{ "day": "2026-07-03", "boundary": "UTC calendar day", "published_count": 180, "by_severity": { "CRITICAL": 25, "HIGH": 77, "MEDIUM": 70, "LOW": 8 }, "kev_count": 0, "exploit_reference_count": 19, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-27771", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.43068, "epss_percentile": 0.98613, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-862", "title": "Gitea Composer package source links use insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27771" }, { "rank": 2, "cve_id": "CVE-2026-20896", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.31809, "epss_percentile": 0.98157, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea Docker image trusts spoofable reverse-proxy headers by default", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20896" }, { "rank": 3, "cve_id": "CVE-2026-58289", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.01766, "epss_percentile": 0.76275, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58289" }, { "rank": 4, "cve_id": "CVE-2026-49814", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01216, "epss_percentile": 0.66151, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49814" }, { "rank": 5, "cve_id": "CVE-2026-53478", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01216, "epss_percentile": 0.66152, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53478" }, { "rank": 6, "cve_id": "CVE-2026-49815", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01096, "epss_percentile": 0.62944, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to execution of arbitrary OS commands.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49815" }, { "rank": 7, "cve_id": "CVE-2026-26355", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.01052, "epss_percentile": 0.6167, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26355" }, { "rank": 8, "cve_id": "CVE-2026-14544", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00864, "epss_percentile": 0.55804, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-190", "title": "Hplip: incomplete fix for cve-2026-8631", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14544" }, { "rank": 9, "cve_id": "CVE-2026-57991", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00745, "epss_percentile": 0.51971, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-59", "title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57991" }, { "rank": 10, "cve_id": "CVE-2026-9725", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00742, "epss_percentile": 0.51861, "kev": false, "kev_due_at": null, "vendor": "printcart", "product": "Printcart Web to Print Product Designer for WooCommerce", "cwe": "CWE-22", "title": "Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9725" }, { "rank": 11, "cve_id": "CVE-2026-47896", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00722, "epss_percentile": 0.51154, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Lucene.Net", "cwe": "CWE-22", "title": "Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47896" }, { "rank": 12, "cve_id": "CVE-2026-56646", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00651, "epss_percentile": 0.48453, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-200", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56646" }, { "rank": 13, "cve_id": "CVE-2026-57993", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00626, "epss_percentile": 0.47299, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-918", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57993" }, { "rank": 14, "cve_id": "CVE-2026-57987", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00617, "epss_percentile": 0.46892, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-918", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57987" }, { "rank": 15, "cve_id": "CVE-2026-57992", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00608, "epss_percentile": 0.46443, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57992" }, { "rank": 16, "cve_id": "CVE-2026-47897", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00605, "epss_percentile": 0.46295, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Lucene.Net", "cwe": "CWE-22", "title": "Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47897" }, { "rank": 17, "cve_id": "CVE-2026-11856", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00604, "epss_percentile": 0.46286, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-294", "title": "cross-origin Digest auth state leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11856" }, { "rank": 18, "cve_id": "CVE-2026-8925", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00592, "epss_percentile": 0.45729, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-415", "title": "SASL double-free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8925" }, { "rank": 19, "cve_id": "CVE-2026-58291", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00586, "epss_percentile": 0.45462, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-672", "title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58291" }, { "rank": 20, "cve_id": "CVE-2026-9079", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00584, "epss_percentile": 0.45341, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-522", "title": "stale proxy password leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9079" }, { "rank": 21, "cve_id": "CVE-2026-57974", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00577, "epss_percentile": 0.45018, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-190", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57974" }, { "rank": 22, "cve_id": "CVE-2026-11352", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00577, "epss_percentile": 0.45027, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-835", "title": "QUIC zero-length UDP datagrams busy-loop", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11352" }, { "rank": 23, "cve_id": "CVE-2026-57981", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00568, "epss_percentile": 0.44563, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57981" }, { "rank": 24, "cve_id": "CVE-2026-27775", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00567, "epss_percentile": 0.44555, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea pre-receive hook permission cache allows full repository write access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27775" }, { "rank": 25, "cve_id": "CVE-2026-28699", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00567, "epss_percentile": 0.44535, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea Basic Auth bypasses OAuth2 access token scopes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28699" }, { "rank": 26, "cve_id": "CVE-2026-8924", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.0056, "epss_percentile": 0.44167, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "trailing