A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?
362 CVEs published, led by Foxit Software Inc. (28).
362 CVEs published July 8, 2026: 26 critical, 170 high, 148 medium, 18 low; 0 in the KEV catalog at press time; 45 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 337 in the results table.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 1693 | 14096 | — | — |
| KEV catalog size | 1675 | |||
Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.
Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.
616 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 37 | 1517 | 120 | 866 | 530 | 1 | 11 | 2 | 0.1 | 7.5 | .0014 | -37 ▼ |
| 79 | 1344 | 149 | 608 | 549 | 38 | 77 | 6 | 0.4 | 7.8 | .0024 | -482 ▼ | |
| microsoft | 52 | 809 | 61 | 553 | 189 | 6 | 286 | 20 | 2.5 | 7.8 | .0046 | +45 ▲ |
| red hat | 31 | 253 | 12 | 99 | 126 | 16 | 2 | 0 | 0.0 | 6.5 | .0030 | +9 ▲ |
| apple | 0 | 104 | 2 | 28 | 72 | 2 | 88 | 7 | 6.7 | 6.5 | .0032 | 0 |
| canonical | 1 | 21 | 2 | 6 | 8 | 5 | 0 | 0 | 0.0 | 5.5 | .0011 | +1 ▲ |
| suse | 6 | 19 | 4 | 11 | 4 | 0 | 0 | 0 | 0.0 | 8.6 | .0042 | +6 ▲ |
| freebsd | 0 | 16 | 0 | 12 | 4 | 0 | 0 | 0 | 0.0 | 7.8 | .0016 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ubiquiti | 25 | 36 | 14 | 21 | 1 | 0 | 3 | 3 | 8.3 | 8.8 | .0049 | +25 ▲ |
| cisco | 8 | 30 | 6 | 14 | 10 | 0 | 56 | 11 | 36.7 | 7.5 | .0057 | +6 ▲ |
| netgear | 0 | 17 | 0 | 0 | 16 | 1 | 0 | 0 | 0.0 | 4.3 | .0024 | 0 |
| palo alto networks | 1 | 12 | 1 | 3 | 7 | 1 | 13 | 2 | 16.7 | 6.0 | .0024 | +1 ▲ |
| checkpoint | 0 | 9 | 1 | 5 | 3 | 0 | 3 | 1 | 11.1 | 7.5 | .0410 | -2 ▼ |
| fortinet | 0 | 9 | 4 | 3 | 2 | 0 | 28 | 3 | 33.3 | 8.3 | .0076 | 0 |
| ivanti | 0 | 9 | 4 | 5 | 0 | 0 | 25 | 5 | 55.6 | 8.8 | .5187 | -1 ▼ |
| f5 | 0 | 8 | 4 | 3 | 1 | 0 | 4 | 1 | 12.5 | 8.9 | .0225 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 51 | 206 | 38 | 79 | 77 | 11 | 33 | 1 | 0.5 | 7.3 | .0058 | +5 ▲ |
| mozilla | 3 | 59 | 12 | 18 | 29 | 0 | 9 | 0 | 0.0 | 7.3 | .0025 | -1 ▼ |
| gitlab | 7 | 38 | 0 | 5 | 27 | 6 | 4 | 2 | 5.3 | 4.7 | .0032 | +7 ▲ |
| github | 1 | 7 | 1 | 1 | 5 | 0 | 0 | 0 | 0.0 | 6.0 | .0039 | +1 ▲ |
| docker | 0 | 7 | 0 | 5 | 2 | 0 | 0 | 0 | 0.0 | 8.2 | .0016 | -2 ▼ |
| drupal | 0 | 5 | 1 | 1 | 3 | 0 | 4 | 1 | 20.0 | 5.1 | .0026 | 0 |
| wordpress | 0 | 0 | 0 | 0 | 0 | 0 | 2 | 0 | — | — | — | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 0 | 270 | 132 | 116 | 18 | 4 | 27 | 2 | 0.7 | 8.8 | .0040 | 0 |
| adobe | 3 | 147 | 13 | 53 | 79 | 2 | 19 | 3 | 2.0 | 6.1 | .0021 | +3 ▲ |
| ibm | 2 | 126 | 38 | 42 | 46 | 0 | 6 | 0 | 0.0 | 7.5 | .0034 | -3 ▼ |
| progress | 10 | 19 | 3 | 14 | 2 | 0 | 6 | 0 | 0.0 | 7.5 | .0037 | +5 ▲ |
| solarwinds | 0 | 7 | 2 | 3 | 2 | 0 | 10 | 4 | 57.1 | 7.5 | .4001 | -2 ▼ |
| veeam | 0 | 4 | 2 | 2 | 0 | 0 | 1 | 0 | 0.0 | 9.0 | .0052 | 0 |
| zohocorp | 0 | 3 | 1 | 1 | 1 | 0 | 0 | 0 | 0.0 | 8.4 | .0170 | 0 |
| atlassian | 0 | 0 | 0 | 0 | 0 | 0 | 13 | 0 | — | — | — | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| synology | 0 | 23 | 2 | 5 | 13 | 3 | 0 | 0 | 0.0 | 5.6 | .0025 | -5 ▼ |
| d-link | 0 | 12 | 0 | 5 | 2 | 5 | 3 | 0 | 0.0 | 5.8 | .0058 | -8 ▼ |
| siemens | 0 | 9 | 0 | 4 | 5 | 0 | 0 | 0 | 0.0 | 6.9 | .0021 | -1 ▼ |
| rockwell automation | 0 | 7 | 1 | 5 | 1 | 0 | 0 | 0 | 0.0 | 8.7 | .0030 | 0 |
| abb | 0 | 6 | 0 | 4 | 2 | 0 | 0 | 0 | 0.0 | 7.2 | .0018 | -4 ▼ |
| schneider electric | 0 | 6 | 0 | 4 | 2 | 0 | 0 | 0 | 0.0 | 7.8 | .0042 | 0 |
| moxa | 0 | 5 | 0 | 3 | 2 | 0 | 0 | 0 | 0.0 | 7.0 | .0029 | 0 |
| dahua | 0 | 3 | 0 | 1 | 1 | 1 | 0 | 0 | 0.0 | 6.9 | .0036 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sourcecodester | 27 | 98 | 0 | 0 | 52 | 46 | 0 | 0 | 0.0 | 5.5 | .0029 | -8 ▼ |
| dell | 27 | 83 | 4 | 38 | 38 | 3 | 2 | 1 | 1.2 | 7.0 | .0020 | +24 ▲ |
| spring | 0 | 73 | 2 | 31 | 39 | 1 | 0 | 0 | 0.0 | 6.5 | .0024 | -2 ▼ |
| capgo | 7 | 68 | 2 | 34 | 31 | 1 | 0 | 0 | 0.0 | 7.0 | .0037 | +7 ▲ |
| openclaw | 1 | 68 | 0 | 36 | 22 | 10 | 0 | 0 | 0.0 | 7.0 | .0021 | +1 ▲ |
| edimax | 0 | 65 | 0 | 39 | 0 | 26 | 1 | 0 | 0.0 | 7.4 | .0080 | 0 |
| itsourcecode | 10 | 63 | 0 | 0 | 19 | 44 | 0 | 0 | 0.0 | 2.1 | .0033 | -12 ▼ |
| themerex | 2 | 60 | 5 | 54 | 1 | 0 | 0 | 0 | 0.0 | 8.1 | .0043 | +2 ▲ |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-10520 | .9991 | 100.0 | 10.0 |
| CVE-2026-20253 | .9694 | 99.9 | 9.8 |
| CVE-2026-35273 | .9547 | 99.9 | 9.8 |
| CVE-2026-20230 | .8820 | 99.8 | 8.6 |
| CVE-2026-34910 | .8747 | 99.7 | 10.0 |
| CVE-2026-34908 | .8519 | 99.7 | 10.0 |
| CVE-2026-48907 | .7810 | 99.5 | 10.0 |
| CVE-2026-45659 | .7608 | 99.5 | 8.8 |
| CVE-2026-34909 | .6390 | 99.2 | 10.0 |
| CVE-2026-49160 | .5383 | 98.9 | 7.5 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-10520 | 10.0 | .9991 | KEV |
| CVE-2026-34910 | 10.0 | .8747 | KEV |
| CVE-2026-34908 | 10.0 | .8519 | KEV |
| CVE-2026-48907 | 10.0 | .7810 | KEV |
| CVE-2026-34909 | 10.0 | .6390 | KEV |
| CVE-2026-48282 | 10.0 | .4239 | KEV |
| CVE-2026-56290 | 10.0 | .3038 | KEV |
| CVE-2026-48908 | 10.0 | .1482 | KEV |
| CVE-2026-13773 | 10.0 | .0610 | |
| CVE-2026-56415 | 10.0 | .0436 |
| Vendor | CVEs |
|---|---|
| 608 | |
| linux | 476 |
| microsoft | 266 |
| oracle | 242 |
| adobe | 145 |
| red hat | 137 |
| apache | 126 |
| ibm | 72 |
| spring | 70 |
| capgo | 68 |
| Vendor | KEV |
|---|---|
| microsoft | 20 |
| cisco | 11 |
| apple | 7 |
| 6 | |
| ivanti | 5 |
| solarwinds | 4 |
| adobe | 3 |
| berriai | 3 |
| fortinet | 3 |
| smartertools | 3 |
| Ecosystem | Advisories |
|---|---|
| Maven | 69 |
| Packagist | 13 |
| PyPI | 6 |
| npm | 6 |
| NuGet | 3 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2026-10520 | ivanti | 0 |
| CVE-2026-11645 | 0 | |
| CVE-2026-12569 | PTC | 0 |
| CVE-2026-20230 | Cisco | 0 |
| CVE-2026-20245 | Cisco | 0 |
| CVE-2026-20253 | Splunk | 0 |
| CVE-2026-20262 | Cisco | 0 |
| CVE-2026-34908 | Ubiquiti Inc | 0 |
| CVE-2026-34909 | Ubiquiti Inc | 0 |
| CVE-2026-34910 | Ubiquiti Inc | 0 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | n/a | 2021-11-17 | 1694 |
| CVE-2021-27102 | n/a | 2021-11-17 | 1694 |
| CVE-2021-27101 | n/a | 2021-11-17 | 1694 |
| CVE-2021-27103 | n/a | 2021-11-17 | 1694 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1694 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1694 |
| CVE-2021-42013 | Apache Software Foundation | 2021-11-17 | 1694 |
| CVE-2021-41773 | Apache Software Foundation | 2021-11-17 | 1694 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1694 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1694 |
EXPLOIT PUBLISHED — lepture mistune: 8 CVEs (CVE-2026-59922, CVE-2026-59923, CVE-2026-59924, CVE-2026-59925, CVE-2026-59927, CVE-2026-59928, CVE-2026-59929, CVE-2026-59930). Public exploit references added.
EXPLOIT PUBLISHED — Wireshark Foundation Wireshark: 8 CVEs (CVE-2026-15165, CVE-2026-15166, CVE-2026-15167, CVE-2026-15168, CVE-2026-15169, CVE-2026-15170, CVE-2026-15171, CVE-2026-15172). Public exploit references added.
EXPLOIT PUBLISHED — gofiber fiber: 3 CVEs (CVE-2026-44332, CVE-2026-45045, CVE-2026-53624). Public exploit references added.
