: 5 CVEs (CVE-2026-48020, CVE-2026-48491, CVE-2026-53622, CVE-2026-54761, CVE-2026-54762). Public exploit references added.

EXPLOIT PUBLISHED — Flowise: 3 CVEs (CVE-2025-71337, CVE-2026-56274, CVE-2026-56275). Public exploit references added.

EXPLOIT PUBLISHED — Ubiquiti Inc UniFi OS Server: 3 CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-55639. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4983 (Eclipse Foundation Eclipse Open VSX). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50023 (yt-dlp). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50193 (FasterXML jackson-databind). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50221 (OpenStack Swift). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54317 (home-assistant core). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54318 (home-assistant core). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54512 (FasterXML jackson-databind). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-55249 (rtk-ai rtk). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-55653 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-55654 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56968 (GNU SASL). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-57053 (GNU libidn). Public exploit reference added.

DUE DATE PASSED — CVE-2026-42271 (BerriAI LiteLLM). CISA remediation deadline was June 22, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

257 CVEs published. 25 box scores, 232 table rows — nothing truncated.

CVE-2026-34910CRITICAL

Ubiquiti UniFi OS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .8747   99.7   YES

AFFECTED
  Product          Versions     Fixed
  UniFi OS Server  unspecified  —
  UDM              unspecified  —
  UDM-Pro          unspecified  —
  UDM-SE           unspecified  —
  UDM-Pro-Max      unspecified  —
  UDM-Beast        unspecified  —
  EFG              unspecified  —
  UDW              unspecified  —
  UDR              unspecified  —
  UDR7             unspecified  —
  + 21 more

TIMELINE
  Mar 31  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Added to CISA KEV, due Jun 26
  Jun 23  Published (CNA: hackerone)

CWE-20 · CNA: hackerone · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 26, 2026

CVE-2026-34908CRITICAL

Ubiquiti UniFi OS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .8519   99.7   YES

AFFECTED
  Product          Versions     Fixed
  UniFi OS Server  unspecified  —
  UDM              unspecified  —
  UDM-Pro          unspecified  —
  UDM-SE           unspecified  —
  UDM-Pro-Max      unspecified  —
  UDM-Beast        unspecified  —
  EFG              unspecified  —
  UDW              unspecified  —
  UDR              unspecified  —
  UDR7             unspecified  —
  + 21 more

TIMELINE
  Mar 31  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Added to CISA KEV, due Jun 26
  Jun 23  Published (CNA: hackerone)

CWE-284 · CNA: hackerone · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 26, 2026

CVE-2026-34909CRITICAL

Ubiquiti UniFi OS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .6390   99.2   YES

AFFECTED
  Product          Versions     Fixed
  UniFi OS Server  unspecified  —
  Express          unspecified  —
  UDM              unspecified  —
  UDM-Pro          unspecified  —
  UDM-SE           unspecified  —
  UDM-Pro-Max      unspecified  —
  UDM-Beast        unspecified  —
  EFG              unspecified  —
  UDW              unspecified  —
  UDR              unspecified  —
  + 22 more

TIMELINE
  Mar 31  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Added to CISA KEV, due Jun 26
  Jun 23  Published (CNA: hackerone)

CWE-22 · CNA: hackerone · CVSS v3.1 · 3 references · NVD status: Analyzed · KEV due June 26, 2026

CVE-2026-56274HIGH

Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0752   94.0     —

AFFECTED
  Product             Versions     Fixed
  Flowise             unspecified  3.1.2
  Flowise Components  unspecified  3.1.2

TIMELINE
  Jun 20  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2026-53753CRITICAL

unclecode crawl4ai — Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0290   85.9     —

AFFECTED
  Product   Versions   Fixed
  crawl4ai  < 0.8.7 –  —

TIMELINE
  Jun 10  Reserved by CNA
  Jun 23  Published (CNA: GitHub_M)

CWE-94, CWE-913 · CNA: GitHub_M · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-11374CRITICAL

zohocorp manageengine_adselfservice_plus — Account Takeover via Predictable SSO Ticket Generation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  C  H  H  H    9.0   .0252   83.6     —

AFFECTED
  Product                             Versions     Fixed
  manageengine_adselfservice_plus     unspecified  —
  manageengine_recovery_manager_plus  unspecified  —
  manageengine_m365_manager_plus      unspecified  —
  manageengine_adaudit_plus           unspecified  —

TIMELINE
  Jun 5   Reserved by CNA
  Jun 23  Published (CNA: Zohocorp)

CWE-287, CWE-330, CWE-340 · CNA: Zohocorp · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-28496CRITICAL

FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    9.4   .0191   78.1     —

AFFECTED
  Product      Versions   Fixed
  FOSSBilling  < 0.8.0 –  —

TIMELINE
  Feb 27  Reserved by CNA
  Jun 23  Published (CNA: GitHub_M)

CWE-1336 · CNA: GitHub_M · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-54157CRITICAL

LobeHub: Unauthenticated SSRF in `/webapi/proxy`

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  C  H  L  H    9.0   .0183   77.2     —

AFFECTED
  Product  Versions    Fixed
  lobehub  < 2.1.57 –  —

TIMELINE
  Jun 11  Reserved by CNA
  Jun 23  Published (CNA: GitHub_M)

