Security Box Score — July 30, 2026

662 CVEs published, led by Google (370).

662 CVEs published July 30, 2026: 110 critical, 199 high, 329 medium, 23 low; 1 in the KEV catalog at press time; 6 with a public exploit reference; 1 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 262 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	9578	21981	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

975 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	835	2315	207	1231	637	1	11	2	0.1	7.8	.0016	+322 ▲
google	491	1756	214	710	779	53	77	6	0.3	7.5	.0025	-599 ▼
microsoft	665	1422	106	981	321	14	286	24	1.7	7.8	.0047	+444 ▲
red hat	148	370	16	146	184	24	2	0	0.0	6.5	.0030	+20 ▲
apple	167	271	57	78	133	3	88	7	2.6	6.5	.0027	+115 ▲
canonical	7	27	3	8	11	5	0	0	0.0	5.6	.0014	+1 ▲
suse	8	21	4	12	4	1	0	0	0.0	8.5	.0039	-3 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	-9 ▼

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	16	38	8	18	12	0	56	12	31.6	7.5	.0057	+6 ▲
ubiquiti	25	36	14	21	1	0	3	3	8.3	8.8	.0049	+17 ▲
palo alto networks	14	25	1	3	14	7	13	2	8.0	4.7	.0028	+5 ▲
fortinet	14	23	6	6	11	0	28	6	26.1	7.2	.0040	+12 ▲
netgear	6	23	0	0	22	1	0	0	0.0	4.6	.0024	-11 ▼
vmware	13	17	4	9	2	2	7	1	5.9	8.3	.0040	+10 ▲
f5	8	16	5	8	3	0	4	1	6.3	8.6	.0057	+2 ▲
checkpoint	3	12	3	6	3	0	3	2	16.7	7.7	.0455	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	178	333	65	142	114	11	33	1	0.3	7.5	.0053	+57 ▲
mozilla	71	127	51	42	34	0	9	0	0.0	8.1	.0031	+21 ▲
drupal	46	51	6	5	35	5	4	1	2.0	5.9	.0026	+46 ▲
gitlab	20	51	0	7	37	7	4	2	3.9	4.9	.0029	-4 ▼
github	6	12	1	3	8	0	0	0	0.0	6.0	.0042	+2 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	-4 ▼
wordpress	3	3	1	1	1	0	2	2	66.7	8.6	.7979	+3 ▲
kubernetes	1	1	0	0	0	1	0	0	0.0	2.4	.0035	+1 ▲

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1109	1379	343	653	322	61	27	3	0.2	8.1	.0036	+867 ▲
adobe	107	251	27	115	105	4	19	3	1.2	7.8	.0026	-35 ▼
ibm	105	229	67	86	76	0	6	0	0.0	7.5	.0032	+30 ▲
progress	33	42	6	29	7	0	6	0	0.0	8.0	.0038	+28 ▲
solarwinds	16	23	17	3	3	0	10	4	17.4	9.1	.0058	+12 ▲
zohocorp	3	6	2	2	2	0	0	0	0.0	7.8	.0146	+2 ▲
veeam	2	6	2	3	1	0	1	0	0.0	8.5	.0035	+1 ▲
atlassian	3	3	0	3	0	0	13	0	0.0	8.0	.0026	+3 ▲

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
rockwell automation	17	24	4	18	2	0	0	8.7	.0029	+10 ▲
synology	0	23	2	5	13	3	0	5.6	.0025	-5 ▼
d-link	8	20	0	5	9	6	3	5.5	.0105	-2 ▼
siemens	7	16	1	8	7	0	0	7.6	.0024	-1 ▼
schneider electric	3	9	1	6	2	0	0	8.6	.0037	-3 ▼
abb	1	7	0	4	3	0	0	7.2	.0018	-5 ▼
hikvision	5	5	0	3	2	0	0	7.2	.0038	+5 ▲
moxa	0	5	0	3	2	0	0	7.0	.0029	-5 ▼

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	49	120	0	0	62	58	0	0	0.0	5.5	.0034	0
openclaw	44	111	0	58	39	14	0	0	0.0	7.0	.0026	-17 ▼
dell	43	99	5	47	44	3	2	1	1.0	7.1	.0021	+5 ▲
capgo	22	83	2	42	38	1	0	0	0.0	7.1	.0037	-39 ▼
nvidia	43	82	12	54	16	0	0	0	0.0	7.8	.0037	+37 ▲
spring	6	79	2	34	41	2	0	0	0.0	6.5	.0022	-66 ▼
imagemagick	37	78	1	5	60	12	0	0	0.0	5.3	.0018	-4 ▼
itsourcecode	18	71	0	0	19	52	0	0	0.0	2.1	.0033	-25 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8
CVE-2026-45659	.7608	99.5	8.8
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-59310	.4588	98.7	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-48282	10.0	.4239	KEV
CVE-2026-56290	10.0	.3038	KEV
CVE-2026-48939	10.0	.1973	KEV
CVE-2026-48908	10.0	.1482	KEV
CVE-2026-56291	10.0	.1459	KEV
CVE-2026-59726	10.0	.0688
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-47668	10.0	.0388

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	835
microsoft	665
google	491
apache	178
apple	167
red hat	148
adobe	107
ibm	105
mozilla	71

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	12
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	65
PyPI	6
NuGet	4
Go	3
npm	3
Packagist	2
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-20316	Cisco	0
CVE-2026-25089	Fortinet	0
CVE-2026-45659	Microsoft	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1716
CVE-2021-27102	n/a	2021-11-17	1716
CVE-2021-27101	n/a	2021-11-17	1716
CVE-2021-27103	n/a	2021-11-17	1716
CVE-2021-21017	Adobe	2021-11-17	1716
CVE-2021-28550	Adobe	2021-11-17	1716
CVE-2021-42013	Apache Software Foundation	2021-11-17	1716
CVE-2021-41773	Apache Software Foundation	2021-11-17	1716
CVE-2021-30858	Apple	2021-11-17	1716
CVE-2021-30860	Apple	2021-11-17	1716

Transactions

EXPLOIT PUBLISHED — boazsegev facil.io: 3 CVEs (CVE-2026-66729, CVE-2026-66730, CVE-2026-66731). Public exploit references added.

EXPLOIT PUBLISHED — Linux: 3 CVEs (CVE-2025-37899, CVE-2025-38002, CVE-2025-38089). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2026-12436 (GitLab). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14234 (Unknown WOLF). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14300 (Unknown miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-41939 (Care Everywhere LLC Care Everywhere Gateway). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45309 (ronf asyncssh). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-47143 (capstone-engine capstone). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-47671 (nhost cli). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54522 (msgpack-ruby). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56819 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56820 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-6267 (GitLab). Public exploit reference added.

DUE DATE PASSED — CVE-2023-4346 (KNX Association KNX Protocol Connection Authorization Option 1). CISA remediation deadline was July 29, 2026; still in catalog.

RESCORED — Linux: 570 CVEs (CVE-2025-21629, CVE-2025-21637, CVE-2025-21638, CVE-2025-21640, CVE-2025-21646, CVE-2025-21647, CVE-2025-21650, CVE-2025-21655, CVE-2025-21659, CVE-2025-21661, CVE-2025-21663, CVE-2025-21664, CVE-2025-21669, CVE-2025-21673, CVE-2025-21676, CVE-2025-21677, CVE-2025-21678, CVE-2025-21682, CVE-2025-21697, CVE-2025-21699, CVE-2025-21701, CVE-2025-21707, CVE-2025-21709, CVE-2025-21710, CVE-2025-21712, CVE-2025-21717, CVE-2025-21718, CVE-2025-21720, CVE-2025-21725, CVE-2025-21730, CVE-2025-21735, CVE-2025-21738, CVE-2025-21748, CVE-2025-21758, CVE-2025-21765, CVE-2025-21766, CVE-2025-21778, CVE-2025-21788, CVE-2025-21789, CVE-2025-21792, CVE-2025-21795, CVE-2025-21801, CVE-2025-21804, CVE-2025-21805, CVE-2025-21808, CVE-2025-21809, CVE-2025-21810, CVE-2025-21823, CVE-2025-21825, CVE-2025-21826, and 520 more — full list in this day's data.json). CVSS rescored — before/after on each CVE page.

RESCORED — Microsoft Windows 10 Version 1607: 3 CVEs (CVE-2026-20816, CVE-2026-20826, CVE-2026-20831). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2023-4244 (Linux Kernel). CVSS 7.8 → 7 (NVD).

RESCORED — CVE-2026-12086 (IBM UCD - IBM UrbanCode Deploy). CVSS 6.2 → 5.5 (NVD).

RESCORED — CVE-2026-50148 (metabase). CVSS 10 → 9.1 (NVD).

RESCORED — CVE-2026-7364 (IBM Verify Identity Access). CVSS 3.1 → 6.1 (NVD).

ENRICHED — CVE-2021-20322 (kernel). Received CVSS 7.4 and CPE data from NVD.

ENRICHED — CVE-2026-53167 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

662 CVEs published. 25 box scores and 375 table rows below; the remaining 262 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-59310CRITICAL

VMware Cloud Foundation — vCenter directory-traversal vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .4588   98.7   YES

AFFECTED
  Product                     Versions   Fixed
  Cloud Foundation            9.1.x.x –  —
  vSphere Foundation          9.1.x.x –  —
  vCenter                     9.1.x.x –  —
  Telco Cloud Infrastructure  3.0 –      —
  Telco Cloud Platform        5.1.x –    —

TIMELINE
  Jul 4   Reserved by CNA
  Jul 30  Published (CNA: vmware)
  Aug 18  Added to CISA KEV, due Aug 21

CWE-22 · CNA: vmware · CVSS v3.1 · 4 references · NVD status: Analyzed · KEV due August 21, 2026

CVE-2026-66066CRITICAL

rails rails — Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.5   .1895   97.1     —

AFFECTED
  Product  Versions     Fixed
  rails    < 7.2.3.2 –  —

TIMELINE
  Jul 23  Reserved by CNA
  Jul 30  Published (CNA: GitHub_M)

CWE-1188 · CNA: GitHub_M · CVSS v4.0 · 13 references · NVD status: Received

CVE-2026-59309CRITICAL

VMware Cloud Foundation — vCenter authentication-bypass vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0818   94.4     —

AFFECTED
  Product                     Versions   Fixed
  Cloud Foundation            9.1.x.x –  —
  vSphere Foundation          9.1.x.x –  —
  vCenter                     9.1.x.x –  —
  Telco Cloud Infrastructure  3.0 –      —
  Telco Cloud Platform        5.1.x –    —

TIMELINE
  Jul 4   Reserved by CNA
  Jul 30  Published (CNA: vmware)

CWE-303 · CNA: vmware · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-67208CRITICAL

somta Juggle — Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0529   91.9     —

AFFECTED
  Product  Versions     Fixed
  Juggle   unspecified  —

TIMELINE
  Jul 28  Reserved by CNA
  Jul 30  Published (CNA: VulnCheck)

CWE-306, CWE-1188 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-38709CRITICAL

n/a n/a — TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0267   84.6     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jul 30  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-63362HIGH

o6 Automation open62541 Integer Underflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   N   N   H    8.2   .0151   72.5     —

AFFECTED
  Product    Versions  Fixed
  open62541  1.3.0 –   —

TIMELINE
  Jul 27  Reserved by CNA
  Jul 30  Published (CNA: icscert)

CWE-191 · CNA: icscert · CVSS v4.0 · 7 references · NVD status: Received

CVE-2026-15969CRITICAL

SGLang SGLang — CVE-2026-15969

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0138   69.9     —

AFFECTED
  Product  Versions     Fixed
  SGLang   unspecified  —

TIMELINE
  Jul 16  Reserved by CNA
  Jul 30  Published (CNA: certcc)

CWE-502 · CNA: certcc · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-44098HIGH

Phoenix Contact CHARX SEC-3150 — OS Command Injection in OCPP Agent via charge_box_id

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   H    8.8   .0137   69.7     —

AFFECTED
  Product         Versions  Fixed
  CHARX SEC-3150  1.0.0 –   —
  CHARX SEC-3100  1.0.0 –   —
  CHARX SEC-3050  1.0.0 –   —
  CHARX SEC-3000  1.0.0 –   —

TIMELINE
  May 5   Reserved by CNA
  Jul 30  Published (CNA: CERTVDE)

CWE-78 · CNA: CERTVDE · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-12943CRITICAL

IBM HMC V10.3.1050.0 — This Power Hardware Management Console update is being released to address

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0101   60.5     —

AFFECTED
  Product           Versions       Fixed
  HMC V10.3.1050.0  10.3.1050.0 –  —
  HMC V11.1.1110.0  11.1.1110.0 –  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 30  Published (CNA: ibm)

CWE-78 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-48449CRITICAL

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0096   58.8     —

AFFECTED
  Product                 Versions     Fixed
  Adobe Campaign Classic  unspecified  7.4.3 build 9398

TIMELINE
  May 21  Reserved by CNA
  Jul 30  Published (CNA: adobe)

CWE-863 · CNA: adobe · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-14522CRITICAL

IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0089   56.8     —

AFFECTED
  Product                 Versions    Fixed
  App Connect Enterprise  13.0.1.0 –  —

TIMELINE
  Jul 2   Reserved by CNA
  Jul 30  Published (CNA: ibm)

CWE-78 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-52680CRITICAL

Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0083   54.8     —

AFFECTED
  Product        Versions  Fixed
  Apache Kyuubi  1.7.0 –   —

TIMELINE
  Jun 8   Reserved by CNA
  Jul 30  Published (CNA: apache)

CWE-22, CWE-73 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-12940CRITICAL

IBM Langflow OSS — Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0068   49.8     —

AFFECTED
  Product       Versions  Fixed
  Langflow OSS  1.0.0 –   —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 30  Published (CNA: ibm)

CWE-78 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-28323CRITICAL

SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0068   49.5     —

AFFECTED
  Product        Versions                            Fixed
  Web Help Desk  2026.1 and all previous versions –  —

TIMELINE
  Feb 26  Reserved by CNA
  Jul 30  Published (CNA: SolarWinds)

CWE-287 · CNA: SolarWinds · CVSS v3.1 · 3 references · NVD status: Analyzed

CVE-2026-16524HIGH

Red Hat Red Hat Enterprise Linux 10 — Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0065   48.5     —

AFFECTED
  Product                                 Versions     Fixed
  Red Hat Enterprise Linux 10             unspecified  0:7.0.3-5.el10_2
  Red Hat Enterprise Linux 8              unspecified  0:5.3.7-22.el8_10.5
  Red Hat Enterprise Linux 9              unspecified  0:6.3.7-8.el9_8.4
  Red Hat Enterprise Linux 6              unspecified  —
  Red Hat Enterprise Linux 7              unspecified  —
  Red Hat OpenShift Container Platform 4  unspecified  —

TIMELINE
  Jul 22  Reserved by CNA
  Jul 30  Published (CNA: redhat)

CWE-78 · CNA: redhat · CVSS v3.1 · 5 references · NVD status: Awaiting Analysis

CVE-2026-41703HIGH

VMware Cloud Foundation — Out-of-bounds read vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  C  H  N  L    7.6   .0063   47.3     —

AFFECTED
  Product               Versions   Fixed
  Cloud Foundation      9.1.x.x –  —
  vSphere Foundation    9.1.x.x –  —
  ESX                   9.1.x.x –  —
  Workstation           25H2 –     —
  Fusion                25H2 –     —
  Telco Cloud Platform  5.1.x –    —

TIMELINE
  Apr 22  Reserved by CNA
  Jul 30  Published (CNA: vmware)

CWE-125 · CNA: vmware · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-58218MEDIUM

Red Hat Red Hat Enterprise Linux 10 — Samba: dns signing dos via tkey name cache exhaustion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  L    5.3   .0062   47.0     —

AFFECTED
  Product                                 Versions     Fixed
  Red Hat Enterprise Linux 10             unspecified  —
  Red Hat Enterprise Linux 6              unspecified  —
  Red Hat Enterprise Linux 6              unspecified  —
  Red Hat Enterprise Linux 7              unspecified  —
  Red Hat Enterprise Linux 8              unspecified  —
  Red Hat Enterprise Linux 9              unspecified  —
  Red Hat OpenShift Container Platform 4  unspecified  —

TIMELINE
  Jun 29  Reserved by CNA
  Jul 30  Published (CNA: redhat)

CWE-410 · CNA: redhat · CVSS v3.1 · 4 references · NVD status: Awaiting Analysis

CVE-2026-65423HIGH

o6 Automation open62541 Integer Overflow or Wraparound

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0060   46.3     —

AFFECTED
  Product    Versions  Fixed
  open62541  1.3.0 –   —

TIMELINE
  Jul 27  Reserved by CNA
  Jul 30  Published (CNA: icscert)

CWE-190 · CNA: icscert · CVSS v4.0 · 7 references · NVD status: Received

CVE-2026-48448HIGH

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  N    8.6   .0059   45.7     —

AFFECTED
  Product                 Versions     Fixed
  Adobe Campaign Classic  unspecified  7.4.3 build 9398

TIMELINE
  May 21  Reserved by CNA
  Jul 30  Published (CNA: adobe)

CWE-89 · CNA: adobe · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-16610CRITICAL

ASE Admin and Site Enhancements (ASE) Pro — Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0058   45.0     —

AFFECTED
  Product                                Versions     Fixed
  Admin and Site Enhancements (ASE) Pro  unspecified  —

TIMELINE
  Jul 22  Reserved by CNA
  Jul 30  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-67206HIGH

wolfcms wolfcms — Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0058   44.9     —

AFFECTED
  Product  Versions     Fixed
  wolfcms  unspecified  —

TIMELINE
  Jul 28  Reserved by CNA
  Jul 30  Published (CNA: VulnCheck)

CWE-434 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-15971CRITICAL

SGLang SGLang — CVE-2026-15971

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0057   44.7     —

AFFECTED
  Product  Versions     Fixed
  SGLang   unspecified  —

TIMELINE
  Jul 16  Reserved by CNA
  Jul 30  Published (CNA: certcc)

CWE-95 · CNA: certcc · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-17658HIGH

Google Chrome — Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0057   44.7     —

AFFECTED
  Product  Versions         Fixed
  Chrome   151.0.7922.72 –  —

TIMELINE
  Jul 27  Reserved by CNA
  Jul 30  Published (CNA: Chrome)

CWE-416 · CNA: Chrome · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-17665HIGH

Google Chrome — Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0057   44.7     —

AFFECTED
  Product  Versions         Fixed
  Chrome   151.0.7922.72 –  —

TIMELINE
  Jul 27  Reserved by CNA
  Jul 30  Published (CNA: Chrome)

CWE-416 · CNA: Chrome · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-17694HIGH

Google Chrome — Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrar…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0057   44.7     —

AFFECTED
  Product  Versions         Fixed
  Chrome   151.0.7922.72 –  —

TIMELINE
  Jul 27  Reserved by CNA
  Jul 30  Published (CNA: Chrome)