dot domain super cookie", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8924" }, { "rank": 27, "cve_id": "CVE-2026-56645", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00556, "epss_percentile": 0.43946, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-122", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56645" }, { "rank": 28, "cve_id": "CVE-2026-22874", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00554, "epss_percentile": 0.43848, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-918", "title": "Gitea webhook and migration allow-list filtering permits SSRF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22874" }, { "rank": 29, "cve_id": "CVE-2026-56015", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00537, "epss_percentile": 0.42952, "kev": false, "kev_due_at": null, "vendor": "TPODER", "product": "Net::IP::LPM", "cwe": "CWE-125", "title": "Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56015" }, { "rank": 30, "cve_id": "CVE-2026-57988", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00532, "epss_percentile": 0.42684, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-23", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57988" }, { "rank": 31, "cve_id": "CVE-2026-14620", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00523, "epss_percentile": 0.42218, "kev": false, "kev_due_at": null, "vendor": "webpack-dev-server", "product": "webpack-dev-server", "cwe": "CWE-352", "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14620" }, { "rank": 32, "cve_id": "CVE-2026-10536", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00507, "epss_percentile": 0.41179, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-416", "title": "HTTP/2 stream-dependency tree UAF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10536" }, { "rank": 33, "cve_id": "CVE-2026-20706", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00493, "epss_percentile": 0.40348, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea repository archive downloads bypass token scope checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20706" }, { "rank": 34, "cve_id": "CVE-2026-11586", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00491, "epss_percentile": 0.40257, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-770", "title": "WS Auto-PONG memory exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11586" }, { "rank": 35, "cve_id": "CVE-2026-26292", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00482, "epss_percentile": 0.39689, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26292" }, { "rank": 36, "cve_id": "CVE-2026-57985", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00479, "epss_percentile": 0.39475, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-20", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57985" }, { "rank": 37, "cve_id": "CVE-2026-45489", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00475, "epss_percentile": 0.39239, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-749", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45489" }, { "rank": 38, "cve_id": "CVE-2026-58523", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00475, "epss_percentile": 0.39238, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-284", "title": "Microsoft Edge for Android Security Feature Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58523" }, { "rank": 39, "cve_id": "CVE-2026-14352", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00473, "epss_percentile": 0.39059, "kev": false, "kev_due_at": null, "vendor": "webandprint", "product": "AR for WooCommerce", "cwe": "CWE-22", "title": "AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14352" }, { "rank": 40, "cve_id": "CVE-2026-57983", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00472, "epss_percentile": 0.39034, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-285", "title": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57983" }, { "rank": 41, "cve_id": "CVE-2026-27780", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00472, "epss_percentile": 0.38991, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea pre-receive hook can miss branch-protection checks after scanner errors", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27780" }, { "rank": 42, "cve_id": "CVE-2026-12481", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00467, "epss_percentile": 0.38699, "kev": false, "kev_due_at": null, "vendor": "keras-team", "product": "keras-team/keras", "cwe": "CWE-502", "title": "Deserialization of Untrusted Data in keras-team/keras", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12481" }, { "rank": 43, "cve_id": "CVE-2026-26307", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00466, "epss_percentile": 0.38615, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-400", "title": "Gitea git grep search lacks a timeout", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26307" }, { "rank": 44, "cve_id": "CVE-2026-49813", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.0046, "epss_percentile": 0.38239, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49813" }, { "rank": 45, "cve_id": "CVE-2026-14327", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00459, "epss_percentile": 0.38204, "kev": false, "kev_due_at": null, "vendor": "webandprint", "product": "AR for WordPress", "cwe": "CWE-22", "title": "AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14327" }, { "rank": 46, "cve_id": "CVE-2026-58285", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00455, "epss_percentile": 0.379, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58285" }, { "rank": 47, "cve_id": "CVE-2026-58287", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00455, "epss_percentile": 0.379, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58287" }, { "rank": 48, "cve_id": "CVE-2026-54483", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00451, "epss_percentile": 0.37627, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-78", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54483" }, { "rank": 49, "cve_id": "CVE-2026-57975", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00445, "epss_percentile": 0.37236, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57975" }, { "rank": 50, "cve_id": "CVE-2026-8927", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.0044, "epss_percentile": 0.3678, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-294", "title": "env-set cross-proxy Digest auth state leak", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8927" }, { "rank": 51, "cve_id": "CVE-2026-58288", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00438, "epss_percentile": 0.36655, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58288" }, { "rank": 52, "cve_id": "CVE-2026-58293", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00438, "epss_percentile": 