{ "day": "2026-06-24", "boundary": "UTC calendar day", "published_count": 520, "by_severity": { "CRITICAL": 56, "HIGH": 226, "MEDIUM": 227, "LOW": 10 }, "kev_count": 0, "exploit_reference_count": 16, "awaiting_enrichment_count": 1, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-52806", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.05509, "epss_percentile": 0.92155, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-77", "title": "Gogs: RCE via git rebase --exec argument injection in pull request merge", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52806" }, { "rank": 2, "cve_id": "CVE-2026-9775", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.03248, "epss_percentile": 0.87319, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-22", "title": "ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9775" }, { "rank": 3, "cve_id": "CVE-2026-54066", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.01892, "epss_percentile": 0.77927, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-22", "title": "SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54066" }, { "rank": 4, "cve_id": "CVE-2026-12486", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.01795, "epss_percentile": 0.76665, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-78", "title": "GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12486" }, { "rank": 5, "cve_id": "CVE-2026-12850", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.01795, "epss_percentile": 0.76666, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-78", "title": "GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12850" }, { "rank": 6, "cve_id": "CVE-2026-12849", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.01759, "epss_percentile": 0.76163, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-78", "title": "GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12849" }, { "rank": 7, "cve_id": "CVE-2026-12851", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.01759, "epss_percentile": 0.76162, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-78", "title": "GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12851" }, { "rank": 8, "cve_id": "CVE-2026-9776", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0158, "epss_percentile": 0.7352, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-22", "title": "ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9776" }, { "rank": 9, "cve_id": "CVE-2026-9777", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01477, "epss_percentile": 0.71792, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-22", "title": "ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9777" }, { "rank": 10, "cve_id": "CVE-2026-9778", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01477, "epss_percentile": 0.71792, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-22", "title": "ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9778" }, { "rank": 11, "cve_id": "CVE-2026-9787", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01403, "epss_percentile": 0.70393, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-78", "title": "Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9787" }, { "rank": 12, "cve_id": "CVE-2026-39938", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01305, "epss_percentile": 0.68247, "kev": false, "kev_due_at": null, "vendor": "Cacti", "product": "cacti", "cwe": "CWE-22", "title": "Cacti: Unauthenticated RCE on Graph Image", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39938" }, { "rank": 13, "cve_id": "CVE-2026-32315", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.01199, "epss_percentile": 0.65671, "kev": false, "kev_due_at": null, "vendor": "motioneye-project", "product": "motioneye", "cwe": "CWE-200", "title": "motionEye: World-Readable Configuration File Exposes Admin Password Hash", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32315" }, { "rank": 14, "cve_id": "CVE-2026-9774", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.01195, "epss_percentile": 0.65579, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-22", "title": "ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9774" }, { "rank": 15, "cve_id": "CVE-2026-56121", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.01143, "epss_percentile": 0.64145, "kev": false, "kev_due_at": null, "vendor": "feast-dev", "product": "feast", "cwe": "CWE-502", "title": "Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56121" }, { "rank": 16, "cve_id": "CVE-2026-40079", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.01137, "epss_percentile": 0.64017, "kev": false, "kev_due_at": null, "vendor": "Cacti", "product": "cacti", "cwe": "CWE-78", "title": "Cacti: Command Injection via escape_command() no-op in RRDtool execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-40079" }, { "rank": 17, "cve_id": "CVE-2026-9773", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01128, "epss_percentile": 0.63772, "kev": false, "kev_due_at": null, "vendor": "Unraid", "product": "Unraid", "cwe": "CWE-78", "title": "Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9773" }, { "rank": 18, "cve_id": "CVE-2026-9772", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01115, "epss_percentile": 0.63452, "kev": false, "kev_due_at": null, "vendor": "Unraid", "product": "Unraid", "cwe": "CWE-78", "title": "Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9772" }, { "rank": 19, "cve_id": "CVE-2026-52815", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.01103, "epss_percentile": 0.63133, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-200", "title": "Gogs: Unauthenticated Organization Teams Information Disclosure via API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52815" }, { "rank": 20, "cve_id": "CVE-2026-48732", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01007, "epss_percentile": 0.6029, "kev": false, "kev_due_at": null, "vendor": "warpdotdev", "product": "warp", "cwe": "CWE-78", "title": "Warp: Remote SSH cwd can lead to unauthorized remote command execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48732" }, { "rank": 21, "cve_id": "CVE-2026-48719", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00948, "epss_percentile": 0.5842, "kev": false, "kev_due_at": null, "vendor": "warpdotdev", "product": "warp", "cwe": "CWE-78", "title": "Warp branch selector command injection via Git branch names", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48719" }, { "rank": 22, "cve_id": "CVE-2026-52813", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00922, "epss_percentile": 0.57542, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-23", "title": "Gogs: Path Traversal in organization name results in RCE through Git hooks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52813" }, { "rank": 23, "cve_id": "CVE-2026-8663", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00833, "epss_percentile": 0.54813, "kev": false, "kev_due_at": null, "vendor": "Rapid7", "product": "InsightConnect RPM Plugin", "cwe": "CWE-78", "title": "OS Command Injection in Rapid7 InsightConnect RPM Plugin", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8663" }, { "rank": 24, "cve_id": "CVE-2026-49980", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00744, "epss_percentile": 0.51911, "kev": false, "kev_due_at": null, "vendor": "rclone", "product": "rclone", "cwe": "CWE-306", "title": "Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49980" }, { "rank": 25, "cve_id": "CVE-2026-7570", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.4997, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7570" }, { "rank": 26, "cve_id": "CVE-2026-9781", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.4997, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9781" }, { "rank": 27, "cve_id": "CVE-2026-9782", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.49969, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9782" }, { "rank": 28, "cve_id": "CVE-2026-9783", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.4997, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9783" }, { "rank": 29, "cve_id": "CVE-2026-9784", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.49969, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9784" }, { "rank": 30, "cve_id": "CVE-2026-9785", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.49969, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9785" }, { "rank": 31, "cve_id": "CVE-2026-9786", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00689, "epss_percentile": 0.4997, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-89", "title": "Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9786" }, { "rank": 32, "cve_id": "CVE-2026-7569", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0067, "epss_percentile": 0.49205, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-79", "title": "Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7569" }, { "rank": 33, "cve_id": "CVE-2026-9780", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0067, "epss_percentile": 0.49206, "kev": false, "kev_due_at": null, "vendor": "Quest", "product": "NetVault Backup", "cwe": "CWE-79", "title": "Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9780" }, { "rank": 34, "cve_id": "CVE-2025-60474", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00633, "epss_percentile": 0.47623, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-121", "title": "A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60474" }, { "rank": 35, "cve_id": "CVE-2026-12485", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00629, "epss_percentile": 0.47443, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-121", "title": "GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12485" }, { "rank": 36, "cve_id": "CVE-2026-54069", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00623, "epss_percentile": 0.47172, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-346", "title": "SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54069" }, { "rank": 37, "cve_id": "CVE-2026-57296", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00595, "epss_percentile": 0.45834, "kev": false, "kev_due_at": null, "vendor": "Jenkins Project", "product": "Jenkins External Workspace Manager Plugin", "cwe": "CWE-22", "title": "Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57296" }, { "rank": 38, "cve_id": "CVE-2026-57281", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00594, "epss_percentile": 0.45797, "kev": false, "kev_due_at": null, "vendor": "Jenkins Project", "product": "Jenkins Script Security Plugin", "cwe": "CWE-93", "title": "Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57281" }, { "rank": 39, "cve_id": "CVE-2026-25119", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00582, "epss_percentile": 0.45245, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-290", "title": "Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25119" }, { "rank": 40, "cve_id": "CVE-2026-12416", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00563, "epss_percentile": 0.44353, "kev": false, "kev_due_at": null, "vendor": "pravel", "product": "Invoice Generator", "cwe": "CWE-640", "title": "Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12416" }, { "rank": 41, "cve_id": "CVE-2025-60467", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00554, "epss_percentile": 0.43874, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-416", "title": "A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-60467" }, { "rank": 42, "cve_id": "CVE-2026-52986", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00552, "epss_percentile": 0.43746, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "netfilter: nf_conntrack_sip: don't use simple_strtoul", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52986" }, { "rank": 43, "cve_id": "CVE-2026-2050", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00552, "epss_percentile": 0.43743, "kev": false, "kev_due_at": null, "vendor": "GIMP", "product": "GIMP", "cwe": "CWE-122", "title": "GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-2050" }, { "rank": 44, "cve_id": "CVE-2026-56111", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00542, "epss_percentile": 0.43218, "kev": false, "kev_due_at": null, "vendor": "MarlinFirmware", "product": "Marlin", "cwe": "CWE-129", "title": "Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56111" }, { "rank": 45, "cve_id": "CVE-2026-52958", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00537, "epss_percentile": 0.42966, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-125", "title": "libceph: Fix potential out-of-bounds access in osdmap_decode()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52958" }, { "rank": 46, "cve_id": "CVE-2026-52982", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00536, "epss_percentile": 0.42926, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52982" }, { "rank": 47, "cve_id": "CVE-2026-52981", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00532, "epss_percentile": 0.42691, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-401", "title": "neigh: let neigh_xmit take skb ownership", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52981" }, { "rank": 48, "cve_id": "CVE-2026-55488", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00529, "epss_percentile": 0.42534, "kev": false, "kev_due_at": null, "vendor": "motioneye-project", "product": "motioneye", "cwe": "CWE-22", "title": "motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55488" }, { "rank": 49, "cve_id": "CVE-2026-53046", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00524, "epss_percentile": 0.42243, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53046" }, { "rank": 50, "cve_id": "CVE-2026-52954", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00523, "epss_percentile": 0.42223, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-617", "title": "libceph: handle rbtree insertion error in decode_choose_args()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52954" }, { "rank": 51, "cve_id": "CVE-2026-52957", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00523, "epss_percentile": 0.42223, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "libceph: Fix potential null-ptr-deref in decode_choose_args()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52957" }, { "rank": 52, "cve_id": "CVE-2026-53045", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00514, "epss_percentile": 0.41633, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "memory: tegra124-emc: Fix dll_change check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53045" }, { "rank": 53, "cve_id": "CVE-2026-52999", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00514, "epss_percentile": 0.41634, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-125", "title": "netfilter: nfnetlink_osf: fix out-of-bounds read on option matching", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52999" }, { "rank": 54, "cve_id": "CVE-2026-53043", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00514, "epss_percentile": 0.41634, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-787", "title": "ocfs2/dlm: validate qr_numregions in dlm_match_regions()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53043" }, { "rank": 55, "cve_id": "CVE-2026-52914", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00513, "epss_percentile": 0.41545, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-787", "title": "batman-adv: fix fragment reassembly length accounting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52914" }, { "rank": 56, "cve_id": "CVE-2026-1840", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00511, "epss_percentile": 0.41413, "kev": false, "kev_due_at": null, "vendor": "Hubbell", "product": "Aclara Metrum Cellular Web Interface", "cwe": "CWE-306", "title": "Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1840" }, { "rank": 57, "cve_id": "CVE-2026-7761", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00508, "epss_percentile": 0.41238, "kev": false, "kev_due_at": null, "vendor": "ultimatemember", "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "cwe": "CWE-862", "title": "Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7761" }, { "rank": 58, "cve_id": "CVE-2026-8705", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00505, "epss_percentile": 0.41055, "kev": false, "kev_due_at": null, "vendor": "clearsale", "product": "ClearSale Total", "cwe": "CWE-89", "title": "ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8705" }, { "rank": 59, "cve_id": "CVE-2026-39948", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00501, "epss_percentile": 0.40839, "kev": false, "kev_due_at": null, "vendor": "Cacti", "product": "cacti", "cwe": "CWE-89", "title": "Cacti has SQL Injection via rfilter parameter in RLIKE clauses", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39948" }, { "rank": 60, "cve_id": "CVE-2026-52998", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00501, "epss_percentile": 0.40836, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52998" }, { "rank": 61, "cve_id": "CVE-2026-53003", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00501, "epss_percentile": 0.40835, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "pppoe: drop PFC frames", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53003" }, { "rank": 62, "cve_id": "CVE-2026-52974", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.005, "epss_percentile": 0.40769, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-401", "title": "net: tls: fix strparser anchor skb leak on offload RX setup failure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52974" }, { "rank": 63, "cve_id": "CVE-2026-48731", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00496, "epss_percentile": 0.40551, "kev": false, "kev_due_at": null, "vendor": "warpdotdev", "product": "warp", "cwe": "CWE-78", "title": "Warp: Linux external editor command injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48731" }, { "rank": 64, "cve_id": "CVE-2026-54297", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00487, "epss_percentile": 0.39996, "kev": false, "kev_due_at": null, "vendor": "lostisland", "product": "faraday", "cwe": "CWE-674", "title": "Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54297" }, { "rank": 65, "cve_id": "CVE-2026-56270", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00475, "epss_percentile": 0.39212, "kev": false, "kev_due_at": null, "vendor": "Flowise", "product": "Flowise", "cwe": "CWE-306", "title": "Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56270" }, { "rank": 66, "cve_id": "CVE-2026-52816", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00475, "epss_percentile": 0.39235, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-80", "title": "Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52816" }, { "rank": 67, "cve_id": "CVE-2026-44017", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00472, "epss_percentile": 0.38995, "kev": false, "kev_due_at": null, "vendor": "docling-project", "product": "docling", "cwe": "CWE-22", "title": "Docling: Unsafe Zip Extraction in EasyOCR Model Download", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44017" }, { "rank": 68, "cve_id": "CVE-2026-12242", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00469, "epss_percentile": 0.38798, "kev": false, "kev_due_at": null, "vendor": "adegans", "product": "AdRotate Banner Manager", "cwe": "CWE-94", "title": "AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12242" }, { "rank": 69, "cve_id": "CVE-2026-52802", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00456, "epss_percentile": 0.37965, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-601", "title": "Gogs: Open Redirect via redirect_to in Gogs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52802" }, { "rank": 70, "cve_id": "CVE-2026-52811", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00455, "epss_percentile": 0.37892, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-22", "title": "Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52811" }, { "rank": 71, "cve_id": "CVE-2026-52946", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00455, "epss_percentile": 0.37905, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-667", "title": "fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52946" }, { "rank": 72, "cve_id": "CVE-2026-12417", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00454, "epss_percentile": 0.37876, "kev": false, "kev_due_at": null, "vendor": "pravel", "product": "SignUp & SignIn", "cwe": "CWE-640", "title": "SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12417" }, { "rank": 73, "cve_id": "CVE-2026-45677", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00451, "epss_percentile": 0.37635, "kev": false, "kev_due_at": null, "vendor": "RocketChat", "product": "Rocket.Chat", "cwe": "CWE-862", "title": "Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45677" }, { "rank": 74, "cve_id": "CVE-2026-4297", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0045, "epss_percentile": 0.3755, "kev": false, "kev_due_at": null, "vendor": "newscred", "product": "Welcome Software Publishing", "cwe": "CWE-862", "title": "Welcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4297" }, { "rank": 75, "cve_id": "CVE-2026-12846", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00446, "epss_percentile": 0.37309, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-121", "title": "GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12846" }, { "rank": 76, "cve_id": "CVE-2026-12847", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00446, "epss_percentile": 0.37309, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-121", "title": "GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12847" }, { "rank": 77, "cve_id": "CVE-2026-12848", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00446, "epss_percentile": 0.3731, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-I/O Box 4E", "cwe": "CWE-121", "title": "GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12848" }, { "rank": 78, "cve_id": "CVE-2026-52983", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00445, "epss_percentile": 0.37213, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "net: airoha: fix BQL imbalance in TX path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52983" }, { "rank": 79, "cve_id": "CVE-2026-52797", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00443, "epss_percentile": 0.37033, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-22", "title": "Gogs: Overwriting critical files results in a denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52797" }, { "rank": 80, "cve_id": "CVE-2026-50551", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.0044, "epss_percentile": 0.36842, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-79", "title": "SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50551" }, { "rank": 81, "cve_id": "CVE-2026-54699", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00436, "epss_percentile": 0.36471, "kev": false, "kev_due_at": null, "vendor": "warpdotdev", "product": "warp", "cwe": "CWE-78", "title": "Warp: OS command injection when opening terminal links from WSL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54699" }, { "rank": 82, "cve_id": "CVE-2026-52814", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00431, "epss_percentile": 0.3613, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-400", "title": "Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52814" }, { "rank": 83, "cve_id": "CVE-2026-53010", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0043, "epss_percentile": 0.36013, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "ksmbd: fix use-after-free in smb2_open during durable reconnect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53010" }, { "rank": 84, "cve_id": "CVE-2026-53055", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0043, "epss_percentile": 0.36013, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "crypto: hisilicon/sec2 - prevent req used-after-free for sec", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53055" }, { "rank": 85, "cve_id": "CVE-2026-57301", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00428, "epss_percentile": 0.35891, "kev": false, "kev_due_at": null, "vendor": "Jenkins Project", "product": "Jenkins OWASP ZAP Plugin", "cwe": "CWE-610", "title": "Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57301" }, { "rank": 86, "cve_id": "CVE-2026-53026", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00426, "epss_percentile": 0.3573, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53026" }, { "rank": 87, "cve_id": "CVE-2026-56262", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00417, "epss_percentile": 0.34913, "kev": false, "kev_due_at": null, "vendor": "Crawl4AI", "product": "Crawl4AI", "cwe": "CWE-306", "title": "Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56262" }, { "rank": 88, "cve_id": "CVE-2026-52801", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00416, "epss_percentile": 0.34909, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-20", "title": "Gogs: Ability to import local repositories via Mirror Settings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52801" }, { "rank": 89, "cve_id": "CVE-2026-54904", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00413, "epss_percentile": 0.34621, "kev": false, "kev_due_at": null, "vendor": "ruby-concurrency", "product": "concurrent-ruby", "cwe": "CWE-835", "title": "concurrent-ruby: `AtomicReference#update` livelocks when the stored value is `Float::NAN`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54904" }, { "rank": 90, "cve_id": "CVE-2026-13164", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00406, "epss_percentile": 0.3396, "kev": false, "kev_due_at": null, "vendor": "Mailerup", "product": "Mailerup", "cwe": "CWE-306", "title": "Unauthenticated self-registration in MailerUp allows access to stored email data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13164" }, { "rank": 91, "cve_id": "CVE-2026-23879", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00404, "epss_percentile": 0.33825, "kev": false, "kev_due_at": null, "vendor": "miurahr", "product": "py7zr", "cwe": "CWE-59", "title": "py7zr: Arbitrary File Write Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23879" }, { "rank": 92, "cve_id": "CVE-2026-39893", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00399, "epss_percentile": 0.33249, "kev": false, "kev_due_at": null, "vendor": "Cacti", "product": "cacti", "cwe": "CWE-89", "title": "Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39893" }, { "rank": 93, "cve_id": "CVE-2026-52931", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00399, "epss_percentile": 0.33269, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "batman-adv: tp_meter: avoid use of uninit sender vars", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52931" }, { "rank": 94, "cve_id": "CVE-2026-53088", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00399, "epss_percentile": 0.33268, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-193", "title": "net: bcmgenet: fix off-by-one in bcmgenet_put_txcb", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53088" }, { "rank": 95, "cve_id": "CVE-2026-9779", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00397, "epss_percentile": 0.33098, "kev": false, "kev_due_at": null, "vendor": "ATEN", "product": "Unizon", "cwe": "CWE-347", "title": "ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9779" }, { "rank": 96, "cve_id": "CVE-2026-53006", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00395, "epss_percentile": 