CWE-416 · CNA: Chrome · CVSS v3.1 · 2 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-17705	8.8	44.7	Google	Chrome	CWE-190	Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-63035	7.2	44.7	o6 Automation	open62541	CWE-416	o6 Automation open62541 Use After Free
CVE-2026-12118	9.8	44.4	IBM	webMethods Integration (on prem)	CWE-502	IBM webMethods Integration could allow an unauthenticated remote attacker to …
CVE-2026-17661	8.8	44.1	Google	Chrome	CWE-416	Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a re…
CVE-2026-17685	8.8	44.1	Google	Chrome	CWE-416	Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17681	9.6	43.9	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Web Authentication in Google Ch…
CVE-2026-1360	7.5	43.7	buddypress	BuddyPress	CWE-502	BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via X…
CVE-2026-66803	10.0	43.5	Microsoft	Azure Cosmos DB	CWE-284	Azure Cosmos DB Remote Code Execution Vulnerability
CVE-2026-17664	6.5	43.5	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Loader in Google Chrome prior t…
CVE-2026-18245	6.4	42.7	AWS	Amplify Codegen UI	CWE-94	Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codege…
CVE-2026-17687	9.6	42.6	Google	Chrome	CWE-843	Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17697	9.6	42.6	Google	Chrome	CWE-843	Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17680	9.6	42.3	Google	Chrome	CWE-122	Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.792…
CVE-2026-68502	9.8	42.2	grisuno	LazyOwn	CWE-306	LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Disp…
CVE-2026-17656	9.6	42.2	Google	Chrome	CWE-416	Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17651	9.6	42.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Dawn in Google Chrome on Androi…
CVE-2026-17655	9.6	42.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in ANGLE in Google Chrome prior to…
CVE-2026-14602	9.0	42.1	Unknown	Remote API	CWE-94	Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query…
CVE-2026-17725	8.8	42.0	Google	Chrome	CWE-843	Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote…
CVE-2026-44617	6.5	41.6	Apache Software Foundation	Apache Zeppelin	CWE-90	Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2…
CVE-2026-17652	9.6	41.4	Google	Chrome	CWE-416	Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-44108	9.3	41.2	Phoenix Contact	CHARX SEC-3150	CWE-696	Firewall bypass during shutdown
CVE-2026-16527	7.3	40.4	Red Hat	Red Hat Enterprise Linux 10	CWE-306	Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing …
CVE-2026-15435	9.8	40.3	IBM	App Connect Enterprise	CWE-22	IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability
CVE-2026-17667	6.5	40.2	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17668	6.5	40.2	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17707	6.5	40.2	Google	Chrome	CWE-457	Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72…
CVE-2026-17714	6.5	40.2	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-15976	9.8	39.8	SGLang	SGLang	CWE-502	CVE-2026-15976
CVE-2026-17669	9.6	39.8	Google	Chrome	CWE-693	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17682	9.6	39.8	Google	Chrome	CWE-190	Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17684	9.6	39.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome…
CVE-2026-17692	9.6	39.8	Google	Chrome	CWE-416	Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.792…
CVE-2026-17704	9.6	39.8	Google	Chrome	CWE-416	Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17708	9.6	39.8	Google	Chrome	CWE-416	Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17717	9.6	39.8	Google	Chrome	CWE-190	Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17678	8.8	39.8	Google	Chrome	CWE-125	Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a…
CVE-2026-67594	9.3	39.3	yolanmees	Spikster	CWE-306	Spikster Missing Authentication via API Route Group
CVE-2026-17719	8.8	39.2	Google	Chrome	CWE-416	Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17670	9.6	39.2	Google	Chrome	CWE-416	Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17671	9.6	39.2	Google	Chrome	CWE-20	Insufficient validation of untrusted input in ANGLE in Google Chrome prior to…
CVE-2026-17672	9.6	39.2	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Chromecast in Google Chrome pri…
CVE-2026-17673	9.6	39.2	Google	Chrome	CWE-190	Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a re…
CVE-2026-17676	9.6	39.2	Google	Chrome	CWE-693	Inappropriate implementation in ANGLE in Google Chrome on Android prior to 15…
CVE-2026-17688	9.6	39.2	Google	Chrome	CWE-416	Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17691	9.6	39.2	Google	Chrome	CWE-787	Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.…
CVE-2026-17695	9.6	39.2	Google	Chrome	CWE-693	Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.…
CVE-2026-17710	9.6	39.2	Google	Chrome	CWE-693	Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.…
CVE-2026-17713	9.6	39.2	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Accessibility in Google Chrome …
CVE-2026-17677	8.8	39.2	Google	Chrome	CWE-693	Inappropriate implementation in ANGLE in Google Chrome on Android prior to 15…
CVE-2026-7849	9.3	39.0	Phoenix Contact	CHARX SEC-3150	CWE-77	Command Injection in SCM (idledisconnect parameter)
CVE-2026-17650	8.3	39.1	Google	Chrome	CWE-416	Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed…
CVE-2026-28811	7.5	39.0	Apache Software Foundation	Apache JSPWiki	CWE-1295	Apache JSPWiki: Error Handling - Reveals Error Details
CVE-2026-17660	8.3	38.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Network in Google Chrome prior …
CVE-2026-17663	8.3	38.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in GPU in Google Chrome on Android…
CVE-2026-66421	8.8	38.4	tugcantopaloglu	openclaw-dashboard	CWE-79	OpenClaw Dashboard Stored XSS via lastMessage Session Field
CVE-2026-17701	9.6	38.4	Google	Chrome	CWE-125	Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac p…
CVE-2026-17686	8.1	38.3	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Passwords in Google Chrome prio…
CVE-2026-17653	8.3	38.2	Google	Chrome	CWE-416	Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remo…
CVE-2026-17751	8.8	38.0	Google	Chrome	CWE-269	Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922…
CVE-2026-58222	8.8	37.9	Red Hat	Red Hat Enterprise Linux 10	CWE-90	Samba: samba ad ldap compare filter injection and trusted-request confusion d…
CVE-2026-12996	6.0	38.0	OpenVPN	OpenVPN	CWE-125	A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4…
CVE-2026-16526	8.8	37.5	Red Hat	Red Hat Enterprise Linux 10	CWE-403	Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability
CVE-2026-17679	6.5	37.4	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Print Preview in Google Chrome …
CVE-2026-17683	6.5	37.4	Google	Chrome	CWE-200	Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72…
CVE-2026-66418	9.3	37.3	tugcantopaloglu	openclaw-dashboard	CWE-79	OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field
CVE-2026-44616	6.5	37.1	Apache Software Foundation	Apache Zeppelin	CWE-90	Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction
CVE-2026-17712	8.8	37.0	Google	Chrome	CWE-362	Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote …
CVE-2026-66756	6.9	36.9	Apache Software Foundation	Apache Tika	CWE-424	Apache Tika: unpack endpoint in tika-server allows configuration with unsecur…
CVE-2026-17758	9.6	36.7	Google	Chrome	CWE-122	Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-17778	8.8	36.7	Google	Chrome	CWE-416	Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-17657	8.3	36.7	Google	Chrome	CWE-416	Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-66755	5.9	36.7	Apache Software Foundation	Apache Tika	CWE-22	Apache Tika: Arbitrary Local File Read in ISArchiveParser
CVE-2026-17729	8.8	36.5	Google	Chrome	CWE-416	Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote…
CVE-2026-17689	4.3	36.1	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-63559	8.7	36.0	o6 Automation	open62541	CWE-190	o6 Automation open62541 Integer Overflow or Wraparound
CVE-2026-15978	7.5	35.8	SGLang	SGLang	CWE-306	CVE-2026-15978
CVE-2026-18140	8.7	35.6	AWS	aws-smithy-json	CWE-674	Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows un…
CVE-2026-44090	9.3	35.4	Phoenix Contact	CHARX SEC-3150	CWE-306	Missing authentication for MQTT Broker
CVE-2026-44101	9.3	35.4	Phoenix Contact	CHARX SEC-3150	CWE-306	OCPP reconfiguration vulnerability
CVE-2026-17881	8.8	35.3	Google	Chrome	CWE-416	Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17544	8.1	35.3	PHP Group	PHP	CWE-787	Out-of-bounds write in bccomp() via crafted operand and scale
CVE-2026-17759	6.5	35.0	Google	Chrome	CWE-457	Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a…
CVE-2026-44092	8.8	34.7	Phoenix Contact	CHARX SEC-3150	CWE-93	Missing input validation / stripping of CRLF characters in SystemConfigManager
CVE-2026-17721	9.6	34.6	Google	Chrome	CWE-787	Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-12932	7.1	34.4	OpenVPN	OpenVPN	CWE-401	A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 thro…
CVE-2026-12942	7.5	34.3	IBM	Langflow OSS	CWE-22	Langflow is affected by path traversal due to multiple unauthenticated and in…
CVE-2026-14519	7.5	34.3	IBM	App Connect Enterprise	CWE-22	IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitr…
CVE-2026-53431	9.1	34.1	malach-it	boruta	CWE-294	Boruta accepts expired JWT client assertions due to missing exp claim validation
CVE-2026-17674	6.5	34.1	Google	Chrome	CWE-693	Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 …
CVE-2026-17703	6.5	34.1	Google	Chrome	CWE-602	Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS pri…
CVE-2026-23985	5.3	34.1	Apache Software Foundation	Apache Superset	CWE-1333	Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
CVE-2026-17675	9.6	33.8	Google	Chrome	CWE-787	Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-17718	9.6	33.8	Google	Chrome	CWE-416	Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17726	9.6	33.8	Google	Chrome	CWE-190	Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 …
CVE-2026-17727	9.6	33.8	Google	Chrome	CWE-787	Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.…
CVE-2026-17738	9.6	33.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Payments in Google Chrome prior…
CVE-2026-17768	9.6	33.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in WebSockets in Google Chrome pri…
CVE-2026-17801	9.6	33.8	Google	Chrome	CWE-125	Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72…
CVE-2026-17804	9.6	33.8	Google	Chrome	CWE-416	Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17752	8.8	33.8	Google	Chrome	CWE-416	Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowe…
CVE-2026-17784	8.8	33.8	Google	Chrome	CWE-416	Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowe…
CVE-2026-28814	7.5	33.8	Apache Software Foundation	Apache JSPWiki	CWE-306	Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
CVE-2026-17922	8.8	33.6	Google	Chrome	CWE-94	Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.79…
CVE-2026-28812	9.8	33.1	Apache Software Foundation	Apache JSPWiki	CWE-290	Apache JSPWiki: UserManager does not sanity-check user database at startup
CVE-2026-41709	2.7	33.1	VMware	Cloud Foundation	CWE-778	ESX insufficient logging vulnerability
CVE-2026-57859	7.7	32.7	e107inc	e107	CWE-502	e107 Second-Order Code Execution via eval()-Based Deserialization in e_array:…
CVE-2026-17696	4.3	32.8	Google	Chrome	CWE-1300	Side-channel information leakage in Media in Google Chrome prior to 151.0.792…
CVE-2026-17700	4.3	32.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Actor in Google Chrome prior to…
CVE-2026-17706	4.3	32.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Media in Google Chrome on Windo…
CVE-2026-13117	6.0	32.6	OpenVPN	OpenVPN	CWE-416	An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.…
CVE-2026-68503	9.8	32.4	grisuno	LazyOwn	CWE-1392	LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 D…
CVE-2026-54363	9.3	32.2	Gladinet	CentreStack	CWE-321	CentreStack < 17.5 Hardcoded Key Token Forgery RCE
CVE-2026-54368	8.7	32.0	Gladinet	CentreStack	CWE-89	CentreStack < 17.4 SQL Injection via x-glad-filter Header
CVE-2026-10700	6.5	31.9	IBM	Langflow OSS	CWE-639	Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling…
CVE-2026-17709	9.6	31.8	Google	Chrome	CWE-362	Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a re…
CVE-2026-17796	6.5	31.6	Google	Chrome	CWE-1300	Side-channel information leakage in WebXR in Google Chrome prior to 151.0.792…
CVE-2026-17800	6.5	31.6	Google	Chrome	CWE-1300	Inappropriate implementation in MediaRecording in Google Chrome prior to 151.…
CVE-2026-17711	9.6	31.0	Google	Chrome	CWE-362	Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a re…
CVE-2026-68500	7.5	31.0	Sylius	MolliePlugin	CWE-639	Sylius Mollie Plugin: Payment status forgery via the payment webhook
CVE-2026-17836	8.8	30.8	Google	Chrome	CWE-416	Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote…
CVE-2026-17722	8.3	30.7	Google	Chrome	CWE-416	Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.…
CVE-2026-17803	9.6	30.6	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Save to Drive in Google Chrome …
CVE-2026-17698	7.5	30.5	Google	Chrome	CWE-20	Insufficient validation of untrusted input in UI in Google Chrome on Android …
CVE-2026-17735	8.7	30.5	Google	Chrome	CWE-20	Insufficient validation of untrusted input in BFCache in Google Chrome prior …
CVE-2026-11771	7.0	30.2	OpenVPN	OpenVPN	CWE-121	OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows atta…
CVE-2026-17807	8.8	30.0	Google	Chrome	CWE-416	Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote…
CVE-2026-60074	7.5	30.0	—	Date-Manip	CWE-1289	Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASC…
CVE-2026-60075	7.5	30.0	—	Date-Manip	CWE-1333	Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic…
CVE-2026-17740	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17757	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17771	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17785	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17790	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72…
CVE-2026-17808	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72…
CVE-2026-17810	4.3	30.0	Google	Chrome	CWE-457	Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-54885	6.9	29.9	malach-it	boruta	CWE-918	Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri f…
CVE-2026-17723	8.3	29.9	Google	Chrome	CWE-416	Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 al…
CVE-2026-67351	8.7	29.7	s9y	Serendipity	CWE-304	Serendipity < 2.6.1 Authentication Bypass via Username Collision
CVE-2026-35847	9.8	29.4	n/a	n/a	CWE-77	An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbit…
CVE-2026-6540	7.9	29.4	Tigera	Calico	CWE-22	L7 policy bypass via unnormalized HTTP path matching
CVE-2026-23981	5.3	29.1	Apache Software Foundation	Apache Superset	CWE-285	Apache Superset: Improper Authorization in Chart Update allowing Dashboard Mo…
CVE-2026-17896	7.5	28.9	Google	Chrome	CWE-416	Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-44091	8.8	28.9	Phoenix Contact	CHARX SEC-3150	CWE-501	Creation of a new configuration by posting a malicious ID to MQTT
CVE-2026-22620	8.6	28.9	Eaton	PADM	CWE-89	Improper input validation in the authentication component of Eaton's Tripp Li…
CVE-2026-44613	6.1	28.8	Apache Software Foundation	Apache Zeppelin	CWE-352	Apache Zeppelin: Cross-site request forgery in REST and WebSocket request han…
CVE-2026-16529	7.5	28.8	Red Hat	Red Hat Enterprise Linux 10	CWE-190	Pcp: pcp: denial of service due to signed integer overflow
CVE-2026-17816	7.5	28.4	Google	Chrome	CWE-269	Insufficient policy enforcement in Speech in Google Chrome on Android prior t…
CVE-2026-16531	5.3	28.4	Red Hat	Red Hat Enterprise Linux 10	CWE-22	Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet
CVE-2026-47876	9.3	28.1	VMware	Cloud Foundation	CWE-787	VMXNET3 out-of-bounds write vulnerability
CVE-2026-17756	6.5	28.0	Google	Chrome	CWE-602	Insufficient policy enforcement in Presentation in Google Chrome prior to 151…
CVE-2026-17764	6.5	28.0	Google	Chrome	CWE-693	Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72…
CVE-2026-17814	6.5	28.0	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome…
CVE-2026-12946	9.9	27.7	IBM	Langflow OSS	CWE-94	Remote Code Execution in CUGA Component CodeAgent
