Security Box Score — July 3, 2026

180 CVEs published, led by Microsoft (43).

180 CVEs published July 3, 2026: 25 critical, 77 high, 70 medium, 8 low; 0 in the KEV catalog at press time; 19 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 155 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	810	13213	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

571 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	33	1513	120	862	530	1	11	2	0.1	7.5	.0014	0
google	52	1317	148	590	542	37	77	6	0.5	7.8	.0024	-9 ▼
microsoft	50	807	61	552	188	6	286	20	2.5	7.8	.0046	+49 ▲
red hat	15	237	12	93	118	14	2	0	0.0	6.5	.0030	+10 ▲
apple	0	104	2	28	72	2	88	7	6.7	6.5	.0032	0
canonical	0	20	2	5	8	5	0	0	0.0	5.5	.0011	0
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	0
suse	2	15	4	8	3	0	0	0	0.0	8.8	.0042	+2 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
ubiquiti	25	36	14	21	1	0	3	3	8.3	8.8	.0049	+25 ▲
cisco	8	30	6	14	10	0	56	11	36.7	7.5	.0057	+6 ▲
netgear	0	17	0	0	16	1	0	0	0.0	4.3	.0024	0
palo alto networks	0	11	1	2	7	1	13	2	18.2	5.9	.0022	0
checkpoint	0	9	1	5	3	0	3	1	11.1	7.5	.0410	0
fortinet	0	9	4	3	2	0	28	3	33.3	8.3	.0076	0
ivanti	0	9	4	5	0	0	25	5	55.6	8.8	.5187	-1 ▼
f5	0	8	4	3	1	0	4	1	12.5	8.9	.0225	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	5	160	24	61	64	10	33	1	0.6	7.3	.0053	-26 ▼
mozilla	2	58	12	18	28	0	9	0	0.0	7.3	.0026	-2 ▼
gitlab	0	31	0	5	21	5	4	2	6.5	4.4	.0029	0
github	1	7	1	1	5	0	0	0	0.0	6.0	.0039	+1 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	-1 ▼
drupal	0	5	1	1	3	0	4	1	20.0	5.1	.0026	0
wordpress	0	0	0	0	0	0	2	0	—	—	—	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	270	132	116	18	4	27	2	0.7	8.8	.0040	0
adobe	0	144	11	53	78	2	19	2	1.4	5.8	.0021	0
ibm	0	124	36	42	46	0	6	0	0.0	7.5	.0034	-5 ▼
progress	2	11	1	9	1	0	6	0	0.0	7.5	.0036	-3 ▼
solarwinds	0	7	2	3	2	0	10	4	57.1	7.5	.4001	-1 ▼
veeam	0	4	2	2	0	0	1	0	0.0	9.0	.0052	0
zohocorp	0	3	1	1	1	0	0	0	0.0	8.4	.0170	0
atlassian	0	0	0	0	0	0	13	0	—	—	—	0

Industrial & Embedded
Vendor	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
synology	23	2	5	13	3	0	5.6	.0025	-5 ▼
d-link	12	0	5	2	5	3	5.8	.0058	-2 ▼
siemens	9	0	4	5	0	0	6.9	.0021	-1 ▼
rockwell automation	7	1	5	1	0	0	8.7	.0030	0
abb	6	0	4	2	0	0	7.2	.0018	-4 ▼
schneider electric	6	0	4	2	0	0	7.8	.0042	0
moxa	5	0	3	2	0	0	7.0	.0029	0
dahua	3	0	1	1	1	0	6.9	.0036	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	20	76	2	34	38	2	2	1	1.3	6.7	.0018	+18 ▲
sourcecodester	2	73	0	0	36	37	0	0	0.0	2.9	.0027	-16 ▼
spring	0	73	2	31	39	1	0	0	0.0	6.5	.0024	-2 ▼
openclaw	0	67	0	35	22	10	0	0	0.0	7.0	.0021	0
edimax	0	65	0	39	0	26	1	0	0.0	7.4	.0080	0
capgo	0	61	2	31	27	1	0	0	0.0	7.1	.0039	0
themerex	2	60	5	54	1	0	0	0	0.0	8.1	.0043	+2 ▲
nvidia	17	56	11	38	7	0	0	0	0.0	7.8	.0038	+15 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-10520	.9991	100.0	10.0
CVE-2026-20253	.9694	99.9	9.8
CVE-2026-35273	.9547	99.9	9.8
CVE-2026-20230	.8820	99.8	8.6
CVE-2026-34910	.8747	99.7	10.0
CVE-2026-34908	.8519	99.7	10.0
CVE-2026-50751	.8377	99.7	9.3
CVE-2026-48907	.7810	99.5	10.0
CVE-2026-45659	.7608	99.5	8.8
CVE-2026-34909	.6390	99.2	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-10520	10.0	.9991	KEV
CVE-2026-34910	10.0	.8747	KEV
CVE-2026-34908	10.0	.8519	KEV
CVE-2026-48907	10.0	.7810	KEV
CVE-2026-34909	10.0	.6390	KEV
CVE-2026-13773	10.0	.0610
CVE-2026-56415	10.0	.0436
CVE-2026-56413	10.0	.0419
CVE-2026-53576	10.0	.0330
CVE-2026-53753	10.0	.0290

Most disclosures (vendor)
Vendor	CVEs
google	1081
linux	513
microsoft	270
oracle	242
adobe	142
red hat	138
apache	95
ibm	70
spring	70
capgo	61

Most KEV additions (YTD)
Vendor	KEV
microsoft	20
cisco	11
apple	7
google	6
ivanti	5
solarwinds	4
berriai	3
fortinet	3
smartertools	3
ubiquiti	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	39
Packagist	15
npm	6
NuGet	3
PyPI	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-10520	ivanti	0
CVE-2026-11645	Google	0
CVE-2026-12569	PTC	0
CVE-2026-20230	Cisco	0
CVE-2026-20245	Cisco	0
CVE-2026-20253	Splunk	0
CVE-2026-20262	Cisco	0
CVE-2026-28318	SolarWinds	0
CVE-2026-34908	Ubiquiti Inc	0
CVE-2026-34909	Ubiquiti Inc	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1689
CVE-2021-27102	n/a	2021-11-17	1689
CVE-2021-27101	n/a	2021-11-17	1689
CVE-2021-27103	n/a	2021-11-17	1689
CVE-2021-21017	Adobe	2021-11-17	1689
CVE-2021-28550	Adobe	2021-11-17	1689
CVE-2021-42013	Apache Software Foundation	2021-11-17	1689
CVE-2021-41773	Apache Software Foundation	2021-11-17	1689
CVE-2021-30858	Apple	2021-11-17	1689
CVE-2021-30860	Apple	2021-11-17	1689

Transactions

EXPLOIT PUBLISHED — curl: 18 CVEs (CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926, CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080, CVE-2026-9545, CVE-2026-9546, CVE-2026-9547, CVE-2026-10536, CVE-2026-11352, CVE-2026-11564, CVE-2026-11586, CVE-2026-11856, CVE-2026-12064). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2026-12481 (keras-team/keras). Public exploit reference added.

DUE DATE PASSED — CVE-2026-48558 (SimpleHelp). CISA remediation deadline was July 2, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

180 CVEs published. 25 box scores, 155 table rows — nothing truncated.

CVE-2026-20896CRITICAL

Gitea Docker image trusts spoofable reverse-proxy headers by default

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0276   85.1     —

AFFECTED
  Product                       Versions     Fixed
  Gitea Open Source Git Server  unspecified  —

TIMELINE
  Mar 3   Reserved by CNA
  Jul 3   Published (CNA: Gitea)

CWE-284 · CNA: Gitea · CVSS v3.1 · 4 references · NVD status: Deferred

CVE-2026-49814HIGH

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0200   79.2     —

AFFECTED
  Product                   Versions     Fixed
  PowerProtect Data Domain  unspecified  —

TIMELINE
  Jun 1   Reserved by CNA
  Jul 3   Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-53478HIGH

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0200   79.2     —

AFFECTED
  Product                   Versions     Fixed
  PowerProtect Data Domain  unspecified  —

TIMELINE
  Jun 9   Reserved by CNA
  Jul 3   Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-58289HIGH

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  C  H  H  H    8.3   .0199   79.1     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 29  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-843 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-26355MEDIUM

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  H    6.5   .0177   76.4     —

AFFECTED
  Product                   Versions     Fixed
  PowerProtect Data Domain  unspecified  —

TIMELINE
  Feb 13  Reserved by CNA
  Jul 3   Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-49815HIGH

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0171   75.6     —

AFFECTED
  Product                   Versions     Fixed
  PowerProtect Data Domain  unspecified  —

TIMELINE
  Jun 1   Reserved by CNA
  Jul 3   Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-27771HIGH

Gitea Composer package source links use insufficient permission checks

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  L  N    8.2   .0139   70.3     —

AFFECTED
  Product                       Versions     Fixed
  Gitea Open Source Git Server  unspecified  —

TIMELINE
  Mar 3   Reserved by CNA
  Jul 3   Published (CNA: Gitea)

CWE-862 · CNA: Gitea · CVSS v3.0 · 4 references · NVD status: Deferred

CVE-2026-9725CRITICAL

Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  H    9.1   .0117   64.9     —

AFFECTED
  Product                                                  Versions     Fixed
  Printcart Web to Print Product Designer for WooCommerce  unspecified  —

TIMELINE
  May 27  Reserved by CNA
  Jul 3   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2026-8925CRITICAL

curl curl — SASL double-free

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0108   62.5     —

AFFECTED
  Product  Versions  Fixed
  curl     8.20.0 –  —

TIMELINE
  May 19  Reserved by CNA
  Jul 3   Public exploit reference published
  Jul 3   Published (CNA: curl)

CWE-415 · CNA: curl · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-9079CRITICAL

curl curl — stale proxy password leak

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0106   62.1     —

AFFECTED
  Product  Versions  Fixed
  curl     8.20.0 –  —

TIMELINE
  May 20  Reserved by CNA
  Jul 3   Public exploit reference published
  Jul 3   Published (CNA: curl)

CWE-522 · CNA: curl · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-57991HIGH

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  N  N    7.4   .0104   61.3     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-59 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-11352HIGH

curl curl — QUIC zero-length UDP datagrams busy-loop

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0101   60.5     —

AFFECTED
  Product  Versions  Fixed
  curl     8.20.0 –  —

TIMELINE
  Jun 5   Reserved by CNA
  Jul 3   Public exploit reference published
  Jul 3   Published (CNA: curl)

CWE-835 · CNA: curl · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-58291MEDIUM

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  C  H  N  N    6.1   .0099   59.9     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 29  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-672 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-14544CRITICAL

Hplip: incomplete fix for cve-2026-8631

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0093   57.8     —

AFFECTED
  Product                      Versions     Fixed
  HPLIP                        unspecified  —
  Red Hat Enterprise Linux 10  unspecified  0:3.23.12-10.el10_2.5
  Red Hat Enterprise Linux 8   unspecified  0:3.18.4-14.el8_10
  Red Hat Enterprise Linux 9   unspecified  0:3.21.2-6.el9_8.5
  Red Hat Enterprise Linux 6   unspecified  —
  Red Hat Enterprise Linux 7   unspecified  —

TIMELINE
  Jul 3   Reserved by CNA
  Jul 3   Published (CNA: redhat)

CWE-190 · CNA: redhat · CVSS v3.1 · 5 references · NVD status: Awaiting Analysis

CVE-2026-56646MEDIUM

Microsoft Edge (Chromium-based) Spoofing Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  N  N    6.5   .0092   57.6     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-200 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-10536CRITICAL

curl curl — HTTP/2 stream-dependency tree UAF

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0089   56.7     —

AFFECTED
  Product  Versions  Fixed
  curl     8.20.0 –  —

TIMELINE
  Jun 1   Reserved by CNA
  Jul 3   Public exploit reference published
  Jul 3   Published (CNA: curl)

CWE-416 · CNA: curl · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-57993HIGH

Microsoft Edge (Chromium-based) Spoofing Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  N  H  N    7.4   .0088   56.3     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-918 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-45489MEDIUM

Microsoft Edge (Chromium-based) Spoofing Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  H  N    6.5   .0088   56.3     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  May 12  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-749 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Modified

CVE-2026-58523MEDIUM

Microsoft Edge for Android Security Feature Bypass Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  H  N    6.5   .0088   56.3     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jul 1   Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-284 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-57987MEDIUM

Microsoft Edge (Chromium-based) Spoofing Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  N  N    6.5   .0087   56.2     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-918 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-11586HIGH

curl curl — WS Auto-PONG memory exhaustion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0086   55.8     —

AFFECTED
  Product  Versions  Fixed
  curl     8.20.0 –  —

TIMELINE
  Jun 8   Reserved by CNA
  Jul 3   Public exploit reference published
  Jul 3   Published (CNA: curl)

CWE-770 · CNA: curl · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-56645HIGH

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0082   54.5     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-122 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-57974HIGH

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0082   54.5     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-190 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-57981HIGH

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0082   54.5     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Jun 26  Reserved by CNA
  Jul 3   Published (CNA: microsoft)

CWE-416 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-47896HIGH

Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   N   N    8.9   .0081   54.1     —

AFFECTED
  Product            Versions           Fixed
  Apache Lucene.Net  4.8.0-beta00005 –  —

TIMELINE
  May 20  Reserved by CNA
  Jul 3   Published (CNA: apache)

CWE-22 · CNA: apache · CVSS v4.0 · 2 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-57988	7.1	52.5	Microsoft	Microsoft Edge (Chromium-based)	CWE-23	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-47897	8.9	51.2	Apache Software Foundation	Apache Lucene.Net	CWE-22	Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.R…
CVE-2026-57985	8.8	51.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-20	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-12481	9.8	51.1	keras-team	keras-team/keras	CWE-502	Deserialization of Untrusted Data in keras-team/keras
CVE-2026-4967	7.5	50.6	Unisoc (Shanghai) Technologies Co., Ltd.	SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T8100/T9100/T8200/T8300	—	In IMS, there is a possible out of bounds read due to a missing bounds check.…
CVE-2026-58597	4.3	50.5	Microsoft	Microsoft Edge (Chromium-based)	CWE-357	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-14352	7.5	49.4	webandprint	AR for WooCommerce	CWE-22	AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File…
CVE-2026-26292	9.8	48.5	Gitea	Gitea Open Source Git Server	CWE-284	Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
CVE-2026-9546	7.5	48.5	curl	curl	—	sending old referer
CVE-2026-57983	10.0	48.3	Microsoft	Microsoft Edge (Chromium-based)	CWE-285	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2026-59234	6.9	47.9	Roskus	Prospero Flow CRM	CWE-639	Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calenda…
CVE-2026-27780	9.8	47.8	Gitea	Gitea Open Source Git Server	CWE-863	Gitea pre-receive hook can miss branch-protection checks after scanner errors
CVE-2026-56015	9.1	47.6	TPODER	Net::IP::LPM	CWE-125	Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read v…
CVE-2026-26307	7.5	47.4	Gitea	Gitea Open Source Git Server	CWE-400	Gitea git grep search lacks a timeout
CVE-2026-49813	6.7	47.2	Dell	PowerProtect Data Domain	CWE-78	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-54483	6.7	47.2	Dell	PowerProtect Data Domain	CWE-78	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release …
CVE-2026-58422	9.8	47.1	Gitea	Gitea Open Source Git Server	CWE-284	Improper authorization on OAuth sign-in callback silently re-enables administ…
CVE-2026-46464	4.9	47.0	Dell	PowerProtect Data Domain	CWE-59	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-14327	7.5	46.8	webandprint	AR for WordPress	CWE-22	AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Par…
CVE-2026-11564	9.1	46.5	curl	curl	CWE-295	Native CA trust persist
CVE-2026-58285	8.3	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-843	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-58287	8.3	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-58288	8.3	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-57975	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-843	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-57984	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-57986	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-57992	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-58276	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-58293	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-73	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-58294	7.5	46.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-416	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-11856	9.8	46.2	curl	curl	CWE-294	cross-origin Digest auth state leak
CVE-2026-27779	7.5	45.2	Gitea	Gitea Open Source Git Server	CWE-284	Gitea forwarded-proto handling allows public URL spoofing
CVE-2026-58421	7.5	45.2	Gitea	Gitea Open Source Git Server	CWE-284	Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
CVE-2026-57977	7.1	44.9	Microsoft	Microsoft Edge (Chromium-based)	CWE-79	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-20706	9.1	44.3	Gitea	Gitea Open Source Git Server	CWE-284	Gitea repository archive downloads bypass token scope checks
CVE-2026-25718	9.1	44.2	Gitea	Gitea Open Source Git Server	CWE-59	Gitea template repository generation mishandles symlinked paths
CVE-2026-58284	8.3	44.2	Microsoft	Microsoft Edge (Chromium-based)	CWE-285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-11398	5.3	44.1	latepoint	LatePoint – Calendar Booking Plugin for Appointments and Events	CWE-862	LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Custo…
CVE-2026-8924	9.1	44.1	curl	curl	—	trailing dot domain super cookie
CVE-2026-9180	5.3	43.9	jetmonsters	MotoPress Appointment Booking	CWE-639	MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Obje…
CVE-2026-28699	8.1	43.6	Gitea	Gitea Open Source Git Server	CWE-284	Gitea Basic Auth bypasses OAuth2 access token scopes
CVE-2026-8458	6.5	43.2	curl	curl	—	wrong reuse for different services
CVE-2026-58296	7.1	43.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-359	Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2026-58297	7.1	43.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-359	Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2026-58423	7.7	42.8	Gitea	Gitea Open Source Git Server	CWE-287	LFS authentication bypass via malformed SSH sub-verb allows unauthorized read…
CVE-2026-13040	7.2	42.3	webaways	NEX-Forms – Ultimate Forms Plugin for WordPress	CWE-79	NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_va…
CVE-2026-27775	8.8	42.0	Gitea	Gitea Open Source Git Server	CWE-863	Gitea pre-receive hook permission cache allows full repository write access
CVE-2026-22547	9.1	41.9	Gitea	Gitea Open Source Git Server	CWE-20	Gitea repository creation accepts invalid field values
CVE-2026-14620	4.7	41.9	webpack-dev-server	webpack-dev-server	CWE-352	webpack-dev-server vulnerable to cross-site request forgery via internal deve…
CVE-2026-14631	5.3	41.6	webpack-dev-server	webpack-dev-server	CWE-20	webpack-dev-server vulnerable to denial of service via a malformed Host or Or…
CVE-2026-58419	7.5	41.1	Gitea	Gitea Open Source Git Server	CWE-200	Notification API leaks private issue metadata after access revocation
CVE-2026-9148	7.2	41.0	advancedcoding	Comments – wpDiscuz	CWE-79	Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website…
CVE-2026-58295	8.3	40.9	Microsoft	Microsoft Edge (Chromium-based)	CWE-843	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2026-26232	9.1	40.2	Gitea	Gitea Open Source Git Server	CWE-294	Gitea OAuth2 authorization codes lack expiry and reuse enforcement
CVE-2026-26247	9.1	40.2	Gitea	Gitea Open Source Git Server	CWE-284	Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
CVE-2026-9080	7.3	40.2	curl	curl	CWE-416	UAF after pause in socket callback
CVE-2026-9230	4.3	40.0	expresstech	Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker	CWE-862	Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticat…
CVE-2026-58292	7.5	39.4	Microsoft	Microsoft Edge (Chromium-based)	CWE-20	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-12920	4.9	39.4	wplegalpages	Cookie Banner for GDPR / CCPA – WPLP Cookie Consent	CWE-89	Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL I…
CVE-2026-24451	7.5	39.3	Gitea	Gitea Open Source Git Server	CWE-200	Gitea fork synchronization can expose private parent repository data
CVE-2026-25038	7.5	39.3	Gitea	Gitea Open Source Git Server	CWE-200	Gitea private organization labels are visible to unauthorized users
CVE-2026-25712	7.5	39.3	Gitea	Gitea Open Source Git Server	CWE-284	Gitea organization permission APIs expose private visibility information
CVE-2026-20779	7.1	39.3	Gitea	Gitea Open Source Git Server	CWE-294	Gitea TOTP single-use enforcement defect allows OTP replay
CVE-2026-4321	9.8	38.4	Raera - Ankara Web Design and Digital Advertising Agency	Destekz	CWE-89	SQLi in Raera's Destekz
CVE-2026-47898	4.0	38.4	Apache Software Foundation	Apache Lucene.Net	CWE-611	Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
CVE-2026-58299	7.5	38.3	Microsoft	Microsoft Edge (Chromium-based)	CWE-367	Microsoft Edge for Android Remote Code Execution Vulnerability
CVE-2026-22874	9.6	38.1	Gitea	Gitea Open Source Git Server	CWE-918	Gitea webhook and migration allow-list filtering permits SSRF
CVE-2026-11900	4.3	37.5	spacetime	Ad Inserter – Ad Manager & AdSense Ads	CWE-639	Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Co…
CVE-2026-24690	7.5	37.3	Gitea	Gitea Open Source Git Server	CWE-284	Gitea pull-request branch updates use insufficient permission checks
CVE-2026-27657	7.5	37.3	Gitea	Gitea Open Source Git Server	CWE-639	Gitea email settings allow changing another user's primary email address
CVE-2026-27660	7.5	37.3	Gitea	Gitea Open Source Git Server	CWE-284	Gitea draft releases use insufficient permission checks
CVE-2026-28705	5.3	37.3	Gitea	Gitea Open Source Git Server	CWE-22	Gitea repository dumps write release assets using unsafe path names
CVE-2026-28744	8.1	37.1	Gitea	Gitea Open Source Git Server	CWE-863	Gitea Git smart HTTP bypasses repository token scopes for bearer tokens
CVE-2026-13341	7.4	36.9	KongHQ	mcp-konnect	CWE-20	Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong…
CVE-2026-58300	5.5	36.9	Microsoft	Microsoft Edge (Chromium-based)	CWE-36	Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2026-5137	4.3	36.9	rometheme	RTMKit	CWE-98	RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion v…
CVE-2026-58283	6.9	36.6	Microsoft	Microsoft Edge (Chromium-based)	CWE-843	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-8927	9.1	36.4	curl	curl	CWE-294	env-set cross-proxy Digest auth state leak
CVE-2026-58522	5.5	36.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-23	Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2026-58290	7.5	35.7	Microsoft	Microsoft Edge (Chromium-based)	CWE-843	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2026-28737	8.7	35.6	Gitea	Gitea Open Source Git Server	CWE-79	Gitea 3D file viewer allows stored XSS through glTF extensionsRequired
CVE-2026-14611	5.3	35.6	DeepMyst	Mysti	CWE-200	DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exp…
CVE-2026-22555	8.1	35.3	Gitea	Gitea Open Source Git Server	CWE-284	Gitea organization forks can expose organization secrets without create permi…
CVE-2026-58282	6.9	34.7	Microsoft	Microsoft Edge (Chromium-based)	CWE-284	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-58286	6.9	34.7	Microsoft	Microsoft Edge (Chromium-based)	CWE-284	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-8489	6.4	34.6	ultimatemember	Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin	CWE-79	Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scr…
CVE-2026-11778	5.4	34.7	villatheme	CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x	CWE-94	CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange…
CVE-2026-58418	6.5	34.3	Gitea	Gitea Open Source Git Server	CWE-918	SSRF via HTTP Redirect in Repository Migration
CVE-2026-58298	6.1	34.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-79	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-58524	6.1	34.1	Microsoft	Microsoft Edge (Chromium-based)	CWE-79	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-9545	7.5	33.6	curl	curl	—	exposing HTTP/3 early data
CVE-2026-8351	6.4	33.6	rometheme	RTMKit	CWE-79	RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vi…
CVE-2026-46465	5.5	33.6	Dell	PowerProtect Data Domain	CWE-134	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-58278	5.4	32.8	Microsoft	Microsoft Edge (Chromium-based)	CWE-918	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-14609	2.9	32.9	SourceCodester	CET Automated Grading System with AI Predictive Analytics	CWE-384	SourceCodester CET Automated Grading System with AI Predictive Analytics sess…
CVE-2026-10055	8.5	32.8	Eclipse Foundation	Eclipse Theia	CWE-200	In Eclipse Theia since version 1.26.0, the backend /services/request-service …
CVE-2026-14604	2.1	32.7	Open Asset Import Library	Assimp	CWE-119	Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double …
CVE-2026-8932	7.5	32.5	curl	curl	—	incomplete mTLS config matching in conn reuse
CVE-2026-20909	5.3	31.8	Gitea	Gitea Open Source Git Server	CWE-284	Gitea tracked-time list endpoint has insufficient permission checks
CVE-2026-25782	5.3	31.8	Gitea	Gitea Open Source Git Server	CWE-639	Gitea tracked-time deletion can target entries from another issue
CVE-2026-11397	5.5	31.3	vjinfotech	WP Import Export Lite	CWE-918	WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side …
CVE-2026-8926	9.1	30.4	curl	curl	CWE-522	password leak with netrc and user in URL
CVE-2026-9626	6.4	30.2	parorrey	JSON API User	CWE-79	JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Script…
CVE-2026-14608	2.1	30.1	SourceCodester	CET Automated Grading System with AI Predictive Analytics	CWE-285	SourceCodester CET Automated Grading System with AI Predictive Analytics POST…
CVE-2026-14617	1.3	30.1	NousResearch	hermes-agent	CWE-178	NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py G…
CVE-2026-58424	8.9	29.7	Gitea	Gitea Open Source Git Server	CWE-285	Permanent Fork PR Workflow Approval Gate Bypass
CVE-2026-27761	4.3	29.4	Gitea	Gitea Open Source Git Server	CWE-863	Gitea repository feeds bypass API token scope enforcement
CVE-2026-45488	5.9	28.9	Microsoft	Microsoft Edge (Chromium-based)	CWE-451	Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2026-9756	6.4	28.4	edge22	GenerateBlocks	CWE-79	GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-12729	4.3	28.0	wedevs	weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot	CWE-862	weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= …
CVE-2026-12557	5.3	27.9	SaturdayDrive	Ninja Forms - File Uploads	CWE-862	Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticat…
CVE-2026-26231	8.5	27.7	Gitea	Gitea Open Source Git Server	CWE-863	Gitea maintainer-edit permissions allow unauthorized commits to readable repo…
CVE-2026-8892	6.4	27.5	creativemindssolutions	CM Business Directory – Optimise and showcase local business	CWE-79	CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Si…
CVE-2026-25779	6.1	26.9	Gitea	Gitea Open Source Git Server	CWE-601	Gitea redirect handling permits open redirects through backslash paths
CVE-2026-25714	4.3	26.7	Gitea	Gitea Open Source Git Server	CWE-862	Gitea user organization API bypasses public-only token filtering
CVE-2026-27783	4.3	26.7	Gitea	Gitea Open Source Git Server	CWE-862	Gitea issue-template APIs bypass repository unit authorization
CVE-2026-12064	7.5	26.3	curl	curl	CWE-295	proto-default skips SSH verification
CVE-2026-46463	6.5	25.6	Dell	PowerProtect Data Domain	CWE-190	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-12731	6.4	25.5	wedevs	weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot	CWE-79	weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= …
CVE-2026-12734	6.4	25.5	wedevs	weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot	CWE-79	weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= …
CVE-2026-14613	4.9	25.3	Red Hat	Red Hat build of Keycloak 26.6	CWE-284	Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint …
CVE-2026-9547	7.4	24.8	curl	curl	—	SSH improper host validation
CVE-2026-28740	7.1	24.5	Gitea	Gitea Open Source Git Server	CWE-639	Gitea LFS object reuse bypasses Code-unit authorization
CVE-2026-14615	2.7	23.8	Red Hat	Red Hat build of Keycloak 26.4	CWE-1220	Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses …
CVE-2026-14614	5.4	23.7	Red Hat	Red Hat build of Keycloak 26.4	CWE-639	Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass …
CVE-2026-8286	8.1	23.1	curl	curl	CWE-295	wrong STARTTLS connection reuse
CVE-2026-58426	9.6	22.1	Gitea	Gitea Open Source Git Server	CWE-347	Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository …
CVE-2026-4804	6.4	20.2	themegrill	Zakra	CWE-79	Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via…
CVE-2026-14355	5.3	19.8	php	php	CWE-122	ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
CVE-2026-41123	4.3	16.6	Dell	PowerProtect Data Domain	CWE-284	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release …
CVE-2026-4322	6.1	16.4	Raera - Ankara Web Design and Digital Advertising Agency	Destekz	CWE-79	XSS in Raera's Destekz
CVE-2026-58379	7.3	13.9	Red Hat	Red Hat Enterprise Linux 9	CWE-122	Gimp: gimp: heap buffer overflow in read_channel_data()
CVE-2026-14612	4.2	13.1	Red Hat	Red Hat Enterprise Linux 10	CWE-787	Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c …
CVE-2026-10054	8.8	12.2	Eclipse Foundation	Eclipse Theia	CWE-306	In affected versions of Eclipse Theia (1.8.1 and later), the browser backend …
CVE-2026-14459	8.8	10.8	TUBITAK BILGEM Software Technologies Research Institute	pardus-software	CWE-88	Argument Injection in TUBITAK BILGEM's pardus-software
CVE-2026-35159	5.3	10.5	Dell	Inspiron 15 3520	CWE-305	Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakne…
CVE-2026-14605	7.1	9.5	n/a	RT-Thread	CWE-119	RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow
CVE-2026-14606	7.1	9.5	n/a	RT-Thread	CWE-119	RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow
CVE-2026-55945	4.2	8.2	Microsoft	Microsoft Edge (Chromium-based)	CWE-362	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2026-44269	4.4	6.8	Dell	PowerProtect Data Domain	CWE-59	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release …
CVE-2026-46468	4.4	6.8	Dell	PowerProtect Data Domain	CWE-59	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-14610	1.9	6.8	Open Asset Import Library	Assimp	CWE-119	Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-b…
CVE-2026-46730	4.2	6.7	Dell	PowerProtect Data Domain	CWE-863	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-41124	4.4	6.3	Dell	PowerProtect Data Domain	CWE-22	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release …
CVE-2026-14607	5.4	6.1	n/a	RT-Thread	CWE-119	RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
CVE-2026-14460	8.8	5.7	TUBITAK BILGEM Software Technologies Research Institute	pardus-software	CWE-862	Missing Authorization in TUBITAK BILGEM's pardus-software
CVE-2026-12960	6.0	5.3	ASUS	Router app	CWE-926	An Improper Export of Android Application Components vulnerability in ASUS Ro…
CVE-2026-8921	8.5	4.9	ASUS	ASUS Business Manager	CWE-73	External Control of File Name or Path vulnerability in ASUS Business Manager …
CVE-2026-46466	2.7	4.6	Dell	PowerProtect Data Domain	CWE-348	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-44268	4.4	4.1	Dell	PowerProtect Data Domain	CWE-732	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release …
CVE-2022-4989	8.5	3.7	ASUS	AI Suite 3	CWE-1284	UNSUPPORTED WHEN ASSIGNED Improper Validation of Specified Quantity in …
CVE-2026-56085	3.3	3.3	Dell	PowerProtect Data Domain	CWE-908	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2022-4990	7.3	2.9	ASUS	AI Suite 3	CWE-1284	UNSUPPORTED WHEN ASSIGNED Improper Validation of Specified Quantity in …
CVE-2026-46467	5.8	1.6	Dell	PowerProtect Data Domain	CWE-532	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release …
CVE-2026-8804	6.7	1.2	Perforce	Puppet Core	CWE-312	Cleartext Storage of Sensitive Information for Puppet Resource API

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-03 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.