0.32851, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "ipv6: fix possible UAF in icmpv6_rcv()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53006" }, { "rank": 97, "cve_id": "CVE-2026-52967", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00393, "epss_percentile": 0.32607, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-125", "title": "smb/client: fix possible infinite loop and oob read in symlink_data()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52967" }, { "rank": 98, "cve_id": "CVE-2026-55454", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00392, "epss_percentile": 0.32485, "kev": false, "kev_due_at": null, "vendor": "appsmithorg", "product": "appsmith", "cwe": "CWE-749", "title": "Appsmith: Caddy admin API exposed without authentication", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55454" }, { "rank": 99, "cve_id": "CVE-2026-52922", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00389, "epss_percentile": 0.32211, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "batman-adv: dat: handle forward allocation error", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52922" }, { "rank": 100, "cve_id": "CVE-2026-52929", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00389, "epss_percentile": 0.32212, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "sctp: stream: fully roll back denied add-stream state", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52929" }, { "rank": 101, "cve_id": "CVE-2026-53049", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00388, "epss_percentile": 0.32138, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-667", "title": "gfs2: add some missing log locking", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53049" }, { "rank": 102, "cve_id": "CVE-2026-10735", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00387, "epss_percentile": 0.32033, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "smart-post-show-pro", "cwe": null, "title": "ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10735" }, { "rank": 103, "cve_id": "CVE-2026-44016", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00384, "epss_percentile": 0.31744, "kev": false, "kev_due_at": null, "vendor": "docling-project", "product": "docling", "cwe": "CWE-94", "title": "Docling: Unsafe Playwright-based HTML Rendering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44016" }, { "rank": 104, "cve_id": "CVE-2026-10749", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00383, "epss_percentile": 0.31605, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Post Duplicator", "cwe": null, "title": "Post Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaData", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10749" }, { "rank": 105, "cve_id": "CVE-2026-52955", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0038, "epss_percentile": 0.31317, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-125", "title": "libceph: Fix potential out-of-bounds access in crush_decode()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52955" }, { "rank": 106, "cve_id": "CVE-2026-57280", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.0038, "epss_percentile": 0.3128, "kev": false, "kev_due_at": null, "vendor": "Jenkins Project", "product": "Jenkins Script Security Plugin", "cwe": "CWE-693", "title": "Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57280" }, { "rank": 107, "cve_id": "CVE-2026-53069", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0038, "epss_percentile": 0.31291, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-476", "title": "net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53069" }, { "rank": 108, "cve_id": "CVE-2026-52799", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00379, "epss_percentile": 0.31226, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-639", "title": "Gogs: Missing Authorization in Attachment Download", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52799" }, { "rank": 109, "cve_id": "CVE-2026-9179", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00376, "epss_percentile": 0.3086, "kev": false, "kev_due_at": null, "vendor": "hancock11", "product": "WP Forms Connector", "cwe": "CWE-89", "title": "WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9179" }, { "rank": 110, "cve_id": "CVE-2026-53087", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00371, "epss_percentile": 0.30407, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-401", "title": "net: bcmgenet: fix leaking free_bds", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53087" }, { "rank": 111, "cve_id": "CVE-2026-52993", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00368, "epss_percentile": 0.30015, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-415", "title": "tipc: fix double-free in tipc_buf_append()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52993" }, { "rank": 112, "cve_id": "CVE-2026-52807", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00368, "epss_percentile": 0.30057, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-79", "title": "Gogs: DOM-based XSS via Milestone Name on New Issue Page", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52807" }, { "rank": 113, "cve_id": "CVE-2026-52804", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.0036, "epss_percentile": 0.29258, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-193", "title": "Gogs: Privilege Escalation via Collaboration Access Mode Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52804" }, { "rank": 114, "cve_id": "CVE-2026-52956", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00359, "epss_percentile": 0.29146, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-125", "title": "libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52956" }, { "rank": 115, "cve_id": "CVE-2026-52960", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00359, "epss_percentile": 0.29146, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "ceph: put folios not suitable for writeback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52960" }, { "rank": 116, "cve_id": "CVE-2026-48793", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00357, "epss_percentile": 0.28984, "kev": false, "kev_due_at": null, "vendor": "jellyfin", "product": "jellyfin", "cwe": "CWE-88", "title": "Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48793" }, { "rank": 117, "cve_id": "CVE-2026-53002", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00354, "epss_percentile": 0.2868, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-787", "title": "netfilter: conntrack: remove sprintf usage", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53002" }, { "rank": 118, "cve_id": "CVE-2026-35025", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00349, "epss_percentile": 0.2806, "kev": false, "kev_due_at": null, "vendor": "ProFTPD Project", "product": "ProFTPD", "cwe": "CWE-59", "title": "ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35025" }, { "rank": 119, "cve_id": "CVE-2026-9175", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00348, "epss_percentile": 0.2798, "kev": false, "kev_due_at": null, "vendor": "ajitdas", "product": "Devs Accounting – Simple Accounting and Invoicing Solution", "cwe": "CWE-862", "title": "Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9175" }, { "rank": 120, "cve_id": "CVE-2026-9178", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00347, "epss_percentile": 0.27871, "kev": false, "kev_due_at": null, "vendor": "hancock11", "product": "WP Forms Connector", "cwe": "CWE-862", "title": "WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9178" }, { "rank": 121, "cve_id": "CVE-2026-39955", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00346, "epss_percentile": 0.27709, "kev": false, "kev_due_at": null, "vendor": "Cacti", "product": "cacti", "cwe": "CWE-89", "title": "Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php", "url": "https://www.cve.org/CVERecord?id=CVE-2026-39955" }, { "rank": 122, "cve_id": "CVE-2026-49851", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00346, "epss_percentile": 0.27744, "kev": false, "kev_due_at": null, "vendor": "lepture", "product": "mistune", "cwe": "CWE-400", "title": "Mistune: Potential DoS via quadratic-time parsing in parse_link_text", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49851" }, { "rank": 123, "cve_id": "CVE-2026-53070", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00346, "epss_percentile": 0.27745, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "sctp: disable BH before calling udp_tunnel_xmit_skb()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53070" }, { "rank": 124, "cve_id": "CVE-2025-71332", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00345, "epss_percentile": 0.27659, "kev": false, "kev_due_at": null, "vendor": "Flowise", "product": "Flowise", "cwe": "CWE-89", "title": "Flowise - SQL Injection in importChatflows API via chatflow.id Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71332" }, { "rank": 125, "cve_id": "CVE-2026-13033", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00344, "epss_percentile": 0.27533, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-125", "title": "Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13033" }, { "rank": 126, "cve_id": "CVE-2026-13038", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00344, "epss_percentile": 0.27534, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "Chrome", "cwe": "CWE-416", "title": "Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13038" }, { "rank": 127, "cve_id": "CVE-2026-49247", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00344, "epss_percentile": 0.27584, "kev": false, "kev_due_at": null, "vendor": "jellyfin", "product": "jellyfin", "cwe": "CWE-22", "title": "Jellyfin: Potential Authenticated path traversal in /ClientLog/Document", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49247" }, { "rank": 128, "cve_id": "CVE-2025-64719", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00344, "epss_percentile": 0.27548, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-20", "title": "Gogs: Denial of Service in repository/wiki file listing web pages", "url": "https://www.cve.org/CVERecord?id=CVE-2025-64719" }, { "rank": 129, "cve_id": "CVE-2026-52989", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00342, "epss_percentile": 0.27384, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-908", "title": "nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52989" }, { "rank": 130, "cve_id": "CVE-2025-71361", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00339, "epss_percentile": 0.26967, "kev": false, "kev_due_at": null, "vendor": "picklescan", "product": "picklescan", "cwe": "CWE-95", "title": "picklescan - Remote Code Execution via Undetected idlelib.calltip.Calltip.fetch_tip", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71361" }, { "rank": 131, "cve_id": "CVE-2026-46348", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.26792, "kev": false, "kev_due_at": null, "vendor": "mastodon", "product": "mastodon", "cwe": "CWE-918", "title": "Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46348" }, { "rank": 132, "cve_id": "CVE-2026-52810", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.26723, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-284", "title": "Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52810" }, { "rank": 133, "cve_id": "CVE-2026-52932", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00335, "epss_percentile": 0.26482, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "xfrm: ipcomp: Free destination pages on acomp errors", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52932" }, { "rank": 134, "cve_id": "CVE-2026-52808", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00335, "epss_percentile": 0.2657, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-269", "title": "Gogs: Write-level collaborators can mutate admin-only repository settings via API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52808" }, { "rank": 135, "cve_id": "CVE-2026-11998", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00333, "epss_percentile": 0.26324, "kev": false, "kev_due_at": null, "vendor": "Google", "product": "AngularJS", "cwe": "CWE-791", "title": "AngularJS XSS via SCE resource URL sanitization bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11998" }, { "rank": 136, "cve_id": "CVE-2026-52924", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00331, "epss_percentile": 0.26111, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": "CWE-416", "title": "sctp: purge outqueue on stale COOKIE-ECHO handling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52924" }, { "rank": 137, "cve_id": "CVE-2026-44020", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0033, "epss_percentile": 0.25987, "kev": false, "kev_due_at": null, "vendor": "docling-project", "product": "docling", "cwe": "CWE-776", "title": "Docling: Unsafe XML Entity Expansion in USPTO Patent Backend", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44020" }, { "rank": 138, "cve_id": "CVE-2026-13163", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00329, "epss_percentile": 0.25892, "kev": false, "kev_due_at": null, "vendor": "Mailerup", "product": "Mailerup", "cwe": "CWE-601", "title": "Lack of input validation in Mailerup input parameter leads to Open Redirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13163" }, { "rank": 139, "cve_id": "CVE-2026-55570", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": 0.00327, "epss_percentile": 0.25636, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-79", "title": "SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55570" }, { "rank": 140, "cve_id": "CVE-2026-50189", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00326, "epss_percentile": 0.25535, "kev": false, "kev_due_at": null, "vendor": "appsmithorg", "product": "appsmith", "cwe": "CWE-183", "title": "Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50189" }, { "rank": 141, "cve_id": "CVE-2026-55762", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00323, "epss_percentile": 0.25171, "kev": false, "kev_due_at": null, "vendor": "RocketChat", "product": "Rocket.Chat", "cwe": "CWE-862", "title": "Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55762" }, { "rank": 142, "cve_id": "CVE-2026-47267", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.0032, "epss_percentile": 0.24838, "kev": false, "kev_due_at": null, "vendor": "gogs", "product": "gogs", "cwe": "CWE-918", "title": "Gogs: SSRF in webhook deliveries", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47267" }, { "rank": 143, "cve_id": "CVE-2026-50699", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": 0.00313, "epss_percentile": 0.2414, "kev": false, "kev_due_at": null, "vendor": "Frappe", "product": "Frappe Framework", "cwe": "CWE-79", "title": "Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50699" }, { "rank": 144, "cve_id": "CVE-2026-33235", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.0031, "epss_percentile": 0.23801, "kev": false, "kev_due_at": null, "vendor": "Significant-Gravitas", "product": "AutoGPT", "cwe": "CWE-400", "title": "AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features", "url": "https://www.cve.org/CVERecord?id=CVE-2026-33235" }, { "rank": 145, "cve_id": "CVE-2026-52945", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00309, "epss_percentile": 0.23667, "kev": false, "kev_due_at": null, "vendor": "Linux", "product": "Linux", "cwe": null, "title": "Revert \"wireguard: device: enable threaded NAPI\"", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52945" }, { "rank": 146, "cve_id": "CVE-2026-45689", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00308, "epss_percentile": 0.23523, "kev": false, "kev_due_at": null, "vendor": "RocketChat", "product": "Rocket.Chat", "cwe": "CWE-943", "title": "Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45689" }, { "rank": 147, "cve_id": "CVE-2026-9612", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00308, "epss_percentile": 0.23514, "kev": false, "kev_due_at": null, "vendor": "yapacdev", "product": "WhatsOrder – Instant Checkout for WooCommerce", "cwe": "CWE-200", "title": "WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9612" }, { "rank": 148, "cve_id": "CVE-2026-54067", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.00307, "epss_percentile": 0.23381, "kev": false, "kev_due_at": null, "vendor": "siyuan-note", "product": "siyuan", "cwe": "CWE-79", "title": "SiYuan: Stored XSS to RCE via CSS-snippet