0.36655, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-73", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58293" }, { "rank": 53, "cve_id": "CVE-2026-27779", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00431, "epss_percentile": 0.36107, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea forwarded-proto handling allows public URL spoofing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27779" }, { "rank": 54, "cve_id": "CVE-2026-57984", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00429, "epss_percentile": 0.35953, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57984" }, { "rank": 55, "cve_id": "CVE-2026-57986", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00429, "epss_percentile": 0.35953, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57986" }, { "rank": 56, "cve_id": "CVE-2026-58276", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00429, "epss_percentile": 0.35953, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58276" }, { "rank": 57, "cve_id": "CVE-2026-25718", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00428, "epss_percentile": 0.35872, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-59", "title": "Gitea template repository generation mishandles symlinked paths", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25718" }, { "rank": 58, "cve_id": "CVE-2026-25038", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00424, "epss_percentile": 0.35546, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-200", "title": "Gitea private organization labels are visible to unauthorized users", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25038" }, { "rank": 59, "cve_id": "CVE-2026-46464", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00422, "epss_percentile": 0.35434, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-59", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('Link following') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46464" }, { "rank": 60, "cve_id": "CVE-2026-58284", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00421, "epss_percentile": 0.3526, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-285", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58284" }, { "rank": 61, "cve_id": "CVE-2026-57977", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00412, "epss_percentile": 0.3454, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-79", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57977" }, { "rank": 62, "cve_id": "CVE-2026-14631", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00405, "epss_percentile": 0.3393, "kev": false, "kev_due_at": null, "vendor": "webpack-dev-server", "product": "webpack-dev-server", "cwe": "CWE-20", "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14631" }, { "rank": 63, "cve_id": "CVE-2026-4967", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00403, "epss_percentile": 0.33765, "kev": false, "kev_due_at": null, "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.", "product": "SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T8100/T9100/T8200/T8300", "cwe": null, "title": "In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4967" }, { "rank": 64, "cve_id": "CVE-2026-59234", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00403, "epss_percentile": 0.33686, "kev": false, "kev_due_at": null, "vendor": "Roskus", "product": "Prospero Flow CRM", "cwe": "CWE-639", "title": "Authorization Bypass Through User-Controlled Key in Prospero Flow CRM calendar event deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59234" }, { "rank": 65, "cve_id": "CVE-2026-9546", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00399, "epss_percentile": 0.33267, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "sending old referer", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9546" }, { "rank": 66, "cve_id": "CVE-2026-20779", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00398, "epss_percentile": 0.33199, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-294", "title": "Gitea TOTP single-use enforcement defect allows OTP replay", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20779" }, { "rank": 67, "cve_id": "CVE-2026-58597", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00398, "epss_percentile": 0.33174, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-357", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58597" }, { "rank": 68, "cve_id": "CVE-2026-8932", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.32997, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "incomplete mTLS config matching in conn reuse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8932" }, { "rank": 69, "cve_id": "CVE-2026-26232", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00379, "epss_percentile": 0.3119, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-294", "title": "Gitea OAuth2 authorization codes lack expiry and reuse enforcement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26232" }, { "rank": 70, "cve_id": "CVE-2026-26247", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00379, "epss_percentile": 0.31189, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26247" }, { "rank": 71, "cve_id": "CVE-2026-8926", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00376, "epss_percentile": 0.30916, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-522", "title": "password leak with netrc and user in URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8926" }, { "rank": 72, "cve_id": "CVE-2026-22547", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00373, "epss_percentile": 0.30543, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-20", "title": "Gitea repository creation accepts invalid field values", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22547" }, { "rank": 73, "cve_id": "CVE-2026-58295", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00372, "epss_percentile": 0.30446, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58295" }, { "rank": 74, "cve_id": "CVE-2026-28705", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00369, "epss_percentile": 0.30068, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-22", "title": "Gitea repository dumps write release assets using unsafe path names", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28705" }, { "rank": 75, "cve_id": "CVE-2026-27761", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00365, "epss_percentile": 0.29742, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea repository feeds bypass API token scope enforcement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27761" }, { "rank": 76, "cve_id": "CVE-2026-11564", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00363, "epss_percentile": 0.29586, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-295", "title": "Native CA trust persist", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11564" }, { "rank": 77, "cve_id": "CVE-2026-24451", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00353, "epss_percentile": 0.28574, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-200", "title": "Gitea fork synchronization can expose private parent repository data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24451" }, { "rank": 78, "cve_id": "CVE-2026-25712", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00353, "epss_percentile": 0.28527, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea organization permission APIs expose private visibility information", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25712" }, { "rank": 79, "cve_id": "CVE-2026-47898", "cvss_base": 4, "cvss_severity": "MEDIUM", "epss_score": 0.00348, "epss_percentile": 0.2799, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Lucene.Net", "cwe": "CWE-611", "title": "Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-47898" }, { "rank": 80, "cve_id": "CVE-2026-27657", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00345, "epss_percentile": 0.27677, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-639", "title": "Gitea email settings allow changing another user's primary email address", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27657" }, { "rank": 81, "cve_id": "CVE-2026-27660", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00345, "epss_percentile": 0.27678, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea draft releases use insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27660" }, { "rank": 82, "cve_id": "CVE-2026-28744", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00343, "epss_percentile": 0.27402, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea Git smart HTTP bypasses repository token scopes for bearer tokens", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28744" }, { "rank": 83, "cve_id": "CVE-2026-58283", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.27341, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58283" }, { "rank": 84, "cve_id": "CVE-2026-9180", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00342, "epss_percentile": 0.27289, "kev": false, "kev_due_at": null, "vendor": "jetmonsters", "product": "MotoPress Appointment Booking", "cwe": "CWE-639", "title": "MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9180" }, { "rank": 85, "cve_id": "CVE-2026-58294", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0034, "epss_percentile": 0.27153, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-416", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58294" }, { "rank": 86, "cve_id": "CVE-2026-58422", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00339, "epss_percentile": 0.2696, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58422" }, { "rank": 87, "cve_id": "CVE-2026-12064", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00339, "epss_percentile": 0.26944, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-295", "title": "proto-default skips SSH verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12064" }, { "rank": 88, "cve_id": "CVE-2026-28737", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.26684, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-79", "title": "Gitea 3D file viewer allows stored XSS through glTF extensionsRequired", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28737" }, { "rank": 89, "cve_id": "CVE-2026-58300", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00337, "epss_percentile": 0.26785, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-36", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58300" }, { "rank": 90, "cve_id": "CVE-2026-25714", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00332, "epss_percentile": 0.26173, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-862", "title": "Gitea user organization API bypasses public-only token filtering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25714" }, { "rank": 91, "cve_id": "CVE-2026-58421", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00327, "epss_percentile": 0.25612, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58421" }, { "rank": 92, "cve_id": "CVE-2026-9547", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00325, "epss_percentile": 0.25481, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "SSH improper host validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9547" }, { "rank": 93, "cve_id": "CVE-2026-58282", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00324, "epss_percentile": 0.2535, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-284", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58282" }, { "rank": 94, "cve_id": "CVE-2026-58286", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00324, "epss_percentile": 0.2535, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-284", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58286" }, { "rank": 95, "cve_id": "CVE-2026-58522", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00323, "epss_percentile": 0.25175, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-23", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58522" }, { "rank": 96, "cve_id": "CVE-2026-11398", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00323, "epss_percentile": 0.25238, "kev": false, "kev_due_at": null, "vendor": "latepoint", "product": "LatePoint – Calendar Booking Plugin for Appointments and Events", "cwe": "CWE-862", "title": "LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11398" }, { "rank": 97, "cve_id": "CVE-2026-24690", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00322, "epss_percentile": 0.2507, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea pull-request branch updates use insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24690" }, { "rank": 98, "cve_id": "CVE-2026-14609", "cvss_base": 2.9, "cvss_severity": "LOW", "epss_score": 0.00321, "epss_percentile": 0.25025, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "CET Automated Grading System with AI Predictive Analytics", "cwe": "CWE-384", "title": "SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14609" }, { "rank": 99, "cve_id": "CVE-2026-14615", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00317, "epss_percentile": 0.24503, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "cwe": "CWE-1220", "title": "Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14615" }, { "rank": 100, "cve_id": "CVE-2026-8458", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00315, "epss_percentile": 0.24326, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "wrong reuse for different services", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8458" }, { "rank": 101, "cve_id": "CVE-2026-58423", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00311, "epss_percentile": 0.23845, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-287", "title": "LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58423" }, { "rank": 102, "cve_id": "CVE-2026-8286", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00309, "epss_percentile": 0.23694, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-295", "title": "wrong STARTTLS connection reuse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8286" }, { "rank": 103, "cve_id": "CVE-2026-58297", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00309, "epss_percentile": 0.2364, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-359", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58297" }, { "rank": 104, "cve_id": "CVE-2026-22555", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00305, "epss_percentile": 0.23151, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea organization forks can expose organization secrets without create permission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-22555" }, { "rank": 105, "cve_id": "CVE-2026-13040", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00304, "epss_percentile": 0.2307, "kev": false, "kev_due_at": null, "vendor": "webaways", "product": "NEX-Forms – Ultimate Forms Plugin for WordPress", "cwe": "CWE-79", "title": "NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13040" }, { "rank": 106, "cve_id": "CVE-2026-58296", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00303, "epss_percentile": 0.22961, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-359", "title": "Microsoft Edge for Android Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58296" }, { "rank": 107, "cve_id": "CVE-2026-9230", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00299, "epss_percentile": 0.2253, "kev": false, "kev_due_at": null, "vendor": "expresstech", "product": "Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker", "cwe": "CWE-862", "title": "Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9230" }, { "rank": 108, "cve_id": "CVE-2026-58419", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00298, "epss_percentile": 0.2249, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-200", "title": "Notification API leaks private issue metadata after access revocation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58419" }, { "rank": 109, "cve_id": "CVE-2026-10055", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00297, "epss_percentile": 0.22302, "kev": false, "kev_due_at": null, "vendor": "Eclipse Foundation", "product": "Eclipse Theia", "cwe": "CWE-200", "title": "In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses, exposing internal administrative endpoints, cloud instance metadata services, and other resources that are intentionally outside the browser network boundary. The vulnerability affects deployments where the Theia service connection is reachable by untrusted users (for example, multi-tenant or publicly-reachable Theia deployments).", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10055" }, { "rank": 110, "cve_id": "CVE-2026-9080", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00295, "epss_percentile": 0.22191, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": "CWE-416", "title": "UAF after pause in socket callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9080" }, { "rank": 111, "cve_id": "CVE-2026-9148", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00292, "epss_percentile": 0.21833, "kev": false, "kev_due_at": null, "vendor": "advancedcoding", "product": "Comments – wpDiscuz", "cwe": "CWE-79", "title": "Comments <= 7.6.56 - Unauthenticated Stored Cross-Site Scripting via 'Website' Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9148" }, { "rank": 112, "cve_id": "CVE-2026-12920", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00292, "epss_percentile": 0.21795, "kev": false, "kev_due_at": null, "vendor": "wplegalpages", "product": "Cookie Banner for GDPR / CCPA – WPLP Cookie Consent", "cwe": "CWE-89", "title": "Cookie Banner for GDPR / CCPA <= 4.3.5 - Authenticated (Administrator+) SQL Injection via 's' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12920" }, { "rank": 113, "cve_id": "CVE-2026-26231", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00291, "epss_percentile": 0.21735, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-863", "title": "Gitea maintainer-edit permissions allow unauthorized commits to readable repositories", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26231" }, { "rank": 114, "cve_id": "CVE-2026-20909", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00286, "epss_percentile": 0.21161, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-284", "title": "Gitea tracked-time list endpoint has insufficient permission checks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-20909" }, { "rank": 115, "cve_id": "CVE-2026-25782", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00286, "epss_percentile": 0.21161, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-639", "title": "Gitea tracked-time deletion can target entries from another issue", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25782" }, { "rank": 116, "cve_id": "CVE-2026-27783", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00284, "epss_percentile": 0.20948, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-862", "title": "Gitea issue-template APIs bypass repository unit authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-27783" }, { "rank": 117, "cve_id": "CVE-2026-58278", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00282, "epss_percentile": 0.20787, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-918", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58278" }, { "rank": 118, "cve_id": "CVE-2026-58292", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00279, "epss_percentile": 0.20489, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-20", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58292" }, { "rank": 119, "cve_id": "CVE-2026-14355", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00279, "epss_percentile": 0.20452, "kev": false, "kev_due_at": null, "vendor": "php", "product": "php", "cwe": "CWE-122", "title": "ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14355" }, { "rank": 120, "cve_id": "CVE-2026-58299", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0027, "epss_percentile": 0.19241, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-367", "title": "Microsoft Edge for Android Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58299" }, { "rank": 121, "cve_id": "CVE-2026-9545", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00268, "epss_percentile": 0.19104, "kev": false, "kev_due_at": null, "vendor": "curl", "product": "curl", "cwe": null, "title": "exposing HTTP/3 early data", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9545" }, { "rank": 122, "cve_id": "CVE-2026-28740", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00267, "epss_percentile": 0.18906, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-639", "title": "Gitea LFS object reuse bypasses Code-unit authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28740" }, { "rank": 123, "cve_id": "CVE-2026-11900", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00267, "epss_percentile": 0.18934, "kev": false, "kev_due_at": null, "vendor": "spacetime", "product": "Ad Inserter – Ad Manager & AdSense Ads", "cwe": "CWE-639", "title": "Ad Inserter <= 2.8.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Post Content Disclosure via 'data' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11900" }, { "rank": 124, "cve_id": "CVE-2026-4321", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00266, "epss_percentile": 0.18599, "kev": false, "kev_due_at": null, "vendor": "Raera - Ankara Web Design and Digital Advertising Agency", "product": "Destekz", "cwe": "CWE-89", "title": "SQLi in Raera's Destekz", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4321" }, { "rank": 125, "cve_id": "CVE-2026-5137", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00266, "epss_percentile": 0.1865, "kev": false, "kev_due_at": null, "vendor": "rometheme", "product": "RTMKit", "cwe": "CWE-98", "title": "RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5137" }, { "rank": 126, "cve_id": "CVE-2026-13341", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00258, "epss_percentile": 0.17724, "kev": false, "kev_due_at": null, "vendor": "KongHQ", "product": "mcp-konnect", "cwe": "CWE-20", "title": "Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13341" }, { "rank": 127, "cve_id": "CVE-2026-14611", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16996, "kev": false, "kev_due_at": null, "vendor": "DeepMyst", "product": "Mysti", "cwe": "CWE-200", "title": "DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14611" }, { "rank": 128, "cve_id": "CVE-2026-11778", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.0025, "epss_percentile": 0.16615, "kev": false, "kev_due_at": null, "vendor": "villatheme", "product": "CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x", "cwe": "CWE-94", "title": "CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11778" }, { "rank": 129, "cve_id": "CVE-2026-58290", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00249, "epss_percentile": 0.16609, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-843", "title": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58290" }, { "rank": 130, "cve_id": "CVE-2026-45488", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.16572, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-451", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45488" }, { "rank": 131, "cve_id": "CVE-2026-25779", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00248, "epss_percentile": 0.16368, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-601", "title": "Gitea redirect handling permits open redirects through backslash paths", "url": "https://www.cve.org/CVERecord?id=CVE-2026-25779" }, { "rank": 132, "cve_id": "CVE-2026-58418", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15845, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-918", "title": "SSRF via HTTP Redirect in Repository Migration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58418" }, { "rank": 133, "cve_id": "CVE-2026-46463", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00243, "epss_percentile": 0.15784, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-190", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46463" }, { "rank": 134, "cve_id": "CVE-2026-58298", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0024, "epss_percentile": 0.15316, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-79", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58298" }, { "rank": 135, "cve_id": "CVE-2026-58524", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.0024, "epss_percentile": 0.15316, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-79", "title": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58524" }, { "rank": 136, "cve_id": "CVE-2026-46465", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00238, "epss_percentile": 0.15092, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-134", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46465" }, { "rank": 137, "cve_id": "CVE-2026-14617", "cvss_base": 1.3, "cvss_severity": "LOW", "epss_score": 0.00237, "epss_percentile": 0.14982, "kev": false, "kev_due_at": null, "vendor": "NousResearch", "product": "hermes-agent", "cwe": "CWE-178", "title": "NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14617" }, { "rank": 138, "cve_id": "CVE-2026-8489", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00234, "epss_percentile": 0.14592, "kev": false, "kev_due_at": null, "vendor": "ultimatemember", "product": "Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin", "cwe": "CWE-79", "title": "Ultimate Member <= 2.11.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Non-HTML Custom Textarea Profile Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8489" }, { "rank": 139, "cve_id": "CVE-2026-58379", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00233, "epss_percentile": 0.14439, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "cwe": "CWE-122", "title": "Gimp: gimp: heap buffer overflow in read_channel_data()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58379" }, { "rank": 140, "cve_id": "CVE-2026-14604", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00233, "epss_percentile": 0.14494, "kev": false, "kev_due_at": null, "vendor": "Open Asset Import Library", "product": "Assimp", "cwe": "CWE-119", "title": "Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14604" }, { "rank": 141, "cve_id": "CVE-2026-8351", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00228, "epss_percentile": 0.13821, "kev": false, "kev_due_at": null, "vendor": "rometheme", "product": "RTMKit", "cwe": "CWE-79", "title": "RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8351" }, { "rank": 142, "cve_id": "CVE-2026-11397", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00228, "epss_percentile": 0.13797, "kev": false, "kev_due_at": null, "vendor": "vjinfotech", "product": "WP Import Export Lite", "cwe": "CWE-918", "title": "WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11397" }, { "rank": 143, "cve_id": "CVE-2026-12557", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00223, "epss_percentile": 0.13192, "kev": false, "kev_due_at": null, "vendor": "SaturdayDrive", "product": "Ninja Forms - File Uploads", "cwe": "CWE-862", "title": "Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12557" }, { "rank": 144, "cve_id": "CVE-2026-14608", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00223, "epss_percentile": 0.13138, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "CET Automated Grading System with AI Predictive Analytics", "cwe": "CWE-285", "title": "SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14608" }, { "rank": 145, "cve_id": "CVE-2026-9626", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00221, "epss_percentile": 0.12979, "kev": false, "kev_due_at": null, "vendor": "parorrey", "product": "JSON API User", "cwe": "CWE-79", "title": "JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9626" }, { "rank": 146, "cve_id": "CVE-2026-14613", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.0022, "epss_percentile": 0.12807, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.6", "cwe": "CWE-284", "title": "Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14613" }, { "rank": 147, "cve_id": "CVE-2026-12729", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00213, "epss_percentile": 0.11891, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot", "cwe": "CWE-862", "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12729" }, { "rank": 148, "cve_id": "CVE-2026-8892", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.11028, "kev": false, "kev_due_at": null, "vendor": "creativemindssolutions", "product": "CM Business Directory – Optimise and showcase local business", "cwe": "CWE-79", "title": "CM Business Directory <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Business Address Meta Fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8892" }, { "rank": 149, "cve_id": "CVE-2026-58424", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00202, "epss_percentile": 0.10423, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-285", "title": "Permanent Fork PR Workflow Approval Gate Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58424" }, { "rank": 150, "cve_id": "CVE-2026-9756", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.10165, "kev": false, "kev_due_at": null, "vendor": "edge22", "product": "GenerateBlocks", "cwe": "CWE-79", "title": "GenerateBlocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9756" }, { "rank": 151, "cve_id": "CVE-2026-12731", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.10223, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot", "cwe": "CWE-79", "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sectionTitleTag' and 'articleTitleTag' Block Attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12731" }, { "rank": 152, "cve_id": "CVE-2026-12734", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.10223, "kev": false, "kev_due_at": null, "vendor": "wedevs", "product": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot", "cwe": "CWE-79", "title": "weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'connectorWidth' Block Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12734" }, { "rank": 153, "cve_id": "CVE-2026-14459", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00198, "epss_percentile": 0.09946, "kev": false, "kev_due_at": null, "vendor": "TUBITAK BILGEM Software Technologies Research Institute", "product": "pardus-software", "cwe": "CWE-88", "title": "Argument Injection in TUBITAK BILGEM's pardus-software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14459" }, { "rank": 154, "cve_id": "CVE-2026-58426", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00188, "epss_percentile": 0.08737, "kev": false, "kev_due_at": null, "vendor": "Gitea", "product": "Gitea Open Source Git Server", "cwe": "CWE-347", "title": "Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58426" }, { "rank": 155, "cve_id": "CVE-2026-35159", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00187, "epss_percentile": 0.0861, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "Inspiron 15 3520", "cwe": "CWE-305", "title": "Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35159" }, { "rank": 156, "cve_id": "CVE-2026-14614", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00185, "epss_percentile": 0.08472, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "cwe": "CWE-639", "title": "Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14614" }, { "rank": 157, "cve_id": "CVE-2026-4804", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00177, "epss_percentile": 0.07599, "kev": false, "kev_due_at": null, "vendor": "themegrill", "product": "Zakra", "cwe": "CWE-79", "title": "Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4804" }, { "rank": 158, "cve_id": "CVE-2026-14460", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00163, "epss_percentile": 0.06048, "kev": false, "kev_due_at": null, "vendor": "TUBITAK BILGEM Software Technologies Research Institute", "product": "pardus-software", "cwe": "CWE-862", "title": "Missing Authorization in TUBITAK BILGEM's pardus-software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14460" }, { "rank": 159, "cve_id": "CVE-2026-10054", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00159, "epss_percentile": 0.05624, "kev": false, "kev_due_at": null, "vendor": "Eclipse Foundation", "product": "Eclipse Theia", "cwe": "CWE-306", "title": "In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication. A fix is in development that enforces same-origin validation by default, removes trust in the fix-origin header, gates HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10054" }, { "rank": 160, "cve_id": "CVE-2026-41123", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.04904, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-284", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in the RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41123" }, { "rank": 161, "cve_id": "CVE-2026-4322", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00149, "epss_percentile": 0.04607, "kev": false, "kev_due_at": null, "vendor": "Raera - Ankara Web Design and Digital Advertising Agency", "product": "Destekz", "cwe": "CWE-79", "title": "XSS in Raera's Destekz", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4322" }, { "rank": 162, "cve_id": "CVE-2026-55945", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00145, "epss_percentile": 0.04245, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Edge (Chromium-based)", "cwe": "CWE-362", "title": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55945" }, { "rank": 163, "cve_id": "CVE-2026-14612", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.0404, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14612" }, { "rank": 164, "cve_id": "CVE-2026-14605", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00141, "epss_percentile": 0.03894, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "RT-Thread", "cwe": "CWE-119", "title": "RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14605" }, { "rank": 165, "cve_id": "CVE-2026-14606", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00141, "epss_percentile": 0.03894, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "RT-Thread", "cwe": "CWE-119", "title": "RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14606" }, { "rank": 166, "cve_id": "CVE-2026-44269", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00133, "epss_percentile": 0.033, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-59", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('link following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44269" }, { "rank": 167, "cve_id": "CVE-2026-46468", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00133, "epss_percentile": 0.033, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-59", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('Link following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46468" }, { "rank": 168, "cve_id": "CVE-2026-14610", "cvss_base": 1.9, "cvss_severity": "LOW", "epss_score": 0.00128, "epss_percentile": 0.02857, "kev": false, "kev_due_at": null, "vendor": "Open Asset Import Library", "product": "Assimp", "cwe": "CWE-119", "title": "Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14610" }, { "rank": 169, "cve_id": "CVE-2026-41124", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00127, "epss_percentile": 0.02763, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-22", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41124" }, { "rank": 170, "cve_id": "CVE-2026-8921", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00124, "epss_percentile": 0.02535, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "ASUS Business Manager", "cwe": "CWE-73", "title": "External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. Refer to the ' Security Update for ASUS Business Manager ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8921" }, { "rank": 171, "cve_id": "CVE-2026-12960", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00119, "epss_percentile": 0.02049, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "Router app", "cwe": "CWE-926", "title": "An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12960" }, { "rank": 172, "cve_id": "CVE-2026-14607", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00119, "epss_percentile": 0.02115, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "RT-Thread", "cwe": "CWE-119", "title": "RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14607" }, { "rank": 173, "cve_id": "CVE-2026-46730", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00116, "epss_percentile": 0.01895, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-863", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect authorization vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46730" }, { "rank": 174, "cve_id": "CVE-2026-46466", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00109, "epss_percentile": 0.01426, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-348", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of less trusted source vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46466" }, { "rank": 175, "cve_id": "CVE-2026-44268", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00104, "epss_percentile": 0.01188, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-732", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect permission Assignment for critical resource vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44268" }, { "rank": 176, "cve_id": "CVE-2022-4989", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00103, "epss_percentile": 0.0114, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "AI Suite 3", "cwe": "CWE-1284", "title": "** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4989" }, { "rank": 177, "cve_id": "CVE-2022-4990", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00096, "epss_percentile": 0.00792, "kev": false, "kev_due_at": null, "vendor": "ASUS", "product": "AI Suite 3", "cwe": "CWE-1284", "title": "** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information.", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4990" }, { "rank": 178, "cve_id": "CVE-2026-56085", "cvss_base": 3.3, "cvss_severity": "LOW", "epss_score": 0.00095, "epss_percentile": 0.00771, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-908", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of uninitialized resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56085" }, { "rank": 179, "cve_id": "CVE-2026-46467", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00085, "epss_percentile": 0.00368, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "PowerProtect Data Domain", "cwe": "CWE-532", "title": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46467" }, { "rank": 180, "cve_id": "CVE-2026-8804", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00079, "epss_percentile": 0.00171, "kev": false, "kev_due_at": null, "vendor": "Perforce", "product": "Puppet Core", "cwe": "CWE-312", "title": "Cleartext Storage of Sensitive Information for Puppet Resource API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8804" } ], "transactions": [ { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-10536", "detail": "EXPLOIT PUBLISHED — CVE-2026-10536 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11352", "detail": "EXPLOIT PUBLISHED — CVE-2026-11352 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11564", "detail": "EXPLOIT PUBLISHED — CVE-2026-11564 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11586", "detail": "EXPLOIT PUBLISHED — CVE-2026-11586 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11856", "detail": "EXPLOIT PUBLISHED — CVE-2026-11856 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-12064", "detail": "EXPLOIT PUBLISHED — CVE-2026-12064 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-12481", "detail": "EXPLOIT PUBLISHED — CVE-2026-12481 (keras-team/keras). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8286", "detail": "EXPLOIT PUBLISHED — CVE-2026-8286 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8458", "detail": "EXPLOIT PUBLISHED — CVE-2026-8458 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8924", "detail": "EXPLOIT PUBLISHED — CVE-2026-8924 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8925", "detail": "EXPLOIT PUBLISHED — CVE-2026-8925 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8926", "detail": "EXPLOIT PUBLISHED — CVE-2026-8926 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8927", "detail": "EXPLOIT PUBLISHED — CVE-2026-8927 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-8932", "detail": "EXPLOIT PUBLISHED — CVE-2026-8932 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9079", "detail": "EXPLOIT PUBLISHED — CVE-2026-9079 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9080", "detail": "EXPLOIT PUBLISHED — CVE-2026-9080 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9545", "detail": "EXPLOIT PUBLISHED — CVE-2026-9545 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9546", "detail": "EXPLOIT PUBLISHED — CVE-2026-9546 (curl). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-9547", "detail": "EXPLOIT PUBLISHED — CVE-2026-9547 (curl). Public exploit reference added." }, { "type": "DUE_DATE_PASSED", "cve_id": "CVE-2026-48558", "detail": "DUE DATE PASSED — CVE-2026-48558 (SimpleHelp). CISA remediation deadline was July 2, 2026; still in catalog." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }