{
  "day": "2026-07-04",
  "boundary": "UTC calendar day",
  "published_count": 69,
  "by_severity": {
    "CRITICAL": 1,
    "HIGH": 30,
    "MEDIUM": 14,
    "LOW": 24
  },
  "kev_count": 0,
  "exploit_reference_count": 3,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-53359",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00908,
      "epss_percentile": 0.5715,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-416",
      "title": "KVM: x86: Fix shadow paging use-after-free due to unexpected role",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53359"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-14628",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00672,
      "epss_percentile": 0.49261,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-22",
      "title": "NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14628"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-14637",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0061,
      "epss_percentile": 0.46547,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-20",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14637"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2025-71364",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00555,
      "epss_percentile": 0.43881,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via Undetected asyncio.unix_events._UnixSubprocessTransport._start",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71364"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2025-71347",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00445,
      "epss_percentile": 0.37164,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Undetected Remote Code Execution via numpy.f2py.crackfortran.param_eval",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71347"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2025-71366",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00445,
      "epss_percentile": 0.37164,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71366"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2025-71367",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00445,
      "epss_percentile": 0.37163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via _operator.attrgetter Detection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71367"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2025-71369",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00445,
      "epss_percentile": 0.37163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Unsafe Deserialization via torch.utils.data.datapipes.utils.decoder.basichandlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71369"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2025-71373",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00444,
      "epss_percentile": 0.37115,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-693",
      "title": "picklescan - Remote Code Execution via operator.methodcaller Detection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71373"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-14635",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00439,
      "epss_percentile": 0.36713,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-22",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14635"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2025-71342",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00427,
      "epss_percentile": 0.35816,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Undetected Remote Code Execution via idlelib.run.Executive.runcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71342"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2025-71345",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00427,
      "epss_percentile": 0.35815,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_autograd_prof",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71345"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2025-71359",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00427,
      "epss_percentile": 0.35816,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Unsafe Deserialization via lib2to3.pgen2.grammar.Grammar.loads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71359"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-12195",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00424,
      "epss_percentile": 0.35554,
      "kev": false,
      "kev_due_at": null,
      "vendor": "myvesta",
      "product": "vesta",
      "cwe": "CWE-78",
      "title": "myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12195"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2025-71380",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00413,
      "epss_percentile": 0.34594,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n8n",
      "product": "n8n",
      "cwe": "CWE-284",
      "title": "n8n - Arbitrary Command Execution via Execute Command Node",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71380"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-14622",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00408,
      "epss_percentile": 0.34172,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jairiidriss",
      "product": "restaurant-website-php-mysql",
      "cwe": "CWE-287",
      "title": "jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14622"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2025-71372",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00379,
      "epss_percentile": 0.31249,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Picklescan",
      "product": "Picklescan",
      "cwe": "CWE-502",
      "title": "Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran.getlincoef Gadget",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71372"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-14627",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00369,
      "epss_percentile": 0.30071,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-287",
      "title": "NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14627"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-14534",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00366,
      "epss_percentile": 0.29879,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trailofbits",
      "product": "fickling",
      "cwe": "CWE-184",
      "title": "Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14534"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2025-71375",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00365,
      "epss_percentile": 0.29704,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Undetected Remote Code Execution via _operator.methodcaller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71375"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-14648",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00347,
      "epss_percentile": 0.27929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Voting System",
      "cwe": "CWE-74",
      "title": "code-projects Online Voting System Login authentication.php test_input sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14648"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-14535",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00332,
      "epss_percentile": 0.26228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trailofbits",
      "product": "fickling",
      "cwe": "CWE-693",
      "title": "Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14535"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-14636",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00323,
      "epss_percentile": 0.25248,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-22",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14636"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-14623",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00317,
      "epss_percentile": 0.24499,
      "kev": false,
      "kev_due_at": null,
      "vendor": "omec-project",
      "product": "amf",
      "cwe": "CWE-404",
      "title": "omec-project amf NGAP Message RRCInactiveTransitionReport denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14623"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-14624",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00317,
      "epss_percentile": 0.24499,
      "kev": false,
      "kev_due_at": null,
      "vendor": "omec-project",
      "product": "amf",
      "cwe": "CWE-404",
      "title": "omec-project amf NGSetupRequest handler.go denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14624"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-14618",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00316,
      "epss_percentile": 0.2445,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Open5GS",
      "cwe": "CWE-404",
      "title": "Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14618"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-14629",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00309,
      "epss_percentile": 0.23636,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "RT-Thread",
      "cwe": "CWE-369",
      "title": "RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zero",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14629"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2025-71343",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.22695,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via lib2to3.pgen2.pgen.ParserGenerator.make_label Detection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71343"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2025-71353",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.22697,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via torch._dynamo.guards.GuardBuilder.get",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71353"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2025-71356",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.22697,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71356"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2025-71360",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.22696,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Remote Code Execution via Undetected idlelib.calltip.get_entity",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71360"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2025-71362",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.003,
      "epss_percentile": 0.22696,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picklescan",
      "product": "picklescan",
      "cwe": "CWE-502",
      "title": "picklescan - Arbitrary Code Execution via Unsafe Deserialization in numpy.f2py.crackfortran",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71362"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-14633",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00288,
      "epss_percentile": 0.21325,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-79",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14633"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-14634",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00288,
      "epss_percentile": 0.21325,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-79",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14634"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-14656",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00278,
      "epss_percentile": 0.20383,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-79",
      "title": "code-projects Assessment Management remove-user.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14656"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-14626",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00277,
      "epss_percentile": 0.20195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-404",
      "title": "NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14626"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-14632",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00273,