CWE-918 · CNA: GitHub_M · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-53755HIGH

unclecode crawl4ai — Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0158   73.6     —

AFFECTED
  Product   Versions   Fixed
  crawl4ai  < 0.8.9 –  —

TIMELINE
  Jun 10  Reserved by CNA
  Jun 23  Published (CNA: GitHub_M)

CWE-918 · CNA: GitHub_M · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-35018HIGH

NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0127   67.5     —

AFFECTED
  Product   Versions     Fixed
  NF20MESH  unspecified  —

TIMELINE
  Mar 31  Reserved by CNA
  Jun 23  Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-55450CRITICAL

langflow-ai langflow — Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  N  H    9.3   .0119   65.6     —

AFFECTED
  Product   Versions   Fixed
  langflow  < 1.9.1 –  —

TIMELINE
  Jun 16  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Published (CNA: GitHub_M)

CWE-200, CWE-306, CWE-400 · CNA: GitHub_M · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-56315CRITICAL

picklescan - Remote Code Execution via Unblocked Standard Library Modules

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0115   64.3     —

AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  1.0.4

TIMELINE
  Jun 20  Reserved by CNA
  Jun 23  Published (CNA: VulnCheck)

CWE-184 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-54892HIGH

elixir-plug plug — Plug: quadratic-time decoding of nested query/body parameters enables denial of service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0095   58.5     —

AFFECTED
  Product  Versions                                    Fixed
  plug     1.15.0 –                                    —
  plug     712b875d3442c765d8d37e546ffd5ad9f8afcc55 –  c317d08fdcf96e17931f7419275b2b8c4bf3e951

TIMELINE
  Jun 16  Reserved by CNA
  Jun 23  Published (CNA: EEF)

CWE-407 · CNA: EEF · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-56258CRITICAL

Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   H   H    9.2   .0091   57.3     —

AFFECTED
  Product   Versions     Fixed
  Crawl4AI  unspecified  0.8.8

TIMELINE
  Jun 19  Reserved by CNA
  Jun 23  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2026-54513HIGH

FasterXML jackson-databind — jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0089   56.7     —

AFFECTED
  Product           Versions               Fixed
  jackson-databind  >= 2.10.0, < 2.18.8 –  —

TIMELINE
  Jun 15  Reserved by CNA
  Jun 23  Published (CNA: GitHub_M)

CWE-184 · CNA: GitHub_M · CVSS v3.1 · 29 references · NVD status: Modified

CVE-2026-56379CRITICAL

ImageMagick - Command Injection via SVG Decoder

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   H   H    9.2   .0088   56.5     —

AFFECTED
  Product      Versions     Fixed
  ImageMagick  unspecified  7.1.2-15
  ImageMagick  unspecified  6.9.13-40

TIMELINE
  Jun 21  Reserved by CNA
  Jun 23  Published (CNA: VulnCheck)

CWE-116, CWE-78 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Modified

CVE-2026-54512HIGH

FasterXML jackson-databind — jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0087   56.2     —

AFFECTED
  Product           Versions               Fixed
  jackson-databind  >= 2.10.0, < 2.18.8 –  —

TIMELINE
  Jun 15  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Published (CNA: GitHub_M)

CWE-184, CWE-502 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-12866CRITICAL

n/a expr-eval — All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attac…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.2   .0087   55.9     —

AFFECTED
  Product                    Versions     Fixed
  expr-eval                  unspecified  —
  org.webjars.npm:expr-eval  unspecified  —

TIMELINE
  Jun 22  Reserved by CNA
  Jun 23  Published (CNA: snyk)

CWE-94 · CNA: snyk · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-35019CRITICAL

NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.2   .0081   54.0     —

AFFECTED
  Product   Versions     Fixed
  NF20MESH  unspecified  —

TIMELINE
  Mar 31  Reserved by CNA
  Jun 23  Published (CNA: VulnCheck)

CWE-321 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-48519CRITICAL

langflow-ai langflow — Langflow: Unauthenticated RCE in Shareable Playgrounds

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  H  H    9.6   .0078   53.3     —

AFFECTED
  Product   Versions   Fixed
  langflow  < 1.9.2 –  —

TIMELINE
  May 21  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Published (CNA: GitHub_M)

CWE-94 · CNA: GitHub_M · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2023-54365HIGH

Traefik - Denial of Service via HTTP/2 Request Handling

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0077   53.0     —

AFFECTED
  Product  Versions       Fixed
  Traefik  unspecified    2.10.5
  Traefik  3.0.0-beta1 –  3.0.0-beta4

TIMELINE
  Jun 22  Reserved by CNA
  Jun 23  Published (CNA: VulnCheck)

CWE-400, CWE-770 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Analyzed

CVE-2026-48020HIGH

Traefik StripPrefix Route-Level Auth Bypass via Path Normalization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   N    7.8   .0076   52.4     —

AFFECTED
  Product  Versions                  Fixed
  traefik  >= 3.7.0-ea.1, < 3.7.3 –  —

TIMELINE
  May 20  Reserved by CNA
  Jun 23  Public exploit reference published
  Jun 23  Published (CNA: GitHub_M)

CWE-288, CWE-22 · CNA: GitHub_M · CVSS v4.0 · 7 references · NVD status: Modified