EXPLOIT PUBLISHED — isaacs node-tar: 3 CVEs (CVE-2026-59871, CVE-2026-59873, CVE-2026-59874). Public exploit references added.
EXPLOIT PUBLISHED — nodeca js-yaml: 3 CVEs (CVE-2026-59868, CVE-2026-59869, CVE-2026-59870). Public exploit references added.
EXPLOIT PUBLISHED — CVE-2026-15105 (davenardella snap7). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-15164 (Wireshark Foundation ciscodump). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-24700. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-44512 (onnx). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-54499 (stanfordnlp stanza). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-54527 (jupyterlab-git). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-54528 (jupyterlab-git). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55470 (hapifhir org.hl7.fhir.core). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55471 (hapifhir org.hl7.fhir.core). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55761 (portainer). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-56297 (FreeRDP). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-58191 (appium). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-59879 (immutable-js). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-59880 (immutable-js). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-59890 (pypa setuptools). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-59939 (httplib2). Public exploit reference added.
How to read these box scores · glossary
362 CVEs published. 25 box scores, 337 table rows — nothing truncated.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P N N H H H 9.2 .0357 88.5 —
AFFECTED Product Versions Fixed Blocksy Companion unspecified 2.1.47
TIMELINE Jun 30 Reserved by CNA Jul 8 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P L N H H H 7.7 .0327 87.4 —
AFFECTED Product Versions Fixed Vfs unspecified —
TIMELINE Jul 8 Reserved by CNA Jul 8 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N L N L L L 1.9 .0222 81.3 —
AFFECTED Product Versions Fixed OpenLLM 0.6.30 – —
TIMELINE Jul 8 Reserved by CNA Jul 8 Published (CNA: VulDB)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0185 77.5 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jan 23 Reserved by CNA Jul 8 Public exploit reference published Jul 8 Published (CNA: mitre)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L L L 5.3 .0182 77.0 —
AFFECTED Product Versions Fixed check-peer-dependencies 4.3.0 – —
TIMELINE Jul 8 Reserved by CNA Jul 8 Published (CNA: VulDB)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0158 73.6 —
AFFECTED Product Versions Fixed My Calendar – Accessible Event Manager unspecified —
TIMELINE Apr 22 Reserved by CNA Jul 8 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H N 9.1 .0151 72.5 —
AFFECTED Product Versions Fixed Apache Gravitino unspecified —
TIMELINE Apr 16 Reserved by CNA Jul 8 Published (CNA: apache)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0147 71.7 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jan 23 Reserved by CNA Jul 8 Published (CNA: mitre)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0147 71.7 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jan 23 Reserved by CNA Jul 8 Published (CNA: mitre)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H H H 7.2 .0147 71.7 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jan 23 Reserved by CNA Jul 8 Published (CNA: mitre)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H H 9.1 .0117 64.9 —
AFFECTED Product Versions Fixed Simple Coherent Form unspecified —
TIMELINE Jul 2 Reserved by CNA Jul 8 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0109 62.7 —
AFFECTED Product Versions Fixed fluentd < 1.19.3 – —
TIMELINE May 4 Reserved by CNA Jul 8 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0103 61.0 —
AFFECTED Product Versions Fixed Jssor Slider by jssor.com unspecified —
TIMELINE Jun 30 Reserved by CNA Jul 8 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0103 61.0 —
AFFECTED Product Versions Fixed WHMCS Bridge unspecified —
TIMELINE Jul 2 Reserved by CNA Jul 8 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0095 58.6 —
AFFECTED Product Versions Fixed Widget Logic Visual unspecified —
TIMELINE Jun 30 Reserved by CNA Jul 8 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0093 57.8 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Jun 8 Reserved by CNA Jul 8 Published (CNA: mitre)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0085 55.3 —
AFFECTED Product Versions Fixed CoreWCF >= 1.9.0, < 1.9.1 – —
TIMELINE Jun 15 Reserved by CNA Jul 8 Published (CNA: GitHub_M)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P N N H H H 7.2 .0083 54.9 —
AFFECTED Product Versions Fixed Cloud NGFW unspecified All PAN-OS 12.1.0 – 12.1.8 Prisma Access 11.2.0 – 11.2.7-h18
TIMELINE Nov 3 Reserved by CNA Jul 8 Published (CNA: palo_alto)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0078 53.3 —
AFFECTED Product Versions Fixed opentelemetry-js < 2.9.0 – —
TIMELINE Jul 7 Reserved by CNA Jul 8 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0077 52.8 —
AFFECTED Product Versions Fixed DoLogin Security unspecified —
TIMELINE Jul 2 Reserved by CNA Jul 8 Published (CNA: Wordfence)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N N H 8.7 .0074 51.9 —
AFFECTED Product Versions Fixed rpcx unspecified 047aec18efa7d037105e2b72c36dd2ae05e1acc6
TIMELINE Jul 7 Reserved by CNA Jul 8 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0074 51.9 —
AFFECTED Product Versions Fixed nats-server < 2.12.12 – —
TIMELINE Jun 29 Reserved by CNA Jul 8 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0074 51.9 —
AFFECTED Product Versions Fixed nats-server < 2.11.17 – —
TIMELINE Jun 29 Reserved by CNA Jul 8 Published (CNA: GitHub_M)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N L H 8.8 .0074 51.8 —
AFFECTED Product Versions Fixed u-boot unspecified —
TIMELINE Mar 3 Reserved by CNA Jul 8 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N N H 8.7 .0071 50.6 —
AFFECTED Product Versions Fixed u-boot unspecified —
TIMELINE Mar 3 Reserved by CNA Jul 8 Published (CNA: VulnCheck)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-55470 | 7.5 | 49.6 | hapifhir | org.hl7.fhir.core | CWE-1333 | HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection all… |
| CVE-2026-12153 | 9.8 | 49.3 | rabilal | WP Learn Manager | CWE-862 | WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrar… |
| CVE-2026-29007 | 6.9 | 49.2 | u-boot | u-boot | CWE-125 | U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c |
| CVE-2026-59879 | 8.7 | 49.0 | immutable-js | immutable-js | CWE-190 | Immutable.js `List` 32-bit trie overflow → unrecoverable DoS |
| CVE-2026-59880 | 8.7 | 49.0 | immutable-js | immutable-js | CWE-407 | Immutable.js: Hash-collision algorithmic complexity denial of service in Immu… |
| CVE-2026-14454 | 9.8 | 48.7 | TONYC | Imager | CWE-196 | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as… |
| CVE-2026-56843 | 9.9 | 48.6 | Webpros | Plesk | CWE-522 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 … |
| CVE-2026-59821 | 2.1 | 48.6 | BerriAI | litellm | CWE-94 | LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks |
| CVE-2026-59928 | 7.5 | 48.4 | lepture | mistune | CWE-407 | Mistune block_parser: quadratic-time parsing on long lists of repeated refere… |
| CVE-2026-12378 | 8.1 | 48.2 | Unknown | Appointment Booking Calendar Plugin and Scheduling Plugin | — | BookingPress <= 1.1.28 - Unauthenticated PHP Object Injection |
| CVE-2026-59868 | 7.5 | 48.1 | nodeca | js-yaml | CWE-770 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| CVE-2026-59870 | 7.5 | 48.1 | nodeca | js-yaml | CWE-770 | js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing |
| CVE-2026-59871 | 7.5 | 48.1 | isaacs | node-tar | CWE-704 | node-tar: Process crash via PAX numeric path type confusion |
| CVE-2026-59922 | 7.5 | 48.1 | lepture | mistune | CWE-407 | Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `… |
| CVE-2026-59925 | 7.5 | 48.1 | lepture | mistune | CWE-407 | inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` e… |
| CVE-2026-10698 | 7.2 | 48.1 | Progress | MOVEit Transfer | CWE-943 | Table scope bypass vulnerability in custom reports |
| CVE-2026-59725 | 7.5 | 47.8 | socketio | socket.io | CWE-404 | Socket.IO: Engine.IO Polling Transport Connection Exhaustion |
| CVE-2026-49866 | 7.5 | 47.4 | libp2p | js-libp2p | CWE-770 | libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays |
| CVE-2026-56669 | 7.5 | 47.4 | elysiajs | elysia | CWE-407 | Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict |
| CVE-2026-31309 | 9.8 | 47.0 | n/a | n/a | CWE-862 | Improper authorization in the /tequilapi/config/user endpoint of Mysterium No… |
| CVE-2026-59935 | 8.7 | 47.0 | py-pdf | pypdf | CWE-835 | pypdf: Possible infinite loop for not terminated inline images (ASCII85 and A… |
| CVE-2026-44160 | 7.5 | 47.0 | fluent | fluentd | CWE-409 | Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and… |
| CVE-2026-49146 | 7.5 | 46.5 | PETDANCE | App::Ack | CWE-770 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbou… |
| CVE-2026-59724 | 7.5 | 46.5 | socketio | socket.io | CWE-20 | Socket.IO: Engine.IO WebTransport SID DoS |
| CVE-2026-59887 | 7.5 | 46.5 | markdown-it | linkify-it | CWE-407 | linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on… |
| CVE-2026-9695 | 9.8 | 46.3 | Dassault Systèmes | DELMIA Apriso | CWE-287 | Improper Authentication vulnerability affecting DELMIA Apriso from Release 20… |
| CVE-2026-58208 | 7.5 | 46.1 | nats-io | nats-server | CWE-248 | NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Serv… |
| CVE-2026-54775 | 6.5 | 46.0 | CoreWCF | CoreWCF | CWE-248 | CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-valu… |
| CVE-2026-57480 | 8.7 | 45.6 | parse-community | parse-server | CWE-407 | Parse Server: Denial of service via exponential-time processing of deeply nes… |
| CVE-2026-14482 | 8.8 | 45.5 | shen2 | 多说社会化评论框 | CWE-269 | 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'… |
| CVE-2026-54061 | 9.1 | 45.2 | dgraph-io | dgraph | CWE-306 | Dgraph Alpha group stores can be replaced via unauthenticated external snapsh… |
| CVE-2026-59257 | 5.3 | 44.7 | n8n | n8n | CWE-89 | n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpo… |
| CVE-2026-55471 | 8.7 | 44.5 | hapifhir | org.hl7.fhir.core | CWE-611 | HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon Transform… |
| CVE-2026-58207 | 6.5 | 44.1 | nats-io | nats-server | CWE-190 | NATS Server: Remote crash via integer overflow in Connz pagination |
| CVE-2026-59873 | 9.2 | 43.9 | isaacs | node-tar | CWE-770 | node-tar: Decompression/parse DoS via unlimited input |
| CVE-2026-55778 | 2.1 | 43.7 | parse-community | parse-server | CWE-434 | Parse Server: Stored XSS via non-standard file extension bypassing file uploa… |
| CVE-2026-59869 | 7.5 | 43.2 | nodeca | js-yaml | CWE-407 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| CVE-2026-15067 | 8.8 | 42.4 | Snowflake | Terraform Provider for Snowflake | CWE-89 | Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could A… |
| CVE-2026-55760 | 7.5 | 42.4 | jknack | handlebars.java | CWE-22 | handlebars.java FileTemplateLoader Path Traversal |
| CVE-2026-54527 | 9.3 | 42.3 | jupyterlab | jupyterlab-git | CWE-79 | JupyterLab Git: Stored XSS leading to RCE |
| CVE-2026-59927 | 5.3 | 42.4 | lepture | mistune | CWE-674 | Mistune directives/include: mutual `.. include::` recursion crashes the rende… |
| CVE-2026-57481 | 2.3 | 42.3 | parse-community | parse-server | CWE-200 | Parse Server: LiveQuery discloses object data to a subscriber across an ACL r… |
| CVE-2026-55575 | 8.2 | 42.0 | harttle | liquidjs | CWE-770 | LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filte… |
| CVE-2026-15121 | 8.8 | 42.0 | Chrome | CWE-416 | Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a r… | |
| CVE-2026-35211 | 6.5 | 41.9 | OpenCTI-Platform | opencti | CWE-94 | OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter … |
| CVE-2026-54499 | 7.5 | 41.7 | stanfordnlp | stanza | CWE-502 | Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders |
| CVE-2026-44332 | 5.3 | 41.6 | gofiber | fiber | CWE-203 | Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer |
| CVE-2026-59822 | 8.8 | 41.5 | BerriAI | litellm | CWE-287 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback |
| CVE-2026-59938 | 6.9 | 41.5 | py-pdf | pypdf | CWE-789 | pypdf: Possible large memory usage for wrong image dimensions |
| CVE-2026-59703 | 8.7 | 41.4 | repomix | repomix | CWE-552 | repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint |
| CVE-2026-58192 | 8.6 | 41.3 | appium | appium | CWE-22 | Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-… |
| CVE-2026-55429 | 8.7 | 41.0 | coder | coder | CWE-639 | Coder's workspace app upsert allows cross-workspace agent rebinding via user-… |
| CVE-2026-9074 | 9.8 | 40.9 | IBM | API Connect | CWE-89 | IBM API Connect SQL Injection |
| CVE-2026-59875 | 5.3 | 40.9 | isaacs | node-tar | CWE-248 | node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records |
| CVE-2026-56273 | 4.9 | 40.5 | Flowise | Flowise | CWE-22 | Flowise - Path Traversal in Vector Store basePath Parameter |
| CVE-2026-10699 | 7.5 | 40.2 | Progress | MOVEit Transfer | CWE-401 | Memory leak in SFTP service can result in a denial of service in MOVEit Transfer |
| CVE-2026-55761 | 7.1 | 40.1 | portainer | portainer | CWE-287 | Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitia… |
| CVE-2026-54591 | 8.1 | 40.0 | ronf | asyncssh | CWE-22 | AsyncSSH: SCP Path Traversal to Arbitrary File Write |
| CVE-2026-44840 | 7.5 | 40.0 | dgraph-io | dgraph | CWE-943 | Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query |
| CVE-2026-49145 | 7.5 | 39.8 | PETDANCE | App::Ack | CWE-73 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-fr… |
| CVE-2026-49147 | 7.5 | 39.8 | PETDANCE | App::Ack | CWE-150 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape s… |
| CVE-2026-51535 | 7.5 | 39.8 | n/a | n/a | CWE-400 | In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) v… |
| CVE-2026-14891 | 8.7 | 39.7 | HashiCorp | Nomad | CWE-59 | Nomad vulnerable to sandbox escape in Docker task driver |
| CVE-2026-35552 | 8.1 | 39.3 | n/a | n/a | CWE-862 | In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0… |
| CVE-2026-55874 | 7.7 | 39.3 | seaweedfs | seaweedfs | CWE-22 | SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows c… |
| CVE-2026-60105 | 7.7 | 39.3 | Monsta Limited of New Zealand | Monsta FTP | CWE-918 | Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass |
| CVE-2026-53482 | 7.5 | 39.3 | Dell | PowerProtect Data Domain | CWE-190 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release … |
| CVE-2026-9701 | 9.8 | 39.3 | joe007 | Eventer | CWE-289 | Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privi… |
| CVE-2026-44025 | 7.5 | 38.9 | fluent | fluentd | CWE-306 | Fluentd: Exposure of Sensitive Information via Monitor Agent API |
| CVE-2026-14500 | 5.3 | 38.7 | sayantandas20 | Bulk Order Update for WooCommerce | CWE-22 | Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Rea… |
| CVE-2026-8307 | 9.8 | 38.4 | Webbeyaz Web Design | Mediküm Web | CWE-89 | SQLi in Webbeyaz's Mediküm Web |
| CVE-2026-59807 | 8.9 | 38.4 | ComposioHQ | composio | CWE-73 | Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts |
| CVE-2026-59731 | 8.2 | 38.2 | withastro | astro | CWE-647 | Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path … |
| CVE-2026-47646 | 6.1 | 38.3 | Microsoft | Dynamics 365 Customer Voice | CWE-79 | Dynamics 365 Customer Voice Spoofing Vulnerability |
| CVE-2026-59820 | 6.1 | 38.2 | BerriAI | litellm | CWE-22 | LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path T… |
| CVE-2026-58252 | 6.5 | 38.2 | nats-io | nats-server | CWE-285 | NATS Server: Subscribe Authz Bypass via Wildcard-Overlap |
| CVE-2026-6230 | 7.5 | 38.1 | tainacan | Tainacan | CWE-89 | Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Par… |
| CVE-2026-9700 | 7.5 | 38.1 | joe007 | Eventer | CWE-89 | Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter |
| CVE-2026-58251 | 6.5 | 38.1 | nats-io | nats-server | CWE-285 | NATS Server: Queue Subscribe Authz Bypass |
| CVE-2026-45045 | 5.3 | 38.1 | gofiber | fiber | CWE-290 | Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward |
| CVE-2026-59924 | 5.9 | 38.0 | lepture | mistune | CWE-22 | Mistune: Arbitrary File Read via Include directive path traversal |
| CVE-2026-15053 | 7.5 | 37.9 | Tanium | Tanium Server | CWE-789 | Tanium addressed a denial of service vulnerability in Tanium Server. |
| CVE-2026-15154 | 6.5 | 37.9 | Red Hat | Red Hat OpenShift AI 2.25 | CWE-1333 | Guardrails-detectors: guardrails-detectors: unauthenticated regular-expressio… |
| CVE-2026-15132 | 8.8 | 37.3 | Chrome | CWE-457 | Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-56250 | 8.7 | 37.3 | Capgo | Capgo | CWE-862 | Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions |
| CVE-2026-58656 | 8.7 | 37.3 | getgrav | grav | CWE-598 | Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and J… |
| CVE-2026-9842 | 7.5 | 37.2 | pixelgrade | Backstage – Customizer Demo Access | CWE-269 | Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo… |
| CVE-2026-59819 | 2.1 | 37.1 | BerriAI | litellm | CWE-73 | LiteLLM: Local file read via request-supplied OIDC file references |
| CVE-2025-3110 | 6.9 | 36.9 | OpenVPN | Access Server | CWE-444 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences in… |
| CVE-2026-11827 | 4.9 | 36.8 | GitLab | GitLab | CWE-522 | Insufficiently Protected Credentials in GitLab |
| CVE-2026-59702 | 9.2 | 36.6 | repomix | repomix | CWE-918 | repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST… |
| CVE-2026-44161 | 7.2 | 36.6 | fluent | fluentd | CWE-918 | Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out… |
| CVE-2026-12936 | 4.9 | 36.6 | devitemsllc | Recurio – Ultimate Subscription for WooCommerce | CWE-89 | Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Par… |
| CVE-2026-60000 | 7.5 | 36.5 | OpenBSD | OpenSSH | CWE-770 | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of serv… |
| CVE-2026-58213 | 7.1 | 36.5 | nats-io | nats-server | CWE-74 | NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding… |
| CVE-2026-14362 | 4.9 | 36.5 | HashiCorp | Shared library | CWE-770 | Denial of service via crafted push/pull gossip message in memberlist |
| CVE-2026-12097 | 5.3 | 36.3 | saadiqbal | User Management | CWE-862 | User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Sett… |
| CVE-2026-59806 | 4.9 | 36.2 | gradio-app | gradio | CWE-601 | Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint |
| CVE-2026-58654 | 5.3 | 36.1 | Grav | Grav | CWE-434 | Grav - Arbitrary File Upload via Avatar Endpoint |
| CVE-2026-59874 | 8.7 | 35.9 | isaacs | node-tar | CWE-835 | node-tar: Negative tar entry size causes infinite loop in archive replace |
| CVE-2026-54779 | 5.9 | 36.0 | CoreWCF | CoreWCF | CWE-294 | CoreWCF: SAML token replay protection is inoperative |
| CVE-2026-56226 | 8.7 | 35.8 | Cap-go | capgo | CWE-200 | Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC |
| CVE-2026-15134 | 5.5 | 35.7 | CodeAstro | Simple Online Leave Management System | CWE-74 | CodeAstro Simple Online Leave Management System index.php sql injection |
| CVE-2026-15135 | 5.5 | 35.7 | code-projects | Online Food Order System | CWE-74 | code-projects Online Food Order System edit_food_items.php sql injection |
| CVE-2026-55596 | 8.7 | 35.6 | udecode | plate | CWE-79 | Plate: Media embed provider metadata can bypass URL sanitization and execute … |
| CVE-2026-59818 | 8.1 | 35.6 | etcd-io | etcd | CWE-295 | etcd: gRPC client listener does not enforce `--client-crl-file` certificate r… |
| CVE-2026-56002 | 8.8 | 35.4 | X.Org | libXfont2 | CWE-122 | libXfont2 PCF Font Parsing Heap Buffer Overflow |
| CVE-2026-59939 | 7.5 | 35.1 | httplib2 | httplib2 | CWE-409 | httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Res… |
| CVE-2026-56086 | 8.8 | 34.5 | Dell | PowerProtect Data Domain | CWE-863 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release … |
| CVE-2026-10706 | 7.5 | 34.3 | Adalo No-Code App Builder | App Builder | — | Exposure of Sensitive Information to an Unauthorized attacker |
| CVE-2026-59262 | 7.1 | 34.3 | affine | monorepo | CWE-862 | AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field |
| CVE-2026-54782 | 10.0 | 34.2 | CoreWCF | CoreWCF | CWE-290 | CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature vali… |
| CVE-2026-15036 | 2.1 | 34.2 | n/a | Harness | CWE-285 | Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization |
| CVE-2026-15107 | 8.8 | 34.1 | Chrome | CWE-416 | Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed … | |
| CVE-2026-15116 | 8.8 | 34.1 | Chrome | CWE-416 | Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-15118 | 8.8 | 34.1 | Chrome | CWE-416 | Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-15126 | 8.8 | 34.1 | Chrome | CWE-416 | Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-15133 | 8.8 | 34.1 | Chrome | CWE-416 | Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 all… | |
| CVE-2026-54652 | 8.1 | 34.0 | blakeblackshear | frigate | CWE-269 | Frigate viewer can read logs exposing admin and camera credentials |
| CVE-2026-3144 | 9.8 | 34.0 | IBM | API Connect | CWE-1392 | IBM API Connect Default Credentials |
| CVE-2026-55404 | 8.8 | 34.0 | yt-dlp | yt-dlp | CWE-74 | yt-dlp: Downstream command injection via improper sanitization of yt-dlp --wr… |
| CVE-2026-54528 | 7.1 | 33.9 | jupyterlab | jupyterlab-git | CWE-178 | jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded… |
| CVE-2026-58501 | 5.9 | 33.6 | mvantellingen | python-zeep | CWE-918 | Zeep SSRF because Settings.forbid_external is not enforced |
| CVE-2026-11903 | 5.4 | 33.6 | Progress | MOVEit Transfer | CWE-79 | Stored XSS in MOVEit Transfer Ad Hoc module |
| CVE-2026-6818 | 7.2 | 33.4 | e4jvikwp | VikBooking Hotel Booking Engine & PMS | CWE-79 | VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross… |
| CVE-2026-59890 | 6.1 | 33.4 | pypa | setuptools | CWE-176 | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization c… |
| CVE-2026-6896 | 5.4 | 33.1 | GitLab | GitLab | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scri… |
| CVE-2026-55830 | 8.3 | 32.9 | zopefoundation | RestrictedPython | CWE-184 | RestrictedPython guard hooks can be shadowed via positional-only arguments |
| CVE-2026-3688 | 8.1 | 32.9 | wclovers | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace | CWE-639 | WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object… |
| CVE-2026-56246 | 7.2 | 32.9 | Capgo | Capgo | CWE-285 | Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege … |
| CVE-2026-56003 | 8.8 | 32.9 | X.Org | libXfont2 | CWE-122 | libXfont2 computeProps Property Buffer Heap Buffer Overflow |
| CVE-2026-15125 | 8.8 | 32.6 | Chrome | CWE-863 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.11… | |
| CVE-2026-5922 | 5.9 | 32.5 | HP Inc. | Poly CCX | CWE-79 | Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack |
| CVE-2026-55433 | 5.4 | 32.2 | coder | coder | CWE-862 | Coder: Devcontainer recreate endpoint missing write authorization allows read… |
| CVE-2026-54590 | 5.9 | 32.1 | ronf | asyncssh | CWE-22 | AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and enviro… |
| CVE-2026-56001 | 8.8 | 32.0 | X.Org | libXfont2 | CWE-122 | libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow |
| CVE-2026-6820 | 7.2 | 32.0 | e4jvikwp | VikBooking Hotel Booking Engine & PMS | CWE-79 | VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross… |
| CVE-2026-59805 | 7.1 | 31.7 | antiwork | gumroad | CWE-862 | Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController |
| CVE-2026-8472 | 4.3 | 31.7 | GitLab | GitLab | CWE-862 | Missing Authorization in GitLab |
| CVE-2026-13320 | 5.4 | 31.6 | GitLab | GitLab | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scri… |
| CVE-2026-15062 | 9.6 | 31.3 | Snowflake | Snowpark Python SDK | CWE-89 | SQL Injection in Snowflake Snowpark Python SDK |
| CVE-2026-48492 | 4.9 | 31.2 | grokability | snipe-it | CWE-862 | Snipe-IT's selectlist visibility is too permissive |
| CVE-2026-14966 | 3.1 | 31.1 | Black Lantern Security | BBOT | CWE-59 | Symlink guard bypass in unarchive module allows planting symlinks during extr… |
| CVE-2026-42505 | 5.3 | 31.0 | Go standard library | crypto/tls | CWE-201 | Invoking Encrypted Client Hello privacy leak in crypto/tls |
| CVE-2026-55668 | 6.3 | 30.5 | filebrowser | filebrowser | CWE-22 | File Browser: ScopedFs follows a dangling symlink on write, letting a scoped … |
| CVE-2026-6280 | 6.5 | 30.5 | NOMYSOFT Informatics Education and Consulting Inc. | Nomysem | CWE-213 | Improper Access Control in Nomysoft Informatics' Nomysem |
| CVE-2026-15105 | 2.1 | 30.5 | davenardella | snap7 | CWE-119 | davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-b… |
| CVE-2026-60124 | 5.3 | 29.9 | misp | misp | CWE-862 | MISP importModule missing authorization allows read-only users to modify even… |
| CVE-2026-60104 | 9.3 | 29.8 | bitwarden | server | CWE-639 | Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request |
| CVE-2026-58657 | 4.8 | 29.9 | Grav | Grav | CWE-79 | Grav - Stored CSS Injection via Markdown Image resize() Action |
| CVE-2026-58525 | 8.2 | 29.7 | Microsoft | Microsoft Edge (Chromium-based) | CWE-284 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
| CVE-2026-54773 | 5.9 | 29.6 | CoreWCF | CoreWCF | CWE-347 | CoreWCF: WS-Security signature substitution via document-wide Signature lookup |
| CVE-2026-58253 | 8.8 | 29.5 | nats-io | nats-server | CWE-287 | NATS Server: Route API Auth Bypass |
| CVE-2026-14250 | 6.3 | 29.4 | themehunk | TH Login Registration | CWE-269 | Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation … |
| CVE-2026-8651 | 7.5 | 29.3 | Progress | MOVEit Transfer | CWE-290 | IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit T… |
| CVE-2026-8650 | 7.5 | 29.2 | Progress | MOVEit Transfer | CWE-23 | Authenticated Path Traversal allows MOVEit admins to view arbitrary system files |
| CVE-2026-59877 | 7.5 | 29.2 | protobufjs | protobuf.js | CWE-835 | protobufjs: Denial of Service via infinite loop in .proto option parsing |
| CVE-2026-56297 | 8.3 | 28.7 | FreeRDP | FreeRDP | CWE-362 | FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback |
| CVE-2026-5356 | 7.5 | 28.8 | latepoint | LatePoint – Calendar Booking Plugin for Appointments and Events | CWE-862 | LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Un… |
| CVE-2026-6352 | 2.7 | 28.7 | GitLab | GitLab | CWE-863 | Incorrect Authorization in GitLab |
| CVE-2026-15041 | 3.7 | 28.5 | Red Hat | Red Hat Directory Server 11 | CWE-208 | 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 passw… |
| CVE-2026-56284 | 6.9 | 28.5 | Cap-go | capgo | CWE-200 | Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC |
| CVE-2026-11798 | 6.1 | 28.2 | the_champ | Social Share, Social Login and Social Comments Plugin – Super Socializer | CWE-79 | Social Share, Social Login and Social Comments Plugin <= 7.14.5 - Reflected C… |
| CVE-2026-57259 | 6.5 | 28.1 | Foxit Software Inc. | Foxit PDF Editor | CWE-611 | Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read |
| CVE-2026-53480 | 2.7 | 28.1 | Dell | PowerProtect Data Domain | CWE-22 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release … |
| CVE-2026-35210 | 7.1 | 27.9 | OpenCTI-Platform | opencti | CWE-639 | OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection |
| CVE-2026-60125 | 5.3 | 27.7 | misp | misp | CWE-863 | importModule function in MISP ignores per-organisation import module restrict… |
| CVE-2026-59876 | 4.8 | 27.5 | protobufjs | protobuf.js | CWE-1321 | protobufjs: Text Format string map parsing can mutate returned map object pro… |
| CVE-2026-58214 | 4.3 | 27.5 | nats-io | nats-server | CWE-863 | NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incom… |
| CVE-2026-56220 | 7.1 | 27.4 | Capgo | Capgo | CWE-863 | Capgo - Unauthorized Manifest Insertion via Read-Only Org Member |
| CVE-2026-59923 | 6.1 | 27.4 | lepture | mistune | CWE-79 | Mistune: XSS via percent-encoded javascript URI bypass in safe_url() |
| CVE-2026-60092 | 5.1 | 27.4 | AVideo | AVideo | CWE-79 | AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants… |
| CVE-2026-15109 | 6.5 | 27.2 | Chrome | CWE-457 | Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a… | |
| CVE-2026-7492 | 5.3 | 27.2 | GitLab | GitLab | CWE-862 | Missing Authorization in GitLab |
| CVE-2026-8801 | 9.8 | 27.0 | Progress | MOVEit Transfer | CWE-46 | File Extension Restriction Bypass in MOVEit Transfer |
| CVE-2026-15113 | 9.6 | 27.0 | Chrome | CWE-416 | Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.11… | |
| CVE-2026-15112 | 8.8 | 27.0 | Chrome | CWE-416 | Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-15123 | 8.8 | 27.1 | Chrome | CWE-122 | Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 … | |
| CVE-2026-15129 | 8.8 | 27.0 | Chrome | CWE-416 | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-55873 | 4.3 | 26.7 | seaweedfs | seaweedfs | CWE-863 | SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management A… |
| CVE-2026-58209 | 4.3 | 26.7 | nats-io | nats-server | CWE-863 | NATS Server: MQTT retained and QoS replay bypass subscribe deny filters |
| CVE-2026-59929 | 6.1 | 26.7 | lepture | mistune | CWE-79 | Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and cha… |
| CVE-2026-59936 | 8.7 | 26.6 | py-pdf | pypdf | CWE-400 | pypdf: Possible infinite loop for not terminated inline images |
| CVE-2026-14373 | 7.7 | 26.5 | HashiCorp | Nomad | CWE-862 | Nomad Docker driver Linux host namespace bypass |
| CVE-2026-59937 | 6.9 | 26.6 | py-pdf | pypdf | CWE-400 | pypdf: Possible long runtimes for repeated malformed cross-reference entries |
| CVE-2026-55877 | 6.1 | 26.2 | symfony | ux | CWE-79 | Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local file… |
| CVE-2026-55431 | 6.1 | 26.0 | coder | coder | CWE-522 | Coder's session token leaked to arbitrary hosts via `coder open app` for exte… |
| CVE-2026-59802 | 6.3 | 25.4 | PasswordPusher | PasswordPusher | CWE-183 | PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload |
| CVE-2026-59895 | 6.1 | 25.0 | honojs | hono | CWE-79 | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility |
| CVE-2026-59926 | 5.3 | 25.0 | lepture | mistune | CWE-79 | Mistune: XSS via unescaped class option in Admonition directive |
| CVE-2025-12506 | 4.3 | 24.9 | GitLab | GitLab | CWE-706 | Use of Incorrectly-Resolved Name or Reference in GitLab |
| CVE-2026-15122 | 8.3 | 24.7 | Chrome | CWE-20 | Insufficient validation of untrusted input in Codecs in Google Chrome on Wind… | |
| CVE-2026-55195 | 8.7 | 24.3 | miurahr | py7zr | CWE-409 | py7zr: Decompression bomb (zip bomb) denial of service via unchecked extracti… |
| CVE-2026-55206 | 8.7 | 24.3 | miurahr | py7zr | CWE-407 | py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read() |
| CVE-2026-6459 | 6.4 | 24.3 | wpdevteam | Essential Addons for Elementor – Popular Elementor Templates & Widgets | CWE-79 | Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cros… |
| CVE-2026-10570 | 6.4 | 24.3 | idocoh | Sympl Repeater for ACF and Elementor | CWE-79 | Sympl Repeater for ACF and Elementor <= 2.3 - Authenticated (Author+) Stored … |
| CVE-2026-15114 | 8.8 | 24.0 | Chrome | CWE-125 | Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.1… | |
| CVE-2026-59882 | 6.5 | 23.9 | guzzle | psr7 | CWE-436 | guzzlehttp/psr7: Host Confusion via Weak URI Host Validation |
| CVE-2026-58191 | 6.1 | 23.8 | appium | appium | CWE-79 | Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig*… |
| CVE-2026-55437 | 5.4 | 23.8 | coder | coder | CWE-79 | Coder vulnerable to stored HTML injection via workspace agent logs in AgentLo… |
| CVE-2026-55432 | 5.4 | 23.7 | coder | coder | CWE-862 | Coder's sub-agent app registration bypasses template port-sharing policy enfo… |
| CVE-2026-56360 | 6.3 | 23.5 | n8n | n8n | CWE-290 | n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger |
| CVE-2026-59804 | 7.6 | 22.8 | web-infra-dev | midscene | CWE-306 | Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket |
| CVE-2026-58254 | 5.3 | 22.9 | nats-io | nats-server | CWE-863 | NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass … |
| CVE-2026-5459 | 5.3 | 22.7 | wedevs | User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration | CWE-639 | User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membersh… |
| CVE-2026-56298 | 5.3 | 22.7 | Capgo | Capgo | CWE-200 | Capgo - EXIF Metadata Exposure in App Information Image Upload |
| CVE-2026-15120 | 8.3 | 22.4 | Chrome | CWE-416 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 al… | |
| CVE-2026-15111 | 7.5 | 22.4 | Chrome | CWE-416 | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a re… | |
| CVE-2026-15117 | 7.5 | 22.4 | Chrome | CWE-416 | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a… | |
| CVE-2026-56775 | 5.3 | 22.2 | n8n | n8n | CWE-863 | n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints |
| CVE-2026-60002 | 9.4 | 22.0 | OpenBSD | OpenSSH | CWE-416 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes it… |
| CVE-2026-12041 | 4.4 | 22.1 | chatra | Chatra Live Chat + ChatBot + Cart Saver | CWE-79 | Chatra Live Chat + ChatBot + Cart Saver <= 1.0.12 - Authenticated (Administra… |
| CVE-2026-59896 | 6.5 | 21.9 | honojs | hono | CWE-362 | hono/jsx does not isolate context per request, leading to cross-request data … |
| CVE-2026-56217 | 5.3 | 21.5 | Capgo | Capgo | CWE-284 | Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update |
| CVE-2026-56778 | 5.3 | 21.4 | n8n | n8n | CWE-863 | n8n - Authorization Bypass in Public API Execution Retry Endpoint |
| CVE-2026-58211 | 5.4 | 21.2 | nats-io | nats-server | CWE-863 | NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection re… |
| CVE-2026-60001 | 6.5 | 21.0 | OpenBSD | OpenSSH | CWE-770 | sshd in OpenSSH before 10.4 does not always honor the minimum authentication … |
| CVE-2026-15034 | 2.1 | 20.4 | flask-dashboard | Flask-MonitoringDashboard | CWE-352 | flask-dashboard Flask-MonitoringDashboard cross-site request forgery |
| CVE-2026-41122 | 7.1 | 20.1 | Dell | PowerProtect Data Domain | CWE-79 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release … |
| CVE-2026-55542 | 1.3 | 20.0 | grokability | snipe-it | CWE-862 | Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL |
| CVE-2026-59253 | 5.3 | 19.9 | n8n | n8n | CWE-639 | n8n - Improper Authorization in Workflow Assignment to Folders |
| CVE-2026-36027 | 6.8 | 19.8 | n/a | n/a | CWE-1313 | An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proxi… |
| CVE-2026-36028 | 6.8 | 19.8 | n/a | n/a | CWE-288 | A protection mechanism failure in the Code 27 Companion Hub allows an attacke… |
| CVE-2026-15063 | 6.3 | 19.8 | Red Hat | Red Hat OpenShift AI (RHOAI) | CWE-306 | Trustyai-service-operator: trustyai service operator: gorch port bypass when … |
| CVE-2026-56776 | 5.3 | 19.4 | n8n | n8n | CWE-863 | n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint |
| CVE-2026-59261 | 8.4 | 19.2 | OpenClaw | OpenClaw | CWE-522 | OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files |
| CVE-2026-54784 | 7.4 | 19.0 | CoreWCF | CoreWCF | CWE-311 | CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality |
| CVE-2026-55999 | 7.8 | 18.6 | X.Org | xorg-server | CWE-122 | xorg-server / xwayland glamor font atlas Heap Buffer Overflow |
| CVE-2026-15044 | 6.3 | 18.3 | Red Hat | Red Hat OpenShift AI (RHOAI) | CWE-200 | Trustyai-service-operator: trustyai service operator: unauthenticated access … |
| CVE-2026-15124 | 4.3 | 18.3 | Chrome | CWE-20 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.… | |
| CVE-2026-15130 | 4.3 | 18.3 | Chrome | CWE-602 | Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0… | |
| CVE-2026-15131 | 4.3 | 18.3 | Chrome | CWE-20 | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.78… | |
| CVE-2026-39178 | 6.3 | 18.0 | n/a | n/a | CWE-89 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated user… |
| CVE-2026-39179 | 6.3 | 18.0 | n/a | n/a | CWE-89 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated user… |
| CVE-2026-15110 | 8.8 | 17.7 | Chrome | CWE-416 | Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed… | |
| CVE-2026-53951 | 8.8 | 17.6 | copier-org | copier | CWE-22 | Copier: trust-prefix bypass via path traversal runs tasks unprompted |
| CVE-2025-14785 | 6.4 | 17.4 | seedprod | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | CWE-79 | Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soo… |
| CVE-2026-6740 | 6.4 | 17.4 | posimyththemes | Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | CWE-79 | Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scrip… |
| CVE-2026-6742 | 6.4 | 17.4 | mdempfle | Advanced iFrame | CWE-79 | Advanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Sc… |
| CVE-2026-14967 | 3.1 | 17.5 | Black Lantern Security | BBOT | CWE-22 | Path traversal in github_workflows allows writing artifacts outside output di… |
| CVE-2026-8649 | 9.8 | 17.1 | Progress | MOVEit Transfer | CWE-943 | Institution scope bypass vulnerability in custom reports |
| CVE-2026-55436 | 7.4 | 17.1 | coder | coder | CWE-295 | Coder's AI Bridge Proxy skips TLS certificate verification in default configu… |
| CVE-2026-8310 | 6.1 | 16.4 | Webbeyaz Web Design | Mediküm Web | CWE-79 | Reflected XSS in Webbeyaz's Mediküm Web |
| CVE-2026-54344 | 4.7 | 16.2 | ToolJet | ToolJet | CWE-78 | ToolJet GitHub Actions comment body shell injection exposes deployment secrets |
| CVE-2026-59995 | 5.4 | 16.1 | OpenBSD | OpenSSH | CWE-23 | sftp in OpenSSH before 10.4 does not properly constrain the location of downl… |
| CVE-2026-59996 | 5.4 | 16.1 | OpenBSD | OpenSSH | CWE-23 | scp in OpenSSH before 10.4 may place a file in the parent directory of an int… |
| CVE-2026-14896 | 4.2 | 16.1 | HashiCorp | Nomad | CWE-863 | Nomad vulnerable to cross-namespace host volume claim deletion |
| CVE-2026-54781 | 7.4 | 15.8 | CoreWCF | CoreWCF | CWE-287 | CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are no… |
| CVE-2026-57439 | 5.0 | 15.3 | gchq | CyberChef | CWE-79 | CyberChef: Prototype pollution in Series Chart operation |
| CVE-2026-56359 | 4.8 | 15.2 | n8n | n8n | CWE-79 | n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL |
| CVE-2026-15119 | 8.3 | 15.1 | Chrome | CWE-362 | Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remot… | |
| CVE-2026-59723 | 8.8 | 14.9 | cline | cline | CWE-346 | Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` en… |
| CVE-2026-56293 | 5.3 | 14.7 | Capgo | Capgo | CWE-285 | Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history … |
| CVE-2026-54780 | 3.7 | 14.5 | CoreWCF | CoreWCF | CWE-327 | CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass |
| CVE-2026-55849 | 8.5 | 14.3 | CycloneDX | cyclonedx-node-npm | CWE-78 | @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument |
| CVE-2026-56283 | 4.8 | 14.2 | Capgo | Capgo | CWE-79 | Capgo - HTML Injection Leading to Open Redirection in Organization Settings |
| CVE-2026-6371 | 4.8 | 14.0 | Limatek System Inc. | LimRAD NAC | CWE-79 | Stored XSS in Limatek's LimRAD NAC |
| CVE-2026-39822 | 7.8 | 13.9 | Go standard library | os | CWE-61 | Root escape via symlink plus trailing slash in os |
| CVE-2026-8315 | 5.4 | 13.1 | Webbeyaz Web Design | Mediküm Web | CWE-79 | Stored XSS in Webbeyaz's Mediküm Web |
| CVE-2026-15169 | 7.5 | 12.9 | Wireshark Foundation | Wireshark | CWE-122 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-56374 | 4.8 | 12.7 | ImageMagick | ImageMagick | CWE-125 | ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter |
| CVE-2026-56000 | 9.0 | 12.5 | X.Org | xorg-x11-server | CWE-416 | xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent() |
| CVE-2026-55438 | 6.8 | 12.6 | coder | coder | CWE-346 | Coder's workspace app CORS origin check can be bypassed via UUID-based subdom… |
| CVE-2026-15127 | 6.1 | 12.4 | Chrome | CWE-79 | Inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.11… | |
| CVE-2026-15128 | 6.1 | 12.4 | Chrome | CWE-79 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.11… | |
| CVE-2026-53624 | 4.8 | 11.4 | gofiber | fiber | CWE-319 | Fiber: HSTS header never set in helmet middleware due to incorrect protocol c… |
| CVE-2026-8800 | 8.8 | 11.0 | Progress | MOVEit Transfer | CWE-863 | Cross-Org External Token Metadata accessible to AuditUser role |
| CVE-2026-55430 | 6.8 | 10.8 | coder | coder | CWE-345 | Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Ho… |
| CVE-2026-10708 | 7.5 | 10.4 | Adalo No-Code App Builder | App Builder | — | Insufficiently Protected Credentials |
| CVE-2026-54774 | 7.4 | 10.1 | CoreWCF | CoreWCF | CWE-345 | CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing t… |
| CVE-2026-5923 | 6.0 | 9.6 | HP Inc. | Poly CCX | CWE-352 | Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack |
| CVE-2026-15108 | 4.3 | 9.5 | Chrome | CWE-190 | Integer overflow in Extensions API in Google Chrome prior to 150.0.7871.115 a… | |
| CVE-2026-54783 | 7.4 | 9.0 | CoreWCF | CoreWCF | CWE-294 | CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature… |
| CVE-2026-44512 | 5.5 | 8.9 | onnx | onnx | CWE-476 | ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero In… |
| CVE-2026-55878 | 7.8 | 8.9 | symfony | ux | CWE-22 | Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and… |
| CVE-2026-59930 | 4.3 | 8.8 | lepture | mistune | CWE-345 | Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` … |
| CVE-2026-9731 | 4.3 | 8.7 | wpkuf | Wp Js Detect | CWE-352 | Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update |
| CVE-2026-57240 | 7.8 | 8.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Form Field Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-56362 | 2.1 | 8.5 | ImageMagick | ImageMagick | CWE-125 | ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache M… |
| CVE-2026-15163 | 7.5 | 8.0 | Wireshark Foundation | Wireshark | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark |
| CVE-2026-22927 | 7.8 | 7.8 | Omnissa | Omnissa Workspace ONE® Tunnel for Windows | CWE-22 | Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalat… |
| CVE-2026-56437 | 8.4 | 7.7 | Fuji Electric Co.,Ltd. | Pupsman | CWE-427 | Uncontrolled search path element issue exists in Pupsman versions prior to 3.… |
| CVE-2026-59998 | 6.5 | 7.5 | OpenBSD | OpenSSH | CWE-573 | sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: G… |
| CVE-2026-59897 | 5.3 | 7.5 | honojs | hono | CWE-348 | Hono: API Gateway v1 adapter can drop a distinct repeated request header valu… |
| CVE-2026-10037 | 8.8 | 7.1 | Canonical | Ubuntu | CWE-20 | Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal |
| CVE-2026-59997 | 5.4 | 6.9 | OpenBSD | OpenSSH | CWE-1284 | internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 comm… |
| CVE-2026-57256 | 7.8 | 6.8 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit Editor/Reader List Box Format Use-After-Free Vulnerability |
| CVE-2026-59946 | 6.1 | 6.7 | composer | composer | CWE-22 | Composer: Path traversal in package bin field lets dependencies chmod arbitra… |
| CVE-2026-58494 | 6.5 | 6.5 | bytecodealliance | wasmtime | CWE-281 | Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination |
| CVE-2026-15167 | 5.5 | 6.5 | Wireshark Foundation | Wireshark | CWE-121 | Stack-based Buffer Overflow in Wireshark |
| CVE-2026-13126 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-13127 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-13128 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-13129 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-57237 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-57238 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne… |
| CVE-2026-57242 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Page Use-After-Free Vulnerability |
| CVE-2026-57244 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Form Control Use-After-Free Vulnerability |
| CVE-2026-57245 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Signature Hyperlink Use-After-Free Vulnerability |
| CVE-2026-57246 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-120 | Foxit PDF Editor/Reader Signature Buffer Overflow Vulnerability |
| CVE-2026-57247 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Field Use-After-Free Vulnerability |
| CVE-2026-57248 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-763 | Foxit PDF Editor/Reader Annotation Improper Release Vulnerability |
| CVE-2026-57249 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Annotation Use-After-Free Vulnerability |
| CVE-2026-57250 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader Form Field Use-After-Free Vulnerability |
| CVE-2026-57251 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-129 | Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability |
| CVE-2026-57252 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-416 | Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnera… |
| CVE-2026-57254 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-843 | Foxit PDF Editor/Reader Annotation Type Confusion Vulnerability |
| CVE-2026-57260 | 7.8 | 6.5 | Foxit Software Inc. | Foxit PDF Editor | CWE-787 | Security vulnerability in Foxit PDF Editor/Reader — U3D Adobe Mesh Decompress… |
| CVE-2026-57239 | 7.8 | 6.4 | Foxit Software Inc. | Foxit PDF Editor | CWE-427 | Foxit PDF Editor/Reader Local Privilege Escalation |
| CVE-2026-59883 | 6.1 | 6.2 | guzzle | guzzle | CWE-346 | Guzzle: Cookie Disclosure and Injection via IP-Address Domains |
| CVE-2026-59948 | 7.0 | 5.8 | composer | composer | CWE-22 | Composer: Arbitrary file write outside vendor via malicious transitive packag… |
| CVE-2026-57895 | 8.5 | 5.5 | Fuji Electric Co.,Ltd. | Pupsman | CWE-276 | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0… |
| CVE-2026-57258 | 6.1 | 5.4 | Foxit Software Inc. | Foxit PDF Editor | CWE-125 | Foxit PDF Editor/Reader Crash via Malformed PRC 3D Stream |
| CVE-2026-50812 | 5.5 | 5.4 | n/a | n/a | CWE-476 | A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 a… |
| CVE-2026-59999 | 7.5 | 5.3 | OpenBSD | OpenSSH | CWE-348 | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take pr… |
| CVE-2026-50813 | 6.1 | 5.2 | n/a | n/a | CWE-126 | An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacke… |
| CVE-2026-15165 | 5.5 | 5.0 | Wireshark Foundation | Wireshark | CWE-122 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-15166 | 5.5 | 5.0 | Wireshark Foundation | Wireshark | CWE-121 | Stack-based Buffer Overflow in Wireshark |
| CVE-2026-15170 | 5.5 | 5.0 | Wireshark Foundation | Wireshark | CWE-122 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-57241 | 6.1 | 4.7 | Foxit Software Inc. | Foxit PDF Editor | CWE-125 | Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability |
| CVE-2026-57243 | 6.1 | 4.7 | Foxit Software Inc. | Foxit PDF Editor | CWE-125 | Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability |
| CVE-2026-57253 | 6.1 | 4.7 | Foxit Software Inc. | Foxit PDF Editor | CWE-125 | Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Discl… |
| CVE-2026-57255 | 6.1 | 4.7 | Foxit Software Inc. | Foxit PDF Editor | CWE-125 | Security vulnerability in Foxit PDF Editor/Reader — OOB Read via NaN-Bypass C… |
| CVE-2026-57257 | 6.1 | 4.7 | Foxit Software Inc. | Foxit PDF Editor | CWE-125 | Security vulnerability in Foxit PDF Editor/Reader — PRC 3D BRep Renderer Heap… |
| CVE-2026-54776 | 4.4 | 4.6 | CoreWCF | CoreWCF | CWE-306 | CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that … |
| CVE-2026-12002 | 4.7 | 4.2 | smub | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | CWE-352 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-… |
| CVE-2026-59947 | 4.7 | 3.9 | composer | composer | CWE-532 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT … |
| CVE-2026-14361 | 4.7 | 3.1 | HashiCorp | Tooling | CWE-59 | Consul-template is vulnerable to path redirection in writeToFile through syml… |
| CVE-2026-15168 | 3.3 | 2.7 | Wireshark Foundation | Wireshark | CWE-457 | Use of Uninitialized Variable in Wireshark |
| CVE-2026-54778 | 6.2 | 2.6 | CoreWCF | CoreWCF | CWE-362 | CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution |
| CVE-2026-15115 | 3.3 | 2.5 | Chrome | CWE-20 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome… | |
| CVE-2026-15164 | 5.5 | 2.2 | Wireshark Foundation | ciscodump | CWE-122 | Heap-based Buffer Overflow in ciscodump |
| CVE-2026-15171 | 5.5 | 2.2 | Wireshark Foundation | Wireshark | CWE-476 | NULL Pointer Dereference in Wireshark |
| CVE-2026-15172 | 5.5 | 2.2 | Wireshark Foundation | Wireshark | CWE-606 | Unchecked Input for Loop Condition in Wireshark |
| CVE-2026-54777 | 6.5 | 1.8 | CoreWCF | CoreWCF | CWE-367 | CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe in… |
| CVE-2026-15174 | 5.5 | 0.6 | Wireshark Foundation | Wireshark | CWE-122 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-15173 | 5.5 | 0.5 | Wireshark Foundation | Wireshark | CWE-122 | Heap-based Buffer Overflow in Wireshark |
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-07-08 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.
Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.
