boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Saturday, July 4, 2026 · all times UTC← 2026-07-03 · archive · 2026-07-05 →

69 CVEs published, led by picklescan (16).

69 CVEs published July 4, 2026: 1 critical, 30 high, 14 medium, 24 low; 0 in the KEV catalog at press time; 3 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 44 in the results table.

Standings

League
MTDYTD2025 same span2025 full
CVEs published8791326212492564
KEV catalog size1671

572 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux37151912086652812730.27.5.0013+3 ▲
google521316148586542377460.57.8.0023-436 ▼
microsoft50816615521886380283.47.8.0045+43 ▲
red hat1520712841029400.06.5.0026+7 ▲
apple0991236629477.16.5.00310
canonical0202585000.05.5.00110
freebsd01601240000.07.8.00150
suse2154830000.08.8.0036+2 ▲
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
ubiquiti2536142110438.38.8.0036+25 ▲
cisco83141280961135.57.5.0056+6 ▲
netgear01700161800.04.3.00240
palo alto networks011017114218.24.8.00220
checkpoint0915303111.17.5.04100
f50943107111.18.9.02210
ivanti09230033555.68.8.5187-1 ▼
fortinet08132028337.57.3.00660
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache5158246162104010.67.3.0048-27 ▼
mozilla25812182801300.07.3.0025-2 ▼
gitlab03305215426.14.4.00220
github171150000.06.0.0026+1 ▲
docker070520100.08.2.0016-1 ▼
drupal0511305120.05.1.00260
jenkins00000060———0
joomla00000010———0
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle02701311161844020.78.8.0040-1 ▼
adobe014611527827532.15.5.00210
ibm01243642460700.07.5.0025-5 ▼
progress2111910900.07.5.0035-3 ▼
solarwinds07122011457.17.5.0835-1 ▼
veeam042200400.09.0.00460
zohocorp031110000.08.4.01700
atlassian000000130———0
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
synology02325133000.05.6.0025-5 ▼
d-link01305252617.75.8.0059-2 ▼
siemens090450100.06.9.0019-1 ▼
rockwell automation071510000.08.7.00300
abb060420000.07.2.0018-4 ▼
schneider electric060420100.07.8.00240
moxa050320000.07.0.00290
dahua030111200.06.9.00360
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
sourcecodester778004137000.05.5.0026-13 ▼
dell2076134382211.36.7.0016+17 ▲
spring073231391000.06.5.0024-2 ▼
openclaw0670352210000.07.0.00210
edimax065039026100.07.4.00590
capgo061231271000.07.1.00310
themerex26055410000.08.1.0043+2 ▲
nvidia1756113870000.07.8.0019+15 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-10520.9990100.010.0
CVE-2026-20253.969499.99.8
CVE-2026-35273.954799.99.8
CVE-2026-34910.869699.710.0
CVE-2026-34908.851999.710.0
CVE-2026-20230.832199.78.6
CVE-2026-42271.830199.6—
CVE-2026-50751.825599.69.3
CVE-2026-48907.688399.310.0
CVE-2026-34909.639099.210.0
Highest CVSS
CVECVSSEPSSNote
CVE-2026-1052010.0.9990KEV
CVE-2026-3491010.0.8696KEV
CVE-2026-3490810.0.8519KEV
CVE-2026-4890710.0.6883KEV
CVE-2026-3490910.0.6390KEV
CVE-2026-5016010.0.1775
CVE-2026-4827610.0.0505
CVE-2026-1377310.0.0341
CVE-2026-5641310.0.0316
CVE-2026-5641510.0.0315
Most disclosures (vendor)
VendorCVEs
google654
linux517
microsoft264
oracle242
adobe142
red hat135
apache94
ibm70
spring70
capgo61
Most KEV additions (YTD)
VendorKEV
microsoft28
cisco11
apple7
google6
ivanti5
solarwinds4
synacor4
adobe3
fortinet3
linux3
Most-affected ecosystems
EcosystemAdvisories
Maven38
Packagist15
npm6
NuGet3
PyPI3
Fastest to KEV
CVEVendorDays
CVE-2025-67038Lantronix0
CVE-2026-10520ivanti0
CVE-2026-11645Google0
CVE-2026-12569PTC0
CVE-2026-20230Cisco0
CVE-2026-20245Cisco0
CVE-2026-20253Splunk0
CVE-2026-20262Cisco0
CVE-2026-28318SolarWinds0
CVE-2026-34908Ubiquiti Inc0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171690
CVE-2021-27102Accellion2021-11-171690
CVE-2021-27101Accellion2021-11-171690
CVE-2021-27103Accellion2021-11-171690
CVE-2021-21017Adobe2021-11-171690
CVE-2021-28550Adobe2021-11-171690
CVE-2021-42013Apache2021-11-171690
CVE-2021-41773Apache2021-11-171690
CVE-2021-30858Apple2021-11-171690
CVE-2021-30860Apple2021-11-171690

Transactions

EXPLOIT PUBLISHED — CVE-2026-12252 (nltk/nltk). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14534 (trailofbits fickling). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14535 (trailofbits fickling). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

69 CVEs published. 25 box scores, 44 table rows — nothing truncated.

CVE-2026-53359HIGH
Linux Linux — KVM: x86: Fix shadow paging use-after-free due to unexpected role
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  C  H  H  H    8.8   .0091   57.1     —
AFFECTED
  Product  Versions                                    Fixed
  Linux    2032a93d66fa282ba0f2ea9152eeff9511fa9a96 –  —
  Linux    2.6.36 –                                    6.1.177
TIMELINE
  Jun 9   Reserved by CNA
  Jul 4   Published (CNA: Linux)
CWE-416 · CNA: Linux · CVSS v3.1 · 8 references · NVD status: Modified
CVE-2026-14628MEDIUM
NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0067   49.3     —
AFFECTED
  Product       Versions    Fixed
  hermes-agent  2026.5.0 –  —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-22 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-14637HIGH
kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   H    7.8   .0061   46.5     —
AFFECTED
  Product                          Versions                                    Fixed
  Ecommerce-CodeIgniter-Bootstrap  13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7 –  —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-20, CWE-502 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2025-71364HIGH
picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0056   43.9     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.30
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71347HIGH
picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0044   37.2     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.33
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71366HIGH
picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0044   37.2     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.28
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71367HIGH
picklescan - Remote Code Execution via _operator.attrgetter Detection Bypass
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0044   37.2     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.34
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71369HIGH
picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0044   37.2     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.28
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71373HIGH
picklescan - Remote Code Execution via operator.methodcaller Detection Bypass
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0044   37.1     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.33
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-693 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-14635MEDIUM
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0044   36.7     —
AFFECTED
  Product                          Versions                                    Fixed
  Ecommerce-CodeIgniter-Bootstrap  222ff31c06687b1c6d0e1ab63953f82c3674c52b –  —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-22 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2025-71342HIGH
picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0043   35.8     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.30
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71345HIGH
picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_prof
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0043   35.8     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.30
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71359HIGH
picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0043   35.8     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.29
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-12195HIGH
myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can inser…
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   N   N    8.5   .0042   35.6     —
AFFECTED
  Product  Versions     Fixed
  vesta    unspecified  —
TIMELINE
  Jun 14  Reserved by CNA
  Jul 4   Published (CNA: PRJBLK)
CWE-78 · CNA: PRJBLK · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2025-71380HIGH
n8n - Arbitrary Command Execution via Execute Command Node
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0041   34.6     —
AFFECTED
  Product  Versions     Fixed
  n8n      unspecified  —
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-284 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-14622MEDIUM
jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.2     —
AFFECTED
  Product                       Versions                                    Fixed
  restaurant-website-php-mysql  521428b5b612449df0cf4a5d15ee40cba67f3d35 –  —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-287, CWE-306 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2025-71372HIGH
Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0038   31.2     —
AFFECTED
  Product     Versions     Fixed
  Picklescan  unspecified  0.0.33
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-14627LOW
NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   L   L   L    2.9   .0037   30.1     —
AFFECTED
  Product       Versions  Fixed
  hermes-agent  0.15.0 –  —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-287 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-14534HIGH
trailofbits fickling — Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0037   29.9     —
AFFECTED
  Product   Versions     Fixed
  fickling  unspecified  0.1.11
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Public exploit reference published
  Jul 4   Published (CNA: BombadilSystems)
CWE-184, CWE-502 · CNA: BombadilSystems · CVSS v3.1 · 4 references · NVD status: Analyzed
CVE-2025-71375HIGH
picklescan - Undetected Remote Code Execution via _operator.methodcaller
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   H   H   N    7.6   .0037   29.7     —
AFFECTED
  Product     Versions     Fixed
  picklescan  unspecified  0.0.34
TIMELINE
  Jun 20  Reserved by CNA
  Jul 4   Published (CNA: VulnCheck)
CWE-502 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred
CVE-2026-14648MEDIUM
code-projects Online Voting System Login authentication.php test_input sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0035   27.9     —
AFFECTED
  Product               Versions  Fixed
  Online Voting System  0.* –     —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-14535CRITICAL
trailofbits fickling — Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0033   26.2     —
