Security Box Score — July 31, 2026

183 CVEs published, led by Red Hat (16).

183 CVEs published July 31, 2026: 26 critical, 66 high, 76 medium, 15 low; 0 in the KEV catalog at press time; 2 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 158 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	9761	22164	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1022 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	835	2315	207	1231	637	1	11	2	0.1	7.8	.0016	+322 ▲
google	496	1761	214	713	781	53	77	6	0.3	7.5	.0025	-594 ▼
microsoft	665	1422	106	981	321	14	286	24	1.7	7.8	.0047	+444 ▲
red hat	164	386	16	154	191	25	2	0	0.0	6.5	.0030	+36 ▲
apple	167	271	57	78	133	3	88	7	2.6	6.5	.0027	+115 ▲
canonical	7	27	3	8	11	5	0	0	0.0	5.6	.0014	+1 ▲
suse	8	21	4	12	4	1	0	0	0.0	8.5	.0039	-3 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	-9 ▼

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	16	38	8	18	12	0	56	12	31.6	7.5	.0057	+6 ▲
ubiquiti	25	36	14	21	1	0	3	3	8.3	8.8	.0049	+17 ▲
palo alto networks	14	25	1	3	14	7	13	2	8.0	4.7	.0028	+5 ▲
fortinet	14	23	6	6	11	0	28	6	26.1	7.2	.0040	+12 ▲
netgear	6	23	0	0	22	1	0	0	0.0	4.6	.0024	-11 ▼
vmware	13	17	4	9	2	2	7	1	5.9	8.3	.0040	+10 ▲
f5	8	16	5	8	3	0	4	1	6.3	8.6	.0057	+2 ▲
checkpoint	3	12	3	6	3	0	3	2	16.7	7.7	.0455	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	181	336	65	143	116	11	33	1	0.3	7.5	.0053	+60 ▲
mozilla	71	127	51	42	34	0	9	0	0.0	8.1	.0031	+21 ▲
drupal	46	51	6	5	35	5	4	1	2.0	5.9	.0026	+46 ▲
gitlab	20	51	0	7	37	7	4	2	3.9	4.9	.0029	-4 ▼
github	6	12	1	3	8	0	0	0	0.0	6.0	.0042	+2 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	-4 ▼
wordpress	3	3	1	1	1	0	2	2	66.7	8.6	.7979	+3 ▲
kubernetes	1	1	0	0	0	1	0	0	0.0	2.4	.0035	+1 ▲

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1109	1379	343	653	322	61	27	3	0.2	8.1	.0036	+867 ▲
adobe	108	252	27	116	105	4	19	3	1.2	7.8	.0026	-34 ▼
ibm	105	229	67	86	76	0	6	0	0.0	7.5	.0032	+30 ▲
progress	33	42	6	29	7	0	6	0	0.0	8.0	.0038	+28 ▲
solarwinds	16	23	17	3	3	0	10	4	17.4	9.1	.0058	+12 ▲
zohocorp	3	6	2	2	2	0	0	0	0.0	7.8	.0146	+2 ▲
veeam	2	6	2	3	1	0	1	0	0.0	8.5	.0035	+1 ▲
atlassian	3	3	0	3	0	0	13	0	0.0	8.0	.0026	+3 ▲

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
rockwell automation	17	24	4	18	2	0	0	8.7	.0029	+10 ▲
synology	0	23	2	5	13	3	0	5.6	.0025	-5 ▼
d-link	8	20	0	5	9	6	3	5.5	.0105	-2 ▼
siemens	7	16	1	8	7	0	0	7.6	.0024	-1 ▼
schneider electric	3	9	1	6	2	0	0	8.6	.0037	-3 ▼
abb	1	7	0	4	3	0	0	7.2	.0018	-5 ▼
hikvision	6	6	0	4	2	0	0	7.2	.0040	+6 ▲
moxa	0	5	0	3	2	0	0	7.0	.0029	-5 ▼