CVE-2026-58046	9.9	27.7	WebPros	Plesk	CWE-89	Improper neutralization in the Plesk XML-RPC API allows a remote authenticate…
CVE-2026-17847	9.6	27.4	Google	Chrome	CWE-20	Insufficient validation of untrusted input in ANGLE in Google Chrome prior to…
CVE-2026-48910	6.5	27.4	Apache Software Foundation	Apache JSPWiki	CWE-80	Apache JSPWiki: Markdown parser allows XSS injection in Markdown error proces…
CVE-2026-11536	8.5	27.0	IBM	WebSphere Application Server	CWE-502	IBM WebSphere Application Server is affected by a remote code execution vulne…
CVE-2026-17791	6.5	26.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Payments in Google Chrome prior…
CVE-2026-17792	6.5	26.8	Google	Chrome	CWE-451	Inappropriate implementation in Credential Management in Google Chrome prior …
CVE-2026-17793	6.5	26.8	Google	Chrome	CWE-451	Inappropriate implementation in Messages in Google Chrome on Android prior to…
CVE-2026-17831	6.5	26.8	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Passwords in Google Chrome prio…
CVE-2026-41186	6.0	26.8	Tigera	Calico	CWE-200	Unauthenticated Go pprof exposure in Calico debug server
CVE-2026-15977	7.5	26.7	SGLang	SGLang	CWE-522	CVE-2026-15977
CVE-2026-17730	4.3	26.7	Google	Chrome	CWE-1300	Side-channel information leakage in Autofill in Google Chrome prior to 151.0.…
CVE-2026-17760	4.3	26.7	Google	Chrome	CWE-1300	Side-channel information leakage in NoStatePrefetch in Google Chrome prior to…
CVE-2026-17767	4.3	26.7	Google	Chrome	CWE-20	Insufficient validation of untrusted input in WebView in Google Chrome on And…
CVE-2026-17769	4.3	26.7	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Cast in Google Chrome prior to …
CVE-2026-17772	4.3	26.7	Google	Chrome	CWE-125	Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a…
CVE-2026-17773	4.3	26.7	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Cast in Google Chrome prior to …
CVE-2026-17795	4.3	26.7	Google	Chrome	CWE-20	Inappropriate implementation in GetUserMedia in Google Chrome prior to 151.0.…
CVE-2026-68501	6.5	26.6	Sylius	MolliePlugin	CWE-639	Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII
CVE-2026-17868	8.8	26.4	Google	Chrome	CWE-269	Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.7…
CVE-2026-17830	6.5	26.5	Google	Chrome	CWE-284	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17935	8.8	26.4	Google	Chrome	CWE-122	Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowe…
CVE-2026-13395	8.6	26.3	Unknown	Online Scheduling and Appointment Booking System	CWE-89	Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
CVE-2026-18064	8.2	26.3	NASA	Core Flight System (cFS) Health & Safety (HS) Application	CWE-476	NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer D…
CVE-2026-17779	5.4	26.4	Google	Chrome	CWE-693	Inappropriate implementation in Site Isolation in Google Chrome prior to 151.…
CVE-2026-13379	5.1	26.3	OpenVPN	OpenVPN	CWE-125	The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows re…
CVE-2026-62663	7.5	26.0	masci	banks	CWE-22	Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/v…
CVE-2026-17662	4.3	25.8	Google	Chrome	CWE-346	Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7…
CVE-2026-17693	4.3	25.8	Google	Chrome	CWE-346	Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0…
CVE-2026-17967	8.8	25.6	Google	Chrome	CWE-416	Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.…
CVE-2026-17690	6.5	25.5	Google	Chrome	CWE-20	Insufficient validation of untrusted input in PDF in Google Chrome on Android…
CVE-2026-54722	8.7	25.1	HackingRepo	dssrf-js	CWE-76	dssrf: there a critical security bug with remove_at_symbol_in_string
CVE-2026-17989	8.8	24.6	Google	Chrome	CWE-843	Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote…
CVE-2026-17543	8.1	24.6	PHP Group	PHP	CWE-89	SQL injection in ext-pgsql via E'...' backslash breakout
CVE-2025-65336	9.8	24.3	n/a	n/a	CWE-89	Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL I…
CVE-2026-17848	9.6	24.3	Google	Chrome	CWE-20	Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17659	4.2	24.2	Google	Chrome	CWE-693	Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0…
CVE-2026-17832	9.6	24.1	Google	Chrome	CWE-416	Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17834	9.6	24.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Passwords in Google Chrome prio…
CVE-2026-17837	9.6	24.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in DevTools in Google Chrome prior…
CVE-2026-12733	7.5	23.5	IBM	DataPower Gateway 10.6CD	CWE-770	IBM DataPower Gateway affected by denial of service
CVE-2026-16308	7.5	23.5	IBM	Enterprise Build of Quarkus	CWE-770	IBM Enterprise Build of Quarkus is affected by a DoS vulnerability
CVE-2026-58216	5.3	23.4	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might ca…
CVE-2026-17875	8.8	23.3	Google	Chrome	CWE-416	Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a re…
CVE-2026-17747	4.2	23.4	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Payments in Google Chrome on An…
CVE-2026-67345	8.5	23.2	dromara	MaxKey	CWE-183	MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
CVE-2026-10842	7.5	23.2	IBM	WebSphere Application Server	CWE-289	IBM WebSphere Application Server and WebSphere Application Server Liberty are…
CVE-2026-44107	8.7	23.0	Phoenix Contact	CHARX SEC-3150	CWE-749	Exposed Reboot via Modbus
CVE-2026-14318	6.8	22.8	Unknown	GiveWP	CWE-79	GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings
CVE-2026-67346	7.7	22.8	kyegomez	swarms	CWE-918	Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass
CVE-2026-67246	6.9	22.8	ASUSTOR Inc.	ADM	CWE-22	A path traversal vulnerability was found in the Wallpaper component of ADM
CVE-2026-44100	8.8	22.7	Phoenix Contact	CHARX SEC-3150	CWE-306	JupiCore charging point reconfiguration without auth
CVE-2026-22622	8.8	22.6	Eaton	PADM	CWE-78	Improper input validation in one of the session management interface of Eaton…
CVE-2026-9322	7.5	22.6	IBM	WebSphere Application Server	CWE-400	IBM WebSphere Application Server and WebSphere Application Server Liberty are…
CVE-2026-15397	7.2	22.5	wpswings	Subscriptions for WooCommerce	CWE-862	Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticat…
CVE-2026-22621	8.3	22.4	Eaton	PADM	CWE-78	Improper input validation in one of the session management interface of Eaton…
CVE-2026-11897	7.5	22.5	IBM	WebSphere Application Server - Liberty	CWE-770	IBM WebSphere Application Server Liberty is affected by a denial of service v…
CVE-2026-17887	7.5	22.4	Google	Chrome	CWE-416	Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-52539	9.1	22.4	n/a	n/a	CWE-798	Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_…
CVE-2026-17918	8.8	22.3	Google	Chrome	CWE-416	Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remo…
CVE-2026-67247	7.1	22.2	ASUSTOR Inc.	ADM	CWE-22	A path traversal vulnerability was found in the IHM Log handling of ADM
CVE-2026-59881	6.9	22.2	aio-libs	aiohttp	CWE-20	AIOHTTP: WebSocket client accepts compressed frames without negotiated permes…
CVE-2026-59952	6.9	22.2	open-circle	valibot	CWE-755	Valibot: record() issue paths can make flatten() throw for inherited Object p…
CVE-2026-65635	8.3	22.1	malach-it	boruta	CWE-653	Boruta dynamic client registration allows creation of over-privileged OAuth c…
CVE-2026-17840	6.5	22.1	Google	Chrome	CWE-451	Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 al…
CVE-2026-17786	8.8	22.0	Google	Chrome	CWE-20	Insufficient validation of untrusted input in DevTools in Google Chrome prior…
CVE-2026-67207	8.7	22.0	wolfcms	wolfcms	CWE-697	Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
CVE-2026-61536	7.5	22.0	masci	banks	CWE-94	Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path…
CVE-2026-16530	6.5	22.0	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Pcp: pcp: remote denial of service and information leakage
CVE-2026-17824	6.5	21.9	Google	Chrome	CWE-284	Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 15…
CVE-2026-18363	9.1	21.8	Enhancesoft LLC	osTicket	CWE-640	Weak password recovery mechanism in osTicket by Enhancesoft LLC
CVE-2026-17956	8.8	21.8	Google	Chrome	CWE-269	Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.79…
CVE-2026-17702	3.1	21.7	Google	Chrome	CWE-346	Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 …
CVE-2026-17715	3.1	21.7	Google	Chrome	CWE-346	Inappropriate implementation in Passwords in Google Chrome prior to 151.0.792…
CVE-2026-12687	7.5	21.6	Unknown	ProfileGrid	CWE-269	ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted…
CVE-2026-15974	6.5	21.6	SGLang	SGLang	CWE-918	CVE-2026-15974
CVE-2026-13435	9.9	21.4	IBM	Langflow OSS	CWE-94	Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure
CVE-2026-17749	9.6	21.3	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Extensions in Google Chrome pri…
CVE-2026-17782	4.3	21.4	Google	Chrome	CWE-451	Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.…
CVE-2026-17794	4.3	21.4	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Mobile in Google Chrome on Andr…
CVE-2026-57862	8.4	21.3	Kanboard	Kanboard	CWE-918	Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation
CVE-2026-11904	5.3	21.2	IBM	Verify Identity Access	CWE-209	Security vulnerabilities have been found in IBM Verify Identity Access and IB…
CVE-2026-17969	8.8	21.1	Google	Chrome	CWE-269	Inappropriate implementation in Passwords in Google Chrome prior to 151.0.792…
CVE-2026-15153	6.8	20.8	Unknown	WP Hotel Booking	CWE-89	WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
CVE-2026-17780	6.3	20.9	Google	Chrome	CWE-284	Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 1…
CVE-2026-54366	8.7	20.6	Gladinet	CentreStack	CWE-611	CentreStack < 17.4 XXE via SharePoint Storage Configuration
CVE-2026-17797	6.1	20.6	Google	Chrome	CWE-79	Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 a…
CVE-2026-17728	5.4	20.6	Google	Chrome	CWE-79	Inappropriate implementation in Extensions in Google Chrome prior to 151.0.79…
CVE-2026-17734	5.4	20.6	Google	Chrome	CWE-79	Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922…
CVE-2026-67349	8.7	20.5	opencost	opencost	CWE-306	OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
CVE-2026-17951	8.8	20.4	Google	Chrome	CWE-122	Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowe…
CVE-2026-66415	8.4	20.4	Leantime	Leantime	CWE-918	Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::…
CVE-2026-56428	8.1	20.3	Bosch	BSH ELP (Electronic Platform) Modules	CWE-286	The SSH service on BSH ELP (Electronic Platform) modules contains a platform-…
CVE-2026-17805	6.5	20.3	Google	Chrome	CWE-602	Insufficient policy enforcement in Glic in Google Chrome on Android prior to …
CVE-2026-17813	6.5	20.3	Google	Chrome	CWE-602	Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS pri…
CVE-2026-67244	8.6	20.3	ASUSTOR Inc.	ADM	CWE-134	A format string vulnerability was found in the Notification OAuth settings of…
CVE-2026-17743	6.5	20.2	Google	Chrome	CWE-346	Insufficient policy enforcement in ControlledFrame in Google Chrome prior to …
CVE-2026-17748	6.5	20.2	Google	Chrome	CWE-346	Inappropriate implementation in Extensions in Google Chrome prior to 151.0.79…
CVE-2026-17754	6.5	20.2	Google	Chrome	CWE-346	Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72…
CVE-2026-17787	6.5	20.2	Google	Chrome	CWE-346	Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922…
CVE-2026-17884	8.8	20.1	Google	Chrome	CWE-416	Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allo…
CVE-2026-67248	8.7	20.2	ASUSTOR Inc.	ADM	CWE-121	A stack-based buffer overflow vulnerability was found in the File Explorer on…
CVE-2026-17741	7.1	20.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in WebView in Google Chrome on And…
CVE-2026-17750	7.1	20.1	Google	Chrome	CWE-416	Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a rem…
CVE-2026-17731	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in Autofill in Google Chrome on Android prior to…
CVE-2026-17733	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in QUIC in Google Chrome on Android prior to 151…
CVE-2026-17742	4.3	20.1	Google	Chrome	CWE-346	Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7…
CVE-2026-17753	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922…
CVE-2026-17762	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17763	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 a…
CVE-2026-17765	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.79…
CVE-2026-17775	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in PresentationAPI in Google Chrome prior to 151…
CVE-2026-17777	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922…
CVE-2026-17788	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72…
CVE-2026-17798	4.3	20.1	Google	Chrome	CWE-346	Inappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 …
CVE-2026-17815	4.3	20.1	Google	Chrome	CWE-346	Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.…
CVE-2026-17820	4.3	20.1	Google	Chrome	CWE-346	Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7…
CVE-2026-17829	4.3	20.1	Google	Chrome	CWE-346	Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.…
CVE-2026-17894	8.8	20.1	Google	Chrome	CWE-416	Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allo…
CVE-2026-14227	6.9	20.1	MikroTik	RouterOS	CWE-613	Insufficient session expiration in MikroTik RouterOS
CVE-2026-17849	4.3	20.0	Google	Chrome	CWE-451	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-55768	8.7	19.8	allinurl	goaccess	CWE-681	GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame lengt…
CVE-2026-12562	8.7	19.7	Toptech Systems	RCU II+	CWE-306	Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical…
CVE-2026-66360	8.7	19.7	MZ Automation GmbH	libiec61850	CWE-125	MZ Automation libiec61850 Out-of-bounds Read
CVE-2026-67347	6.1	19.6	vendurehq	vendure	CWE-863	Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset …
CVE-2026-17856	9.6	19.4	Google	Chrome	CWE-693	Inappropriate implementation in Network in Google Chrome on Mac prior to 151.…
CVE-2026-17865	9.6	19.5	Google	Chrome	CWE-693	Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0…
CVE-2026-17886	8.8	19.5	Google	Chrome	CWE-416	Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-17819	6.5	19.4	Google	Chrome	CWE-451	Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.…
CVE-2026-17828	6.5	19.4	Google	Chrome	CWE-451	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17835	6.5	19.4	Google	Chrome	CWE-451	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17838	6.5	19.4	Google	Chrome	CWE-451	Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.…
CVE-2026-17839	6.5	19.4	Google	Chrome	CWE-451	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17802	4.3	19.3	Google	Chrome	CWE-1300	Side-channel information leakage in GPU in Google Chrome on Android prior to …
CVE-2026-17825	6.5	19.2	Google	Chrome	CWE-284	Insufficient policy enforcement in Passwords in Google Chrome on Android prio…
CVE-2026-17736	5.8	19.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in WebView in Google Chrome on And…
CVE-2026-17799	5.4	19.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Safe Browsing in Google Chrome …
CVE-2026-17971	8.8	19.0	Google	Chrome	CWE-125	Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72…
CVE-2026-17744	7.1	19.0	Google	Chrome	CWE-269	Inappropriate implementation in File Input in Google Chrome on Linux prior to…
CVE-2026-58040	6.3	19.0	nodejs	node	CWE-297	An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reu…
CVE-2026-17946	6.5	18.6	Google	Chrome	CWE-457	Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17968	6.5	18.6	Google	Chrome	CWE-457	Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72…
CVE-2026-17812	5.4	18.7	Google	Chrome	CWE-451	Inappropriate implementation in DigitalCredentials in Google Chrome prior to …
CVE-2026-14356	8.8	18.6	fleekdash	FleekDash V2	CWE-862	FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+…
CVE-2026-17950	8.8	18.6	Google	Chrome	CWE-269	Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to…
CVE-2026-62246	8.5	18.6	clastix	kamaji	CWE-284	Kamaji: TenantControlPlane namespace/name collision binds two tenants to the …
CVE-2026-18382	6.8	18.5	Red Hat	Cost Management Metrics Operator	CWE-918	Project-koku/koku-metrics-operator: koku-metrics-operator: service-account cl…
CVE-2026-65834	6.8	18.3	projectcapsule	capsule	CWE-20	Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validati…
