boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Wednesday, July 1, 2026 · all times UTC← 2026-06-30 · archive · 2026-07-02 →

Security Box Score — July 1, 2026

365 CVEs published, led by Google (52).

365 CVEs published July 1, 2026: 58 critical, 123 high, 166 medium, 8 low; 1 in the KEV catalog at press time; 19 with a public exploit reference; 10 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 340 in the results table.

Standings

League
MTDYTD2025 same span2025 full
CVEs published36512768——
KEV catalog size1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

555 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux31151112086053011120.17.5.0014+30 ▲
google521317148590542377760.57.8.0024-8 ▼
microsoft2759585231726286202.67.8.0045+1 ▲
red hat8230119211413200.06.5.0030+4 ▲
apple01042287228876.76.5.00320
canonical0202585000.05.5.00110
freebsd01601240000.07.8.00160
suse0133730000.08.6.00390
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco830614100561136.77.5.0057+8 ▲
netgear01700161000.04.3.00240
palo alto networks011127113218.25.9.00220
ubiquiti01174003327.39.9.00830
checkpoint0915303111.17.5.04100
fortinet09432028333.38.3.00760
ivanti09450025555.68.8.5187-1 ▼
f50843104112.58.9.02250
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache2157245963103310.67.2.0053-26 ▼
mozilla2581218280900.07.3.00260
gitlab03105215426.54.4.00290
github171150000.06.0.0039+1 ▲
docker070520000.08.2.00160
drupal0511304120.05.1.00260
wordpress00000020———0
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle02701321161842720.78.8.00400
adobe014411537821921.45.8.00210
ibm01243642460600.07.5.0034-5 ▼
progress091710600.07.5.00360
solarwinds07232010457.17.5.40010
veeam042200100.09.0.00520
zohocorp031110000.08.4.01700
atlassian000000130———0
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
synology02325133000.05.6.00250
d-link0120525300.05.8.0058-2 ▼
siemens090450000.06.9.00210
rockwell automation071510000.08.7.00300
abb060420000.07.2.00180
schneider electric060420000.07.8.00420
moxa050320000.07.0.00290
dahua030111000.06.9.00360
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
spring073231391000.06.5.0024-2 ▼
sourcecodester071003635000.05.5.0027-12 ▼
openclaw0670352210000.07.0.00210
edimax065039026100.07.4.00800
capgo061231271000.07.1.00390
themerex05855300000.08.1.00430
dell157231240211.87.4.0017+1 ▲
nvidia1756113870000.07.8.0038+17 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-10520.9991100.010.0
CVE-2026-20253.969499.99.8
CVE-2026-35273.954799.99.8
CVE-2026-20230.882099.88.6
CVE-2026-34910.874799.710.0
CVE-2026-34908.851999.710.0
CVE-2026-50751.837799.79.3
CVE-2026-48907.781099.510.0
CVE-2026-45659.760899.58.8
CVE-2026-34909.639099.210.0
Highest CVSS
CVECVSSEPSSNote
CVE-2026-1052010.0.9991KEV
CVE-2026-3491010.0.8747KEV
CVE-2026-3490810.0.8519KEV
CVE-2026-4890710.0.7810KEV
CVE-2026-3490910.0.6390KEV
CVE-2026-1377310.0.0610
CVE-2026-5641510.0.0436
CVE-2026-5641310.0.0419
CVE-2026-5357610.0.0330
CVE-2026-5375310.0.0290
Most disclosures (vendor)
VendorCVEs
google1082
linux543
oracle242
microsoft222
adobe142
red hat132
apache95
ibm70
spring70
capgo61
Most KEV additions (YTD)
VendorKEV
microsoft20
cisco11
apple7
google6
ivanti5
solarwinds4
berriai3
fortinet3
smartertools3
ubiquiti3
Most-affected ecosystems
EcosystemAdvisories
Maven41
Packagist15
PyPI8
npm6
Fastest to KEV
CVEVendorDays
CVE-2025-48595Google0
CVE-2026-10520ivanti0
CVE-2026-11645Google0
CVE-2026-12569PTC0
CVE-2026-20230Cisco0
CVE-2026-20245Cisco0
CVE-2026-20253Splunk0
CVE-2026-20262Cisco0
CVE-2026-28318SolarWinds0
CVE-2026-34908Ubiquiti Inc0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104n/a2021-11-171687
CVE-2021-27102n/a2021-11-171687
CVE-2021-27101n/a2021-11-171687
CVE-2021-27103n/a2021-11-171687
CVE-2021-21017Adobe2021-11-171687
CVE-2021-28550Adobe2021-11-171687
CVE-2021-42013Apache Software Foundation2021-11-171687
CVE-2021-41773Apache Software Foundation2021-11-171687
CVE-2021-30858Apple2021-11-171687
CVE-2021-30860Apple2021-11-171687

Transactions

EXPLOIT PUBLISHED — ChaN FatFs: 6 CVEs (CVE-2026-6682, CVE-2026-6683, CVE-2026-6684, CVE-2026-6686, CVE-2026-6687, CVE-2026-6688). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2026-13323 (Eclipse Foundation Eclipse Open VSX). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50160 (hoppscotch). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-57516 (Anyscale, Inc Ray). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-8857 (Wikimedia Foundation timeline). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

365 CVEs published. 25 box scores, 340 table rows — nothing truncated.

CVE-2026-45659HIGH
Microsoft SharePoint Remote Code Execution Vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .7608   99.5   YES
AFFECTED
  Product                                           Versions  Fixed
  Microsoft SharePoint Enterprise Server 2016       16.0.0 –  —
  Microsoft SharePoint Server 2019                  16.0.0 –  —
  Microsoft SharePoint Server Subscription Edition  16.0.0 –  —
TIMELINE
  May 12  Reserved by CNA
  Jul 1   Added to CISA KEV, due Jul 4
  Jul 1   Published (CNA: microsoft)
CWE-502 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due July 4, 2026
CVE-2026-58457CRITICAL
Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0294   86.1     —
AFFECTED
  Product              Versions     Fixed
  M300 Wi-Fi Repeater  unspecified  —
TIMELINE
  Jun 30  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred
CVE-2026-58452HIGH
JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0267   84.6     —
AFFECTED
  Product                   Versions           Fixed
  C492A-W6 Wi-Fi IP Camera  4.8.30.57701411 –  —
TIMELINE
  Jun 30  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred
CVE-2026-7840CRITICAL
uvnc UltraVNC — UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE)
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0263   84.3     —
AFFECTED
  Product   Versions     Fixed
  UltraVNC  unspecified  —
TIMELINE
  May 5   Reserved by CNA
  Jul 1   Published (CNA: securin)
CWE-787 · CNA: securin · CVSS v4.0 · 3 references · NVD status: Modified
CVE-2026-8857NONE
Wikimedia Foundation timeline — Full RCE using EasyTimeline Extension
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   N    0.0   .0210   80.3     —
AFFECTED
  Product   Versions     Fixed
  timeline  unspecified  —
TIMELINE
  May 18  Reserved by CNA
  Jul 1   Public exploit reference published
  Jul 1   Published (CNA: wikimedia-foundation)
CWE-94 · CNA: wikimedia-foundation · CVSS v4.0 · 1 reference · NVD status: Analyzed
CVE-2026-58453CRITICAL
JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0190   78.0     —
AFFECTED
  Product                   Versions           Fixed
  C492A-W6 Wi-Fi IP Camera  4.8.30.57701411 –  —
TIMELINE
  Jun 30  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-1392 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Deferred
CVE-2026-58127CRITICAL
Hyland PACSgear MediaWriter — PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0188   77.9     —
AFFECTED
  Product               Versions  Fixed
  PACSgear MediaWriter  5.2.1 –   —
TIMELINE
  Jun 29  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-306, CWE-502 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Analyzed
CVE-2026-7838HIGH
uvnc UltraVNC — UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    8.7   .0187   77.7     —
AFFECTED
  Product   Versions     Fixed
  UltraVNC  unspecified  —
TIMELINE
  May 5   Reserved by CNA
  Jul 1   Published (CNA: securin)
CWE-190, CWE-787 · CNA: securin · CVSS v4.0 · 3 references · NVD status: Modified
CVE-2026-58126CRITICAL
Hyland PACSgear PACS Scan — PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0184   77.4     —
AFFECTED
  Product             Versions  Fixed
  PACSgear PACS Scan  5.2.1 –   —
TIMELINE
  Jun 29  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-306, CWE-502 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Analyzed
CVE-2026-50043HIGH
Seiko Solutions Inc. SkyBridge MB-A100/MB-A110 — Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in …
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    8.6   .0171   75.6     —
AFFECTED
  Product                    Versions        Fixed
  SkyBridge MB-A100/MB-A110  all versions –  —
TIMELINE
  Jun 8   Reserved by CNA
  Jul 1   Published (CNA: jpcert)
CWE-78 · CNA: jpcert · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-50160CRITICAL
hoppscotch hoppscotch — Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  N   10.0   .0170   75.4     —
AFFECTED
  Product     Versions       Fixed
  hoppscotch  <= 2026.4.1 –  —
TIMELINE
  Jun 3   Reserved by CNA
  Jul 1   Public exploit reference published
  Jul 1   Published (CNA: GitHub_M)
CWE-915 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Analyzed
CVE-2026-7828MEDIUM
uvnc UltraVNC — UltraVNC repeater integer overflow in win_log malloc leading to heap overflow
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  L    5.3   .0135   69.4     —
AFFECTED
  Product   Versions     Fixed
  UltraVNC  unspecified  —
TIMELINE
  May 5   Reserved by CNA
  Jul 1   Published (CNA: securin)
CWE-190 · CNA: securin · CVSS v3.1 · 3 references · NVD status: Modified
CVE-2026-51947CRITICAL
n/a n/a — An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal C…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0107   62.4     —
AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —
TIMELINE
  Jun 8   Reserved by CNA
  Jul 1   Published (CNA: mitre)
CWE-502 · CNA: mitre · CVSS v3.1 · 3 references · NVD status: Awaiting Analysis
CVE-2026-13760HIGH
AWS AWS CDK — OS Command Injection in aws-cdk-lib Docker Bundling
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   A   H   H   H    7.0   .0107   62.2     —
AFFECTED
  Product  Versions     Fixed
  AWS CDK  unspecified  —
TIMELINE
  Jun 29  Reserved by CNA
  Jul 1   Published (CNA: AMZN)
CWE-78 · CNA: AMZN · CVSS v4.0 · 3 references · NVD status: Awaiting Analysis
CVE-2026-38142MEDIUM
n/a n/a — An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Ten…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  N    6.5   .0106   62.1     —
AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —
TIMELINE
  Apr 6   Reserved by CNA
  Jul 1   Published (CNA: mitre)
CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Deferred
CVE-2026-23537CRITICAL
Feast: unauthenticated arbitrary file write
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  H    9.1   .0105   61.6     —
AFFECTED
  Product                       Versions     Fixed
  Feast Feature Server          unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  Red Hat OpenShift AI (RHOAI)  unspecified  —
  + 5 more
TIMELINE
  Jan 13  Reserved by CNA
  Jul 1   Published (CNA: redhat)
CWE-862 · CNA: redhat · CVSS v3.1 · 4 references · NVD status: Awaiting Analysis
CVE-2026-58399HIGH
antonio-castellon module-auth — @acastellon/auth has an authentication bypass via spoofable headers in validateToken()
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   H   N    8.7   .0097   59.4     —
AFFECTED
  Product      Versions   Fixed
  module-auth  < 2.3.0 –  —
TIMELINE
  Jun 30  Reserved by CNA
  Jul 1   Published (CNA: GitHub_M)
CWE-287 · CNA: GitHub_M · CVSS v4.0 · 3 references · NVD status: Deferred
CVE-2026-57517CRITICAL
Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0096   59.0     —
AFFECTED
  Product            Versions     Fixed
  Control Web Panel  unspecified  —
TIMELINE
  Jun 24  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-89 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Awaiting Analysis
CVE-2026-49119HIGH
gradio-app gradio — Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0093   58.0     —
AFFECTED
  Product  Versions     Fixed
  gradio   unspecified  —
TIMELINE
  May 27  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-22 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Analyzed
CVE-2026-34106CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.9     —
AFFECTED
  Product          Versions     Fixed
  language-system  unspecified  —
TIMELINE
  Mar 25  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-34107CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.9     —
AFFECTED
  Product          Versions     Fixed
  language-system  unspecified  —
TIMELINE
  Mar 25  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-34108CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.9     —
AFFECTED
  Product          Versions     Fixed
  language-system  unspecified  —
TIMELINE
  Mar 25  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-34109CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.9     —
AFFECTED
  Product          Versions     Fixed
  language-system  unspecified  —
TIMELINE
  Mar 25  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-34110CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.9     —
AFFECTED
  Product          Versions     Fixed
  language-system  unspecified  —
TIMELINE
  Mar 25  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-34111CRITICAL
Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0093   57.9     —
AFFECTED
  Product          Versions     Fixed
  language-system  unspecified  —
TIMELINE
  Mar 25  Reserved by CNA
  Jul 1   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-341129.357.9guardianlanguage-systemCWE-78Guardian Language-System Unauthenticated OS Command Injection via id Paramete…
CVE-2026-341139.357.9guardianlanguage-systemCWE-78Guardian Language-System Unauthenticated OS Command Injection via id Paramete…
CVE-2026-341149.357.9guardianlanguage-systemCWE-78Guardian Language-System Unauthenticated OS Command Injection via id Paramete…
CVE-2026-341159.357.9guardianlanguage-systemCWE-78Guardian Language-System Unauthenticated OS Command Injection via id Paramete…
CVE-2026-341169.357.9guardianlanguage-systemCWE-78Guardian Language-System Unauthenticated OS Command Injection via id Paramete…
CVE-2026-341179.357.9guardianlanguage-systemCWE-78Guardian Language-System Unauthenticated OS Command Injection via id Paramete…
CVE-2026-201917.557.3CiscoCisco Catalyst CenterCWE-22Cisco Catalyst Center Arbitrary File Read Vulnerability
CVE-2026-137317.256.6quantumcloudWPBot – AI ChatBot for Live Support, Lead Generation, AI ServicesCWE-79WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversatio…
CVE-2026-543997.556.1Apache Software FoundationApache HttpComponents CoreCWE-400Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Conf…
CVE-2026-544287.556.1Apache Software FoundationApache HttpComponents CoreCWE-400Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SE…
CVE-2026-575168.655.7Anyscale, IncRayCWE-502Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
CVE-2026-78297.255.5uvncUltraVNCCWE-787UltraVNC repeater authenticated out-of-bounds write in rule parser via oversi…
CVE-2026-584547.754.9JAIOTlinkC492A-W6 Wi-Fi IP CameraCWE-94JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint
CVE-2026-242709.854.3NVIDIAAIStore frameworkCWE-290NVIDIA AIStore framework contains a vulnerability where an attacker could byp…
CVE-2026-521869.852.8n/an/aCWE-89SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows…
CVE-2026-60709.152.6cmsjunkieWP-BusinessDirectory – Business directory plugin for WordPressCWE-73WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via P…
CVE-2026-78317.651.8uvncUltraVNCCWE-193UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing
CVE-2026-142657.751.4AWSAWS Advanced JDBC WrapperCWE-502RCE via Deserialization in AWS Advanced JDBC Wrapper
CVE-2026-242647.551.2NVIDIATriton Inference ServerCWE-409NVIDIA Triton Inference Server for Linux contains a vulnerability where an at…
CVE-2026-113879.850.8cozyvision1SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart RecoveryCWE-287SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Passw…
CVE-2026-144399.450.8AltiumAltium Enterprise ServerCWE-22Path Traversal in Altium Git Service Allows Remote Code Execution
CVE-2025-156469.849.3BPSHTML::GumboCWE-125HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confu…
CVE-2026-242667.549.1NVIDIATriton Inference ServerCWE-416NVIDIA Triton Inference Server for Linux contains a vulnerability where an at…
CVE-2026-78399.148.6uvncUltraVNCCWE-798UltraVNC repeater ships hardcoded default admin password allowing unauthentic…
CVE-2026-340999.347.4guardianlanguage-systemCWE-89Guardian Language-System Unauthenticated SQL Injection via id Parameter in jo…
CVE-2026-521907.547.4n/an/aCWE-121Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allo…
CVE-2026-118837.246.9UnknownWebAuthn Provider for Two Factor—WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass
CVE-2026-121275.345.8smubWPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & MoreCWE-93WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthentica…
CVE-2026-551537.145.4swaldmanmchange-commons-javaCWE-470mchange-commons-java contains elements susceptible to abuse via JNDI injectio…
CVE-2026-134687.545.4themeisleVisualizer – Tables & Charts Manager with Built-in AI GeneratorCWE-862Visualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Info…
CVE-2026-132288.844.9latepointLatePoint – Calendar Booking Plugin for Appointments and EventsCWE-269LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administ…
CVE-2026-202137.544.7CiscoCisco Secure EndpointCWE-120ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CVE-2026-202147.544.7CiscoCisco Secure EndpointCWE-120ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CVE-2026-202157.544.8CiscoCisco Secure EndpointCWE-120ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability
CVE-2026-202167.544.8CiscoCisco Secure EndpointCWE-770ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability
CVE-2026-202177.544.8CiscoCisco Secure EndpointCWE-120ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerab…
CVE-2026-202437.544.8CiscoCisco Secure EndpointCWE-120ClamAV ALZ Archive Processing Denial of Service Vulnerability
CVE-2026-202447.544.7CiscoCisco Secure EndpointCWE-120ClamAV DMG File Processing Denial of Service Vulnerability
CVE-2026-584517.144.3hordeimpCWE-22Horde IMP < 7.0.1 Path Traversal via Compose.php img src
CVE-2026-51368.843.8Red HatRed Hat Satellite 6.16 for RHEL 8CWE-266Foreman: foreman: privilege escalation to administrator-level access via user…
CVE-2026-121106.543.6taskbuilderTaskbuilder – Project Management & Task Management Tool With Kanban BoardCWE-89Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_se…
CVE-2026-549086.343.1piondtlsCWE-125Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK Serv…
CVE-2026-120906.542.8taskbuilderTaskbuilder – Project Management & Task Management Tool With Kanban BoardCWE-89Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_pr…
CVE-2026-83872.442.8allegroaiallegroai/clearmlCWE-23Relative Path Traversal in allegroai/clearml
CVE-2026-558866.342.7xdanjoditCWE-1321Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()
CVE-2026-585928.942.5LadybirdBrowserLadybirdCWE-787Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference i…
CVE-2026-121427.242.3webawaysNEX-Forms – Ultimate Forms Plugin for WordPressCWE-79NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]…
CVE-2026-576929.842.1LCwebPrivateContentCWE-266WordPress PrivateContent plugin <= 9.9.2 - Privilege Escalation vulnerability
CVE-2026-143636.942.0The Wikimedia FoundationMediawiki - Cargo ExtensionCWE-89Cargo Extension: SQLi in Special:Drilldown
CVE-2026-539065.141.8MyComplianceOfficeMCOCWE-22Path Disclosure and Path Traversal in MCO
CVE-2026-141989.141.6@fastify/middie@fastify/middieCWE-436@fastify/middie vulnerable to authorization bypass via encoded slash in path …
CVE-2026-129237.541.6emarket-designVideo Gallery – YouTube Gallery, Playlist & Video GridCWE-98Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call …
CVE-2026-560165.941.4MARKSTOSCGI::Session::ID::md5CWE-338CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable sess…
CVE-2026-144059.640.7GoogleChromeCWE-457Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a rem…
CVE-2026-580255.940.7Wikimedia FoundationMediaWikiCWE-94Remote Code Execution via Unsafe Deserialization in LogItem Import
CVE-2026-141817.540.5@fastify/middie@fastify/middieCWE-248@fastify/middie standalone engine vulnerable to Denial of Service via malform…
CVE-2026-561494.940.5ElasticElasticsearchCWE-770Allocation of Resources Without Limits or Throttling in Elasticsearch Leading…
CVE-2026-341009.340.3guardianlanguage-systemCWE-89Guardian Language-System SQL Injection via id Parameter in media.php
CVE-2026-341019.340.3guardianlanguage-systemCWE-89Guardian Language-System SQL Injection via id Parameter in text_file.php
CVE-2026-341029.340.3guardianlanguage-systemCWE-89Guardian Language-System SQL Injection via id Parameter in job_info_get.php
CVE-2026-341039.340.3guardianlanguage-systemCWE-89Guardian Language-System SQL Injection via id Parameter in subtitles.php
CVE-2026-341049.340.3guardianlanguage-systemCWE-89Guardian Language-System SQL Injection via name Parameter in designer.php
CVE-2026-341059.340.3guardianlanguage-systemCWE-89Guardian Language-System SQL Injection via id Parameter in translate_text.php
CVE-2026-440423.740.0uvncUltraVNCCWE-193UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check
CVE-2026-369127.539.8n/an/aCWE-476A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function o…
CVE-2026-388917.539.8n/an/aCWE-20An improper input validation in the gazebo_ros_diff_drive.cpp component of ga…
CVE-2026-12397.539.5kstoverNinja Forms – The Contact Form Builder That Grows With YouCWE-862Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive In…
CVE-2026-137060.039.2Wikimedia FoundationUrlShortenerCWE-20UrlShortener extension url validation can be bypassed due to difference betwe…
CVE-2026-561507.539.0ElasticFleet ServerCWE-770Allocation of Resources Without Limits or Throttling in Fleet Server Leading …
CVE-2026-585216.938.9The Wikimedia FoundationMediawiki - Cargo ExtensionCWE-89SQLi in Cargo extension via year range filter
CVE-2026-119886.538.9thimpressLearnPress – WordPress LMS Plugin for Create and Sell Online CoursesCWE-639LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Su…
CVE-2026-129024.338.7stellarwpKadence Blocks — Page Builder Toolkit for Gutenberg EditorCWE-862Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor…
CVE-2026-490876.538.7ElasticKibanaCWE-770Allocation of Resources Without Limits or Throttling in Kibana Leading to Den…
CVE-2026-561486.538.7ElasticElasticsearchCWE-674Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVE-2026-561516.538.7ElasticKibanaCWE-20Improper Input Validation in Kibana Leading to Denial of Service
CVE-2026-125797.438.2deltawwAS228TCWE-288AS228T - Authentication Bypass Vulnerability
CVE-2026-557916.938.1craftcmscmsCWE-79Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Pois…
CVE-2026-118237.538.1Repute InfosystemsBookingPress Appointment Booking ProCWE-89BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection…
CVE-2026-547566.338.0xdanjoditCWE-1321Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge
CVE-2026-115687.537.9UnknownProduct Configurator for WooCommerce—Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft …
CVE-2026-557907.438.0craftcmscmsCWE-79Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
CVE-2026-125757.537.9deltawwDVP80ES3CWE-404DVP80ES3 Improper Resource Shutdown or Release Vulnerability
CVE-2026-141937.537.9deltawwDVP80ES300TCWE-129DVP80ES300T - Improper Validation of Array Index Vulnerability
CVE-2026-505218.337.7MicrosoftMicrosoft Edge (Chromium-based)CWE-416Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-242608.537.6NVIDIAContainer ToolkitCWE-367NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker…
CVE-2026-144318.837.3GoogleChromeCWE-843Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote…
CVE-2026-134546.537.3jetmonstersMotoPress Appointment BookingCWE-89MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection…
CVE-2026-129044.337.3stellarwpKadence Blocks — Page Builder Toolkit for Gutenberg EditorCWE-639Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (…
CVE-2026-51426.536.9Red HatRed Hat Satellite 6.16 for RHEL 8CWE-639Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scopin…
CVE-2026-122248.836.6wedevsDokan ProCWE-269Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_…
CVE-2026-519466.536.6n/an/aCWE-89SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) al…
CVE-2026-141917.836.3RARLABWinRARCWE-129WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVol…
CVE-2026-143838.836.1GoogleChromeCWE-94Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 al…
CVE-2026-144078.836.1GoogleChromeCWE-94Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 al…
CVE-2026-121334.336.0beardevJoomSport – for Sports: Team & League, Football, Hockey & moreCWE-862JoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arb…
CVE-2026-242407.835.7NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-242437.835.7NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-242447.835.7NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-242457.835.7NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-242467.835.7NVIDIAMegatron-BridgeCWE-470NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-242477.835.7NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-51356.535.7Red HatRed Hat Satellite 6.16 for RHEL 8CWE-639Foreman: foreman: unauthorized modification of host configurations via broken…
CVE-2026-107508.135.6UnknownRoyal MCP—Royal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools
CVE-2026-125778.735.4deltawwDVP80ES3CWE-358DVP80ES3 Improperly Implemented Security Check for Standard vulnerability
CVE-2026-28918.235.4HP IncCCXCWE-400Poly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service
CVE-2026-75177.235.5dhruvinCustom Payment Gateways for WooCommerceCWE-79Custom Payment Gateways for WooCommerce <= 2.1.0 - Unauthenticated Stored Cro…
CVE-2026-143405.335.4GitHubEnterprise ServerCWE-863An incorrect authorization vulnerability in GitHub Enterprise Server allows i…
CVE-2026-105399.535.1BMCControl-M/ServerCWE-305Unauthenticated command injection in Control-M/Server communication command
CVE-2026-124084.335.0rilwisSlim SEO – A Fast & Automated SEO Plugin For WordPressCWE-200Slim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization t…
CVE-2026-533559.834.9LinuxLinuxCWE-476net: rds: clear i_sends on setup unwind
CVE-2026-490906.534.8ElasticElasticsearchCWE-400Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
CVE-2026-91076.434.6wpchillKali Forms — Contact Form & Drag-and-Drop BuilderCWE-79Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripti…
CVE-2026-100956.434.6opajaapWP Photo Album PlusCWE-79WP Photo Album Plus <= 9.1.13.005 - Authenticated (Contributor+) Stored Cross…
CVE-2026-132466.434.6stellarwpGiveWP – Donation Plugin and Fundraising PlatformCWE-79GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'b…
CVE-2026-105388.934.5BMCControl-M/Enterprise ManagerCWE-502Improper deserialization handling in Control-M Components
CVE-2026-143938.834.1GoogleChromeCWE-416Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote…
CVE-2026-143958.834.1GoogleChromeCWE-787Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a r…
CVE-2026-144038.834.1GoogleChromeCWE-416Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote…
CVE-2026-144308.834.1GoogleChromeCWE-190Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remo…
CVE-2026-144328.834.1GoogleChromeCWE-416Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote…
CVE-2026-440416.534.1uvncUltraVNCCWE-125UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NU…
CVE-2026-580335.334.1Wikimedia FoundationMediaWikiCWE-200"Total number of distinct authors" statistic at action=info does not exclude …
CVE-2026-557948.734.0craftcmscmsCWE-94Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
CVE-2026-557935.934.0craftcmscmsCWE-79Craft CMS: Stored XSS via Structure entry title in table view
CVE-2026-539035.333.5MyComplianceOfficeMCOCWE-639Insecure Direct Object Reference in MCO
CVE-2026-136039.033.4pretixpretix-oppwaCWE-20SSRF with API key leak in pretix-oppwa
CVE-2026-242507.833.4NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-242517.833.4NVIDIAMegatron-BridgeCWE-502NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-556614.833.4tinacmstinacmsCWE-79TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, al…
CVE-2026-502806.033.3craftcmscmsCWE-284Craft CMS: Authorization bypass in `entries/move-to-section` via missing targ…
CVE-2026-124354.333.2stylemixMotors – Car Dealership & Classified Listings PluginCWE-862Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbi…
CVE-2026-143858.832.9GoogleChromeCWE-122Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 …
CVE-2026-555945.332.9ImageMagickImageMagickCWE-400ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
CVE-2026-440406.532.5uvncUltraVNCCWE-338UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authenticatio…
CVE-2026-557926.032.5craftcmscmsCWE-200Craft CMS: Sensitive File Disclosure / Server-Side File Read
CVE-2026-539095.332.3MyComplianceOfficeMCOCWE-434Arbitrary File Upload in MCO
CVE-2026-502847.131.5craftcmscmsCWE-862Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFo…
CVE-2026-121134.331.5codepeopleAppointment Booking CalendarCWE-862Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticat…
CVE-2026-50514.431.1HashiCorpVaultCWE-22Audit Log Plugin Directory Guard Bypass via Legacy path Option
CVE-2026-136027.730.9pretixpretixCWE-20Session takeover vulnerability
CVE-2026-51384.330.7Red HatRed Hat Satellite 6.16 for RHEL 8CWE-639Foreman: foreman: information disclosure via improper validation of nested re…
CVE-2026-547046.530.7open-telemetryopentelemetry-java-instrumentationCWE-532OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-T…
CVE-2026-144239.630.4GoogleChromeCWE-843Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remo…
CVE-2026-117948.130.1UnknownAdvanced Form Integration — Connect Forms to 200+ Apps—Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via …
CVE-2026-534666.530.0ImageMagickImageMagickCWE-190ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion o…
CVE-2026-542602.730.0wagtailwagtailCWE-400Wagtail: Denial of service via unbounded filter specs in the image preview
CVE-2026-144228.829.8GoogleChromeCWE-125Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 …
CVE-2026-580275.329.8Wikimedia FoundationAbuseFilterCWE-200QueryAbuseFilter API can be used to see the hit count of private filters, whi…
CVE-2026-580245.129.6Wikimedia FoundationMediaWikiCWE-200API identification of users on private wikis
CVE-2026-580260.029.6Wikimedia FoundationMediaWikiCWE-200$wgNonincludableNamespaces can be bypassed by embedding redirect in other nam…
CVE-2026-127546.129.5e4jvikwpVikBooking Hotel Booking Engine & PMSCWE-79VikBooking Hotel Booking Engine & PMS <= 1.8.12 - Reflected Cross-Site Script…
CVE-2026-130156.129.5jgwhite33WP Google Review SliderCWE-79WP Google Review Slider <= 18.1 - Reflected Cross-Site Scripting via 'place' …
CVE-2025-233509.029.3NVIDIABlueField GACWE-787NVIDIA ConnectX and BlueField contain a vulnerability in the command interfac…
CVE-2025-233519.029.3NVIDIABlueField GACWE-787NVIDIA ConnectX and BlueField contain a vulnerability in the command interfac…
CVE-2026-547862.329.4bytecodealliancewasmtimeCWE-400Wasmtime: Leak in WASIp1 `fd_renumber` implementation
CVE-2026-555775.929.2ImageMagickImageMagickCWE-754ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder
CVE-2026-502797.629.1craftcmscmsCWE-285Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mut…
CVE-2026-502835.329.1craftcmscmsCWE-639Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
CVE-2026-144097.528.9GoogleChromeCWE-693Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 al…
CVE-2026-144267.528.9GoogleChromeCWE-416Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote…
CVE-2026-539086.928.8MyComplianceOfficeMCOCWE-204User Enumeration in MCO
CVE-2026-134436.428.4themeumTutor LMS – eLearning and online course solutionCWE-79Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via…
CVE-2026-137336.428.4codename065Download ManagerCWE-79Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site S…
CVE-2026-580295.327.7Wikimedia FoundationMediaWikiCWE-287Full Account Takeover from BotPasswords and OAuth via action=changeauthentica…
CVE-2026-121356.427.5foliovisionFV Flowplayer Video PlayerCWE-79FV Flowplayer Video Player <= 7.5.51.7212 - Authenticated (Contributor+) Stor…
CVE-2026-66877.627.4ChaNFatFsCWE-121FatFs Stack Buffer Overflow via Uncapped exFAT Label Length
CVE-2026-534928.427.3containerdcontainerdCWE-20containerd CRI checkpoint restore CDI annotation smuggling
CVE-2026-143996.527.2GoogleChromeCWE-457Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a r…
CVE-2026-144026.527.2GoogleChromeCWE-457Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46…
CVE-2026-144086.527.2GoogleChromeCWE-457Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a r…
CVE-2026-144216.527.2GoogleChromeCWE-457Uninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46…
CVE-2026-143829.627.1GoogleChromeCWE-20Insufficient validation of untrusted input in ANGLE in Google Chrome prior to…
CVE-2026-143879.627.1GoogleChromeCWE-472Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a re…
CVE-2026-143909.627.1GoogleChromeCWE-416Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a rem…
CVE-2026-143929.627.1GoogleChromeCWE-787Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a…
CVE-2026-143979.627.1GoogleChromeCWE-787Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 a…
CVE-2026-143989.627.1GoogleChromeCWE-416Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a rem…
CVE-2026-144119.627.1GoogleChromeCWE-20Insufficient validation of untrusted input in ANGLE in Google Chrome prior to…
CVE-2026-144169.627.0GoogleChromeCWE-125Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a …
CVE-2026-144179.627.0GoogleChromeCWE-416Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remo…
CVE-2026-144199.627.0GoogleChromeCWE-416Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remo…
CVE-2026-144209.627.0GoogleChromeCWE-125Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 …
CVE-2026-144249.627.0GoogleChromeCWE-416Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed…
CVE-2026-144259.627.0GoogleChromeCWE-416Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a rem…
CVE-2026-143948.827.1GoogleChromeCWE-416Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote…
CVE-2026-144158.827.1GoogleChromeCWE-122Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 al…
CVE-2026-137070.026.9Wikimedia FoundationOAuthCWE-384Session fixation attacks on improperly configured OAuth 1.0a tools
CVE-2026-539027.126.8MyComplianceOfficeMCOCWE-266Privilege Escalation in MCO
CVE-2026-539046.326.7MyComplianceOfficeMCOCWE-307Account Denial of Service in MCO
CVE-2026-542616.526.5wagtailwagtailCWE-280Wagtail: Improper permission handling in image preview
CVE-2026-541646.526.0api-platformcoreCWE-843API Platform Core: Missing IRI type check enables resource type confusion
CVE-2026-100964.326.0qodeinteractiveQi BlocksCWE-639Qi Blocks <= 1.4.9 - Insecure Direct Object Reference to Authenticated (Autho…
CVE-2026-51208.125.8Dassault SystèmesBIOVIA WorkbookCWE-362Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 thro…
CVE-2026-133238.725.4Eclipse FoundationEclipse Open VSXCWE-79In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-su…
CVE-2026-144138.325.5GoogleChromeCWE-457Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a …
CVE-2026-127326.425.5thimpressLearnPress – WordPress LMS Plugin for Create and Sell Online CoursesCWE-79LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scriptin…
CVE-2026-534675.325.3ImageMagickImageMagickCWE-200ImageMagick: Information Disclosure in MNG decoder because allocated memory i…
CVE-2026-556884.025.3AsyncHttpClientasync-http-clientCWE-1275AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via T…
CVE-2026-204587.525.2MediaTek, Inc.MediaTek chipsetCWE-787In Modem, there is a possible memory corruption due to a missing bounds check…
CVE-2026-585176.925.3The Wikimedia FoundationMediawiki - WikiLambda ExtensionCWE-288Blocked users can create and edit WikiLambda objects
CVE-2026-577204.325.3Codexpert IncThumbPressCWE-862WordPress ThumbPress plugin <= 6.3.2 - Broken Access Control vulnerability
CVE-2026-144278.325.2GoogleChromeCWE-122Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed …
CVE-2026-144018.324.7GoogleChromeCWE-20Insufficient validation of untrusted input in ANGLE in Google Chrome on Andro…
CVE-2026-144128.324.7GoogleChromeCWE-20Insufficient validation of untrusted input in ANGLE in Google Chrome prior to…
CVE-2026-144288.324.7GoogleChromeCWE-20Insufficient validation of untrusted input in Dawn in Google Chrome on Androi…
CVE-2026-144298.324.7GoogleChromeCWE-20Insufficient validation of untrusted input in Skia in Google Chrome prior to …
CVE-2026-490884.424.6ElasticKibanaCWE-532Insertion of Sensitive Information into Log File in Kibana Leading to Informa…
CVE-2026-66827.624.5ChaNFatFsCWE-190FatFs Integer Overflow in FAT32 Volume Mount
CVE-2026-66887.624.5ChaNFatFsCWE-120FatFs Buffer Overflow via Unbounded LFN Filename Copy
CVE-2026-274095.324.2Webba PluginsWebba BookingCWE-862WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability
CVE-2026-580362.124.2Wikimedia FoundationMediaWikiCWE-200Users API leaks whether privileged users have their user groups disabled for …
CVE-2026-121588.823.9metagaussRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User LoginCWE-352RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escala…
CVE-2026-143846.524.0GoogleChromeCWE-125Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.4…
CVE-2026-143866.524.0GoogleChromeCWE-125Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a…
CVE-2026-143886.524.0GoogleChromeCWE-125Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a…
CVE-2026-143966.524.0GoogleChromeCWE-125Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a…
CVE-2026-490918.023.9ElasticKibanaCWE-116Improper Output Neutralization for Logs in Kibana Leading to Log Injection
CVE-2026-539055.323.9MyComplianceOfficeMCOCWE-863Unauthorized Access to Administrator ACL View in MCO
CVE-2026-498585.923.6api-platformcoreCWE-524API Platform Core: Cross-user attribute leak in JSON:API and HAL item normali…
CVE-2026-66834.622.6ChaNFatFsCWE-369FatFs Divide-by-Zero in exFAT Sync
CVE-2026-66844.622.6ChaNFatFsCWE-835FatFs Infinite Loop in GPT Partition Scan
CVE-2026-561525.322.6ElasticElastic DefendCWE-863Incorrect Authorization in Elastic Defend Leading to Information Disclosure
CVE-2026-143898.322.4GoogleChromeCWE-472Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a re…
CVE-2026-144008.322.4GoogleChromeCWE-787Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed …
CVE-2026-501955.622.4containerdcontainerdCWE-345containerd: CRI checkpoint import allows local image tag poisoning
CVE-2026-144145.322.2GoogleChromeCWE-20Insufficient validation of untrusted input in Skia in Google Chrome prior to …
CVE-2026-582637.222.0xdanjoditCWE-79Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext car…
CVE-2026-580325.321.9Wikimedia FoundationMediaWikiCWE-79mw.Api.getErrorMessage() may return injected HTML if used without errorformat…
CVE-2026-143586.921.8The Wikimedia FoundationMediawiki - Charts ExtensionCWE-79Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
CVE-2026-274355.321.4WofficeIOWofficeCWE-862WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability
CVE-2026-577215.321.4WP ReloadedApplyOnlineCWE-862WordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability
CVE-2026-585938.720.9NodeBBNodeBBCWE-290NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to L…
CVE-2026-580340.020.6Wikimedia FoundationCheckUserCWE-79Stored XSS through a system message when blocking a temporary account that's …
CVE-2026-580350.020.6Wikimedia FoundationMediaWikiCWE-79Stored XSS through a system message in the codex version of Special:Block
CVE-2026-204575.320.5MediaTek, Inc.MediaTek chipsetCWE-476In Modem, there is a possible system crash due to improper input validation. …
CVE-2026-78307.420.4uvncUltraVNCCWE-326UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabli…
CVE-2026-577367.420.3HubSpotHubSpotCWE-201WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability
CVE-2026-118874.320.3UnknownSalon Booking System—Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass
CVE-2026-143915.320.2GoogleChromeCWE-190Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 …
CVE-2026-204615.320.2MediaTek, Inc.MediaTek chipsetCWE-787In Modem, there is a possible out of bounds write due to a missing bounds che…
CVE-2026-585206.920.2The Wikimedia FoundationMediawiki - UrlShortener ExtensionCWE-601UrlShortener defaults to ineffective validation open to third-party redirects
CVE-2026-144184.320.2GoogleChromeCWE-457Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a …
CVE-2026-556607.619.8tinacmstinacmsCWE-79TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization byp…
CVE-2026-580380.019.2Wikimedia FoundationtimelineCWE-79Stored XSS through javascript URLs in SVGs generated by EasyTimeline
CVE-2026-580305.318.7Wikimedia FoundationSyntaxHighlight_GeSHiCWE-79SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
CVE-2026-542594.318.7wagtailwagtailCWE-280Wagtail: Improper restriction handling on Documents and Images chosen endpoints
CVE-2026-542624.318.7wagtailwagtailCWE-280Wagtail: Pages translations can be created without page permissions when usin…
CVE-2026-580370.018.7Wikimedia FoundationMediaWikiCWE-79Core log entries for exceptions and XSS issues in log entry formatting code t…
CVE-2026-580280.018.4Wikimedia FoundationMediaWikiCWE-79Pretty-printed API output combined with centralauthtoken allows XSS with cert…
CVE-2026-580310.018.4Wikimedia FoundationMediaWikiCWE-79Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected
CVE-2026-142586.518.0Red HatRed Hat Enterprise Linux 10CWE-835Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd o…
CVE-2026-144046.518.1GoogleChromeCWE-451Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.4…
CVE-2026-472625.317.9containerdcontainerdCWE-400containerd image-triggered runtime DoS via unbounded group parsing
CVE-2026-204595.317.9MediaTek, Inc.MediaTek chipsetCWE-288In Modem, there is a possible system crash due to improper input validation. …
CVE-2026-204605.317.9MediaTek, Inc.MediaTek chipsetCWE-288In Modem, there is a possible information disclosure due to improper input va…
CVE-2026-547127.517.7open-telemetryopentelemetry-java-instrumentationCWE-400OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
CVE-2026-547205.417.7silverstripesilverstripe-frameworkCWE-79Silverstripe Framework: Possible XSS attack through media embed
CVE-2026-23876.417.4stephenharrisEvent OrganiserCWE-79Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Sc…
CVE-2026-113806.417.4jetmonstersJetWidgets For ElementorCWE-79JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Sit…
CVE-2026-143816.516.9GoogleChromeCWE-290Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.…
CVE-2026-66864.616.7ChaNFatFsCWE-908FatFs Use of Uninitialized Clusters After Seek Past EOF
CVE-2026-115624.316.6UnknownWS Form LITE—WS Form LITE < 1.11.8 - Subscriber+ Arbitrary Settings Update
CVE-2026-540747.816.2tinacmstinacmsCWE-94@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TI…
CVE-2026-52206.415.7DivvyDrive Information Technologies Inc.DivvyDriveCWE-79Stored XSS in DivvyDrive Information Technologies' DivvyDrive
CVE-2026-144104.315.4GoogleChromeCWE-451Inappropriate implementation in Skia in Google Chrome prior to 150.0.7871.46 …
CVE-2026-242487.815.0NVIDIAMegatron-BridgeCWE-94NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-539074.815.0MyComplianceOfficeMCOCWE-79Stored Cross‑Site Scripting in MCO
CVE-2026-144065.914.8GoogleChromeCWE-125Out of bounds read in V8 in Google Chrome prior to 150.0.7871.46 allowed an a…
CVE-2026-577225.914.9ShortPixelEnable Media ReplaceCWE-79WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) v…
CVE-2026-340964.814.2guardianlanguage-systemCWE-79Guardian Language-System XSS via name Parameter in designer.php
CVE-2026-340974.814.2guardianlanguage-systemCWE-79Guardian Language-System XSS via id Parameter in text_file.php
CVE-2026-340984.814.2guardianlanguage-systemCWE-79Guardian Language-System XSS via id Parameter in media.php
CVE-2026-119814.313.5stellarwpGiveWP – Donation Plugin and Fundraising PlatformCWE-352GiveWP <= 4.15.3 - Cross-Site Request Forgery
CVE-2026-242497.813.2NVIDIAMegatron-BridgeCWE-94NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-585196.913.2The Wikimedia FoundationMediawiki - Cargo ExtensionCWE-79Stored XSS through Cargo's map format
CVE-2026-125767.513.1deltawwDVP80ES3CWE-924DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a C…
CVE-2026-62835.413.1DivvyDrive Information Technologies Inc.DivvyDriveCWE-79Stored XSS in DivvyDrive Information Technologies' DivvyDrive
CVE-2026-577376.512.9Averta LTDShortcodes and extra features for Phlox themeCWE-79WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.16 - C…
CVE-2026-579625.312.3MozillaThunderbirdCWE-400Denial-of-service via malicious LDAP address-book server
CVE-2026-115704.212.1UnknownUser Submitted Posts—User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name
CVE-2026-132114.311.9genuagenucenterCWE-201Genucenter Disclosure of SNMP Credentials
CVE-2026-118803.111.0UnknownFluent Forms—Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR
CVE-2026-542637.310.2wagtailwagtailCWE-79Wagtail: Reflected XSS in dynamic image URL generator view
CVE-2026-144407.69.6CloudflareUniversal SSLCWE-693Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-…
CVE-2026-579636.58.8MozillaThunderbirdCWE-79Chat UI manipulation by injection
CVE-2026-242427.88.7NVIDIAMegatron-BridgeCWE-918NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker c…
CVE-2026-415793.38.2opencontainersruncCWE-61runc: Malicious image with /dev symlink can trigger limited host filesystem i…
CVE-2026-143246.57.0Red HatRed Hat Enterprise Linux 10CWE-476Pipewire: raop rtsp null deref
CVE-2026-124805.57.0keras-teamkeras-team/kerasCWE-73Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras
CVE-2026-534898.26.9containerdcontainerdCWE-61containerd: Arbitrary host CRI log file read via symlink following in CRI che…
CVE-2026-577237.46.9e4jvikwpVikBooking Hotel Booking Engine & PMSCWE-352WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Ar…
CVE-2025-156661.96.5Open Asset Import LibraryAssimpCWE-119Open Asset Import Library Assimp Model File SceneCombiner.cpp Copy heap-based…
CVE-2026-533345.56.4LinuxLinuxCWE-476mm/damon/reclaim: handle ctx allocation failure
CVE-2026-533355.56.4LinuxLinuxCWE-476mm/damon/lru_sort: handle ctx allocation failure
CVE-2026-411217.86.3DellDevice Management AgentCWE-59Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improp…
CVE-2026-533467.16.0LinuxLinuxCWE-125rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
CVE-2026-533307.15.8LinuxLinuxCWE-125drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
CVE-2026-137696.85.8AWSAWS CLICWE-732Overly permissive File Permissions in AWS CLI
CVE-2026-534889.45.7containerdcontainerdCWE-20containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binar…
CVE-2026-466807.35.7containerdcontainerdCWE-269containerd user ID handling bypass allows runAsNonRoot evasion
CVE-2026-533285.55.5LinuxLinux—sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
CVE-2026-533315.55.6LinuxLinux—slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
CVE-2026-533365.55.6LinuxLinux—nvmem: layouts: onie-tlv: fix hang on unknown types
CVE-2026-533375.55.6LinuxLinuxCWE-476net: bonding: fix NULL pointer dereference in bond_do_ioctl()
CVE-2026-533395.55.6LinuxLinuxCWE-476i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
CVE-2026-533435.55.6LinuxLinux—ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
CVE-2026-533455.55.5LinuxLinuxCWE-401KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
CVE-2026-533475.55.5LinuxLinuxCWE-908drm/virtio: Fix driver removal with disabled KMS
CVE-2026-533495.55.6LinuxLinux—netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
CVE-2026-533505.55.6LinuxLinuxCWE-476ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
CVE-2026-533535.55.6LinuxLinux—hsr: Remove WARN_ONCE() in hsr_addr_is_self().
CVE-2026-204636.75.5MediaTek, Inc.MediaTek chipsetCWE-280In Modem, there is a possible escalation of privilege due to a permissions by…
CVE-2026-369096.25.4n/an/aCWE-476A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Alek…
CVE-2026-533335.55.4LinuxLinux—mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
CVE-2026-533385.55.4LinuxLinuxCWE-476net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_…
CVE-2026-533405.55.4LinuxLinux—i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
CVE-2026-533425.55.4LinuxLinux—arm64: mm: call pagetable dtor when freeing hot-removed page tables
CVE-2026-204626.75.3MediaTek, Inc.MediaTek chipsetCWE-122In Telephony, there is a possible memory corruption due to a heap buffer over…
CVE-2026-369105.54.5n/an/aCWE-119An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MP…
CVE-2026-369115.54.2n/an/aCWE-369A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBuffe…
CVE-2026-555105.54.2ImageMagickImageMagickCWE-416ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
CVE-2026-555975.54.2ImageMagickImageMagickCWE-682ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect hand…
CVE-2026-533445.53.8LinuxLinuxCWE-908pinctrl: mcp23s08: Initialize mcp->dev and mcp->addr before regmap init
CVE-2026-533485.53.8LinuxLinuxCWE-476ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions
CVE-2026-533515.53.8LinuxLinux—riscv/ptrace: Use USER_REGSET_NOTE_TYPE for REGSET_CFI
CVE-2026-533297.03.7LinuxLinuxCWE-674drm/amd/display: Use krealloc_array() in dal_vector_reserve()
CVE-2026-533548.82.8LinuxLinux—arm64: errata: Mitigate TLBI errata on various Arm CPUs
CVE-2026-585186.92.8The Wikimedia FoundationMediawiki - RedirectManager ExtensionCWE-352Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation M…
CVE-2026-533275.52.8LinuxLinux—debugobjects: Do not fill_pool() if pi_blocked_on
CVE-2026-533325.52.8LinuxLinux—slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
CVE-2026-533567.82.6LinuxLinux—drm/i915/gem: Fix phys BO pread/pwrite with offset
CVE-2026-533417.82.5LinuxLinuxCWE-416fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
CVE-2026-84804.32.5StormshieldStormshield Network SecurityCWE-295Connection possible to the Administration portal with a revoked certificate
CVE-2026-533265.52.5LinuxLinuxCWE-667debugobjects: Don't call fill_pool() in early boot hardirq context
CVE-2026-555954.72.3ImageMagickImageMagickCWE-400ImageMagick: Infinite Loop in connected-components when providing invalid arg…
CVE-2026-533524.71.4LinuxLinuxCWE-362signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
CVE-2026-105405.61.2BMCControl-M/Enterprise ManagerCWE-328Weak password hash protection in Control-M/Entreprise Manager
CVE-2026-143305.50.9Red HatRed Hat Enterprise Linux 10CWE-770Pipewire: pulse server alloca stack overflow
CVE-2026-556285.50.9ImageMagickImageMagickCWE-73ImageMagick: Policy Bypass in concatenate operation due to missing checks
CVE-2026-123746.40.1Cato NetworksSDP ClientCWE-295Improper XPC caller certificate validation and TOCTOU race condition in macOS…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-01 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.