      "epss_percentile": 0.197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kirilkirkov",
      "product": "Ecommerce-CodeIgniter-Bootstrap",
      "cwe": "CWE-601",
      "title": "kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14632"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-14649",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.19115,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Voting System",
      "cwe": "CWE-74",
      "title": "code-projects Online Voting System saveVote.php test_input sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14649"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-14642",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.19118,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_class2.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14642"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-14652",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.19115,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Simple and Nice Shopping Cart Script",
      "cwe": "CWE-74",
      "title": "SourceCodester Simple and Nice Shopping Cart Script Admin Login login.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14652"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-14653",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.19115,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Simple and Nice Shopping Cart Script",
      "cwe": "CWE-74",
      "title": "SourceCodester Simple and Nice Shopping Cart Script mensproductdeletequery.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14653"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-14654",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.19116,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Simple and Nice Shopping Cart Script",
      "cwe": "CWE-74",
      "title": "SourceCodester Simple and Nice Shopping Cart Script girlsproductdeletequery.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14654"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-14641",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00266,
      "epss_percentile": 0.18591,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_course.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14641"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-53362",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00265,
      "epss_percentile": 0.18548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "ipv6: account for fraggap on the paged allocation path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53362"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-14640",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.1829,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CodeAstro",
      "product": "Apartment Visitor Management System",
      "cwe": "CWE-74",
      "title": "CodeAstro Apartment Visitor Management System Login index.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14640"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-14660",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.18289,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Job Portal",
      "cwe": "CWE-74",
      "title": "code-projects Online Job Portal login.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14660"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-12196",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00256,
      "epss_percentile": 0.17423,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hestiacp",
      "product": "hestiacp",
      "cwe": "CWE-287",
      "title": "HestiaCP Admin Takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12196"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-14647",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00253,
      "epss_percentile": 0.17025,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "onnx",
      "cwe": "CWE-119",
      "title": "onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14647"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-12194",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.0025,
      "epss_percentile": 0.16681,
      "kev": false,
      "kev_due_at": null,
      "vendor": "phpipam",
      "product": "phpipam",
      "cwe": "CWE-98",
      "title": "PHPIPAM Authenticated LFI",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12194"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-54424",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00245,
      "epss_percentile": 0.16017,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unity",
      "product": "Parsec",
      "cwe": "CWE-648",
      "title": "An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\\SYSTEM with a user-controlled value of the AppData environment variable.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54424"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-14621",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": 0.0024,
      "epss_percentile": 0.15457,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FederatedAI",
      "product": "FATE",
      "cwe": "CWE-488",
      "title": "FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14621"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-14625",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00224,
      "epss_percentile": 0.1335,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NousResearch",
      "product": "hermes-agent",
      "cwe": "CWE-693",
      "title": "NousResearch hermes-agent server.py shell.exec protection mechanism",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14625"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-14655",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00214,
      "epss_percentile": 0.12113,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-79",
      "title": "code-projects Assessment Management view-users.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14655"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-14619",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00204,
      "epss_percentile": 0.10759,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System medicine.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14619"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-14657",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00204,
      "epss_percentile": 0.1076,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-74",
      "title": "code-projects Assessment Management Database Query marking-scheme.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14657"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-14638",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.10245,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System patient.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14638"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-14639",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.10247,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CodeAstro",
      "product": "Ecommerce Website",
      "cwe": "CWE-74",
      "title": "CodeAstro Ecommerce Website my_account.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14639"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-14658",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.10241,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Assessment Management",
      "cwe": "CWE-74",
      "title": "code-projects Assessment Management marking-scheme.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14658"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-14659",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.1024,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System patientappointment.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14659"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-12252",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00195,
      "epss_percentile": 0.09528,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nltk",
      "product": "nltk/nltk",
      "cwe": "CWE-94",
      "title": "Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12252"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-12746",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00186,
      "epss_percentile": 0.08556,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BIAFRA",
      "product": "Dancer2::Plugin::Auth::OAuth::Provider",
      "cwe": "CWE-352",
      "title": "Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12746"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-53360",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00183,
      "epss_percentile": 0.08187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": "CWE-125",
      "title": "KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53360"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2024-1248",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00182,
      "epss_percentile": 0.0816,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WSO2",
      "product": "WSO2 API Manager",
      "cwe": "CWE-298",
      "title": "Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1248"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-12740",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00172,
      "epss_percentile": 0.06948,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CORNELIUS",
      "product": "Plack::Middleware::OAuth",
      "cwe": "CWE-352",
      "title": "Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12740"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-14630",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": 0.0016,
      "epss_percentile": 0.05654,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ForceInjection",
      "product": "AI-fundermentals",
      "cwe": "CWE-327",
      "title": "ForceInjection AI-fundermentals Memory Recall smart_customer_service.py get_conversation_history weak hash",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14630"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2025-13475",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00158,
      "epss_percentile": 0.0548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WSO2",
      "product": "WSO2 Identity Server",
      "cwe": "CWE-288",
      "title": "Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13475"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-53361",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.0312,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "af_unix: Set gc_in_progress to true in unix_gc().",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53361"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-14650",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00116,
      "epss_percentile": 0.01892,
      "kev": false,
      "kev_due_at": null,
      "vendor": "connorskees",
      "product": "grass",
      "cwe": "CWE-404",
      "title": "connorskees grass UTF-8 Character raw_to_parse_error denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14650"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-14651",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00115,
      "epss_percentile": 0.01822,
      "kev": false,
      "kev_due_at": null,
      "vendor": "connorskees",
      "product": "grass",
      "cwe": "CWE-404",
      "title": "connorskees grass visitor denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14651"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-12252",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-12252 (nltk/nltk). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-14534",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-14534 (trailofbits fickling). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-14535",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-14535 (trailofbits fickling). Public exploit reference added."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}