AFFECTED
  Product   Versions     Fixed
  fickling  unspecified  0.1.12
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Public exploit reference published
  Jul 4   Published (CNA: BombadilSystems)
CWE-693 · CNA: BombadilSystems · CVSS v3.1 · 4 references · NVD status: Analyzed
CVE-2026-14636MEDIUM
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   L   L    5.3   .0032   25.2     —
AFFECTED
  Product                          Versions                                    Fixed
  Ecommerce-CodeIgniter-Bootstrap  23105f25dadf57b4314fc015a63a7c6e910c89df –  —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-22 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2026-14623LOW
omec-project amf NGAP Message RRCInactiveTransitionReport denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0032   24.5     —
AFFECTED
  Product  Versions  Fixed
  amf      2.1.0 –   —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred
CVE-2026-14624LOW
omec-project amf NGSetupRequest handler.go denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   L    2.1   .0032   24.5     —
AFFECTED
  Product  Versions  Fixed
  amf      2.0.0 –   —
TIMELINE
  Jul 3   Reserved by CNA
  Jul 4   Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-146182.124.4n/aOpen5GSCWE-404Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service
CVE-2026-146292.123.6n/aRT-ThreadCWE-369RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zero
CVE-2025-713437.622.7picklescanpicklescanCWE-502picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.…
CVE-2025-713537.622.7picklescanpicklescanCWE-502picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get
CVE-2025-713567.622.7picklescanpicklescanCWE-502picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shap…
CVE-2025-713607.622.7picklescanpicklescanCWE-502picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity
CVE-2025-713627.622.7picklescanpicklescanCWE-502picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2p…
CVE-2026-146332.121.3kirilkirkovEcommerce-CodeIgniter-BootstrapCWE-79kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cros…
CVE-2026-146342.121.3kirilkirkovEcommerce-CodeIgniter-BootstrapCWE-79kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Contro…
CVE-2026-146562.120.4code-projectsAssessment ManagementCWE-79code-projects Assessment Management remove-user.php cross site scripting
CVE-2026-146262.120.2NousResearchhermes-agentCWE-404NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation deni…
CVE-2026-146322.119.7kirilkirkovEcommerce-CodeIgniter-BootstrapCWE-601kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php…
CVE-2026-146496.919.1code-projectsOnline Voting SystemCWE-74code-projects Online Voting System saveVote.php test_input sql injection
CVE-2026-146425.519.1SourceCodesterClass and Exam Timetabling SystemCWE-74SourceCodester Class and Exam Timetabling System edit_class2.php sql injection
CVE-2026-146525.519.1SourceCodesterSimple and Nice Shopping Cart ScriptCWE-74SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql…
CVE-2026-146535.519.1SourceCodesterSimple and Nice Shopping Cart ScriptCWE-74SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.ph…
CVE-2026-146545.519.1SourceCodesterSimple and Nice Shopping Cart ScriptCWE-74SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.p…
CVE-2026-146415.518.6SourceCodesterClass and Exam Timetabling SystemCWE-74SourceCodester Class and Exam Timetabling System edit_course.php sql injection
CVE-2026-533627.818.5LinuxLinux—ipv6: account for fraggap on the paged allocation path
CVE-2026-146405.518.3CodeAstroApartment Visitor Management SystemCWE-74CodeAstro Apartment Visitor Management System Login index.php sql injection
CVE-2026-146605.518.3code-projectsOnline Job PortalCWE-74code-projects Online Job Portal login.php sql injection
CVE-2026-121968.317.4hestiacphestiacpCWE-287HestiaCP Admin Takeover
CVE-2026-146472.117.0n/aonnxCWE-119onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds
CVE-2026-121942.316.7phpipamphpipamCWE-98PHPIPAM Authenticated LFI
CVE-2026-544248.416.0UnityParsecCWE-648An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows …
CVE-2026-146211.315.5FederatedAIFATECWE-488FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStrea…
CVE-2026-146252.113.4NousResearchhermes-agentCWE-693NousResearch hermes-agent server.py shell.exec protection mechanism
CVE-2026-146551.912.1code-projectsAssessment ManagementCWE-79code-projects Assessment Management view-users.php cross site scripting
CVE-2026-146192.110.8itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System medicine.php sql injection
CVE-2026-146572.110.8code-projectsAssessment ManagementCWE-74code-projects Assessment Management Database Query marking-scheme.php sql inj…
CVE-2026-146382.110.2itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System patient.php sql injection
CVE-2026-146392.110.2CodeAstroEcommerce WebsiteCWE-74CodeAstro Ecommerce Website my_account.php sql injection
CVE-2026-146582.110.2code-projectsAssessment ManagementCWE-74code-projects Assessment Management marking-scheme.php sql injection
CVE-2026-146592.110.2itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System patientappointment.php sql injection
CVE-2026-122527.89.5nltknltk/nltkCWE-94Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk
CVE-2026-127468.18.6BIAFRADancer2::Plugin::Auth::OAuth::ProviderCWE-352Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not s…
CVE-2026-533608.88.2LinuxLinuxCWE-125KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
CVE-2024-12485.38.2WSO2WSO2 API ManagerCWE-298Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enable…
CVE-2026-127408.16.9CORNELIUSPlack::Middleware::OAuthCWE-352Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OA…
CVE-2026-146301.35.7ForceInjectionAI-fundermentalsCWE-327ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_c…
CVE-2025-134757.35.5WSO2WSO2 Identity ServerCWE-288Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Pr…
CVE-2026-533617.13.1LinuxLinux—af_unix: Set gc_in_progress to true in unix_gc().
CVE-2026-146501.91.9connorskeesgrassCWE-404connorskees grass UTF-8 Character raw_to_parse_error denial of service
CVE-2026-146511.91.8connorskeesgrassCWE-404connorskees grass visitor denial of service

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-04 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion.