A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?
232 CVEs published, led by Apple (37).
232 CVEs published June 29, 2026: 11 critical, 76 high, 101 medium, 44 low; 1 in the KEV catalog at press time; 6 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 207 in the results table.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 7301 | 11762 | — | — |
| KEV catalog size | 1675 | |||
Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.
Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.
528 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 513 | 1480 | 119 | 854 | 506 | 1 | 11 | 2 | 0.1 | 7.8 | .0014 | -127 ▼ |
| 708 | 883 | 86 | 468 | 300 | 29 | 77 | 6 | 0.7 | 8.1 | .0023 | +540 ▲ | |
| microsoft | 220 | 756 | 58 | 520 | 172 | 6 | 286 | 19 | 2.5 | 7.8 | .0045 | +54 ▲ |
| red hat | 115 | 209 | 9 | 84 | 103 | 13 | 2 | 0 | 0.0 | 6.5 | .0029 | +73 ▲ |
| apple | 52 | 104 | 2 | 28 | 72 | 2 | 88 | 7 | 6.7 | 6.5 | .0032 | +30 ▲ |
| canonical | 6 | 20 | 2 | 5 | 8 | 5 | 0 | 0 | 0.0 | 5.5 | .0011 | -8 ▼ |
| freebsd | 9 | 16 | 0 | 12 | 4 | 0 | 0 | 0 | 0.0 | 7.8 | .0016 | +2 ▲ |
| suse | 6 | 8 | 2 | 5 | 1 | 0 | 0 | 0 | 0.0 | 8.7 | .0039 | +4 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cisco | 10 | 22 | 6 | 6 | 10 | 0 | 56 | 11 | 50.0 | 7.3 | .0566 | +5 ▲ |
| netgear | 17 | 17 | 0 | 0 | 16 | 1 | 0 | 0 | 0.0 | 4.3 | .0024 | +17 ▲ |
| palo alto networks | 9 | 11 | 1 | 2 | 7 | 1 | 13 | 2 | 18.2 | 5.9 | .0022 | +7 ▲ |
| ubiquiti | 8 | 11 | 7 | 4 | 0 | 0 | 3 | 3 | 27.3 | 9.9 | .0083 | +6 ▲ |
| ivanti | 4 | 9 | 4 | 5 | 0 | 0 | 25 | 5 | 55.6 | 8.8 | .5187 | +2 ▲ |
| checkpoint | 3 | 9 | 1 | 5 | 3 | 0 | 3 | 1 | 11.1 | 7.5 | .0410 | -3 ▼ |
| fortinet | 2 | 9 | 4 | 3 | 2 | 0 | 28 | 3 | 33.3 | 8.3 | .0076 | +1 ▲ |
| f5 | 6 | 8 | 4 | 3 | 1 | 0 | 4 | 1 | 12.5 | 8.9 | .0225 | +4 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 111 | 145 | 24 | 49 | 61 | 10 | 33 | 1 | 0.7 | 7.0 | .0052 | +90 ▲ |
| mozilla | 49 | 55 | 11 | 18 | 26 | 0 | 9 | 0 | 0.0 | 7.3 | .0026 | +43 ▲ |
| gitlab | 24 | 31 | 0 | 5 | 21 | 5 | 4 | 2 | 6.5 | 4.4 | .0029 | +17 ▲ |
| docker | 4 | 7 | 0 | 5 | 2 | 0 | 0 | 0 | 0.0 | 8.2 | .0016 | +1 ▲ |
| drupal | 0 | 5 | 1 | 1 | 3 | 0 | 4 | 1 | 20.0 | 5.1 | .0026 | -5 ▼ |
| github | 1 | 3 | 1 | 1 | 1 | 0 | 0 | 0 | 0.0 | 7.0 | .0039 | -1 ▼ |
| wordpress | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 0 | — | — | — | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 242 | 270 | 132 | 116 | 18 | 4 | 27 | 2 | 0.7 | 8.8 | .0040 | +217 ▲ |
| adobe | 132 | 134 | 4 | 51 | 77 | 2 | 19 | 2 | 1.5 | 5.5 | .0021 | +132 ▲ |
| ibm | 32 | 81 | 19 | 35 | 27 | 0 | 6 | 0 | 0.0 | 7.5 | .0031 | -17 ▼ |
| progress | 5 | 9 | 1 | 7 | 1 | 0 | 6 | 0 | 0.0 | 7.5 | .0036 | +1 ▲ |
| solarwinds | 3 | 6 | 2 | 3 | 1 | 0 | 10 | 4 | 66.7 | 7.8 | .6082 | +3 ▲ |
| veeam | 1 | 4 | 2 | 2 | 0 | 0 | 1 | 0 | 0.0 | 9.0 | .0052 | -2 ▼ |
| zohocorp | 1 | 3 | 1 | 1 | 1 | 0 | 0 | 0 | 0.0 | 8.4 | .0170 | -1 ▼ |
| atlassian | 0 | 0 | 0 | 0 | 0 | 0 | 13 | 0 | — | — | — | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| synology | 5 | 23 | 2 | 5 | 13 | 3 | 0 | 0 | 0.0 | 5.6 | .0025 | -13 ▼ |
| d-link | 10 | 12 | 0 | 5 | 2 | 5 | 3 | 0 | 0.0 | 5.8 | .0058 | +8 ▲ |
| siemens | 7 | 8 | 0 | 4 | 4 | 0 | 0 | 0 | 0.0 | 7.5 | .0020 | +6 ▲ |
| rockwell automation | 7 | 7 | 1 | 5 | 1 | 0 | 0 | 0 | 0.0 | 8.7 | .0030 | +7 ▲ |
| abb | 6 | 6 | 0 | 4 | 2 | 0 | 0 | 0 | 0.0 | 7.2 | .0018 | +6 ▲ |
| schneider electric | 6 | 6 | 0 | 4 | 2 | 0 | 0 | 0 | 0.0 | 7.8 | .0042 | +6 ▲ |
| moxa | 5 | 5 | 0 | 3 | 2 | 0 | 0 | 0 | 0.0 | 7.0 | .0029 | +5 ▲ |
| dahua | 3 | 3 | 0 | 1 | 1 | 1 | 0 | 0 | 0.0 | 6.9 | .0036 | +3 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| spring | 72 | 73 | 2 | 31 | 39 | 1 | 0 | 0 | 0.0 | 6.5 | .0024 | +71 ▲ |
| sourcecodester | 49 | 71 | 0 | 0 | 36 | 35 | 0 | 0 | 0.0 | 5.5 | .0027 | +29 ▲ |
| openclaw | 61 | 67 | 0 | 35 | 22 | 10 | 0 | 0 | 0.0 | 7.0 | .0021 | +55 ▲ |
| edimax | 14 | 65 | 0 | 39 | 0 | 26 | 1 | 0 | 0.0 | 7.4 | .0080 | -30 ▼ |
| themerex | 58 | 58 | 5 | 53 | 0 | 0 | 0 | 0 | 0.0 | 8.1 | .0043 | +58 ▲ |
| dell | 38 | 56 | 2 | 30 | 24 | 0 | 2 | 1 | 1.8 | 7.3 | .0017 | +26 ▲ |
| itsourcecode | 43 | 53 | 0 | 0 | 18 | 35 | 0 | 0 | 0.0 | 2.1 | .0027 | +33 ▲ |
| jenkins project | 36 | 49 | 0 | 9 | 39 | 1 | 3 | 0 | 0.0 | 4.8 | .0025 | +23 ▲ |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-10520 | .9991 | 100.0 | 10.0 |
| CVE-2026-20253 | .9694 | 99.9 | 9.8 |
| CVE-2026-35273 | .9547 | 99.9 | 9.8 |
| CVE-2026-20230 | .8820 | 99.8 | 8.6 |
| CVE-2026-34910 | .8747 | 99.7 | 10.0 |
| CVE-2026-34908 | .8519 | 99.7 | 10.0 |
| CVE-2026-50751 | .8377 | 99.7 | 9.3 |
| CVE-2026-48907 | .7810 | 99.5 | 10.0 |
| CVE-2026-34909 | .6390 | 99.2 | 10.0 |
| CVE-2026-49160 | .5383 | 98.9 | 7.5 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-10520 | 10.0 | .9991 | KEV |
| CVE-2026-34910 | 10.0 | .8747 | KEV |
| CVE-2026-34908 | 10.0 | .8519 | KEV |
| CVE-2026-48907 | 10.0 | .7810 | KEV |
| CVE-2026-34909 | 10.0 | .6390 | KEV |
| CVE-2026-53576 | 10.0 | .0330 | |
| CVE-2026-53753 | 10.0 | .0290 | |
| CVE-2026-49777 | 10.0 | .0166 | |
| CVE-2026-49869 | 10.0 | .0116 | |
| CVE-2026-11429 | 10.0 | .0115 |
| Vendor | CVEs |
|---|---|
| 708 | |
| linux | 513 |
| oracle | 242 |
| microsoft | 220 |
| adobe | 132 |
| red hat | 115 |
| apache | 111 |
| spring | 72 |
| openclaw | 61 |
| themerex | 58 |
| Vendor | KEV |
|---|---|
| microsoft | 19 |
| cisco | 11 |
| apple | 7 |
| 6 | |
| ivanti | 5 |
| solarwinds | 4 |
| berriai | 3 |
| fortinet | 3 |
| smartertools | 3 |
| ubiquiti | 3 |
| Ecosystem | Advisories |
|---|---|
| Maven | 39 |
| Packagist | 15 |
| PyPI | 9 |
| npm | 5 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2025-48595 | 0 | |
| CVE-2026-10520 | ivanti | 0 |
| CVE-2026-11645 | 0 | |
| CVE-2026-12569 | PTC | 0 |
| CVE-2026-20230 | Cisco | 0 |
| CVE-2026-20245 | Cisco | 0 |
| CVE-2026-20253 | Splunk | 0 |
| CVE-2026-20262 | Cisco | 0 |
| CVE-2026-28318 | SolarWinds | 0 |
| CVE-2026-34908 | Ubiquiti Inc | 0 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | n/a | 2021-11-17 | 1685 |
| CVE-2021-27102 | n/a | 2021-11-17 | 1685 |
| CVE-2021-27101 | n/a | 2021-11-17 | 1685 |
| CVE-2021-27103 | n/a | 2021-11-17 | 1685 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1685 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1685 |
| CVE-2021-42013 | Apache Software Foundation | 2021-11-17 | 1685 |
| CVE-2021-41773 | Apache Software Foundation | 2021-11-17 | 1685 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1685 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1685 |
EXPLOIT PUBLISHED — zephyrproject zephyr: 4 CVEs (CVE-2026-7656, CVE-2026-8023, CVE-2026-10647, CVE-2026-10648). Public exploit references added.
EXPLOIT PUBLISHED — CVE-2026-36848. Public exploit reference added.
DUE DATE PASSED — CVE-2026-12569 (PTC Windchill PDMLink). CISA remediation deadline was June 28, 2026; still in catalog.
DUE DATE PASSED — CVE-2026-20230 (Cisco Unified Communications Manager). CISA remediation deadline was June 28, 2026; still in catalog.
How to read these box scores · glossary
232 CVEs published. 25 box scores, 207 table rows — nothing truncated.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P N N H H H 9.5 .1238 95.9 YES
AFFECTED Product Versions Fixed SimpleHelp 5.5.0 – —
TIMELINE May 21 Reserved by CNA Jun 12 Public exploit reference published Jun 29 Added to CISA KEV, due Jul 2 Jun 29 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0554 92.2 —
AFFECTED Product Versions Fixed DCS-935L 1.10.01 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R C L L N 6.1 .0409 89.9 —
AFFECTED Product Versions Fixed Apache Tomcat 11.0.0-M1 – —
TIMELINE Jun 4 Reserved by CNA Jun 29 Published (CNA: apache)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0356 88.4 —
AFFECTED Product Versions Fixed gorse unspecified 0.5.10
TIMELINE Jun 23 Reserved by CNA Jun 29 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U L L L 7.3 .0286 85.7 —
AFFECTED Product Versions Fixed Apache Tomcat 11.0.0-M1 – —
TIMELINE Jun 17 Reserved by CNA Jun 29 Published (CNA: apache)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0271 84.8 —
AFFECTED Product Versions Fixed luci-proto-openvpn unspecified e4ff45ecbc6ad212951815c8c99b2749fbd7de6b
TIMELINE Jun 26 Reserved by CNA Jun 29 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P L N H H H 7.7 .0228 81.8 —
AFFECTED Product Versions Fixed luci-app-tailscale-community unspecified —
TIMELINE Jun 26 Reserved by CNA Jun 29 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 2.1 .0218 81.0 —
AFFECTED Product Versions Fixed WL-NU516U1-A M16U1_V240425 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 2.1 .0199 79.1 —
AFFECTED Product Versions Fixed EW-7478APC 1.04 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 2.1 .0199 79.1 —
AFFECTED Product Versions Fixed EW-7478APC 1.04 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 2.1 .0199 79.1 —
AFFECTED Product Versions Fixed EW-7478APC 1.04 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0194 78.6 —
AFFECTED Product Versions Fixed coolify < 4.0.0-beta.471 – —
TIMELINE Mar 30 Reserved by CNA Jun 29 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U L L N 6.5 .0153 72.8 —
AFFECTED Product Versions Fixed Apache Tomcat 11.0.0-M1 – —
TIMELINE Jun 17 Reserved by CNA Jun 29 Published (CNA: apache)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H H 9.1 .0121 66.2 —
AFFECTED Product Versions Fixed iOS and iPadOS unspecified — macOS unspecified — tvOS unspecified — visionOS unspecified — watchOS unspecified —
TIMELINE Apr 7 Reserved by CNA Jun 29 Published (CNA: apple)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV A L N H N N N H 6.8 .0112 63.6 —
AFFECTED Product Versions Fixed TL-WR841N v14 unspecified —
TIMELINE May 20 Reserved by CNA Jun 29 Published (CNA: TPLink)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H N 7.5 .0099 59.9 —
AFFECTED Product Versions Fixed Helix3 extension for Joomla 1.0-3.1.1 – —
TIMELINE May 27 Reserved by CNA Jun 29 Published (CNA: Joomla)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0098 59.5 —
AFFECTED Product Versions Fixed coolify < 4.0.0-beta.470 – —
TIMELINE Mar 30 Reserved by CNA Jun 29 Published (CNA: GitHub_M)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0098 59.5 —
AFFECTED Product Versions Fixed FrontAccounting unspecified 701fea6848da4a02fb83d30f07a9c0473d6b7e33
TIMELINE Apr 13 Reserved by CNA Jun 29 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0093 57.8 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Apr 6 Reserved by CNA Jun 29 Public exploit reference published Jun 29 Published (CNA: mitre)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R C L L L 7.1 .0091 57.3 —
AFFECTED Product Versions Fixed Safari unspecified — iOS and iPadOS unspecified — macOS unspecified — tvOS unspecified — visionOS unspecified — watchOS unspecified —
TIMELINE May 1 Reserved by CNA Jun 29 Published (CNA: apple)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N R U H H H 8.8 .0089 56.7 —
AFFECTED Product Versions Fixed Safari unspecified — iOS and iPadOS unspecified — macOS unspecified — tvOS unspecified — visionOS unspecified — watchOS unspecified —
TIMELINE May 1 Reserved by CNA Jun 29 Published (CNA: apple)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0087 56.1 —
AFFECTED Product Versions Fixed zephyr 4.0.0 – —
TIMELINE May 5 Reserved by CNA Jun 29 Public exploit reference published Jun 29 Published (CNA: zephyr)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0085 55.5 —
AFFECTED Product Versions Fixed JD12L 16.03.53.23 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0085 55.5 —
AFFECTED Product Versions Fixed JD12L 16.03.53.23 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 7.4 .0085 55.5 —
AFFECTED Product Versions Fixed JD12L 16.03.53.23 – —
TIMELINE Jun 28 Reserved by CNA Jun 29 Published (CNA: VulDB)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-13539 | 7.4 | 55.5 | Wavlink | WL-NU516U1-A | CWE-119 | Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow |
| CVE-2026-13562 | 7.4 | 54.0 | Edimax | EW-7478APC | CWE-119 | Edimax EW-7478APC POST Request formiNICSiteSurvey buffer overflow |
| CVE-2026-13563 | 7.4 | 54.0 | Edimax | EW-7478APC | CWE-119 | Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow |
| CVE-2026-13564 | 7.4 | 54.0 | Edimax | EW-7478APC | CWE-119 | Edimax EW-7478APC POST Request formPPPoESetup stack-based overflow |
| CVE-2026-13580 | 7.4 | 54.0 | Edimax | EW-7478APC | CWE-119 | Edimax EW-7478APC POST Request formQoS buffer overflow |
| CVE-2026-13582 | 7.4 | 54.0 | Edimax | EW-7478APC | CWE-119 | Edimax EW-7478APC POST Request formUSBAccount buffer overflow |
| CVE-2026-13583 | 7.4 | 54.0 | Edimax | EW-7478APC | CWE-119 | Edimax EW-7478APC POST Request formUSBFolder buffer overflow |
| CVE-2026-13165 | 8.6 | 50.7 | Krajowa Izba Rozliczeniowa | SzafirHost | CWE-434 | Remote Code Execution in SzafirHost |
| CVE-2026-53427 | 2.3 | 50.0 | leandrocp | mdex | CWE-79 | Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence a… |
| CVE-2026-43707 | 6.5 | 49.9 | Apple | Safari | CWE-119 | A memory corruption issue was addressed with improved memory handling. This i… |
| CVE-2026-43745 | 6.5 | 49.6 | Apple | Safari | CWE-787 | An out-of-bounds write issue was addressed with improved input validation. Th… |
| CVE-2026-13763 | 7.9 | 49.5 | AWS | AWS Application Load Balancer | CWE-444 | HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load… |
| CVE-2026-37637 | 9.1 | 49.0 | n/a | n/a | CWE-94 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute ar… |
| CVE-2026-43720 | 6.5 | 48.8 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-13587 | 2.9 | 48.8 | seladb | PcapPlusPlus | CWE-119 | seladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based… |
| CVE-2026-13546 | 5.5 | 48.6 | Feehi | CMS | CWE-287 | Feehi CMS REST API Endpoint articles missing authentication |
| CVE-2026-13528 | 5.5 | 48.3 | YunaiV | ruoyi-vue-pro | CWE-22 | YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint Fil… |
| CVE-2026-13592 | 5.5 | 47.8 | liftoff-sr | CIPster | CWE-119 | liftoff-sr CIPster EtherNet IP Message append out-of-bounds write |
| CVE-2026-56124 | 8.7 | 47.8 | shimosyan | phpUploader | CWE-359 | phpUploader < 2.0.2 Unauthenticated Database Exposure via index model |
| CVE-2026-13762 | 7.9 | 47.3 | AWS | Amazon CloudFront | CWE-444 | HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront wi… |
| CVE-2026-53404 | 7.3 | 47.2 | Apache Software Foundation | Apache Tomcat | CWE-670 | Apache Tomcat: Bad ornext processing in RewriteValve |
| CVE-2026-56018 | 7.5 | 46.5 | GTERMARS | JavaScript::Minifier::XS | CWE-400 | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every c… |
| CVE-2026-25707 | 8.8 | 46.0 | SUSE | libzypp | CWE-23 | Handcrafted repo metadata may cause arbitrary local files to be overwritten b… |
| CVE-2026-43716 | 6.5 | 46.0 | Apple | Safari | CWE-119 | The issue was addressed with improved memory handling. This issue is fixed in… |
| CVE-2026-13543 | 2.9 | 45.4 | n/a | Documenso | CWE-287 | Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentica… |
| CVE-2026-13588 | 2.9 | 45.3 | seladb | PcapPlusPlus | CWE-119 | seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based… |
| CVE-2026-13589 | 2.9 | 45.3 | seladb | PcapPlusPlus | CWE-119 | seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubComman… |
| CVE-2026-13590 | 2.9 | 45.3 | seladb | PcapPlusPlus | CWE-119 | seladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow |
| CVE-2026-55276 | 9.1 | 44.3 | Apache Software Foundation | Apache Tomcat | CWE-670 | Apache Tomcat: Logged effective web.xml is incomplete |
| CVE-2026-55607 | 7.7 | 43.6 | anthropics | claude-code | CWE-22 | Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxe… |
| CVE-2026-43701 | 7.1 | 43.6 | Apple | Safari | CWE-284 | The issue was addressed with improved checks. This issue is fixed in Safari 2… |
| CVE-2026-12856 | 8.8 | 43.5 | Red Hat | Red Hat OpenShift Dev Spaces 3.29 | CWE-88 | Vscode-java: vscode: command injection vulnerability in the javadoc hover pro… |
| CVE-2026-57331 | 9.9 | 43.4 | videowhisper | Paid Videochat Turnkey Site | CWE-22 | WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deleti… |
| CVE-2026-53434 | 9.1 | 43.2 | Apache Software Foundation | Apache Tomcat | CWE-390 | Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Conn… |
| CVE-2026-12616 | 6.9 | 43.0 | Eclipse Foundation | Eclipse CSI - PIA | CWE-117 | The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplie… |
| CVE-2026-13749 | 8.8 | 42.9 | Snowflake | Snowflake CLI | CWE-94 | Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Temp… |
| CVE-2026-54889 | 5.1 | 42.9 | leandrocp | mdex | CWE-79 | Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injectio… |
| CVE-2026-11720 | 9.3 | 42.6 | MCP Toolbox for Databases (googleapis/mcp-toolbox) | CWE-22 | Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder | |
| CVE-2026-43713 | 6.5 | 42.4 | Apple | Safari | CWE-284 | A permissions issue was addressed with additional restrictions. This issue is… |
| CVE-2026-13571 | 5.5 | 41.2 | SourceCodester | Simple Food Ordering System | CWE-840 | SourceCodester Simple Food Ordering System cart.php logic error |
| CVE-2026-13549 | 2.1 | 41.3 | CodeAstro | Complaint Management System | CWE-285 | CodeAstro Complaint Management System Report Endpoint Report.php deletereport… |
| CVE-2026-13522 | 2.1 | 41.2 | Investintech | SlimPDFReader | CWE-119 | Investintech SlimPDFReader PDF File SlimPDFReader.exe TeighaDo+0x25cde0 out-o… |
| CVE-2026-43705 | 8.8 | 40.9 | Apple | Safari | CWE-843 | A type confusion issue was addressed with improved checks. This issue is fixe… |
| CVE-2026-13553 | 5.5 | 40.2 | itsourcecode | Online Hotel Management System | CWE-284 | itsourcecode Online Hotel Management System controller.php add unrestricted u… |
| CVE-2026-51221 | 7.5 | 39.8 | n/a | n/a | CWE-284 | A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer … |
| CVE-2026-56017 | 7.5 | 39.8 | GTERMARS | JavaScript::Minifier::XS | CWE-125 | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL poin… |
| CVE-2026-13533 | 5.5 | 39.4 | agentejo | Cockpit CMS | CWE-425 | agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access |
| CVE-2026-56285 | 7.7 | 39.3 | zedeus | nitter | CWE-918 | Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint |
| CVE-2026-43703 | 6.5 | 39.2 | Apple | iOS and iPadOS | CWE-125 | The issue was addressed with improved memory handling. This issue is fixed in… |
| CVE-2026-43732 | 6.5 | 39.3 | Apple | Safari | CWE-22 | A path handling issue was addressed with improved validation. This issue is f… |
| CVE-2026-51219 | 7.5 | 39.0 | n/a | n/a | CWE-122 | A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages f… |
| CVE-2026-40523 | 7.2 | 38.8 | FrontAccounting | FrontAccounting | CWE-89 | FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php |
| CVE-2026-40524 | 7.2 | 38.8 | FrontAccounting | FrontAccounting | CWE-89 | FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions() |
| CVE-2026-13547 | 5.5 | 38.7 | Hanwang | e-Face General Management Platform | CWE-284 | Hanwang e-Face General Management Platform upload.do unrestricted upload |
| CVE-2026-13568 | 5.5 | 38.7 | SourceCodester | Inventory Management System | CWE-266 | SourceCodester Inventory Management System User Registration Endpoint users_h… |
| CVE-2026-13554 | 2.1 | 38.6 | itsourcecode | Online Hotel Management System | CWE-79 | itsourcecode Online Hotel Management System POST Request controller.php add c… |
| CVE-2026-13556 | 2.1 | 38.6 | itsourcecode | Online Hotel Management System | CWE-79 | itsourcecode Online Hotel Management System POST Request controller.php edit … |
| CVE-2026-13557 | 2.1 | 38.6 | itsourcecode | Online Hotel Management System | CWE-79 | itsourcecode Online Hotel Management System POST Request controller.php add c… |
| CVE-2026-13567 | 2.1 | 38.6 | code-projects | Online Music Site | CWE-79 | code-projects Online Music Site POST Request Feedback.php cross site scripting |
| CVE-2026-43676 | 6.5 | 38.5 | Apple | Safari | CWE-125 | An out-of-bounds access issue was addressed with improved bounds checking. Th… |
| CVE-2026-13744 | 8.8 | 38.2 | Snowflake | Snowflake CLI | CWE-89 | Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlle… |
| CVE-2026-56783 | 7.1 | 37.8 | parseablehq | parseable | CWE-522 | Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API |
| CVE-2026-56780 | 7.7 | 37.5 | modoboa | modoboa | CWE-639 | Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change… |
| CVE-2026-13536 | 2.1 | 37.1 | n/a | GotoHTTP | CWE-79 | GotoHTTP reg.12x cross site scripting |
| CVE-2026-13437 | 6.5 | 36.3 | Devolutions | PowerShell Universal | CWE-201 | Insertion of sensitive information into sent data in the AI Agent job API in … |
| CVE-2026-57953 | 5.3 | 36.3 | its-a-feature | Mythic | CWE-863 | Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventin… |
| CVE-2026-43706 | 6.5 | 36.2 | Apple | iOS and iPadOS | CWE-415 | A double free issue was addressed with improved memory management. This issue… |
| CVE-2026-43721 | 6.5 | 36.2 | Apple | Safari | CWE-732 | This issue was addressed through improved state management. This issue is fix… |
| CVE-2026-55955 | 6.5 | 36.2 | Apache Software Foundation | Apache Tomcat | CWE-287 | Apache Tomcat: EncryptInterceptor not protected against replay attacks |
| CVE-2026-57957 | 2.3 | 36.1 | papermark | papermark | CWE-942 | Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint |
| CVE-2026-57951 | 7.1 | 35.9 | its-a-feature | Mythic | CWE-863 | Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table |
| CVE-2026-12912 | 7.3 | 35.8 | Red Hat | Red Hat Enterprise Linux 10 | CWE-122 | Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed … |
| CVE-2026-13521 | 5.5 | 35.7 | SourceCodester | Class and Exam Timetabling System | CWE-74 | SourceCodester Class and Exam Timetabling System preview5.php sql injection |
| CVE-2026-13526 | 5.5 | 35.7 | SourceCodester | Class and Exam Timetabling System | CWE-74 | SourceCodester Class and Exam Timetabling System edit_class.php sql injection |
| CVE-2026-13527 | 5.5 | 35.7 | SourceCodester | Class and Exam Timetabling System | CWE-74 | SourceCodester Class and Exam Timetabling System preview4.php sql injection |
| CVE-2026-13550 | 5.5 | 35.7 | itsourcecode | Baptism Information Management System | CWE-74 | itsourcecode Baptism Information Management System delbaptism.php sql injection |
| CVE-2026-13551 | 5.5 | 35.7 | itsourcecode | Baptism Information Management System | CWE-74 | itsourcecode Baptism Information Management System editBaptism.php sql injection |
| CVE-2026-13552 | 5.5 | 35.7 | itsourcecode | Online Hotel Management System | CWE-74 | itsourcecode Online Hotel Management System controller.php edit sql injection |
| CVE-2026-13555 | 5.5 | 35.7 | itsourcecode | Online Hotel Management System | CWE-74 | itsourcecode Online Hotel Management System controller.php add sql injection |
| CVE-2026-13559 | 5.5 | 35.7 | code-projects | Real State Services | CWE-74 | code-projects Real State Services single-list_sale.php add sql injection |
| CVE-2026-13565 | 5.5 | 35.7 | SourceCodester | Class and Exam Timetabling System | CWE-74 | SourceCodester Class and Exam Timetabling System edit_class1.php sql injection |
| CVE-2026-13566 | 5.5 | 35.7 | SourceCodester | Class and Exam Timetabling System | CWE-74 | SourceCodester Class and Exam Timetabling System preview3.php sql injection |
| CVE-2026-57960 | 8.3 | 35.6 | HiEventsDev | Hi.Events | CWE-359 | Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List sho… |
| CVE-2026-43712 | 6.5 | 35.4 | Apple | Safari | CWE-125 | The issue was addressed with improved memory handling. This issue is fixed in… |
| CVE-2026-57946 | 6.3 | 35.4 | iv-org | Invidious | CWE-862 | Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint |
| CVE-2026-13524 | 2.9 | 35.1 | CherryHQ | cherry-studio | CWE-266 | CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper a… |
| CVE-2026-41052 | 9.4 | 35.1 | SUSE | Rancher | CWE-305 | Rancher Privilege Escalation from Project Owner to Host |
| CVE-2026-57950 | 8.6 | 34.0 | Yunai | ruoyi-vue-pro | CWE-863 | ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController |
| CVE-2026-43718 | 6.5 | 34.0 | Apple | Safari | CWE-121 | A stack overflow was addressed with improved input validation. This issue is … |
| CVE-2026-51218 | 7.5 | 33.7 | n/a | n/a | CWE-122 | A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/co… |
| CVE-2026-57346 | 7.1 | 33.7 | Epiphyt | Embed Privacy | CWE-22 | WordPress Embed Privacy plugin <= 1.12.3 - Arbitrary File Deletion vulnerability |
| CVE-2026-43731 | 8.8 | 33.4 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-57949 | 7.1 | 33.0 | Yunai | ruoyi-vue-pro | CWE-862 | ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint |
| CVE-2026-43740 | 6.5 | 32.7 | Apple | Safari | CWE-119 | The issue was addressed with improved memory handling. This issue is fixed in… |
| CVE-2026-13758 | 3.7 | 32.7 | MIK | CryptX | CWE-208 | CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in… |
| CVE-2026-56781 | 6.9 | 32.5 | teableio | teable | CWE-639 | Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Ove… |
| CVE-2026-43699 | 6.5 | 32.1 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-43734 | 6.5 | 32.1 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-43742 | 6.5 | 32.1 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-41896 | 7.5 | 31.7 | coollabsio | coolify | CWE-287 | Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null… |
| CVE-2026-28979 | 6.5 | 31.7 | Apple | Safari | CWE-125 | An out-of-bounds access issue was addressed with improved bounds checking. Th… |
| CVE-2026-43704 | 5.3 | 31.7 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-13676 | 7.5 | 31.2 | fast-uri | fast-uri | CWE-436 | fast-uri vulnerable to host confusion via failed IDN canonicalization |
| CVE-2026-57498 | 9.6 | 30.8 | coollabsio | coolify | CWE-639 | Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and de… |
| CVE-2025-7386 | 6.8 | 30.4 | Hitachi | Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8 | CWE-522 | Information exposure vulnerability in Hitachi Storage Navigator |
| CVE-2026-43708 | 4.3 | 30.1 | Apple | Safari | CWE-20 | The issue was addressed with improved input validation. This issue is fixed i… |
| CVE-2026-13540 | 2.1 | 30.2 | n/a | GitBucket | CWE-918 | GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-s… |
| CVE-2026-13544 | 2.1 | 30.2 | Feehi | CMS | CWE-266 | Feehi CMS API users access control |
| CVE-2026-43709 | 6.5 | 29.7 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-43717 | 6.5 | 29.7 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-39872 | 6.5 | 29.5 | Apple | Safari | CWE-119 | The issue was addressed with improved memory handling. This issue is fixed in… |
| CVE-2026-43663 | 6.5 | 29.5 | Apple | Safari | CWE-119 | The issue was addressed with improved memory handling. This issue is fixed in… |
| CVE-2026-13529 | 2.9 | 29.4 | n/a | YzmCMS | CWE-74 | YzmCMS index.php sql injection |
| CVE-2026-43726 | 6.5 | 28.5 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-57956 | 6.1 | 27.9 | SigNoz | signoz | CWE-639 | SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Ale… |
| CVE-2026-10083 | 7.5 | 27.8 | Unknown | APCu Manager | — | APCu Manager < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution |
| CVE-2025-2902 | 8.3 | 27.6 | Hitachi | Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H | CWE-862 | Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtua… |
| CVE-2026-43727 | 6.5 | 27.6 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-13569 | 2.0 | 27.5 | weng-xianhu | EyouCMS | CWE-74 | weng-xianhu EyouCMS API index.php sql injection |
| CVE-2026-13558 | 2.0 | 27.4 | CodeAstro | Complaint Management System | CWE-79 | CodeAstro Complaint Management System Report addreport cross site scripting |
| CVE-2026-41992 | 6.9 | 27.2 | GNU | gzip | CWE-126 | Global Buffer Overflow in GNU gzip |
| CVE-2026-34592 | 7.7 | 26.5 | coollabsio | coolify | CWE-639 | Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH … |
| CVE-2026-57943 | 6.0 | 26.3 | LibrePhotos | librephotos | CWE-639 | LibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared End… |
| CVE-2026-57332 | 7.1 | 26.3 | WP Swings | Wallet System for WooCommerce | CWE-862 | WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Contr… |
| CVE-2026-13520 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System Appointment appointmentapproval.php s… |
| CVE-2026-13525 | 2.1 | 25.7 | CodeAstro | Human Resource Management System | CWE-74 | CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employe… |
| CVE-2026-13530 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System Appointment appointmentdetail.php sql… |
| CVE-2026-13531 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System department.php sql injection |
| CVE-2026-13532 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System departmentDoctor.php sql injection |
| CVE-2026-13535 | 2.1 | 25.7 | CodeAstro | Human Resource Management System | CWE-74 | CodeAstro Human Resource Management System View Endpoint Employee_model.php G… |
| CVE-2026-13541 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System doctorchangepassword.php sql injection |
| CVE-2026-13542 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System doctorprofile.php sql injection |
| CVE-2026-13548 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System doctortimings.php sql injection |
| CVE-2026-13572 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System insertbillingrecord.php sql injection |
| CVE-2026-13578 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System patientdetail.php sql injection |
| CVE-2026-13579 | 2.1 | 25.7 | itsourcecode | Hospital Management System | CWE-74 | itsourcecode Hospital Management System patientchangepassword.php sql injection |
| CVE-2026-57334 | 6.5 | 25.6 | weDevs | WP User Frontend | CWE-862 | WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability |
| CVE-2026-57339 | 6.5 | 25.6 | Strategy11 Team | Business Directory | CWE-862 | WordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnera… |
| CVE-2026-57340 | 6.5 | 25.6 | shohei.tanaka | Japanized For WooCommerce | CWE-862 | WordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control … |
| CVE-2026-57341 | 6.5 | 25.6 | Colissimo | Colissimo Officiel : Méthodes de livraison pour WooCommerce | CWE-639 | WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin … |
| CVE-2026-13570 | 2.0 | 25.4 | SourceCodester | Inventory Management System | CWE-79 | SourceCodester Inventory Management System User Registration Endpoint users_h… |
| CVE-2026-7656 | 6.8 | 25.2 | zephyrproject | zephyr | CWE-290 | Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA accep… |
| CVE-2026-43746 | 6.5 | 25.3 | Apple | Safari | CWE-416 | A use-after-free issue was addressed with improved memory management. This is… |
| CVE-2026-57947 | 6.3 | 25.1 | pinpoint-apm | pinpoint | CWE-918 | Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration |
| CVE-2026-13752 | 8.0 | 25.0 | Snowflake | Snowflake CLI | CWE-89 | Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in … |
| CVE-2026-43724 | 7.8 | 24.8 | Apple | iOS and iPadOS | CWE-20 | The issue was addressed with improved input sanitization. This issue is fixed… |
| CVE-2026-57945 | 5.3 | 24.8 | photoprism | photoprism | CWE-639 | PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{ui… |
| CVE-2026-13534 | 1.3 | 24.9 | CherryHQ | cherry-studio | CWE-285 | CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authoriza… |
| CVE-2026-57955 | 8.3 | 24.6 | SigNoz | signoz | CWE-89 | SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter |
| CVE-2026-13591 | 1.3 | 23.9 | DeepMyst | Mysti | CWE-266 | DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation impro… |
| CVE-2026-56457 | 4.3 | 22.1 | HCLSoftware | HCL DevOps Deploy / HCL Launch | CWE-532 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive inf… |
| CVE-2026-57335 | 6.5 | 21.9 | Ads WPQuads | Ads by WPQuads | CWE-862 | WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2026-57676 | 4.3 | 21.3 | Matteo Manna | Simple User Avatar | CWE-639 | WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object Reference… |
| CVE-2026-13593 | 6.5 | 21.2 | GTERMARS | CSS::Minifier::XS | CWE-401 | CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the e… |
| CVE-2026-57952 | 6.0 | 20.8 | its-a-feature | Mythic | CWE-862 | Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverifi… |
| CVE-2026-57958 | 5.1 | 20.5 | inovector | mixpost | CWE-79 | Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter |
| CVE-2026-57954 | 5.3 | 20.0 | yahoo | elide | CWE-862 | Elide 7.1.17 - Permission Bypass in Sort Expression Validation |
| CVE-2026-57942 | 6.9 | 19.9 | LibreTranslate | LibreTranslate | CWE-348 | LibreTranslate - IP Spoofing via X-Forwarded-For Header |
| CVE-2026-9267 | 6.9 | 18.6 | Eclipse Foundation | Eclipse tinydtls | CWE-125 | Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 conta… |
| CVE-2026-43722 | 5.5 | 17.5 | Apple | iOS and iPadOS | CWE-20 | The issue was addressed with improved input sanitization. This issue is fixed… |
| CVE-2026-57327 | 6.3 | 17.3 | mainwp | MainWP | CWE-862 | WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability |
| CVE-2026-55844 | 7.5 | 17.1 | home-assistant | core | CWE-319 | Home Assistant: iOS Companion App ignores internal SSID allowlist for connect… |
| CVE-2026-57959 | 8.2 | 16.9 | HiEventsDev | Hi.Events | CWE-367 | Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condi… |
| CVE-2026-57326 | 6.1 | 16.4 | Strategy11 Team | Business Directory | CWE-79 | WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vu… |
| CVE-2026-57320 | 7.1 | 16.3 | RealMag777 | BEAR | CWE-79 | WordPress BEAR plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-57333 | 7.1 | 16.3 | Spencer Haws | Link Whisper Free | CWE-79 | WordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting … |
| CVE-2026-57336 | 7.1 | 16.3 | Astoundify | Jobify | CWE-79 | WordPress Jobify theme <= 4.3.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-57337 | 7.1 | 16.3 | PluginOps | Landing Page Builder | CWE-79 | WordPress Landing Page Builder plugin <= 1.5.3.5 - Cross Site Scripting (XSS)… |
| CVE-2026-57338 | 7.1 | 16.3 | Repute InfoSystems | ARForms | CWE-79 | WordPress ARForms plugin <= 7.1.2 - Reflected Cross Site Scripting (XSS) vuln… |
| CVE-2026-57997 | 6.3 | 16.0 | strapi | strapi | CWE-327 | Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Conf… |
| CVE-2026-31016 | 6.5 | 14.8 | n/a | n/a | CWE-352 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 a… |
| CVE-2026-54888 | 6.9 | 14.5 | leandrocp | mdex | CWE-674 | Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex |
| CVE-2026-40522 | 7.1 | 13.9 | FrontAccounting | FrontAccounting | CWE-89 | FrontAccounting < 2.4.20 SQL Injection via rep601.php |
| CVE-2026-43735 | 8.1 | 13.6 | Apple | Safari | CWE-352 | The issue was addressed with improved checks. This issue is fixed in Safari 2… |
| CVE-2026-13537 | 2.1 | 13.6 | CodeAstro | Human Resource Management System | CWE-352 | CodeAstro Human Resource Management System cross-site request forgery |
| CVE-2026-57328 | 6.5 | 12.9 | Strategy11 Team | Business Directory | CWE-79 | WordPress Business Directory plugin <= 6.4.22 - Cross Site Scripting (XSS) vu… |
| CVE-2026-57329 | 6.5 | 12.9 | WOOCOMMERCE DESIGNER PRO | WooCommerce Designer Pro | CWE-79 | WordPress WooCommerce Designer Pro plugin <= 1.9.34 - Cross Site Scripting (X… |
| CVE-2026-57330 | 6.5 | 12.9 | Stylemix | MasterStudy LMS | CWE-79 | WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulne… |
| CVE-2026-13746 | 5.4 | 12.0 | Snowflake | Snowflake CLI | CWE-89 | Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Para… |
| CVE-2026-13751 | 9.6 | 10.3 | Snowflake | Snowflake CLI | CWE-829 | Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/… |
| CVE-2026-57948 | 7.6 | 10.0 | pinpoint-apm | pinpoint | CWE-614 | Pinpoint - Insecure Session Cookie Attributes in pinpointJwt |
| CVE-2026-10647 | 5.3 | 9.9 | zephyrproject | zephyr | CWE-667 | Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure |
| CVE-2026-43700 | 6.5 | 8.4 | Apple | Safari | CWE-346 | A cross-origin issue was addressed with improved tracking of security origins… |
| CVE-2026-53428 | 6.9 | 8.1 | leandrocp | mdex | CWE-789 | Unbounded memory allocation in highlight_lines range expansion in mdex |
| CVE-2026-13748 | 6.3 | 8.1 | Snowflake | Snowflake CLI | CWE-22 | Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper Fil… |
| CVE-2026-53426 | 8.2 | 7.6 | leandrocp | mdex | CWE-770 | Atom-table exhaustion denial-of-service via JSON parse_document in MDEx |
| CVE-2026-53429 | 6.9 | 7.6 | leandrocp | mdex | CWE-401 | Unbounded native memory leak in mdex escaped-tag rendering enables unauthenti… |
| CVE-2026-13601 | 6.5 | 7.5 | Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | CWE-693 | Yelp: yelp-xsl: overly permissive content security policy in yelp allows host… |
| CVE-2026-57919 | 7.8 | 7.2 | n/a | n/a | CWE-276 | PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a… |
| CVE-2026-13523 | 1.9 | 5.3 | n/a | GPAC | CWE-404 | GPAC ISOBMFF base_encoding.c data amplification |
| CVE-2026-46406 | 4.4 | 4.7 | anthropics | claude-code | CWE-59 | Claude Code: Insecure Temporary File in /copy Command Enables Response Disclo… |
| CVE-2026-54369 | 8.4 | 4.7 | acl project | acl | CWE-59 | acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions |
| CVE-2026-10648 | 5.5 | 4.6 | zephyrproject | zephyr | CWE-476 | NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-poo… |
| CVE-2026-13595 | 5.3 | 4.6 | Red Hat | Red Hat Hardened Images | CWE-416 | Util-linux: util-linux: heap use-after-free in libblkid nested partition probing |
| CVE-2026-13750 | 5.5 | 4.5 | Snowflake | Snowflake CLI | CWE-532 | Snowflake CLI Sensitive Credential Exposure Through Debug Logging |
| CVE-2026-13757 | 6.2 | 4.2 | Red Hat | Red Hat Enterprise Linux 10 | CWE-674 | P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing |
| CVE-2026-9676 | 4.3 | 3.8 | Unknown | F4 Post Tree | — | f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification |
| CVE-2026-54371 | 8.4 | 2.9 | attr project | attr | CWE-59 | attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr |
| CVE-2025-0824 | 3.7 | 2.8 | Hitachi | Hitachi Virtual Storage Platform One Block 23, 24, 26, 28 | CWE-347 | lack of validation for firmware update in Hitachi Virtual Storage |
| CVE-2026-53325 | 5.5 | 2.5 | Linux | Linux | CWE-476 | agp/amd64: Fix broken error propagation in agp_amd64_probe() |
| CVE-2026-57966 | 4.4 | 2.5 | Red Hat | Red Hat Enterprise Linux 10 | CWE-22 | Spice-vdagent: path traversal in file transfer via unsanitized filename |
| CVE-2026-22078 | 7.3 | 2.2 | OPPO | O+ Connect | CWE-266 | O+ Connect's lack of authentication for IPC channels led to a local privilege… |
| CVE-2026-41991 | 2.0 | 1.8 | GNU | gzip | CWE-377 | Predictable Temporary File in GNU gzip |
| CVE-2026-13742 | 5.9 | 1.7 | Honeywell Technologies | IQ MultiAccess | CWE-367 | Lack of signature verification before execution of downloaded content |
| CVE-2026-57965 | 5.1 | 1.6 | Red Hat | Red Hat Enterprise Linux 10 | CWE-190 | Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow |
| CVE-2026-43743 | 4.7 | 1.2 | Apple | iOS and iPadOS | CWE-362 | A race condition was addressed with improved state handling. This issue is fi… |
| CVE-2026-54370 | 7.2 | 0.4 | acl project | acl | CWE-367 | acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl |
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-06-29 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.
Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.
