A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?
376 CVEs published, led by JetBrains (18).
376 CVEs published July 23, 2026: 63 critical, 137 high, 166 medium, 10 low; 0 in the KEV catalog at press time; 16 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 351 in the results table.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 7468 | 19871 | — | — |
| KEV catalog size | 1675 | |||
Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.
Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.
843 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 480 | 1960 | 178 | 1080 | 596 | 1 | 11 | 2 | 0.1 | 7.8 | .0016 | +380 ▲ |
| microsoft | 650 | 1407 | 98 | 977 | 318 | 14 | 286 | 24 | 1.7 | 7.8 | .0047 | +430 ▲ |
| 119 | 1384 | 156 | 633 | 556 | 39 | 77 | 6 | 0.4 | 7.8 | .0025 | -565 ▼ | |
| red hat | 107 | 329 | 16 | 129 | 162 | 22 | 2 | 0 | 0.0 | 6.5 | .0032 | +16 ▲ |
| apple | 3 | 107 | 2 | 30 | 73 | 2 | 88 | 7 | 6.5 | 6.5 | .0032 | -11 ▼ |
| canonical | 7 | 27 | 3 | 8 | 11 | 5 | 0 | 0 | 0.0 | 5.6 | .0014 | +5 ▲ |
| suse | 8 | 21 | 4 | 12 | 4 | 1 | 0 | 0 | 0.0 | 8.5 | .0039 | +4 ▲ |
| freebsd | 0 | 16 | 0 | 12 | 4 | 0 | 0 | 0 | 0.0 | 7.8 | .0016 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cisco | 15 | 37 | 8 | 18 | 11 | 0 | 56 | 11 | 29.7 | 7.5 | .0057 | +6 ▲ |
| ubiquiti | 25 | 36 | 14 | 21 | 1 | 0 | 3 | 3 | 8.3 | 8.8 | .0049 | +17 ▲ |
| palo alto networks | 14 | 25 | 1 | 3 | 14 | 7 | 13 | 2 | 8.0 | 4.7 | .0028 | +5 ▲ |
| netgear | 6 | 23 | 0 | 0 | 22 | 1 | 0 | 0 | 0.0 | 4.6 | .0024 | -11 ▼ |
| fortinet | 13 | 22 | 6 | 6 | 10 | 0 | 28 | 5 | 22.7 | 7.3 | .0039 | +11 ▲ |
| f5 | 8 | 16 | 5 | 8 | 3 | 0 | 4 | 1 | 6.3 | 8.6 | .0057 | +2 ▲ |
| vmware | 8 | 12 | 1 | 8 | 2 | 1 | 7 | 1 | 8.3 | 8.2 | .0039 | +5 ▲ |
| checkpoint | 3 | 12 | 3 | 6 | 3 | 0 | 3 | 2 | 16.7 | 7.7 | .0455 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 92 | 247 | 55 | 95 | 85 | 11 | 33 | 1 | 0.4 | 7.5 | .0059 | 0 |
| mozilla | 71 | 127 | 51 | 42 | 34 | 0 | 9 | 0 | 0.0 | 8.1 | .0031 | +22 ▲ |
| drupal | 46 | 51 | 6 | 5 | 35 | 5 | 4 | 1 | 2.0 | 5.9 | .0026 | +46 ▲ |
| gitlab | 7 | 38 | 0 | 5 | 27 | 6 | 4 | 2 | 5.3 | 4.7 | .0032 | -4 ▼ |
| github | 5 | 11 | 1 | 2 | 8 | 0 | 0 | 0 | 0.0 | 6.0 | .0042 | +5 ▲ |
| docker | 0 | 7 | 0 | 5 | 2 | 0 | 0 | 0 | 0.0 | 8.2 | .0016 | -4 ▼ |
| wordpress | 2 | 2 | 1 | 0 | 1 | 0 | 2 | 2 | 100.0 | 7.9 | .8879 | +2 ▲ |
| kubernetes | 1 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | 0.0 | 2.4 | .0035 | +1 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 1109 | 1379 | 343 | 653 | 322 | 61 | 27 | 3 | 0.2 | 8.1 | .0036 | +867 ▲ |
| adobe | 95 | 239 | 26 | 104 | 105 | 4 | 19 | 3 | 1.3 | 7.7 | .0026 | -37 ▼ |
| ibm | 37 | 161 | 52 | 54 | 55 | 0 | 6 | 0 | 0.0 | 7.5 | .0036 | +5 ▲ |
| progress | 28 | 37 | 6 | 24 | 7 | 0 | 6 | 0 | 0.0 | 7.5 | .0037 | +23 ▲ |
| solarwinds | 15 | 22 | 16 | 3 | 3 | 0 | 10 | 4 | 18.2 | 9.1 | .0058 | +12 ▲ |
| zohocorp | 3 | 6 | 2 | 2 | 2 | 0 | 0 | 0 | 0.0 | 7.8 | .0146 | +2 ▲ |
| veeam | 1 | 5 | 2 | 3 | 0 | 0 | 1 | 0 | 0.0 | 8.6 | .0051 | 0 |
| atlassian | 3 | 3 | 0 | 3 | 0 | 0 | 13 | 0 | 0.0 | 8.0 | .0026 | +3 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| rockwell automation | 17 | 24 | 4 | 18 | 2 | 0 | 0 | 0 | 0.0 | 8.7 | .0029 | +10 ▲ |
| synology | 0 | 23 | 2 | 5 | 13 | 3 | 0 | 0 | 0.0 | 5.6 | .0025 | -5 ▼ |
| d-link | 8 | 20 | 0 | 5 | 9 | 6 | 3 | 0 | 0.0 | 5.5 | .0105 | -1 ▼ |
| siemens | 7 | 16 | 1 | 8 | 7 | 0 | 0 | 0 | 0.0 | 7.6 | .0024 | 0 |
| abb | 1 | 7 | 0 | 4 | 3 | 0 | 0 | 0 | 0.0 | 7.2 | .0018 | -5 ▼ |
| schneider electric | 0 | 6 | 0 | 4 | 2 | 0 | 0 | 0 | 0.0 | 7.8 | .0042 | -1 ▼ |
| hikvision | 5 | 5 | 0 | 3 | 2 | 0 | 0 | 0 | 0.0 | 7.2 | .0038 | +5 ▲ |
| moxa | 0 | 5 | 0 | 3 | 2 | 0 | 0 | 0 | 0.0 | 7.0 | .0029 | -5 ▼ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sourcecodester | 49 | 120 | 0 | 0 | 62 | 58 | 0 | 0 | 0.0 | 5.5 | .0034 | +12 ▲ |
| openclaw | 44 | 111 | 0 | 58 | 39 | 14 | 0 | 0 | 0.0 | 7.0 | .0026 | -17 ▼ |
| dell | 43 | 99 | 5 | 47 | 44 | 3 | 2 | 1 | 1.0 | 7.1 | .0021 | +12 ▲ |
| capgo | 22 | 83 | 2 | 42 | 38 | 1 | 0 | 0 | 0.0 | 7.1 | .0037 | -14 ▼ |
| nvidia | 41 | 80 | 12 | 52 | 16 | 0 | 0 | 0 | 0.0 | 7.8 | .0037 | +35 ▲ |
| imagemagick | 32 | 73 | 1 | 5 | 55 | 12 | 0 | 0 | 0.0 | 5.3 | .0019 | -1 ▼ |
| spring | 0 | 73 | 2 | 31 | 39 | 1 | 0 | 0 | 0.0 | 6.5 | .0024 | -72 ▼ |
| itsourcecode | 18 | 71 | 0 | 0 | 19 | 52 | 0 | 0 | 0.0 | 2.1 | .0033 | -4 ▼ |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-63030 | .9779 | 99.9 | 9.8 |
| CVE-2026-16232 | .8912 | 99.8 | 9.3 |
| CVE-2026-20230 | .8820 | 99.8 | 8.6 |
| CVE-2026-50522 | .8461 | 99.7 | 9.8 |
| CVE-2026-15409 | .8366 | 99.7 | 10.0 |
| CVE-2026-60137 | .7979 | 99.6 | 5.9 |
| CVE-2026-6875 | .7758 | 99.5 | 9.5 |
| CVE-2026-25089 | .7611 | 99.5 | 9.8 |
| CVE-2026-45659 | .7608 | 99.5 | 8.8 |
| CVE-2026-0770 | .6342 | 99.1 | 9.8 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-15409 | 10.0 | .8366 | KEV |
| CVE-2026-48282 | 10.0 | .4239 | KEV |
| CVE-2026-56290 | 10.0 | .3038 | KEV |
| CVE-2026-48939 | 10.0 | .1973 | KEV |
| CVE-2026-48908 | 10.0 | .1482 | KEV |
| CVE-2026-56291 | 10.0 | .1459 | KEV |
| CVE-2026-59726 | 10.0 | .0688 | |
| CVE-2026-8985 | 10.0 | .0660 | |
| CVE-2026-13773 | 10.0 | .0610 | |
| CVE-2026-6516 | 10.0 | .0486 |
| Vendor | CVEs |
|---|---|
| oracle | 1109 |
| linux | 893 |
| microsoft | 651 |
| 525 | |
| red hat | 144 |
| apache | 121 |
| adobe | 105 |
| ibm | 80 |
| mozilla | 72 |
| sourcecodester | 61 |
| Vendor | KEV |
|---|---|
| microsoft | 24 |
| cisco | 11 |
| apple | 7 |
| 6 | |
| fortinet | 5 |
| ivanti | 5 |
| solarwinds | 4 |
| adobe | 3 |
| berriai | 3 |
| oracle | 3 |
| Ecosystem | Advisories |
|---|---|
| Maven | 62 |
| npm | 6 |
| PyPI | 5 |
| NuGet | 3 |
| Packagist | 1 |
| crates.io | 1 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2021-27137 | DD-WRT | 0 |
| CVE-2026-0770 | Langflow | 0 |
| CVE-2026-12569 | PTC | 0 |
| CVE-2026-15409 | SonicWall | 0 |
| CVE-2026-15410 | SonicWall | 0 |
| CVE-2026-16232 | checkpoint | 0 |
| CVE-2026-20230 | Cisco | 0 |
| CVE-2026-25089 | Fortinet | 0 |
| CVE-2026-45659 | Microsoft | 0 |
| CVE-2026-46817 | Oracle Corporation | 0 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | n/a | 2021-11-17 | 1709 |
| CVE-2021-27102 | n/a | 2021-11-17 | 1709 |
| CVE-2021-27101 | n/a | 2021-11-17 | 1709 |
| CVE-2021-27103 | n/a | 2021-11-17 | 1709 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1709 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1709 |
| CVE-2021-42013 | Apache Software Foundation | 2021-11-17 | 1709 |
| CVE-2021-41773 | Apache Software Foundation | 2021-11-17 | 1709 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1709 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1709 |
EXPLOIT PUBLISHED — cure53 DOMPurify: 9 CVEs (CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65904, CVE-2026-65911, CVE-2026-65914). Public exploit references added.