CVE-2026-11940HIGH

Python Software Foundation CPython — tarfile extraction filter bypass allows escaping the destination directory

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   N    7.8   .0075   52.2     —

AFFECTED
  Product  Versions     Fixed
  CPython  unspecified  —

TIMELINE
  Jun 10  Reserved by CNA
  Jun 23  Published (CNA: PSF)

CWE-22, CWE-59 · CNA: PSF · CVSS v4.0 · 10 references · NVD status: Awaiting Analysis

CVE-2026-41862HIGH

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persi…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0075   52.0     —

AFFECTED
  Product              Versions  Fixed
  Spring Statemachine  4.0.0 –   —

TIMELINE
  Apr 22  Reserved by CNA
  Jun 23  Published (CNA: vmware)

CWE-502 · CNA: vmware · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-39253HIGH

n/a n/a — An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0072   51.2     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jun 23  Published (CNA: mitre)

CWE-502 · CNA: mitre · CVSS v3.1 · 2 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2025-61018	7.5	49.7	n/a	n/a	CWE-89	An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v…
CVE-2025-61020	7.5	49.7	n/a	n/a	CWE-89	An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource …
CVE-2025-61023	7.5	49.7	n/a	n/a	CWE-89	An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 …
CVE-2025-61028	7.5	49.7	n/a	n/a	CWE-89	An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.1…
CVE-2026-45135	8.1	49.4	caddyserver	caddy	CWE-20	Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PH…
CVE-2026-50023	9.6	49.0	yt-dlp	yt-dlp	CWE-641	yt-dlp: Dangerous file type creation via insufficient filename sanitization (…
CVE-2026-55447	9.6	48.9	langflow-ai	langflow	CWE-61	Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CVE-2026-34916	8.8	48.4	Revive Adserver	Revive Adserver	CWE-94	A missing validation of user input when saving delivery limitations in Revive…
CVE-2026-52844	7.5	47.0	caddyserver	caddy	CWE-22	Caddy: Windows `file_server` path authorization bypass via encoded backslash
CVE-2026-50193	6.3	46.8	FasterXML	jackson-databind	CWE-400	jackson-databind: Deeply nested JsonNode throws StackOverflowError for toStri…
CVE-2025-71341	7.6	46.7	picklescan	picklescan	CWE-502	picklescan - Remote Code Execution via Undetected profile.Profile.runctx
CVE-2026-13007	8.7	46.5	tenable	Tenable Identity Exposure	CWE-306	Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure
CVE-2026-52673	6.5	46.0	n/a	n/a	CWE-89	SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote atta…
CVE-2026-44959	8.8	45.3	Revive	Adserver	CWE-94	A missing validation of user input exists when saving delivery limitations in…
CVE-2025-71382	7.1	45.3	ArtifexSoftware	mupdf	CWE-674	MuPDF < 1.27.0-rc1 Stack Exhaustion DoS via EPUB CSS Rendering
CVE-2026-55446	7.5	45.1	langflow-ai	langflow	CWE-400	Langflow: Unauthenticated DoS through multipart form boundary file upload
CVE-2026-11772	5.1	43.8	DRIMO	DRIMO CMS	CWE-79	Reflected XSS in DRIMO CMS
CVE-2026-55249	8.8	43.6	rtk-ai	rtk	CWE-78	@rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync T…
CVE-2026-10521	8.6	43.6	MB connect line	mbCONNECT24	CWE-425	Authenticated unintended access to critical program parameters
CVE-2026-54309	8.8	43.3	n8n-io	n8n	CWE-306	n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control S…
CVE-2026-54314	6.3	43.3	n8n-io	n8n	CWE-409	n8n: Denial of Service via ZIP decompression in webhook workflow
CVE-2026-54310	6.5	43.2	n8n-io	n8n	CWE-89	n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
CVE-2025-71370	7.6	43.2	picklescan	picklescan	CWE-502	picklescan - Remote Code Execution via torch.jit.unsupported_tensor_ops.execW…
CVE-2026-54588	9.6	43.2	poweradmin	poweradmin	CWE-20	Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, …
CVE-2026-49465	6.0	43.0	n8n-io	n8n	CWE-22	n8n: Git Node Clone and Push Operations Bypass File Sandbox
CVE-2026-44791	9.4	42.8	n8n-io	n8n	CWE-1321	n8n: XML Node Prototype Pollution Patch Bypass
CVE-2026-11807	9.6	42.5	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-862	Eda-server: websocket missing authorization allows credential theft via activ…
CVE-2026-44790	9.4	42.4	n8n-io	n8n	CWE-88	n8n: Arbitrary File Read via Git Node
CVE-2026-44789	9.4	42.4	n8n-io	n8n	CWE-1321	n8n: HTTP Request Node Pagination Prototype Pollution to RCE
CVE-2026-9733	9.1	41.9	HAYAJO	Mojolicious::Plugin::Web::Auth::OAuth2	CWE-338	Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an…
CVE-2026-56222	8.6	41.8	Capgo	Capgo	CWE-639	Capgo - Cross-Organization App Takeover via Mismatched org_id and app_id in /…
