{
  "day": "2026-07-18",
  "boundary": "UTC calendar day",
  "published_count": 80,
  "by_severity": {
    "CRITICAL": 7,
    "HIGH": 29,
    "MEDIUM": 18,
    "LOW": 26
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-47865",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00874,
      "epss_percentile": 0.56118,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-287",
      "title": "VMware Avi Load Balancer Authentication Bypass Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47865"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-16133",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00827,
      "epss_percentile": 0.54614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LiuMengxuan04",
      "product": "MiniCode",
      "cwe": "CWE-74",
      "title": "LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16133"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-59173",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00734,
      "epss_percentile": 0.51579,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Traffic Server",
      "cwe": "CWE-400",
      "title": "Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59173"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-47871",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00651,
      "epss_percentile": 0.4843,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-22",
      "title": "VMware Avi Load Balancer Directory Traversal Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47871"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-16097",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00463,
      "epss_percentile": 0.38424,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shibby",
      "product": "Tomato",
      "cwe": "CWE-119",
      "title": "Shibby Tomato Scheduler Name sub_42537C stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16097"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-47867",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00441,
      "epss_percentile": 0.36889,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-94",
      "title": "VMware Avi Load Balancer Remote Code Execution Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47867"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-47869",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00441,
      "epss_percentile": 0.36888,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-94",
      "title": "VMware Avi Load Balancer Remote Code Execution Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47869"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-16096",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00438,
      "epss_percentile": 0.3664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shibby",
      "product": "Tomato",
      "cwe": "CWE-119",
      "title": "Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16096"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-16083",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0043,
      "epss_percentile": 0.36051,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-287",
      "title": "Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16083"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-53994",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00424,
      "epss_percentile": 0.35568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ProFTPD Project",
      "product": "ProFTPD",
      "cwe": "CWE-122",
      "title": "ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53994"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-9323",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00421,
      "epss_percentile": 0.35259,
      "kev": false,
      "kev_due_at": null,
      "vendor": "urwid",
      "product": "urwid",
      "cwe": "CWE-338",
      "title": "Insecure PRNG and Information Exposure in urwid Web Display Backend",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9323"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-11826",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00421,
      "epss_percentile": 0.35316,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openplcproject",
      "product": "OpenPLC_v3",
      "cwe": "CWE-122",
      "title": "OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11826"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-16095",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00419,
      "epss_percentile": 0.3514,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shibby",
      "product": "Tomato",
      "cwe": "CWE-119",
      "title": "Shibby Tomato rc setup_conntrack out-of-bounds write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16095"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-16084",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00401,
      "epss_percentile": 0.33491,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-918",
      "title": "Sipeed PicoClaw web.go web_fetch server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16084"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-16198",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00393,
      "epss_percentile": 0.32607,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-287",
      "title": "Sipeed PicoClaw First Run Setup access_control.go authentication bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16198"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2024-58368",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00387,
      "epss_percentile": 0.32013,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 1.1.0 Denial of Service via HTTP Headers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58368"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2024-58362",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00375,
      "epss_percentile": 0.30821,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-75",
      "title": "SurrealDB before 1.5.5 Query Injection via RPC API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58362"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-10130",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00366,
      "epss_percentile": 0.29834,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "QueryWeaver",
      "cwe": "CWE-863",
      "title": "QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10130"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-16124",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0033,
      "epss_percentile": 0.25963,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-918",
      "title": "nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16124"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-16194",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0033,
      "epss_percentile": 0.25963,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhayujie",
      "product": "CowAgent",
      "cwe": "CWE-918",
      "title": "zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16194"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-16088",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.0033,
      "epss_percentile": 0.25958,
      "kev": false,
      "kev_due_at": null,
      "vendor": "halo-dev",
      "product": "halo",
      "cwe": "CWE-22",
      "title": "halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16088"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2024-58358",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00329,
      "epss_percentile": 0.25844,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 2.1.0 Denial of Service via Nonexistent Role",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58358"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-15631",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00326,
      "epss_percentile": 0.256,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/http-proxy",
      "product": "@fastify/http-proxy",
      "cwe": "CWE-22",
      "title": "@fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15631"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-16151",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0032,
      "epss_percentile": 0.24912,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CartoDB",
      "product": "carto-api-client",
      "cwe": "CWE-94",
      "title": "CartoDB carto-api-client filters.ts addFilter prototype pollution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16151"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2024-58366",
      "cvss_base": 9,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00316,
      "epss_percentile": 0.24398,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-134",
      "title": "SurrealDB before 1.1.1 Format String via Scripting Functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58366"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2024-58357",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00314,
      "epss_percentile": 0.24175,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 2.1.0 Denial of Service via rand::time()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58357"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2024-58359",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00314,
      "epss_percentile": 0.24175,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 2.1.0 Denial of Service via rand() Sorting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58359"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2025-71397",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00311,
      "epss_percentile": 0.23858,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-835",
      "title": "SurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71397"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2025-71396",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00311,
      "epss_percentile": 0.23858,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-770",
      "title": "SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71396"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2025-71391",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00301,
      "epss_percentile": 0.22736,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 2.2.2 Denial of Service via /sql endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71391"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-16126",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00298,
      "epss_percentile": 0.22411,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-285",
      "title": "zevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16126"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-16076",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00291,
      "epss_percentile": 0.21719,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AstrBotDevs",
      "product": "AstrBot",
      "cwe": "CWE-287",
      "title": "AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16076"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-16196",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00289,
      "epss_percentile": 0.21466,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-918",
      "title": "Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16196"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-16125",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00288,
      "epss_percentile": 0.21384,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-918",
      "title": "zevorn rt-claw http_request net.c claw_net_post server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16125"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-16127",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00288,
      "epss_percentile": 0.21385,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-918",
      "title": "zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16127"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-16128",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00288,
      "epss_percentile": 0.21386,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zevorn",
      "product": "rt-claw",
      "cwe": "CWE-918",
      "title": "zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16128"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-16152",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00284,
      "epss_percentile": 0.20967,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16152"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-16119",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00282,
      "epss_percentile": 0.20784,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-285",
      "title": "nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16119"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-16154",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00278,
      "epss_percentile": 0.20342,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-74",
      "title": "SourceCodester Class and Exam Timetabling System edit_room1.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16154"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2023-54366",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00277,
      "epss_percentile": 0.20263,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-276",
      "title": "SurrealDB before 1.0.1 Insecure Default Table Permissions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54366"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2024-58370",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00275,
      "epss_percentile": 0.19923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-674",
      "title": "SurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58370"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-16117",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00269,
      "epss_percentile": 0.19177,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/http-proxy",
      "product": "@fastify/http-proxy",
      "cwe": "CWE-20",
      "title": "@fastify/http-proxy vulnerable to prefix escape via URL-encoded characters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16117"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-47866",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00268,
      "epss_percentile": 0.19027,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-863",
      "title": "VMware Avi Load Balancer Authorization Bypass Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47866"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-12228",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00261,
      "epss_percentile": 0.17989,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parisneo",
      "product": "parisneo/lollms",
      "cwe": "CWE-79",
      "title": "Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12228"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2025-71393",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00261,
      "epss_percentile": 0.17975,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-674",
      "title": "SurrealDB before 2.2.2 Memory Exhaustion via Nested Functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71393"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-16150",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00256,
      "epss_percentile": 0.17392,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RobinHerbots",
      "product": "Inputmask",
      "cwe": "CWE-94",
      "title": "RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16150"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2024-58361",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.17195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 2.0.4 Denial of Service via Parser Exception",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58361"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2024-58364",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.17195,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 1.2.1 Denial of Service via Parsing Error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58364"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2024-58365",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.17197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 1.2.0 Denial of Service via Nonexistent Function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58365"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2024-58369",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.17196,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 1.1.1 Denial of Service via Global Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58369"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-47870",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00252,
      "epss_percentile": 0.1694,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-269",
      "title": "VMware Avi Load Balancer Privilege Escalation Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47870"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2025-71390",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00248,
      "epss_percentile": 0.16388,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-863",
      "title": "SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71390"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2025-71394",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00246,
      "epss_percentile": 0.16123,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-22",
      "title": "SurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71394"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2025-71392",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00239,
      "epss_percentile": 0.15254,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-77",
      "title": "SurrealDB before 2.2.2 SurrealQL Injection via export",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71392"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2025-71395",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00235,
      "epss_percentile": 0.14643,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-789",
      "title": "SurrealDB before 2.2.2 Memory Exhaustion via string::replace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71395"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-16158",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00231,
      "epss_percentile": 0.14205,
      "kev": false,
      "kev_due_at": null,
      "vendor": "@fastify/reply-from",
      "product": "@fastify/reply-from",
      "cwe": "CWE-441",
      "title": "@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16158"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2025-71398",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00228,
      "epss_percentile": 0.13883,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-918",
      "title": "SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71398"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-16120",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00228,
      "epss_percentile": 0.1388,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-706",
      "title": "nextlevelbuilder GoClaw exec_approval.go extractBin name resolution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16120"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-57857",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00224,
      "epss_percentile": 0.13323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flow",
      "product": "Flow Payment",
      "cwe": "CWE-79",
      "title": "Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57857"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-16075",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00218,
      "epss_percentile": 0.12564,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AstrBotDevs",
      "product": "AstrBot",
      "cwe": "CWE-285",
      "title": "AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16075"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2024-58367",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00209,
      "epss_percentile": 0.11316,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-285",
      "title": "SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58367"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-16121",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00209,
      "epss_percentile": 0.11442,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-266",
      "title": "nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16121"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-16123",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00209,
      "epss_percentile": 0.11437,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-862",
      "title": "nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16123"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-16195",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00209,
      "epss_percentile": 0.11442,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-285",
      "title": "Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16195"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-16197",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00209,
      "epss_percentile": 0.1144,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-862",
      "title": "Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16197"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-16131",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.002,
      "epss_percentile": 0.10246,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Hospital Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Hospital Management System prescriptionrecord.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16131"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-16155",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00199,
      "epss_percentile": 0.10029,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-79",
      "title": "SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16155"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-16156",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00199,
      "epss_percentile": 0.10032,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Class and Exam Timetabling System",
      "cwe": "CWE-79",
      "title": "SourceCodester Class and Exam Timetabling System forexam.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16156"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2024-58356",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00197,
      "epss_percentile": 0.098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-276",
      "title": "SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58356"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-16122",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00197,
      "epss_percentile": 0.09758,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nextlevelbuilder",
      "product": "GoClaw",
      "cwe": "CWE-285",
      "title": "nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16122"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2024-58363",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00194,
      "epss_percentile": 0.09463,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-287",
      "title": "SurrealDB before 1.5.4 Authentication Bypass via Database Switch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58363"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-16077",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00168,
      "epss_percentile": 0.06515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AstrBotDevs",
      "product": "AstrBot",
      "cwe": "CWE-59",
      "title": "AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16077"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-16081",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00166,
      "epss_percentile": 0.06336,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-352",
      "title": "Sipeed PicoClaw auth.go cross-site request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16081"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-9734",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.05335,
      "kev": false,
      "kev_due_at": null,
      "vendor": "w3scloud",
      "product": "W3SC Elementor to Zoho CRM",
      "cwe": "CWE-352",
      "title": "W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9734"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-9147",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00153,
      "epss_percentile": 0.05019,
      "kev": false,
      "kev_due_at": null,
      "vendor": "scikit-hep",
      "product": "uproot",
      "cwe": "CWE-94",
      "title": "uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9147"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-57848",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00144,
      "epss_percentile": 0.04196,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stoatchat",
      "product": "Stoat for Android",
      "cwe": "CWE-926",
      "title": "Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57848"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-16130",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00138,
      "epss_percentile": 0.03618,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nearai",
      "product": "ironclaw",
      "cwe": "CWE-59",
      "title": "nearai ironclaw write_file path_utils.rs validate_path link following",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16130"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-16085",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00113,
      "epss_percentile": 0.01626,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-829",
      "title": "Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16085"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-47868",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0011,
      "epss_percentile": 0.01455,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VMware",
      "product": "Avi Load Balancer",
      "cwe": "CWE-269",
      "title": "VMware Avi Load Balancer Local Privilege Escalation Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47868"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-16082",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00091,
      "epss_percentile": 0.00552,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipeed",
      "product": "PicoClaw",
      "cwe": "CWE-362",
      "title": "Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16082"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16075",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16075 (AstrBotDevs AstrBot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16076",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16076 (AstrBotDevs AstrBot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16077",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16077 (AstrBotDevs AstrBot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16081",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16081 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16082",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16082 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16083",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16083 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16084",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16084 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16085",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16085 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16088",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16088 (halo-dev halo). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16119",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16119 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16120",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16120 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16121",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16121 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16122",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16122 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16123",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16123 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16124",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16124 (nextlevelbuilder GoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16125",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16125 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16126",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16126 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16127",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16127 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16128",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16128 (zevorn rt-claw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16130",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16130 (nearai ironclaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16131",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16131 (itsourcecode Hospital Management System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16133",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16133 (LiuMengxuan04 MiniCode). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16152",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16152 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16154",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16154 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16155",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16155 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16156",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16156 (SourceCodester Class and Exam Timetabling System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16194",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16194 (zhayujie CowAgent). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16195",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16195 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16196",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16196 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16197",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16197 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-16198",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-16198 (Sipeed PicoClaw). Public exploit reference added."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-15409",
      "detail": "DUE DATE PASSED — CVE-2026-15409 (SonicWall SMA1000). CISA remediation deadline was July 17, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-15410",
      "detail": "DUE DATE PASSED — CVE-2026-15410 (SonicWall SMA1000). CISA remediation deadline was July 17, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-56164",
      "detail": "DUE DATE PASSED — CVE-2026-56164 (Microsoft SharePoint Enterprise Server 2016). CISA remediation deadline was July 17, 2026; still in catalog."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}