EXPLOIT PUBLISHED — Ubiquiti UniFi OS: 3 CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910). Public exploit references added.
EXPLOIT PUBLISHED — CVE-2026-16489 (jsforce). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-16628 (oclif). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-16630 (syncfusion ej2-javascript-ui-controls). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-20253 (Splunk Enterprise). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-26740. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-42999 (OpenStack Keystone). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-43000 (OpenStack Keystone). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-44210 (kata-containers). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-44891 (netty). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55831 (netty). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-56292 (acymailing.com AcyMailing extension for Joomla). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-57827 (rsjoomla.com RSFiles extension for Joomla). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-57828 (phoca.cz Phoca Download extension for Joomla). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-65012 (invoke-ai InvokeAI). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-65013 (onlook repo). Public exploit reference added.
RESCORED — Microsoft Windows 10 Version 1607: 4 CVEs (CVE-2026-42975, CVE-2026-50491, CVE-2026-54989, CVE-2026-57089). CVSS rescored — before/after on each CVE page.
RESCORED — Microsoft Windows 11 Version 24H2: 3 CVEs (CVE-2026-50317, CVE-2026-50440, CVE-2026-56187). CVSS rescored — before/after on each CVE page.
RESCORED — CVE-2026-10732 (decompress). CVSS 6.1 → 5.6 (NVD).
RESCORED — CVE-2026-13448 (IBM Langflow OSS). CVSS 8.1 → 9.8 (NVD).
RESCORED — CVE-2026-16631 (publint). CVSS 4.8 → 1.9 (NVD).
RESCORED — CVE-2026-16632 (boazsegev facil.io). CVSS 6.9 → 5.5 (NVD).
RESCORED — CVE-2026-42010 (Red Hat Enterprise Linux 10). CVSS 7.1 → 9.8 (NVD).
RESCORED — CVE-2026-42999 (OpenStack Keystone). CVSS 6 → 8.8 (NVD).
RESCORED — CVE-2026-43000 (OpenStack Keystone). CVSS 6 → 8.8 (NVD).
RESCORED — CVE-2026-44930 (Apache Software Foundation Apache CXF). CVSS 4.3 → 9.8 (NVD).
RESCORED — CVE-2026-50406 (Microsoft Windows 10 Version 21H2). CVSS 7 → 7.8 (NVD).
ENRICHED — Ubiquiti UniFi OS: 3 CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910). Received CVSS/CPE analysis.
ENRICHED — CVE-2026-10520 (Ivanti Sentry). Received CVSS 10.0 and CPE data from NVD.
ENRICHED — CVE-2026-11645 (Google Chromium V8). Received CVSS 8.8 and CPE data from NVD.
ENRICHED — CVE-2026-20253 (Splunk Enterprise). Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2026-25089 (Fortinet FortiSandbox). Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2026-34926 (Trend Micro Apex One). Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2026-35273 (Oracle PeopleSoft Enterprise PeopleTools). Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2026-45498 (Microsoft Defender). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2026-45659 (Microsoft SharePoint Server). Received CVSS 8.8 and CPE data from NVD.
ENRICHED — CVE-2026-48172 (LiteSpeed cPanel Plugin). Received CVSS 10.0 and CPE data from NVD.
ENRICHED — CVE-2026-48907 (Widget Factory Joomla Content Editor ). Received CVSS 10.0 and CPE data from NVD.
ENRICHED — CVE-2026-54420 (LiteSpeed cPanel Plugin). Received CVSS 8.5 and CPE data from NVD.
ENRICHED — CVE-2026-9082 (Drupal Core). Received CVSS 9.8 and CPE data from NVD.
How to read these box scores · glossary
376 CVEs published. 25 box scores, 351 table rows — nothing truncated.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N C H H H 9.0 .1599 96.6 —
AFFECTED Product Versions Fixed Fastjson 1.2.68 – —
TIMELINE Jul 23 Reserved by CNA Jul 23 Published (CNA: alibaba)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H L 10.0 .0486 91.4 —
AFFECTED Product Versions Fixed ManageEngine ADAudit Plus unspecified —
TIMELINE Apr 17 Reserved by CNA Jul 23 Published (CNA: Zohocorp)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H H 10.0 .0388 89.4 —
AFFECTED Product Versions Fixed dbgate < 7.1.9 – —
TIMELINE May 19 Reserved by CNA Jul 23 Published (CNA: GitHub_M)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0339 87.9 —
AFFECTED Product Versions Fixed microweber unspecified —
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H N N 8.7 .0192 78.3 —
AFFECTED Product Versions Fixed meshery unspecified —
TIMELINE Jul 23 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 9.4 .0171 75.6 —
AFFECTED Product Versions Fixed dbgate < 7.1.9 – —
TIMELINE May 19 Reserved by CNA Jul 23 Published (CNA: GitHub_M)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0152 72.6 —
AFFECTED Product Versions Fixed h2ogpt unspecified —
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N L N L L L 1.9 .0122 66.5 —
AFFECTED Product Versions Fixed serverless-localstack 1.0 – —
TIMELINE Jul 23 Reserved by CNA Jul 23 Published (CNA: VulDB)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 10.0 .0120 65.8 —
AFFECTED Product Versions Fixed cal.diy unspecified 5.9.9
TIMELINE Jul 16 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 9.4 .0101 60.5 —
AFFECTED Product Versions Fixed 9router unspecified 0.4.60
TIMELINE Jul 18 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0090 57.0 —
AFFECTED Product Versions Fixed Standalone Report Designer 6.3 – 14.1.12
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0087 55.9 —
AFFECTED Product Versions Fixed Standalone Report Designer 6.3 – 14.1.12
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0087 55.9 —
AFFECTED Product Versions Fixed Standalone Report Designer 6.3 – 14.1.12
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0087 55.9 —
AFFECTED Product Versions Fixed Standalone Report Designer 6.3 – 14.1.12
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0085 55.4 —
AFFECTED Product Versions Fixed grav 1.7.0 – 2.0.9
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .0084 55.1 —
AFFECTED Product Versions Fixed pardus-update 0.6.6 – —
TIMELINE Jul 20 Reserved by CNA Jul 23 Published (CNA: TR-CERT)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0080 53.7 —
AFFECTED Product Versions Fixed SAML Single Sign On – SSO Login unspecified —
TIMELINE Jul 16 Reserved by CNA Jul 23 Published (CNA: Wordfence)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N P H H H 9.4 .0079 53.5 —
AFFECTED Product Versions Fixed siyuan unspecified 3.7.2
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N P H H H 9.4 .0079 53.5 —
AFFECTED Product Versions Fixed siyuan unspecified 3.7.2
TIMELINE Jul 22 Reserved by CNA Jul 23 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C H H H 9.9 .0079 53.5 —
AFFECTED Product Versions Fixed Advanced Views n/a – 3.9.0
TIMELINE Jul 5 Reserved by CNA Jul 23 Published (CNA: Patchstack)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N N H 8.7 .0075 52.2 —
AFFECTED Product Versions Fixed aws-smithy-http-server unspecified —
TIMELINE Jul 23 Reserved by CNA Jul 23 Published (CNA: AMZN)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0072 51.2 —
AFFECTED Product Versions Fixed Microsoft Account - – —
TIMELINE Jun 19 Reserved by CNA Jul 23 Published (CNA: microsoft)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0071 50.8 —
AFFECTED Product Versions Fixed MountDev AI MCP Connector for WordPress unspecified —
TIMELINE Jul 7 Reserved by CNA Jul 23 Published (CNA: Wordfence)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0071 50.8 —
AFFECTED Product Versions Fixed Victim Information Notification Exchange (VINE) unspecified 2026-05-07
TIMELINE Jul 16 Reserved by CNA Jul 23 Published (CNA: cisa-cg)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0071 50.7 —
AFFECTED Product Versions Fixed Surface Management Services - – —
TIMELINE Jun 11 Reserved by CNA Jul 23 Published (CNA: microsoft)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-63765 | 8.8 | 50.5 | chatwoot | chatwoot | CWE-306 | Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob … |
| CVE-2026-65701 | 9.3 | 50.2 | svc-develop-team | so-vits-svc | CWE-22 | SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route |
| CVE-2026-16653 | 5.5 | 50.0 | boazsegev | facil.io | CWE-22 | boazsegev facil.io Public Folder http.c http_sendfile2 path traversal |
| CVE-2026-16767 | 5.5 | 49.6 | Ne-Lexa | php-zip | CWE-22 | Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal |
| CVE-2026-15074 | 7.5 | 49.3 | @fastify/static | @fastify/static | CWE-22 | @fastify/static vulnerable to route guard bypass via path traversal |
| CVE-2026-14282 | 9.8 | 49.3 | rtcamp | GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more | CWE-434 | GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Uplo… |
| CVE-2026-16796 | 8.4 | 47.3 | AWS | bedrock-agentcore 1.18.1 | CWE-88 | Improper neutralization of argument delimiters in AWS Bedrock AgentCore Pytho… |
| CVE-2026-16735 | 1.9 | 47.1 | release-it | conventional-changelog | CWE-77 | release-it conventional-changelog Changelog File index.js writeChangelog os c… |
| CVE-2026-49035 | 9.2 | 46.7 | MZ Automation | libIEC61850 | CWE-122 | Stack-based Buffer Overflow in MZ Automation libIEC61850 |
| CVE-2026-16733 | 1.9 | 46.6 | bahmutov | find-cypress-specs | CWE-77 | bahmutov find-cypress-specs Branch index.js shell.exec os command injection |
| CVE-2026-25800 | 7.5 | 46.5 | quinn-rs | quinn | CWE-770 | quinn-proto has remote memory exhaustion from unbounded out-of-order stream r… |
| CVE-2026-59555 | 10.0 | 46.3 | Roland Barker | Participants Database | CWE-22 | WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion v… |
| CVE-2026-16078 | 6.5 | 45.8 | kilbot | WCPOS – Point of Sale (POS) plugin for WooCommerce | CWE-22 | WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary Fi… |
| CVE-2026-65607 | 7.1 | 45.4 | siyuan-note | siyuan | CWE-22 | SiYuan before v3.7.2 Path Traversal via /export/temp/ |
| CVE-2026-56160 | 9.9 | 45.3 | Microsoft | Azure Red Hat OpenShift (ARO) | CWE-285 | Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability |
| CVE-2026-15348 | 6.3 | 45.1 | codename065 | Premium Packages – Sell Digital Products Securely | CWE-287 | Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl'… |
| CVE-2026-65702 | 8.8 | 45.1 | vanna-ai | vanna | CWE-22 | Vanna 2.0.2 Path Traversal via FileSystemConversationStore |
| CVE-2026-44909 | 7.5 | 44.8 | proxygen | — | Proxygen lacked a generalized slow-consumer detection mechanism in its core H… | |
| CVE-2026-59544 | 9.8 | 44.3 | Thrive Themes Coupon | Thrive Quiz Builder | CWE-502 | WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulne… |
| CVE-2024-58354 | 8.5 | 44.0 | calcom | cal.diy | CWE-77 | cal.com Repository Takeover via pull_request_target Workflow |
| CVE-2026-65497 | 7.2 | 43.0 | Complianz | Complianz | CWE-502 | WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability |
| CVE-2026-15827 | 5.3 | 42.9 | ataurr | GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | CWE-862 | GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Infor… |
| CVE-2026-65906 | 10.0 | 42.7 | JetBrains | TeamCity | CWE-94 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DS… |
| CVE-2026-14291 | 7.5 | 42.5 | Unknown | security-ninja-premium | CWE-287 | Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secni… |
| CVE-2026-47723 | 7.1 | 42.2 | juev | nebula-mesh | CWE-1021 | nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Opt… |
| CVE-2026-65897 | 8.7 | 42.0 | getgrav | grav | CWE-269 | Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups |
| CVE-2026-47752 | 9.9 | 41.7 | Quenary | tugtainer | CWE-1336 | Tugtainer has Server-Side Template Injection in notification templates that l… |
| CVE-2026-52439 | 9.8 | 41.5 | n/a | n/a | CWE-917 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitra… |
| CVE-2026-47669 | 9.3 | 41.5 | dbgate | dbgate | CWE-22 | DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE |
| CVE-2026-42933 | 10.0 | 41.3 | Pronetiqs | Panduit Intravue | CWE-441 | Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs |
| CVE-2026-64813 | 10.0 | 41.2 | JetBrains | IntelliJ IDEA | CWE-602 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification w… |
| CVE-2026-65917 | 8.7 | 40.9 | usmannasir | cyberpanel | CWE-639 | CyberPanel IncBackups IDOR via Sequential Backup ID |
| CVE-2026-44210 | 5.8 | 40.7 | kata-containers | kata-containers | CWE-88 | Kata Containers have VM Escape via virtiofsd Argument Injection through Defau… |
| CVE-2024-58330 | 7.5 | 40.5 | Bosch | Camera Firmware | CWE-284 | A missing authentication check in Bosch IP cameras of families CPP13 and CPP1… |
| CVE-2026-27064 | 9.1 | 40.5 | EverPress | Mailster | CWE-434 | WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability |
| CVE-2026-65455 | 9.1 | 40.5 | MapSVG | MapSVG | CWE-434 | WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability |
| CVE-2026-65461 | 9.1 | 40.5 | Webの相談所 | Really Simple CSV Importer | CWE-434 | WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vu… |
| CVE-2026-15011 | 9.8 | 40.2 | emarket-design | Customer Support Ticket System & Helpdesk | CWE-94 | Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Inj… |
| CVE-2026-21655 | 8.7 | 40.0 | Johnson Control | victor | CWE-502 | C-CURE 9000 and Victor application server - Deserialization of Untrusted Data |
| CVE-2026-64800 | 5.7 | 40.0 | JetBrains | GoLand | CWE-532 | In JetBrains GoLand before 2026.2 sensitive configuration values written to l… |
| CVE-2026-65916 | 7.2 | 39.8 | usmannasir | cyberpanel | CWE-862 | CyberPanel Missing Authorization in cancelBackupCreation Handler |
| CVE-2026-59540 | 9.8 | 39.4 | Cozy Vision Technologies Pvt. Ltd. | SMS Alert Order Notifications | CWE-266 | WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalatio… |
| CVE-2026-61951 | 9.8 | 39.4 | themetechmount | TrueBooker | CWE-266 | WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability |
| CVE-2026-65695 | 7.6 | 39.4 | GongRzhe | Office-Word-MCP-Server | CWE-22 | Office-Word-MCP-Server 1.1.11 Path Traversal via document tools |
| CVE-2026-47724 | 9.9 | 39.3 | juev | nebula-mesh | CWE-862 | nebula-mesh: API endpoints lack ownership checks, enabling cross-operator pri… |
| CVE-2026-65896 | 7.1 | 39.0 | getgrav | grav | CWE-73 | Grav API Plugin before 1.0.10 Path Traversal via move |
| CVE-2026-64812 | 10.0 | 38.8 | JetBrains | IntelliJ IDEA | CWE-306 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was pos… |
| CVE-2026-15906 | 6.5 | 38.7 | codename065 | Premium Packages – Sell Digital Products Securely | CWE-89 | Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby… |
| CVE-2026-59542 | 7.7 | 38.5 | WP Chill | Kali Forms | CWE-22 | WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability |
| CVE-2026-65698 | 6.0 | 38.6 | voideditor | void | CWE-22 | Void 1.3.4 Path Traversal via AI Agent File-Reading Tools |
| CVE-2026-47722 | 8.7 | 38.4 | juev | nebula-mesh | CWE-94 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml |
| CVE-2026-64600 | 7.8 | 38.4 | Linux | Linux | CWE-362 | xfs: resample the data fork mapping after cycling ILOCK |
| CVE-2026-47769 | 5.3 | 38.4 | Work90210 | APIFold | CWE-306 | APIFold Vulnerable to Unauthenticated Webhook Event Injection |
| CVE-2026-14257 | 7.5 | 38.2 | juliangruber | brace-expansion | CWE-400 | brace-expansion DoS via unbounded expansion length causing an out-of-memory p… |
| CVE-2026-63313 | 8.3 | 38.2 | decolua | 9router | CWE-918 | 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch |
| CVE-2026-9713 | 7.5 | 38.1 | King-Theme | Product Designer for WooCommerce WordPress | Lumise | CWE-89 | Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticate… |
| CVE-2026-50032 | 8.7 | 37.9 | MZ Automation | libIEC61850 | CWE-476 | NULL Pointer Dereference in MZ Automation libIEC61850 |
| CVE-2026-50039 | 8.7 | 37.7 | MZ Automation | libIEC61850 | CWE-121 | Stack-based Buffer Overflow in MZ Automation libIEC61850 |