CVE-2025-55639	6.5	41.2	n/a	n/a	CWE-476	GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the …
CVE-2026-27604	10.0	41.1	FOSSBilling	FOSSBilling	CWE-200	FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Ac…
CVE-2025-61019	7.5	40.4	n/a	n/a	CWE-89	An issue in the sqlo_key_part_best component of openlink virtuoso-opensource …
CVE-2025-61021	7.5	40.4	n/a	n/a	CWE-89	An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensou…
CVE-2025-61022	7.5	40.4	n/a	n/a	CWE-89	An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v…
CVE-2025-61024	7.5	40.4	n/a	n/a	CWE-89	An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7…
CVE-2025-61025	7.5	40.4	n/a	n/a	CWE-89	An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.1…
CVE-2025-61027	7.5	40.4	n/a	n/a	CWE-89	An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 …
CVE-2025-61029	7.5	40.4	n/a	n/a	CWE-89	An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 …
CVE-2026-33760	8.8	40.2	langflow-ai	langflow	CWE-639	Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpo…
CVE-2026-56248	8.7	39.8	Cap-go	capgo	CWE-400	Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy
CVE-2026-42867	6.5	38.3	langflow-ai	langflow	CWE-22	Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
CVE-2026-54316	6.0	38.3	anthropics	claude-code	CWE-183	Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domai…
CVE-2026-50574	9.6	38.2	yt-dlp	yt-dlp	CWE-74	yt-dlp: Arbitrary code execution via manifest downloads with aria2c
CVE-2026-56322	8.7	37.8	Capgo	Capgo	CWE-200	Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Pa…
CVE-2026-54324	6.5	37.6	daytonaio	daytona	CWE-639	Daytona: Cross-tenant data leak in notification WebSocket gateway via unverif…
CVE-2026-56115	8.7	37.4	garybowers	bootimus	CWE-862	Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass
CVE-2026-54516	5.3	37.1	FasterXML	jackson-databind	CWE-915	jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private f…
CVE-2026-11972	8.2	36.8	Python Software Foundation	CPython	CWE-252	tarfile opened in streaming mode mishandles EOF
CVE-2026-49402	8.1	36.8	denoland	deno	CWE-78	Deno: Command Injection via spawnSync & spawn on Windows
CVE-2026-47376	5.1	36.7	nocodb	nocodb	CWE-79	NocoDB: Reflected Cross-Site Scripting via Password Reset Token
CVE-2026-56371	6.9	36.4	ImageMagick	ImageMagick	CWE-401	ImageMagick - Memory Leak in TXT File Processing via Texture Attribute
CVE-2026-48520	6.1	36.2	langflow-ai	langflow	CWE-73	Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read
CVE-2026-47385	5.3	36.2	nocodb	nocodb	CWE-22	NocoDB: Path Traversal via SQLite Source Filename
CVE-2026-54762	5.9	36.0	traefik	traefik	CWE-636	Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolut…
CVE-2026-53754	7.5	35.9	unclecode	crawl4ai	CWE-918	Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT6…
CVE-2026-53662	9.6	35.7	immich-app	immich	CWE-79	immich: One-click account takeover via XSS in login page continue redirect
CVE-2025-71365	7.6	35.7	picklescan	picklescan	CWE-502	picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.myeval Dete…
CVE-2025-71376	7.6	35.7	picklescan	picklescan	CWE-502	picklescan - Arbitrary Code Execution via Undetected idlelib.autocomplete.Aut…
CVE-2026-8163	8.8	35.6	Unknown	Infility Global	—	Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter
CVE-2026-47381	6.9	35.6	nocodb	nocodb	CWE-290	NocoDB: Cross-Workspace Integration Use in Connection Test
CVE-2026-54257	9.3	35.4	electron	electron	CWE-120	Electron: Buffer performs incorrect byte length calculations resulting in hea…
CVE-2026-47379	6.9	35.4	nocodb	nocodb	CWE-200	NocoDB: Plaintext Password Comparison in Shared Views
CVE-2025-71337	8.7	34.9	Flowise	Flowise	CWE-620	Flowise - Unverified Email Change via Account Profile Endpoint
CVE-2026-56785	8.4	34.9	FlatPress	FlatPress	CWE-79	FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact For…
CVE-2026-47384	5.3	34.8	nocodb	nocodb	CWE-89	NocoDB: SQL Injection via Column Title in Bulk GroupBy
CVE-2026-54010	8.3	34.7	open-webui	open-webui	CWE-284	Open WebUI: Forged chat-file link allows cross-user file read and deletion
CVE-2026-56762	6.9	34.5	Hono	Hono	CWE-20	Hono - Missing Cookie Name Validation in setCookie()
CVE-2026-55654	3.7	34.3	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Openssh: heap out-of-bounds read in red hat enterprise linux versions of open…
CVE-2026-56225	8.7	34.0	Capgo	Capgo	CWE-269	Capgo - Authorization Bypass in API Key Management via App-Limited Keys
CVE-2026-44961	0.0	34.0	Revive	Adserver	CWE-287	The XML‑RPC API addUser method has a validation bypass introduced in the fix …
CVE-2026-46551	6.5	33.9	nocodb	nocodb	CWE-770	NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Servi…
CVE-2026-8379	7.5	33.5	Unknown	Frontend File Manager Plugin	—	Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download
CVE-2026-47279	6.9	33.4	nocodb	nocodb	CWE-284	NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints
CVE-2026-47378	6.9	33.4	nocodb	nocodb	CWE-639	NocoDB: Hidden Column Exposure in Public Shared View Endpoints
CVE-2026-53931	6.9	33.4	nocodb	nocodb	CWE-441	NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
CVE-2026-53926	6.3	33.4	nocodb	nocodb	CWE-613	NocoDB: OAuth Tokens Persist Through Security Events
CVE-2026-47377	5.1	33.4	nocodb	nocodb	CWE-601	NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin
CVE-2026-46553	2.1	33.4	nocodb	nocodb	CWE-770	NocoDB: Attachment Size Limit Bypass via Upload-by-URL
CVE-2026-56695	7.1	33.0	HKUDS	OpenHarness	CWE-862	OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
CVE-2026-56234	6.9	32.9	Capgo	Capgo	CWE-307	Capgo - Password Spraying via Public-Key Accessible Credential Validation End…
CVE-2026-12969	5.3	32.8	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes …
CVE-2026-54321	7.0	32.7	daytonaio	daytona	CWE-613	Daytona: Public sandbox previews remain accessible for up to one hour after b…
CVE-2026-47387	8.4	32.5	nocodb	nocodb	CWE-79	NocoDB: Stored Cross-Site Scripting via Form View Redirect URL
CVE-2026-47383	7.4	32.5	nocodb	nocodb	CWE-79	NocoDB: Stored Cross-Site Scripting via Row Comments
CVE-2026-54312	7.2	32.4	n8n-io	n8n	CWE-1321	n8n: Microsoft SQL Node Prototype Pollution
CVE-2026-56701	7.1	32.4	Grav	Grav	CWE-611	Grav - XML External Entity Injection via SVG Upload
CVE-2026-53929	5.1	32.5	nocodb	nocodb	CWE-79	NocoDB: Stored Cross-Site Scripting via Secure Attachment
CVE-2026-53622	7.8	32.3	traefik	traefik	CWE-288	Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and …
CVE-2026-11820	6.5	32.3	Red Hat	Red Hat Enterprise Linux 10	CWE-532	Community.general: community.general nexmo — api credentials exposed in get u…
CVE-2026-7842	6.8	31.9	Unknown	Infility Global	—	Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter
CVE-2026-54311	6.0	31.9	n8n-io	n8n	CWE-488	n8n: Merge Node SQL Mode Prototype Pollution
CVE-2026-44956	0.0	31.7	Revive	Adserver	CWE-79	Low‑privileged users could use their Full Name as a vector for a stored XSS a…
CVE-2026-44960	0.0	31.7	Revive	Adserver	CWE-79	A stored XSS can be exploited by leveraging the usernames as an attack vector…
CVE-2026-34914	8.3	31.6	Revive	Adserver	CWE-89	A missing sanitisation of user input in the zone-include.php script of Revive…
CVE-2026-53927	5.1	31.6	nocodb	nocodb	CWE-918	NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
CVE-2026-53930	5.1	31.6	nocodb	nocodb	CWE-918	NocoDB: Server-Side Request Forgery via Base Migration URL
CVE-2026-44792	8.9	31.5	n8n-io	n8n	CWE-89	n8n: Source Control Pull SQL Injection
CVE-2026-23513	7.1	31.5	FOSSBilling	FOSSBilling	CWE-863	FOSSBilling: Broken Authorization in Client Transaction and Order Listings
CVE-2026-56243	8.6	31.4	Capgo	Capgo	CWE-288	Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
CVE-2026-54307	8.5	31.3	n8n-io	n8n	CWE-863	n8n: Credential Exfiltration via Permission Bypass
CVE-2026-54018	7.7	31.3	open-webui	open-webui	CWE-918	Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
CVE-2026-54019	6.5	31.3	open-webui	open-webui	CWE-862	Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
CVE-2026-49444	7.1	31.3	n8n-io	n8n	CWE-20	n8n: Python sandbox escape
CVE-2026-54517	5.3	31.2	FasterXML	jackson-databind	CWE-863	jackson-databind: @JsonView bypass for setterless creator properties
CVE-2026-54304	7.1	31.0	n8n-io	n8n	CWE-200	n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
CVE-2026-54009	6.5	31.0	open-webui	open-webui	CWE-639	Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
CVE-2026-34917	4.3	30.7	Revive	Adserver	CWE-287	Low‑privileged session IDs generated for the web admin console could be reuse…
CVE-2026-56402	7.1	30.3	nanocoai	nanoclaw	CWE-862	NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Han…
CVE-2026-47375	6.0	30.3	nocodb	nocodb	CWE-89	NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
CVE-2026-47693	6.9	30.2	poweradmin	poweradmin	CWE-1236	Poweradmin: CSV Injection in log export endpoints allows formula execution in…
CVE-2026-10609	6.8	30.2	Red Hat	Logging Subsystem for Red Hat OpenShift	CWE-862	Openshift/cluster-logging-operator: cluster logging operator creates and forw…
CVE-2026-54305	8.9	30.1	n8n-io	n8n	CWE-200	n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
CVE-2026-56696	5.3	29.7	HKUDS	OpenHarness	CWE-862	OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
CVE-2026-54761	6.0	29.5	traefik	traefik	CWE-284	Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute o…
CVE-2026-54514	5.3	29.4	FasterXML	jackson-databind	CWE-918	jackson-databind: InetSocketAddress deserialization triggers eager DNS resolu…
CVE-2026-55736	5.9	29.3	ash-project	ash	CWE-915	Private action arguments can be set by user input in Ash
CVE-2026-10711	8.8	29.2	AKIN Software Computer Import Export Industry and Trade Ltd.	CafePlus	CWE-306	RCE in Akınsoft's CafePlus
CVE-2025-62180	7.1	29.1	Pegasystems	Pega Infinity	CWE-639	Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an autho…
CVE-2025-64105	5.1	29.1	FOSSBilling	FOSSBilling	CWE-639	FOSSBilling: IDOR Vulnerability in Support Ticket Creation
CVE-2026-56784	8.6	29.0	openremote	openremote	CWE-639	OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
CVE-2026-54014	4.3	28.7	open-webui	open-webui	CWE-22	Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/ope…
CVE-2026-54518	6.5	28.1	FasterXML	jackson-databind	CWE-863	jackson-databind: @JsonView bypass for unwrapped creator parameters in jackso…
CVE-2026-54320	8.4	27.8	daytonaio	daytona	CWE-287	Daytona: Cross-tenant organization takeover via invitation acceptance with an…
CVE-2026-47382	5.3	27.7	nocodb	nocodb	CWE-918	NocoDB: Server-Side Request Forgery via Database Connection Host
CVE-2026-45732	8.3	27.6	n8n-io	n8n	CWE-639	n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
CVE-2026-4610	6.4	27.5	metagauss	ProfileGrid – User Profiles, Groups and Communities	CWE-79	ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Script…
CVE-2026-54022	5.3	27.3	open-webui	open-webui	CWE-706	Open WebUI: Any authenticated user can read other users' private notes via So…
CVE-2026-54515	5.3	27.1	FasterXML	jackson-databind	CWE-915	jackson-databind: Case-insensitive deserialization bypasses per-property @Jso…
CVE-2026-56263	5.3	26.9	Crawl4AI	Crawl4AI	CWE-79	Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard
CVE-2026-54313	6.5	26.8	n8n-io	n8n	CWE-89	n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
CVE-2026-44958	5.4	26.4	Revive	Adserver	CWE-284	An access control bypass allows an advertiser‑level user to activate or deact…
CVE-2026-54011	5.4	26.0	open-webui	open-webui	CWE-79	Open WebUI: Stored XSS in Mermaid Markdown Preview
CVE-2026-48491	7.8	25.1	traefik	traefik	CWE-288	Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-front…
CVE-2026-54008	8.5	24.9	open-webui	open-webui	CWE-918	Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`
CVE-2026-54012	7.1	24.7	open-webui	open-webui	CWE-284	Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
CVE-2026-56376	6.3	24.2	ImageMagick	ImageMagick	CWE-416	ImageMagick - Heap Use-After-Free in Meta Coder
CVE-2026-50019	7.4	24.1	yt-dlp	yt-dlp	CWE-200	yt-dlp: File Downloader cookie leak with curl
CVE-2026-56275	6.0	23.6	Flowise	Flowise	CWE-918	Flowise - Server-Side Request Forgery via Execute Flow Base URL
CVE-2026-55517	4.3	23.7	denoland	deno	CWE-248	Deno: Denial of service via non-ASCII bytes in WebSocket response headers
CVE-2026-47380	6.3	23.5	nocodb	nocodb	CWE-208	NocoDB: User Enumeration via Sign-In Timing
CVE-2026-53928	6.3	23.5	nocodb	nocodb	CWE-613	NocoDB: Refresh Tokens Persist Through Password Recovery
CVE-2026-46554	2.3	23.5	nocodb	nocodb	CWE-613	NocoDB: Stale Auth Cache After API Token Deletion
CVE-2026-46552	5.8	23.4	nocodb	nocodb	CWE-285	NocoDB: Shared-base link access can invite arbitrary users as persistent base…
CVE-2026-4983	5.4	23.1	Eclipse Foundation	Eclipse Open VSX	CWE-79	Open VSX Registry does not sanitize SVG files uploaded as extension icons pri…
CVE-2026-44089	9.4	23.0	Totolink	EX1200L	CWE-121	Buffer Overflow in Totolink EX1200L router
CVE-2026-54317	7.6	22.9	home-assistant	core	CWE-200	Home Assistant: Konnected alarm-panel switch state and zone topology disclose…
CVE-2026-48493	5.5	22.6	grokability	snipe-it	CWE-863	Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assi…
CVE-2026-54322	7.7	22.5	daytonaio	daytona	CWE-639	Daytona: Cross-org IDOR in organization role update/delete — any org owner ca…
CVE-2026-54016	4.3	22.4	open-webui	open-webui	CWE-639	Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Kno…
CVE-2026-54013	7.6	22.1	open-webui	open-webui	CWE-79	Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open W…
CVE-2026-54308	6.3	21.9	n8n-io	n8n	CWE-290	n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node
CVE-2026-54006	4.3	21.9	open-webui	open-webui	CWE-639	Open WebUI: Calendar event re-parenting allows writing events into another us…
CVE-2026-56694	5.3	21.4	nanocoai	nanoclaw	CWE-863	NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
CVE-2026-46548	4.3	21.3	nocodb	nocodb	CWE-918	NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discor…
CVE-2026-52845	8.1	21.1	caddyserver	caddy	CWE-287	Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
CVE-2026-55653	6.5	20.9	Red Hat	Red Hat Enterprise Linux 10	CWE-415	Openssh: double free in red hat enterprise linux versions of openssh dh-gex c…
CVE-2026-56116	7.1	20.7	NetworkConfiguration	dhcpcd	CWE-401	dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling
CVE-2026-56968	5.3	20.5	GNU	GNU SASL	CWE-908	GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_…
CVE-2026-54021	6.3	20.2	open-webui	open-webui	CWE-863	Open WebUI: Authenticated users can target arbitrary configured Ollama backen…
CVE-2026-54306	6.3	19.9	n8n-io	n8n	CWE-1321	n8n: Prototype Pollution enables confused-deputy execution via public webhooks
CVE-2026-12891	4.3	19.0	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Gstreamer1-plugins-bad: gstreamer1-plugins-bad: global buffer overflow (oob r…
CVE-2026-47388	2.3	18.8	nocodb	nocodb	CWE-639	NocoDB: Missing Ownership Check in MCP Attachment Read
CVE-2026-34912	4.3	18.6	Revive	Adserver	CWE-284	A missing access control check when linking banners or campaigns to a zone th…
CVE-2026-34913	4.3	18.6	Revive	Adserver	CWE-284	A missing access control check when linking trackers to campaigns through the…
CVE-2026-44957	4.3	18.6	Revive	Adserver	CWE-284	A missing access control check when invoking various modify methods in the XM…
CVE-2026-11833	8.2	18.6	Yokogawa Electric Corporation	FAST/TOOLS	CWE-319	Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web…
CVE-2026-54015	6.4	18.6	open-webui	open-webui	CWE-284	Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read …
CVE-2026-56113	6.0	18.5	NetworkConfiguration	dhcpcd	CWE-416	dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW
CVE-2026-56114	6.0	18.5	NetworkConfiguration	dhcpcd	CWE-787	dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage()
CVE-2026-8172	7.1	18.5	Unknown	Simple Basic Contact Form	—	Simple Basic Contact Form <= 20250114 - Reflected XSS
CVE-2026-46547	6.1	17.9	nocodb	nocodb	CWE-79	NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL
CVE-2020-9711	5.5	17.4	Adobe	Acrobat Reader	CWE-125	Acrobat Reader \| Out-of-bounds Read (CWE-125)
CVE-2020-9713	5.5	17.4	Adobe	Acrobat Reader	CWE-125	Acrobat Reader \| Out-of-bounds Read (CWE-125)
CVE-2026-34915	6.1	17.3	Revive	Adserver	CWE-79	A missing sanitisation of user input in the zone-include.php script of Revive…
CVE-2020-9695	7.8	17.3	Adobe	Acrobat Reader	CWE-787	Acrobat Reader \| Out-of-bounds Write (CWE-787)
CVE-2026-47386	6.3	16.8	nocodb	nocodb	CWE-362	NocoDB: OAuth Authorization Code Race Condition
CVE-2026-10857	6.1	16.4	AKIN Software Computer Import Export Industry and Trade Ltd.	e-Commerce	CWE-79	Reflected XSS in Akinsoft's e-Commerce
CVE-2026-5818	7.2	15.5	Caliptra	Core Runtime Firmware	CWE-253	MCU Firmware Update Authentication Bypass on Caliptra Core
CVE-2026-54319	4.2	15.2	daytonaio	daytona	CWE-22	Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into…
CVE-2026-12163	4.8	15.1	Fortra	File Integrity Monitoring (FIM)	CWE-79	Stored XSS in Fortra File Integrity Monitoring (FIM)
CVE-2026-46549	2.0	15.0	nocodb	nocodb	CWE-863	NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation
CVE-2026-54301	7.0	14.6	n8n-io	n8n	CWE-79	n8n: Same-Origin XSS in Respond to Webhook Node
CVE-2026-49440	7.4	14.5	denoland	deno	CWE-325	Deno: Miller-Rabin Primality Test Allows Zero Rounds
CVE-2026-44726	9.1	14.1	denoland	deno	CWE-319	Deno: TLS retry copies stale upgrade hook, risking plaintext traffic
CVE-2026-54007	7.1	13.8	open-webui	open-webui	CWE-346	Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
CVE-2026-54302	7.0	13.7	n8n-io	n8n	CWE-79	n8n: Stored XSS in Chat Trigger Node
CVE-2026-54303	6.8	13.7	n8n-io	n8n	CWE-79	n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhoo…
CVE-2026-55766	4.8	13.5	guzzle	psr7	CWE-93	guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
CVE-2026-8378	5.4	13.1	Unknown	Frontend File Manager Plugin	—	Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scriptin…
CVE-2026-55423	6.1	12.5	langflow-ai	langflow	CWE-613	Langflow: Logout button does not clear session
CVE-2026-12112	7.8	11.8	Red Hat	Red Hat Satellite 6.18	CWE-287	Foreman-mcp-server: mcp server: active session hijacking via insecure session…
CVE-2026-55767	5.8	11.3	guzzle	guzzle	CWE-346	Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle
CVE-2026-9073	6.2	10.8	Red Hat	Red Hat Satellite 6.18	CWE-532	Foreman-mcp-server: mcp server: insecure sensitive http header sanitization
CVE-2026-49401	8.4	9.4	denoland	deno	CWE-41	Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-6458	5.1	9.4	Caliptra	Core Runtime Firmware	CWE-325	AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AA…
CVE-2026-54555	7.8	9.3	rtk-ai	rtk	CWE-863	rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separ…
CVE-2026-12958	8.5	8.8	Amazon Web Services	Language Servers for AWS	CWE-61	Arbitrary file write in Language Servers for AWS
CVE-2026-52846	4.2	8.5	caddyserver	caddy	CWE-116	Caddy: stripHTML template function bypass
CVE-2026-54323	5.9	8.1	daytonaio	daytona	CWE-295	Daytona: Git credential leak via git clone with TLS verification disabled
CVE-2026-49406	5.5	7.1	denoland	deno	CWE-22	Deno: BYONM module resolution allows `package.json` main path traversal to by…
CVE-2026-56815	7.4	6.7	rasta-mouse	pwnlift	CWE-61	pwnlift before d7a9544, in a privileged deployment, contains a symlink follow…
CVE-2026-54326	2.5	6.7	earendil-works	pi	CWE-79	Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass
CVE-2026-12957	8.5	6.5	Amazon Web Services	Language Servers for AWS	CWE-732	Arbitrary Code Execution in Language Servers for AWS
CVE-2026-54318	7.1	6.3	home-assistant	core	CWE-926	Home Assistant: Exported BroadcastReceiver allows local apps to spoof device …
CVE-2026-45692	3.8	6.1	caddyserver	caddy	CWE-187	Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Nor…
CVE-2026-56692	6.8	6.0	nanocoai	nanoclaw	CWE-59	NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttac…
CVE-2026-56693	6.8	5.9	nanocoai	nanoclaw	CWE-602	NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System…
CVE-2026-54325	4.4	5.9	earendil-works	pi	CWE-829	Pi loads project-local extensions without approval
CVE-2026-54328	7.3	5.8	earendil-works	pi	CWE-379	Pi: Predictable temporary extension install paths allow local privilege escal…
CVE-2026-11819	5.5	5.5	Red Hat	Red Hat Enterprise Linux 10	CWE-532	Community.general: community.general keyring_info — os keyring passphrase ret…
CVE-2026-46550	5.4	5.2	nocodb	nocodb	CWE-614	NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags
CVE-2026-49411	6.5	5.1	denoland	deno	CWE-284	Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny…
CVE-2025-15619	3.5	5.1	HCLSoftware	Connections	CWE-284	HCL Connections is vulnerable to broken access control
CVE-2026-56301	6.8	4.3	Nuxt	Nuxt	CWE-276	Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
CVE-2026-57053	2.5	4.3	GNU	libidn	CWE-1284	GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memor…
CVE-2026-55568	5.9	4.2	guzzle	guzzle	CWE-311	Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
CVE-2026-12164	4.4	4.0	Fortra	File Integrity Monitoring (FIM)	CWE-266	Privilege Escalation in Fortra File Integrity Monitoring (FIM)
CVE-2026-50221	5.3	3.9	OpenStack	Swift	CWE-918	In OpenStack Swift before 2.37.2, proxy-server does not strip internal update…
CVE-2026-57062	2.9	3.8	GnuPG	GnuPG	CWE-1284	CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 m…
CVE-2026-49859	5.2	3.6	denoland	deno	CWE-693	Deno: `fetch()` API sandbox bypass via missing DNS resolution check
CVE-2026-49860	5.2	3.6	denoland	deno	CWE-918	Deno: WebSocket API sandbox bypass via missing post-DNS check
CVE-2026-49983	5.2	3.5	denoland	deno	CWE-863	Deno: process.loadEnvFile() bypasses env permission checks and mutates proces…
CVE-2026-56117	5.7	3.2	NetworkConfiguration	dhcpcd	CWE-416	dhcpcd Heap Use-After-Free via Control Socket Handling
CVE-2026-0864	4.1	2.5	Python Software Foundation	CPython	CWE-74	Configuration Injection via Carriage Return (\r) in write() method
CVE-2026-12892	4.4	1.9	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Gstreamer1-plugins-bad: gstreamer1-plugins-bad: 1-byte heap out-of-bounds rea…
CVE-2025-13162	4.1	1.8	ABB	Control Builder A	CWE-427	Advant Master Online Builder DLL vulnerability
CVE-2026-7574	8.7	1.7	Anthropic	Claude Desktop Cowork	CWE-353	Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use
CVE-2026-45792	6.9	1.4	rtk-ai	rtk	CWE-345	RTK improperly trusts project-local filter configuration, allowing silent tam…
CVE-2026-54327	2.2	0.6	earendil-works	pi	CWE-367	Pi: Race condition in auth.json writes could expose stored credentials
CVE-2026-55655	6.1	0.4	Red Hat	Red Hat Enterprise Linux 10	CWE-923	Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-06-23 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.