CVE-2026-44104	9.3	18.3	Phoenix Contact	CHARX SEC-3150	CWE-347	ControllerAgent does not perform validation of firmware
CVE-2026-64816	7.1	18.3	CyberTimon	RapidRAW	CWE-73	RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath
CVE-2026-18186	7.1	17.9	ASUSTOR Inc.	ADM	CWE-134	A stored format string vulnerability was found in the FTP Backup on the ADM
CVE-2026-18187	7.1	17.9	ASUSTOR Inc.	ADM	CWE-134	A format string vulnerability was found in the Internal Backup on the ADM
CVE-2026-18188	7.1	17.9	ASUSTOR Inc.	ADM	CWE-134	A format string vulnerability was found in the Rsync Backup on the ADM
CVE-2026-17761	5.4	17.9	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome…
CVE-2026-15658	8.1	17.8	foreUP	foreUP	CWE-639	foreUP customer REST API allows unauthenticated endpoint access
CVE-2026-61893	6.9	17.8	MZ Automation	lib60870	CWE-125	MZ Automation lib60870 Out-of-bounds Read
CVE-2026-63033	6.9	17.8	MZ Automation	lib60870	CWE-125	MZ Automation lib60870 Out-of-bounds Read
CVE-2026-15657	6.5	17.8	foreUP	foreUP	CWE-522	foreUP customer REST API allows authenticated users to read cleartext payment…
CVE-2024-25039	7.5	17.7	IBM	Engineering Requirements Management DOORS and DOORS Web Access	CWE-400	IBM Engineering Requirements Management DOORS and DOORS Web Access is affecte…
CVE-2026-54715	7.1	17.7	allinurl	goaccess	CWE-122	GoAccess: Heap Out-of-Bounds Write in parse_browser()
CVE-2026-17892	6.5	17.7	Google	Chrome	CWE-200	Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72…
CVE-2026-55777	5.3	17.7	allinurl	goaccess	CWE-125	GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads…
CVE-2026-17789	6.5	17.6	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Chrome for iOS in Google Chrome…
CVE-2026-17869	8.1	17.5	Google	Chrome	CWE-125	Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a…
CVE-2025-69930	9.8	17.4	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69931	9.8	17.3	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69933	9.8	17.3	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69934	9.8	17.4	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69935	9.8	17.4	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in t…
CVE-2025-69936	9.8	17.3	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69937	9.8	17.3	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69938	9.8	17.3	n/a	n/a	CWE-89	CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in …
CVE-2025-69941	9.8	17.3	n/a	n/a	CWE-89	SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in…
CVE-2025-69947	9.8	17.4	n/a	n/a	CWE-89	SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in…
CVE-2026-4978	9.8	17.3	UMAI Vision	Traffic Analysis System	CWE-89	SQLi in UMAI Vision's Traffic Analysis System
CVE-2026-14923	6.5	17.2	Unknown	Sync Post With Other Site	CWE-863	Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modi…
CVE-2026-17992	6.5	17.2	Google	Chrome	CWE-457	Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 …
CVE-2026-17851	4.3	17.2	Google	Chrome	CWE-1300	Side-channel information leakage in Autofill in Google Chrome prior to 151.0.…
CVE-2026-17859	4.3	17.2	Google	Chrome	CWE-1300	Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922…
CVE-2026-17924	9.6	17.1	Google	Chrome	CWE-416	Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remot…
CVE-2026-17940	9.6	17.1	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Picture-in-Picture in Google Ch…
CVE-2026-17947	9.6	17.1	Google	Chrome	CWE-416	Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed …
CVE-2026-44094	8.3	17.1	Phoenix Contact	CHARX SEC-3150	CWE-636	Fallback to second RAUC slot with default credentials
CVE-2026-17776	5.8	17.1	Google	Chrome	CWE-693	Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a r…
CVE-2026-17774	7.5	16.9	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Variations in Google Chrome pri…
CVE-2026-17745	5.8	16.8	Google	Chrome	CWE-125	Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a …
CVE-2026-17746	5.8	16.8	Google	Chrome	CWE-416	Use after free in GPU in Google Chrome on Mac prior to 151.0.7922.72 allowed …
CVE-2026-17770	5.8	16.8	Google	Chrome	CWE-125	Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 al…
CVE-2026-17737	5.0	16.8	Google	Chrome	CWE-416	Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.7…
CVE-2026-12722	8.2	16.7	FTC Software IT Services	FTC E-Commerce Management Panel	CWE-306	Authentication Bypass in FTC Software's E-Commerce Management Panel
CVE-2026-18362	5.9	16.7	dfir-iris	iris-web	CWE-770	DFIR-IRIS Missing Brute Force Protection in User Authentication
CVE-2026-17720	3.1	16.6	Google	Chrome	CWE-346	Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.…
CVE-2026-67348	8.6	16.5	julep-ai	julep	CWE-639	Julep Insecure Direct Object Reference via GET /executions/{execution_id}
CVE-2026-12500	7.5	16.5	Unknown	WP Travel Engine	CWE-862	WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
CVE-2026-13178	7.5	16.5	Unknown	Eventin	CWE-639	Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
CVE-2026-54364	6.9	16.3	Gladinet	CentreStack	CWE-116	CentreStack < 17.4 Session Injection via SelectProvider.aspx
CVE-2026-17732	3.1	16.2	Google	Chrome	CWE-346	Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 a…
CVE-2026-17826	3.1	16.2	Google	Chrome	CWE-346	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-63550	7.1	15.9	MZ Automation GmbH	libiec61850	CWE-125	MZ Automation libiec61850 Out-of-bounds Read
CVE-2026-18017	8.8	15.8	Google	Chrome	CWE-416	Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remo…
CVE-2026-17913	5.4	15.7	Google	Chrome	CWE-451	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17842	6.5	15.5	Google	Chrome	CWE-346	Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior …
CVE-2026-17846	6.5	15.5	Google	Chrome	CWE-346	Inappropriate implementation in Media in Google Chrome on Windows prior to 15…
CVE-2026-17845	6.1	15.5	Google	Chrome	CWE-79	Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 a…
CVE-2026-13345	5.3	15.5	Unknown	Essential Addons for Elementor	CWE-639	Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Privat…
CVE-2026-58066	9.8	15.4	Rocket.Chat	Rocket.Chat	CWE-287	Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2…
CVE-2026-44097	5.3	15.3	Phoenix Contact	CHARX SEC-3150	CWE-434	File Upload vulnerability
CVE-2026-17934	4.3	15.4	Google	Chrome	CWE-20	Insufficient validation of untrusted input in DevTools in Google Chrome prior…
CVE-2026-17991	9.6	15.2	Google	Chrome	CWE-20	Insufficient validation of untrusted input in AI in Google Chrome prior to 15…
CVE-2026-17699	8.6	15.2	Google	Chrome	CWE-416	Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a loc…
CVE-2026-17666	9.1	15.0	Google	Chrome	CWE-325	Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allo…
CVE-2026-67527	7.6	15.1	opf	openproject	CWE-862	OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via…
CVE-2026-16092	6.5	15.0	labelblanc	Improved Save Button	CWE-89	Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Inje…
CVE-2025-36374	5.5	15.0	IBM	DataPower Gateway 10.6CD	CWE-611	IBM DataPower Gateway affected by XML external entity injection
CVE-2026-14980	8.8	14.8	IBM	WebSphere Application Server - Liberty	CWE-269	IBM WebSphere Application Server Liberty is affected by a cross-site request …
CVE-2026-18353	8.8	14.8	Eclipse Foundation	Eclipse CSI - PIA	CWE-918	Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
CVE-2026-48499	9.3	14.6	activepieces	activepieces	CWE-200	Activepieces: Cross-tenant data exposure and code injection via the Code piec…
CVE-2026-17850	6.5	14.6	Google	Chrome	CWE-346	Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7…
CVE-2026-17852	6.5	14.6	Google	Chrome	CWE-346	Inappropriate implementation in Media Router in Google Chrome prior to 151.0.…
CVE-2026-17975	6.5	14.5	Google	Chrome	CWE-200	Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.79…
CVE-2026-17843	4.3	14.5	Google	Chrome	CWE-346	Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 a…
CVE-2026-17930	7.5	14.5	Google	Chrome	CWE-20	Insufficient validation of untrusted input in Extensions in Google Chrome pri…

Results continue: ranks 401–662.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-30 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.