| CVE-2026-59545 | 8.1 | 37.6 | miniOrange | miniOrange Discord Integration | CWE-288 | WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authenticat… |
| CVE-2026-13009 | 6.5 | 37.3 | wupsales | AI Copilot – Content Generator | CWE-89 | AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0]… |
| CVE-2026-15761 | 6.5 | 37.3 | tickera | Tickera – Sell Tickets & Manage Events | CWE-89 | Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filte… |
| CVE-2026-6924 | 8.7 | 36.8 | Silicon Labs | Silicon Labs Matter Github | CWE-336 | Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path |
| CVE-2026-12353 | 5.3 | 36.2 | Red Hat | Red Hat Certificate System 9 | CWE-772 | Rhcs: memory leak during https connection leads to denial of service |
| CVE-2026-65762 | 5.1 | 36.2 | phoca.cz | Phoca Guestbook extension for Joomla | CWE-79 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook … |
| CVE-2026-65763 | 5.1 | 36.2 | phoca.cz | Phoca Maps extension for Joomla | CWE-79 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0… |
| CVE-2026-65759 | 8.7 | 36.0 | joomshaper.com | Easy Store extension for Joomla | CWE-284 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in … |
| CVE-2026-16765 | 5.5 | 35.7 | CodeAstro | Online Classroom | CWE-74 | CodeAstro Online Classroom loginlinkadmin.php sql injection |
| CVE-2026-65477 | 7.5 | 35.5 | Select-Themes | Tonda Core | CWE-98 | WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability |
| CVE-2026-65481 | 7.5 | 35.5 | Elated-Themes | Vino | CWE-98 | WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability |
| CVE-2026-43823 | 7.5 | 35.4 | Apple | swift-crypto | CWE-415 | When initializing an RSA public key from DER or PEM bytes throws an error, th… |
| CVE-2026-16807 | 8.8 | 35.4 | Chrome | CWE-787 | Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowe… | |
| CVE-2026-16002 | 8.8 | 35.3 | MZ Automation | lib60870 | CWE-125 | Out-of-bounds Read in MZ Automation lib60870 |
| CVE-2026-59554 | 7.5 | 35.3 | Ziina | Ziina | CWE-1390 | WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability |
| CVE-2026-65495 | 7.5 | 35.2 | Dokan Multivendor Plugin | Dokan Pro | CWE-862 | WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability |
| CVE-2026-65760 | 9.2 | 34.9 | joomshaper.com | Easy Store extension for Joomla | CWE-284 | Joomla Extension - joomshaper.com - cross-customer order and personal informa… |
| CVE-2026-65907 | 9.1 | 34.8 | JetBrains | TeamCity | CWE-94 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS ro… |
| CVE-2026-14481 | 6.4 | 34.6 | equalizedigital | Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance | CWE-79 | Equalize Digital Accessibility Checker <= 1.46.0 - Authenticated (Contributor… |
| CVE-2026-16804 | 8.3 | 34.6 | Chrome | CWE-416 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a re… | |
| CVE-2026-16745 | 8.8 | 34.4 | Red Hat | Red Hat OpenShift AI 2.25 | CWE-346 | Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-tok… |
| CVE-2026-59541 | 8.8 | 34.5 | Hakan Ozevin | WP BASE Booking | CWE-266 | WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability |
| CVE-2026-59524 | 6.5 | 34.5 | Sandhills Development, LLC | Easy Digital Downloads | CWE-288 | WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vuln… |
| CVE-2026-28698 | 9.2 | 34.3 | Pronetiqs | Panduit Intravue | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in… |
| CVE-2024-58353 | 9.3 | 34.3 | calcom | cal.diy | CWE-80 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions |
| CVE-2024-58355 | 9.3 | 34.3 | calcom | cal.diy | CWE-80 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions |
| CVE-2026-56167 | 8.8 | 34.2 | Microsoft | Azure AI Search | CWE-918 | Azure AI Search Elevation of Privilege Vulnerability |
| CVE-2026-13119 | 6.5 | 34.1 | roundupwp | Registrations for the Events Calendar – Event Registration Plugin | CWE-89 | Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) S… |
| CVE-2026-15448 | 6.5 | 34.1 | tickera | Tickera – Sell Tickets & Manage Events | CWE-89 | Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_statu… |
| CVE-2026-57696 | 7.1 | 33.7 | videowhisper | Picture Gallery | CWE-22 | WordPress Picture Gallery plugin <= 1.6.5 - Arbitrary File Deletion vulnerabi… |
| CVE-2026-16764 | 2.1 | 33.6 | OWASP | DefectDojo | CWE-266 | OWASP DefectDojo API/Web serializers.py UserSerializer privileges management |
| CVE-2026-12082 | 7.5 | 33.5 | Unknown | Praison AI SEO | CWE-862 | Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post… |
| CVE-2026-16768 | 5.3 | 33.4 | GNOME | gdk-pixbuf | CWE-125 | Gdk-pixbuf: out-of-bounds read in ico parser |
| CVE-2026-59525 | 9.3 | 32.9 | Roland Barker | Participants Database | CWE-89 | WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability |
| CVE-2026-59526 | 9.3 | 32.9 | RomanCode | MapSVG | CWE-89 | WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability |
| CVE-2026-61949 | 9.3 | 32.9 | Bookly | Bookly | CWE-89 | WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability |
| CVE-2026-61950 | 9.3 | 32.9 | themetechmount | TrueBooker | CWE-89 | WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability |
| CVE-2026-65493 | 7.5 | 32.9 | Dokan | Dokan Pro | CWE-502 | WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability |
| CVE-2026-65920 | 5.3 | 32.6 | huggingface | diffusers | CWE-22 | Diffusers Path Traversal via weight_map Arbitrary File Read |
| CVE-2026-15786 | 4.4 | 32.6 | gowebsmarty | WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security | CWE-22 | WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Writ… |
| CVE-2026-40430 | 8.7 | 32.2 | Pronetiqs | Panduit Intravue | CWE-256 | Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs |
| CVE-2026-65500 | 7.5 | 32.2 | pixelacehq | Manual - Documentation, Knowledge Base & Education WordPress Theme | CWE-862 | WordPress Manual - Documentation, Knowledge Base & Education WordPress theme … |
| CVE-2026-21653 | 7.2 | 31.6 | Johnson Controls | CCure 9000 and victor application server | CWE-918 | CCure and Victor Application Server - Server Side Request Forgery |
| CVE-2026-16805 | 8.8 | 31.5 | Chrome | CWE-416 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a re… | |
| CVE-2026-16806 | 8.8 | 31.5 | Chrome | CWE-416 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a r… | |
| CVE-2026-47743 | 8.7 | 31.2 | shopperlabs | shopper | CWE-79 | Shopper: Multiple data integrity and disclosure issues in admin Livewire comp… |
| CVE-2026-65462 | 7.6 | 31.1 | Uncanny Owl | Uncanny Automator | CWE-89 | WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability |
| CVE-2026-65532 | 7.6 | 31.0 | PersianScript | Persian Woocommerce SMS | CWE-89 | WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability |
| CVE-2026-63226 | 6.9 | 31.1 | Ricoh Company | Ricoh printers and Multifunction Printers (MFPs) | CWE-923 | Printers and Multifunction Printers (MFPs) provided by Ricoh Company, Ltd. do… |
| CVE-2026-27377 | 6.7 | 31.1 | axiomthemes | QuickCal - Appointment Booking Calendar for WordPress | CWE-862 | WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0… |
| CVE-2026-27355 | 5.3 | 30.9 | metaphorcreations | Ditty | CWE-862 | WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability |
| CVE-2026-65431 | 9.8 | 30.8 | regularlabs.com | GeoIP extension for Joomla | CWE-22 | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension |
| CVE-2026-57716 | 5.3 | 30.3 | videowhisper | Broadcast Live Video | CWE-22 | WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vuln… |
| CVE-2026-27372 | 6.5 | 30.1 | Pepro Dev. Group | PeproDev Ultimate Invoice | CWE-201 | WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure… |
| CVE-2026-61945 | 6.5 | 29.8 | MultiVendorX | WooCommerce Product Stock Alert | CWE-497 | WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Ex… |
| CVE-2026-7120 | 5.3 | 29.6 | @fastify/static | @fastify/static | CWE-180 | @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths |
| CVE-2026-48013 | 4.1 | 29.3 | shopware | shopware | CWE-918 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation |
| CVE-2026-15017 | 8.8 | 28.9 | mdjm | MDJM Event Management | CWE-269 | MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Esca… |
| CVE-2026-8287 | 4.3 | 28.6 | BizimHesap Information Systems Industry and Trade Inc. | Online Pre-Accounting Software | CWE-770 | Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accoun… |
| CVE-2026-15617 | 9.1 | 28.4 | Logto | Logto | CWE-178 | Principal/domain lookup without case normalization |
| CVE-2026-24552 | 8.5 | 28.4 | John-Michael L'Allier | Create | CWE-89 | WordPress Create plugin <= 2.5.3 - SQL Injection vulnerability |
| CVE-2026-25405 | 8.5 | 28.4 | DigitalME | eRoom | CWE-89 | WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability |
| CVE-2026-65450 | 8.5 | 28.4 | RomanCode | MapSVG | CWE-89 | WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability |
| CVE-2026-65451 | 8.5 | 28.4 | RomanCode | MapSVG | CWE-89 | WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability |
| CVE-2026-65454 | 8.5 | 28.4 | ExpressTech Systems | Quiz And Survey Master | CWE-89 | WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability |
| CVE-2026-65526 | 8.5 | 28.4 | Themeisle | Visualizer | CWE-89 | WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability |
| CVE-2026-47755 | 6.5 | 28.0 | itflow-org | itflow | CWE-639 | ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unp… |
| CVE-2026-15687 | 2.4 | 27.9 | Kubernetes | kubernetes-client/java | CWE-22 | Path traversal via non-tar copyDirectoryFromPod |
| CVE-2026-15611 | 9.1 | 27.8 | Logto | Logto | CWE-287 | Unverified email-based SSO account linking |
| CVE-2026-65761 | 9.3 | 27.3 | joomshaper.com | Easy Store extension for Joomla | CWE-89 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Sto… |
| CVE-2026-59547 | 7.5 | 27.2 | Easy Payment | Payment Gateway for PayPal on WooCommerce | CWE-862 | WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken … |
| CVE-2026-61954 | 7.5 | 27.2 | PayU India | PayU India | CWE-862 | WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability |
| CVE-2026-64611 | 7.5 | 27.1 | Red Hat | Red Hat Enterprise Linux 10 | CWE-835 | Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loo… |
| CVE-2026-7232 | 7.2 | 27.0 | FormCraft | FormCraft | CWE-79 | FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix … |
| CVE-2026-44955 | 6.9 | 27.0 | Pronetiqs | Panduit Intravue | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in… |
| CVE-2026-59522 | 6.5 | 26.5 | weDevs | WP ERP | CWE-862 | WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability |
| CVE-2026-57367 | 7.1 | 26.3 | WP Booking System . | WP Booking System | CWE-862 | WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnera… |
| CVE-2026-65754 | 7.5 | 26.0 | regularlabs.com | ReReplacer PRo extension for Joomla | CWE-22 | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro… |
| CVE-2026-57425 | 6.5 | 25.6 | wpdesk | Autopay dla WooCommerce | CWE-862 | WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vu… |
| CVE-2026-57717 | 6.5 | 25.6 | knitpay | Knit Pay | CWE-862 | WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability |
| CVE-2026-9729 | 6.4 | 25.5 | webpushr | Web Push Notifications – Webpushr | CWE-79 | Web Push Notifications <= 4.39.0 - Authenticated (Contributor+) Stored Cross-… |
| CVE-2026-15394 | 6.4 | 25.5 | mahethekiller | Header Footer Script Adder | CWE-79 | Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site… |
| CVE-2026-15404 | 6.4 | 25.5 | niklaslindemann | Bulk Page Generator – LPagery | CWE-79 | Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site… |
| CVE-2026-15646 | 6.4 | 25.5 | berocket | Brands for WooCommerce | CWE-79 | Brands for WooCommerce <= 3.8.8 - Authenticated (Contributor+) Stored Cross-S… |
| CVE-2026-15794 | 6.4 | 25.5 | berocket | Grid/List View for WooCommerce | CWE-79 | Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored… |
| CVE-2026-64815 | 9.8 | 25.4 | JetBrains | IntelliJ IDEA | CWE-94 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possibl… |
| CVE-2026-65918 | 7.1 | 25.3 | pytorch | vision | CWE-125 | PyTorch torchvision GIF Decoder Out-of-bounds Heap Read |
| CVE-2026-65474 | 5.3 | 25.3 | WPManageNinja | Ninja Tables | CWE-497 | WordPress Ninja Tables plugin <= 5.2.10 - Sensitive Data Exposure vulnerability |
| CVE-2026-65490 | 5.3 | 25.3 | mischiefmarmot | Create by Mediavine | CWE-497 | WordPress Create by Mediavine plugin <= 2.5.3 - Sensitive Data Exposure vulne… |
| CVE-2026-65498 | 5.3 | 25.3 | Complianz | Complianz | CWE-497 | WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability |
| CVE-2026-65505 | 5.3 | 25.3 | bdthemes | Ultimate Store Kit Elementor Addons | CWE-497 | WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Dat… |
| CVE-2026-65521 | 5.3 | 25.3 | Mahmudul Hasan Arif | WP Social Ninja | CWE-497 | WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerabi… |
| CVE-2026-65895 | 8.2 | 25.2 | getgrav | grav | CWE-862 | Grav API Plugin before 1.0.10 Broken Access Control |
| CVE-2026-15616 | 9.1 | 25.2 | Logto | Logto | CWE-308 | Local MFA not enforced during SSO sign-in |
| CVE-2026-21723 | 5.3 | 25.1 | Grafana | Grafana OSS | CWE-400 | CVE-2026-21723 Record |
| CVE-2026-34496 | 7.1 | 24.9 | Johnson Controls | victor Web | CWE-269 | victor Web - Priviledge Escalation |
| CVE-2026-65903 | 5.1 | 24.8 | cure53 | DOMPurify | CWE-697 | DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS |
| CVE-2026-64814 | 8.6 | 24.4 | JetBrains | IntelliJ IDEA | CWE-862 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possibl… |
| CVE-2026-9635 | 6.4 | 24.3 | mythemeshop | WP Shortcode by MyThemeShop | CWE-79 | WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored C… |
| CVE-2026-7534 | 7.2 | 24.0 | FantasticPlugins | SUMO Reward Points for WooCommerce | CWE-79 | SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-S… |
| CVE-2026-12421 | 7.2 | 24.0 | n/a | ARforms | CWE-79 | ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password'… |
| CVE-2026-65913 | 5.1 | 23.9 | cure53 | DOMPurify | CWE-1321 | DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES |
| CVE-2026-65758 | 8.2 | 23.5 | tassos.gr | Convert Forms extension for Joomla | CWE-284 | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms exten… |
| CVE-2026-64799 | 7.5 | 23.4 | regularlabs.com | Articles Anywhere Pro extension for Joomla | CWE-918 | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Artic… |
| CVE-2026-25466 | 5.3 | 23.4 | WPGMaps | WP Go Maps | CWE-862 | WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability |
| CVE-2026-65452 | 5.3 | 23.4 | motov.net | Ebook Store | CWE-862 | WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability |
| CVE-2026-65485 | 5.3 | 23.4 | Daniel Iser | Content Control | CWE-862 | WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability |
| CVE-2026-65486 | 5.3 | 23.4 | Bastien Ho | Event post | CWE-862 | WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability |
| CVE-2026-65489 | 5.3 | 23.4 | LA-Studio | LA-Studio Element Kit for Elementor | CWE-862 | WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access… |
| CVE-2026-65501 | 5.3 | 23.4 | vendidero | Shiptastic for WooCommerce | CWE-639 | WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object… |
| CVE-2026-65529 | 5.3 | 23.4 | Iqonic Design | Graphina | CWE-862 | WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability |
| CVE-2026-15647 | 4.4 | 23.2 | berocket | Brands for WooCommerce | CWE-79 | Brands for WooCommerce <= 3.8.8 - Authenticated (Shop Manager+) Stored Cross-… |
| CVE-2026-57808 | 6.5 | 21.9 | Saad Iqbal | WP EasyPay | CWE-862 | WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability |
| CVE-2026-65458 | 4.3 | 21.4 | Chouby | Polylang | CWE-497 | WordPress Polylang and Polylang Pro plugins <= 3.8.5 - Sensitive Data Exposur… |
| CVE-2026-65535 | 4.3 | 21.4 | Takayuki Miyauchi | TinyMCE Templates | CWE-497 | WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnera… |
| CVE-2026-27399 | 5.3 | 21.4 | WebWizards | MarketKing | CWE-862 | WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability |
| CVE-2026-27418 | 5.3 | 21.4 | Epsiloncool | WP Fast Total Search | CWE-862 | WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vul… |
| CVE-2026-27422 | 5.3 | 21.4 | bPlugins | YT Player | CWE-862 | WordPress YT Player plugin <= 2.0.9 - Broken Access Control vulnerability |
| CVE-2026-61972 | 5.3 | 21.4 | WooLentor | ShopLentor Pro | CWE-862 | WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability |
| CVE-2026-65453 | 5.3 | 21.4 | motov.net | Ebook Store | CWE-862 | WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability |
| CVE-2026-65468 | 5.3 | 21.4 | Crocoblock. Jetimpex Inc. | JetBooking | CWE-862 | WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability |
| CVE-2026-65469 | 5.3 | 21.4 | Strategy11 Team | AWP Classifieds | CWE-862 | WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability |
| CVE-2026-65472 | 5.3 | 21.4 | Kit | Kit (formerly ConvertKit) | CWE-862 | WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control v… |
| CVE-2026-65476 | 5.3 | 21.4 | uxper | Civi | CWE-862 | WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability |
| CVE-2026-65487 | 5.3 | 21.4 | ThemeGoods | Photography | CWE-862 | WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability |
| CVE-2026-65506 | 5.3 | 21.4 | sonaar | MP3 Audio Player for Music, Radio & Podcast by Sonaar | CWE-862 | WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1… |
| CVE-2026-65525 | 5.3 | 21.4 | uxper | Civi Framework | CWE-862 | WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-10697 | 9.8 | 21.1 | Progress | MOVEit Transfer | CWE-287 | MFA Bypass in MOVEit Transfer |
| CVE-2026-65703 | 8.5 | 21.1 | FFmpeg | FFmpeg | CWE-787 | FFmpeg 2.7 - 8.1.2 Out-of-Bounds Write in TDSC Video Decoder |
| CVE-2026-64874 | 9.8 | 20.9 | regularlabs.com | Cache Cleaner Pro extension for Joomla | CWE-200 | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro… |
| CVE-2026-65604 | 8.8 | 21.0 | zalando | skipper | CWE-20 | Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass |
| CVE-2026-25427 | 5.4 | 20.7 | DigitalME | eRoom | CWE-862 | WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability |
| CVE-2026-27391 | 5.4 | 20.7 | Stylemix | uListing | CWE-862 | WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-65463 | 5.4 | 20.7 | masteriyo | Masteriyo - LMS | CWE-639 | WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References… |
| CVE-2026-65479 | 5.4 | 20.7 | MVP Themes | Reviewer | CWE-862 | WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability |
| CVE-2026-65494 | 7.1 | 20.5 | Dokan | Dokan Pro | CWE-89 | WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability |
| CVE-2026-61948 | 9.3 | 20.2 | Shahjada | WPDM – Premium Packages | CWE-89 | WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability |
| CVE-2026-61946 | 6.5 | 20.2 | Easy Appointments | Easy Appointments | CWE-639 | WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object Refere… |
| CVE-2026-61943 | 7.5 | 19.7 | Shahjada | WPDM – Premium Packages | CWE-862 | WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vul… |
| CVE-2026-65699 | 2.3 | 19.4 | reworkd | AgentGPT | CWE-639 | AgentGPT 1.0.0 Authorization Bypass via Agent Task Creation |
| CVE-2026-48012 | 4.3 | 19.3 | shopware | shopware | CWE-601 | Shopware SSO referer trust leading to an arbitrary redirect target |
| CVE-2026-65697 | 5.1 | 19.1 | usefathom | fathom | CWE-79 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint |
| CVE-2026-65456 | 4.3 | 18.7 | PickPlugins | Product Slider for WooCommerce | CWE-639 | WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct … |
| CVE-2026-65491 | 4.3 | 18.7 | Jonathan Daggerhart | Query Wrangler | CWE-862 | WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability |
| CVE-2026-65524 | 4.3 | 18.7 | ThemeFusion | Avada Custom Branding | CWE-862 | WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnera… |
| CVE-2026-65530 | 4.3 | 18.7 | Templatespare | TemplateSpare | CWE-862 | WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability |
| CVE-2026-50103 | 7.1 | 18.5 | MZ Automation | libIEC61850 | CWE-228 | Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC6… |
| CVE-2026-64873 | 9.8 | 18.5 | regularlabs.com | Cache Cleaner Pro extension for Joomla | CWE-918 | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension |
| CVE-2026-65516 | 7.2 | 18.1 | Pepro Dev. Group | PeproDev Ultimate Invoice | CWE-918 | WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request For… |
| CVE-2026-65499 | 6.5 | 18.1 | Pepro Dev. Group | PeproDev Ultimate Invoice | CWE-862 | WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control v… |
| CVE-2026-65899 | 5.1 | 18.3 | cure53 | DOMPurify | CWE-693 | DOMPurify before 3.4.9 Trusted Types Policy State Contamination |
| CVE-2026-60122 | 8.5 | 17.9 | gpsd | gpsd | CWE-94 | gpsd gpsprof Code Injection via SKY.satellites used Field |
| CVE-2026-15037 | 2.9 | 17.6 | Qt | Qt | CWE-91 | XML injection vulnerability in QDom comment, CDATA and processing-instruction… |
| CVE-2026-57703 | 6.3 | 17.3 | sunshinephotocart | Sunshine Photo Cart | CWE-862 | WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vuln… |
| CVE-2026-65484 | 6.3 | 17.3 | AnalogWP | Style Kits | CWE-862 | WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability |
| CVE-2026-65696 | 5.3 | 17.3 | sct | overseerr | CWE-639 | Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API |
| CVE-2026-25424 | 4.3 | 16.6 | mediavine | Mediavine Control Panel | CWE-862 | WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control v… |
| CVE-2026-27392 | 4.3 | 16.6 | Stylemix | uListing | CWE-862 | WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability |
| CVE-2026-27423 | 4.3 | 16.6 | Roland Barker | Participants Database | CWE-862 | WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vul… |
| CVE-2026-61973 | 4.3 | 16.6 | WooLentor | ShopLentor Pro | CWE-862 | WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability |
| CVE-2026-65457 | 4.3 | 16.6 | yoomoney | ЮKassa для WooCommerce | CWE-862 | WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vul… |
| CVE-2026-65537 | 4.3 | 16.6 | Themeisle | Cyr to Lat reloaded – transliteration of links and file names | CWE-862 | WordPress Cyr to Lat reloaded – transliteration of links and file names plugi… |
| CVE-2026-9066 | 6.1 | 16.4 | Unknown | WP Compress | CWE-79 | WP Compress < 7.10.04 - Reflected XSS via test_zone |
| CVE-2026-65756 | 6.1 | 16.4 | regularlabs.com | Keyboard Shortcuts extension for Joomla | CWE-79 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension |
| CVE-2026-57370 | 7.1 | 16.3 | CODEPRESS IT Solutions LLC | Visitor Traffic Real Time Statistics Pro | CWE-79 | WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.9.1 - Reflect… |
| CVE-2026-57374 | 7.1 | 16.2 | Wisetr INC. | Funnel Kit Funnel Builder PRO | CWE-79 | WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scrip… |
| CVE-2026-57397 | 7.1 | 16.3 | ThimPress. | Coaching | CWE-79 | WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-57427 | 7.1 | 16.2 | Download Monitor | Download Monitor - WPForms Lock | CWE-79 | WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Script… |
| CVE-2026-57428 | 7.1 | 16.2 | BoldGrid | Sprout Clients | CWE-79 | WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnera… |
| CVE-2026-57699 | 7.1 | 16.3 | bqworks | Slider Pro | CWE-79 | WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-57701 | 7.1 | 16.3 | WebCodingPlace | Real Estate Manager Pro | CWE-79 | WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scr… |
| CVE-2026-57704 | 7.1 | 16.3 | StoreApps | Smart Manager | CWE-79 | WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnera… |
| CVE-2026-57735 | 7.1 | 16.3 | Soflyy | Breakdance | CWE-79 | WordPress Breakdance plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-57767 | 7.1 | 16.3 | CodeCabin.io | WP Google Maps Pro | CWE-79 | WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) v… |
| CVE-2026-57769 | 7.1 | 16.3 | ThemeGoods | Grand Photography | CWE-79 | WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (… |
| CVE-2026-57809 | 7.1 | 16.3 | AffiliateWP | AffiliateWP | CWE-79 | WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS)… |
| CVE-2026-59512 | 7.1 | 16.3 | PI Web Solution | Product Enquiry for WooCommerce | CWE-79 | WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Sc… |
| CVE-2026-59517 | 7.1 | 16.3 | hassantafreshi | Easy Form Builder | CWE-79 | WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vul… |
| CVE-2026-61944 | 7.1 | 16.3 | Bookly | Bookly | CWE-79 | WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-61947 | 7.1 | 16.3 | WPVibes | Form Vibes – Database Manager for Forms | CWE-79 | WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Sit… |
| CVE-2026-65492 | 7.1 | 16.3 | Dokan WordPress Plugin | Dokan Pro | CWE-79 | WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-65510 | 7.1 | 16.3 | Pepro Dev. Group | PeproDev Ultimate Invoice | CWE-79 | WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (X… |
| CVE-2026-65511 | 7.1 | 16.3 | pixelacehq | Manual - Documentation, Knowledge Base & Education WordPress Theme | CWE-79 | WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme … |
| CVE-2026-15630 | 9.9 | 15.6 | Casdoor | Casdoor | CWE-269 | CVE-2026-15630 |
| CVE-2026-65430 | 7.5 | 15.5 | regularlabs.com | GeoIP extension for Joomla | CWE-200 | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP exte… |
| CVE-2026-65755 | 7.5 | 15.5 | regularlabs.com | Articles Anywhere extension for Joomla | CWE-524 | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Ar… |
| CVE-2026-9577 | 4.8 | 15.1 | Unknown | Post Status Notifier Lite | CWE-79 | Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter |
| CVE-2025-68081 | 5.9 | 14.9 | Lester Chan | WP-Polls | CWE-79 | WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-24628 | 5.9 | 14.9 | Supsystic | Photo Gallery by Supsystic | CWE-79 | WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting … |
| CVE-2026-65483 | 5.9 | 14.9 | hashthemes | HashThemes Demo Importer | CWE-79 | WordPress HashThemes Demo Importer plugin <= 1.4.2 - Cross Site Scripting (XS… |
| CVE-2026-65534 | 5.9 | 14.9 | Charlie Etienne | Custom links in Elementor Image Carousel | CWE-79 | WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Si… |
| CVE-2026-65538 | 5.9 | 14.9 | Nilo Velez | Machete | CWE-79 | WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-65550 | 5.9 | 14.9 | wpshopmart | Tabs | CWE-79 | WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-65902 | 5.3 | 14.5 | cure53 | DOMPurify | CWE-501 | DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags |
| CVE-2026-11804 | 5.2 | 14.3 | Tridium | Niagara Framework | CWE-280 | Program Module Vulnerability |
| CVE-2026-48530 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx |
| CVE-2026-48531 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx |
| CVE-2026-48532 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx |
| CVE-2026-48534 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx |
| CVE-2026-48535 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx |
| CVE-2026-48536 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx |
| CVE-2026-48537 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx |
| CVE-2026-48538 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx |
| CVE-2026-48539 | 5.1 | 14.2 | GFI Software | GFI Archiver | CWE-79 | GFI Archiver < 15.13 Stored XSS via MailInsights.aspx |
| CVE-2026-65911 | 5.1 | 13.9 | cure53 | DOMPurify | CWE-79 | DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage |
| CVE-2026-15614 | 7.5 | 13.5 | Logto | Logto | CWE-294 | IdP-initiated SAML sessions not reliably invalidated (replay) |
| CVE-2026-65478 | 5.4 | 13.6 | CridioStudio | ListingPro | CWE-862 | WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability |
| CVE-2026-59514 | 9.3 | 13.5 | MightyNetworks vs BuddyBoss | Buddyboss Platform | CWE-89 | WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability |
| CVE-2026-16584 | 7.3 | 13.2 | AWS | aws-api-mcp-server | CWE-455 | AWS API MCP Server Security Policy Bypass via Startup Failure |
| CVE-2026-27403 | 6.5 | 12.9 | NerdPress | Hubbub Lite | CWE-79 | WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerabi… |
| CVE-2026-57373 | 6.5 | 12.9 | Wisetr INC. | Funnel Kit Funnel Builder PRO | CWE-79 | WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scrip… |
| CVE-2026-57384 | 6.5 | 12.9 | Membership Software | WishList Member X | CWE-79 | WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vul… |
| CVE-2026-59513 | 6.5 | 12.9 | masteriyo | Masteriyo - LMS | CWE-79 | WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulner… |
| CVE-2026-64872 | 6.5 | 12.8 | regularlabs.com | Cache Cleaner Pro extension for Joomla | CWE-22 | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro exte… |
| CVE-2026-65449 | 6.5 | 12.9 | RomanCode | MapSVG | CWE-79 | WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-65465 | 6.5 | 12.9 | Crocoblock. Jetimpex Inc. | JetElements For Elementor | CWE-79 | WordPress JetElements For Elementor plugin <= 2.9.1.1 - Cross Site Scripting … |
| CVE-2026-65470 | 6.5 | 12.9 | WPManageNinja | Fluent Support | CWE-79 | WordPress Fluent Support plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnera… |
| CVE-2026-65473 | 6.5 | 12.9 | Nexcess | Virtue/Ascend/Pinnacle Toolkit | CWE-79 | WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Script… |
| CVE-2026-65475 | 6.5 | 12.9 | WP Chill | Modula Image Gallery | CWE-79 | WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting … |
| CVE-2026-65480 | 6.5 | 12.9 | CodexThemes | TheGem | CWE-79 | WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-65482 | 6.5 | 12.9 | LA-Studio | LA-Studio Element Kit for Elementor | CWE-79 | WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Sc… |
| CVE-2026-65503 | 6.5 | 12.9 | bdthemes | Ultimate Store Kit Elementor Addons | CWE-79 | WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Sc… |
| CVE-2026-65514 | 6.5 | 12.9 | codepeople | Appointment Hour Booking | CWE-79 | WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (X… |
| CVE-2026-65518 | 6.5 | 12.9 | Scott Paterson | Accept Donations with PayPal & Stripe | CWE-79 | WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site … |
| CVE-2026-65519 | 6.5 | 12.9 | gt3themes | Photo Gallery | CWE-79 | WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulne… |
| CVE-2026-65522 | 6.5 | 12.9 | pixelacehq | Manual - Documentation, Knowledge Base & Education WordPress Theme | CWE-79 | WordPress Manual - Documentation, Knowledge Base & Education WordPress theme … |
| CVE-2026-65527 | 6.5 | 12.9 | lqd | LIQUID SPEECH BALLOON | CWE-79 | WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) … |
| CVE-2026-65528 | 6.5 | 12.9 | bannersky | BSK PDF Manager | CWE-79 | WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerab… |
| CVE-2026-65533 | 6.5 | 12.9 | wbolt.com | Smart SEO Tool | CWE-79 | WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnera… |
| CVE-2026-65713 | 6.5 | 12.8 | regularlabs.com | Modals Pro extension for Joomla | CWE-22 | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro ext… |
| CVE-2026-65531 | 4.8 | 12.0 | Themeum | Qubely | CWE-862 | WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability |
| CVE-2026-64875 | 6.5 | 11.6 | regularlabs.com | GeoIP extension for Joomla | CWE-290 | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP exten… |
| CVE-2026-65898 | 5.1 | 11.4 | cure53 | DOMPurify | CWE-79 | DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig |
| CVE-2026-64802 | 7.8 | 11.2 | JetBrains | GoLand | CWE-94 | In JetBrains GoLand before 2026.2 arbitrary code execution was possible befor… |
| CVE-2026-64803 | 7.8 | 11.2 | JetBrains | GoLand | CWE-94 | In JetBrains GoLand before 2026.2 arbitrary code execution was possible befor… |
| CVE-2026-65900 | 5.1 | 10.9 | cure53 | DOMPurify | CWE-79 | DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM |
| CVE-2026-24639 | 4.4 | 10.8 | Ronald Huereca | Photo Block | CWE-918 | WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vu… |
| CVE-2026-65496 | 4.4 | 10.8 | Complianz | Complianz | CWE-918 | WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vuln… |
| CVE-2026-65914 | 5.3 | 10.7 | cure53 | DOMPurify | CWE-79 | DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization |
| CVE-2026-65904 | 2.3 | 10.5 | cure53 | DOMPurify | CWE-754 | DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode |
| CVE-2026-15966 | 9.8 | 10.3 | Progress | MOVEit Transfer | CWE-942 | Improper CORS handling in MOVEit Transfer |
| CVE-2026-15967 | 9.8 | 10.3 | Progress | MOVEit Transfer | CWE-613 | MOVEit Transfer refresh-token processing does not enforce updated account res… |
| CVE-2026-57784 | 9.6 | 9.8 | Ninja Forms | Ninja Forms File Uploads Extension | CWE-352 | WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Re… |
| CVE-2026-65471 | 9.6 | 9.8 | Avada Studio | Avada Core | CWE-352 | WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vul… |
| CVE-2026-57785 | 8.8 | 9.8 | ApusTheme | ApusListing | CWE-352 | WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vul… |
| CVE-2026-64804 | 8.4 | 8.8 | JetBrains | WebStorm | CWE-829 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible bef… |
| CVE-2026-64805 | 8.4 | 8.8 | JetBrains | WebStorm | CWE-829 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible bef… |
| CVE-2026-64806 | 8.4 | 8.8 | JetBrains | WebStorm | CWE-829 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible bef… |
| CVE-2026-64808 | 8.4 | 8.8 | JetBrains | PhpStorm | CWE-829 | In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible bef… |
| CVE-2026-64809 | 8.4 | 8.8 | JetBrains | PhpStorm | CWE-829 | In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible bef… |
| CVE-2026-65901 | 5.1 | 8.9 | cure53 | DOMPurify | CWE-79 | DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName |
| CVE-2026-65466 | 4.9 | 8.4 | Crocoblock. Jetimpex Inc. | JetBooking | CWE-918 | WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vul… |
| CVE-2026-65467 | 4.9 | 8.4 | Crocoblock. Jetimpex Inc. | JetEngine | CWE-918 | WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vul… |
| CVE-2026-65706 | 8.5 | 8.3 | FFmpeg | FFmpeg | CWE-131 | FFmpeg 3.0 - 8.1.2 vf_swaprect Out-of-Bounds Write via NV12 Frame Processing |
| CVE-2026-65705 | 7.3 | 8.3 | FFmpeg | FFmpeg | CWE-131 | FFmpeg 3.4 - 8.1.2 vf_floodfill Out-of-Bounds Write via filter_frame() |
| CVE-2026-65908 | 8.6 | 8.1 | JetBrains | PyCharm | CWE-829 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via mal… |
| CVE-2026-38764 | 7.8 | 8.1 | n/a | n/a | CWE-269 | An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local at… |
| CVE-2026-64807 | 7.8 | 8.1 | JetBrains | WebStorm | CWE-829 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via… |
| CVE-2026-15612 | 9.1 | 7.8 | Logto | Logto | CWE-345 | LOIDC nonce validation bypass |
| CVE-2026-15615 | 7.5 | 7.8 | Logto | Logto | CWE-345 | SAML <Conditions> element not validated |
| CVE-2026-15968 | 5.4 | 7.7 | Progress | MOVEit Transfer | CWE-79 | Stored XSS vulnerability in MOVEit Transfer |
| CVE-2026-64785 | 5.3 | 7.6 | Apple | swift-nio-http2 | CWE-444 | SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR,… |
| CVE-2026-65704 | 7.3 | 7.4 | FFmpeg | FFmpeg | CWE-191 | FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder |
| CVE-2026-65912 | 5.1 | 6.9 | cure53 | DOMPurify | CWE-79 | DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR |
| CVE-2026-65010 | 4.4 | 6.7 | huggingface | datasets | CWE-61 | Datasets Symlink-following Arbitrary File Write via Extractor.extract() |
| CVE-2026-65536 | 6.5 | 6.1 | Mahdi Yousefi | افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) | CWE-352 | WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <… |
| CVE-2026-59678 | 7.1 | 5.2 | Linux-Gaming | PortProtonQt | CWE-863 | portprotonqt allows any users to mount and unmount arbitrary file systems and… |
| CVE-2026-15212 | 8.8 | 5.1 | wpo365 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | CWE-352 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 … |
| CVE-2026-6390 | 6.8 | 4.8 | Red Hat | Red Hat Enterprise Linux 10 | CWE-134 | Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of… |
| CVE-2026-39155 | 6.5 | 4.4 | n/a | n/a | CWE-345 | Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod… |
| CVE-2026-64810 | 6.1 | 4.3 | JetBrains | IntelliJ IDEA | CWE-79 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an ID… |
| CVE-2026-65712 | 6.2 | 4.0 | regularlabs.com | CDN for Joomla Pro extension for Joomla | CWE-22 | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla… |
| CVE-2026-65512 | 5.4 | 3.8 | Melapress | WP Activity Log | CWE-352 | WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cros… |
| CVE-2026-52684 | 3.7 | 3.8 | PowerDNS | Recursor | — | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack |
| CVE-2026-24537 | 4.3 | 3.7 | Alex Volkov | WP Accessibility Helper (WAH) | CWE-352 | WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request … |
| CVE-2026-65460 | 4.3 | 3.7 | zarinpal | Zarinpal Gateway | CWE-352 | WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF… |
| CVE-2026-59677 | 6.8 | 3.5 | SELinuxProject | selinux | CWE-862 | Process Kill Attack Vector in killall() in seunshare |
| CVE-2026-61981 | 5.4 | 3.4 | QuantumCloud | Simple Link Directory Pro | CWE-352 | WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request For… |
| CVE-2026-65464 | 5.4 | 3.4 | Nexcess | GiveWP | CWE-352 | WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnera… |
| CVE-2026-65757 | 8.1 | 2.9 | regularlabs.com | Modules Anywhere extension for Joomla | CWE-352 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privile… |
| CVE-2026-50044 | 7.6 | 2.8 | Pronetiqs | Panduit Intravue | CWE-326 | Inadequate Encryption Strength in Panduit IntraVUE by Pronetiqs |
| CVE-2026-57626 | 7.1 | 2.7 | MailPoet | MailPoet | CWE-352 | WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) v… |
| CVE-2026-65488 | 7.1 | 2.7 | LA-Studio | LA-Studio Element Kit for Elementor | CWE-352 | WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Re… |
| CVE-2026-65539 | 7.1 | 2.7 | Bimal Rekhadiya | Kwayy HTML Sitemap | CWE-352 | WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability |
| CVE-2026-65540 | 7.1 | 2.7 | Metin Saraç | Popup for CF7 with Sweet Alert | CWE-352 | WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request… |
| CVE-2026-64876 | 8.8 | 2.6 | regularlabs.com | GeoIP extension for Joomla | CWE-352 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privile… |
| CVE-2026-64811 | 7.8 | 2.5 | JetBrains | IntelliJ IDEA | CWE-829 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possibl… |
| CVE-2026-52688 | 7.5 | 2.2 | PowerDNS | Recursor | CWE-295 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation |
| CVE-2024-58023 | 8.4 | 1.4 | Bosch | Bosch Configuration Manager | CWE-312 | Information disclosure in Bosch Configuration Manager in Version 7.72.0106 al… |
| CVE-2026-52686 | 3.7 | 1.3 | PowerDNS | Recursor | CWE-347 | Wildcard CNAME proof validation bypass |
| CVE-2026-64871 | 5.4 | 0.7 | regularlabs.com | Cache Cleaner extension for Joomla | CWE-352 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privile… |
| CVE-2026-59676 | 5.8 | 0.4 | SELinuxProject | selinux | CWE-367 | Local File Deletion Attack Vector in rm_rf() in seunshare |
| CVE-2026-43820 | 7.7 | 0.1 | Apple | swift-nio-ssl | CWE-125 | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes f… |
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-07-23 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.
Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.