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	49	120	0	0	62	58	0	0	0.0	5.5	.0034	0
openclaw	44	111	0	58	39	14	0	0	0.0	7.0	.0026	-17 ▼
dell	43	99	5	47	44	3	2	1	1.0	7.1	.0021	+5 ▲
capgo	22	83	2	42	38	1	0	0	0.0	7.1	.0037	-39 ▼
nvidia	43	82	12	54	16	0	0	0	0.0	7.8	.0037	+37 ▲
spring	6	79	2	34	41	2	0	0	0.0	6.5	.0022	-66 ▼
imagemagick	37	78	1	5	60	12	0	0	0.0	5.3	.0018	-4 ▼
itsourcecode	18	71	0	0	19	52	0	0	0.0	2.1	.0033	-25 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-59310	.4588	98.7	9.8
CVE-2026-48282	.4239	98.6	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-48282	10.0	.4239	KEV
CVE-2026-56290	10.0	.3038	KEV
CVE-2026-48939	10.0	.1973	KEV
CVE-2026-48908	10.0	.1482	KEV
CVE-2026-56291	10.0	.1459	KEV
CVE-2026-59726	10.0	.0688
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-47668	10.0	.0388

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	804
microsoft	663
google	444
apache	179
apple	167
red hat	156
adobe	108
ibm	105
mozilla	69

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	12
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	65
PyPI	6
NuGet	4
Go	3
npm	3
Packagist	2
crates.io	2

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-20316	Cisco	0
CVE-2026-25089	Fortinet	0
CVE-2026-46817	Oracle Corporation	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1717
CVE-2021-27102	n/a	2021-11-17	1717
CVE-2021-27101	n/a	2021-11-17	1717
CVE-2021-27103	n/a	2021-11-17	1717
CVE-2021-21017	Adobe	2021-11-17	1717
CVE-2021-28550	Adobe	2021-11-17	1717
CVE-2021-42013	Apache Software Foundation	2021-11-17	1717
CVE-2021-41773	Apache Software Foundation	2021-11-17	1717
CVE-2021-30858	Apple	2021-11-17	1717
CVE-2021-30860	Apple	2021-11-17	1717

Transactions

EXPLOIT PUBLISHED — CVE-2009-3960. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-12615 (Apache Software Foundation Apache Tomcat). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-47966. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-47246. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10685 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10686 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56968 (GNU SASL). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-66066 (rails). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67206 (wolfcms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67207 (wolfcms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67345 (dromara MaxKey). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67347 (vendurehq vendure). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67348 (julep-ai julep). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67349 (opencost). Public exploit reference added.

DUE DATE PASSED — CVE-2026-16812 (Arista Networks VeloCloud Orchestrator On-Prem). CISA remediation deadline was July 30, 2026; still in catalog.

RESCORED — Dígitro NGC Explorer: 3 CVEs (CVE-2025-4526, CVE-2025-4527, CVE-2025-4528). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2023-27997 (Fortinet FortiOS-6K7K). CVSS 9.2 → 9.8 (NVD).

RESCORED — CVE-2023-4966 (Citrix NetScaler ADC). CVSS 9.4 → 7.5 (NVD).

RESCORED — CVE-2023-6507 (Python Software Foundation CPython). CVSS 6.1 → 4.9 (NVD).

RESCORED — CVE-2026-56968 (GNU SASL). CVSS 3.7 → 5.3 (NVD).

Yesterday's Results

How to read these box scores · glossary

183 CVEs published. 25 box scores, 158 table rows — nothing truncated.

CVE-2026-14483CRITICAL

Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0364   88.7     —

AFFECTED
  Product                                        Versions     Fixed
  Realtyna Organic IDX plugin + WPL Real Estate  unspecified  —

TIMELINE
  Jul 2   Reserved by CNA
  Jul 31  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2026-38708CRITICAL

n/a n/a — TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0262   84.3     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jul 31  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-38711CRITICAL

n/a n/a — TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0262   84.3     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jul 31  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-38713CRITICAL

n/a n/a — TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0262   84.3     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jul 31  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-38710HIGH

n/a n/a — TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the syste…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0255   83.8     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Apr 6   Reserved by CNA
  Jul 31  Published (CNA: mitre)

CWE-77 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-9044HIGH

TP-Link Systems Inc. AXE75 V1 — Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   H   N   H   H   H    8.5   .0116   64.6     —

AFFECTED
  Product   Versions     Fixed
  AXE75 V1  unspecified  —

TIMELINE
  May 19  Reserved by CNA
  Jul 31  Published (CNA: TPLink)

CWE-78 · CNA: TPLink · CVSS v4.0 · 3 references · NVD status: Analyzed

CVE-2026-58048CRITICAL

WebPros cPanel — Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4   .0097   59.1     —

AFFECTED
  Product     Versions     Fixed
  cPanel      unspecified  —
  WP Squared  unspecified  —

TIMELINE
  Jun 27  Reserved by CNA
  Jul 31  Published (CNA: hackerone)

CWE-89 · CNA: hackerone · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-15722HIGH

Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8 — 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0083   54.8     —

AFFECTED
  Product                                                                Versions     Fixed
  Red Hat Directory Server 11.7 E4S for RHEL 8                           unspecified  8080020260806114250.f969626e
  Red Hat Directory Server 11.9 for RHEL 8                               unspecified  8100020260803140625.37ed7c03
  Red Hat Directory Server 12.2 E4S for RHEL 9                           unspecified  9020020260730155601.1674d574
  Red Hat Directory Server 12.4 E4S for RHEL 9                           unspecified  9040020260810131422.1674d574
  Red Hat Enterprise Linux 10                                            unspecified  0:3.2.0-9.el10_2
  Red Hat Enterprise Linux 10.0 Extended Update Support                  unspecified  0:3.0.6-20.el10_0
  Red Hat Enterprise Linux 7 Extended Lifecycle Support                  unspecified  0:1.3.11.1-14.el7_9
  Red Hat Enterprise Linux 8                                             unspecified  8100020260806150504.25e700aa
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support  unspecified  8040020260803141511.96015a92
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On  unspecified  8040020260803141511.96015a92
  + 11 more

TIMELINE
  Jul 14  Reserved by CNA
  Jul 31  Published (CNA: redhat)

CWE-121 · CNA: redhat · CVSS v3.1 · 17 references · NVD status: Modified

CVE-2026-68771CRITICAL

Comfy-Org ComfyUI — ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0078   53.2     —

AFFECTED
  Product  Versions     Fixed
  ComfyUI  unspecified  —

TIMELINE
  Jul 31  Reserved by CNA
  Jul 31  Published (CNA: VulnCheck)

CWE-502 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-63223CRITICAL

codeigniter4 CodeIgniter4 — CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0076   52.5     —

AFFECTED
  Product       Versions   Fixed
  CodeIgniter4  < 4.7.4 –  —

TIMELINE
  Jul 15  Reserved by CNA
  Jul 31  Published (CNA: GitHub_M)

CWE-434 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-56671HIGH

Comfy-Org ComfyUI — ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0066   48.9     —

AFFECTED
  Product  Versions    Fixed
  ComfyUI  < 0.28.0 –  —

TIMELINE
  Jun 22  Reserved by CNA
  Jul 31  Published (CNA: GitHub_M)

CWE-22 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-51785CRITICAL

n/a n/a — An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0066   48.8     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 8   Reserved by CNA
  Jul 31  Published (CNA: mitre)

CWE-94 · CNA: mitre · CVSS v3.1 · 4 references · NVD status: Received

CVE-2026-52134CRITICAL

n/a n/a — An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0063   47.3     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 8   Reserved by CNA
  Jul 31  Published (CNA: mitre)

CWE-284 · CNA: mitre · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-16236HIGH

Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0061   46.5     —

AFFECTED
  Product                                        Versions     Fixed
  Realtyna Organic IDX plugin + WPL Real Estate  unspecified  —

TIMELINE
  Jul 19  Reserved by CNA
  Jul 31  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-44615MEDIUM

Apache Software Foundation Apache Zeppelin — Path traversal in NotebookRepo note and folder path composition

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0058   44.9     —

AFFECTED
  Product          Versions  Fixed
  Apache Zeppelin  0.9.0 –   —

TIMELINE
  May 7   Reserved by CNA
  Jul 31  Published (CNA: apache)

CWE-22 · CNA: apache · CVSS v3.1 · 4 references · NVD status: Analyzed

CVE-2026-58047MEDIUM

WebPros cPanel — HTTP Smuggling in cPanel allows potential leak of credentials.

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   L   L   N    5.6   .0053   42.7     —

AFFECTED
  Product     Versions     Fixed
  cPanel      unspecified  —
  WP Squared  unspecified  —

TIMELINE
  Jun 27  Reserved by CNA
  Jul 31  Published (CNA: hackerone)

CWE-444 · CNA: hackerone · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-11770HIGH

Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8 — 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0053   42.2     —

AFFECTED
  Product                                                                Versions     Fixed
  Red Hat Directory Server 11.7 E4S for RHEL 8                           unspecified  8080020260806114250.f969626e
  Red Hat Directory Server 11.9 for RHEL 8                               unspecified  8100020260803140625.37ed7c03
  Red Hat Directory Server 12.2 E4S for RHEL 9                           unspecified  9020020260730155601.1674d574
  Red Hat Directory Server 12.4 E4S for RHEL 9                           unspecified  9040020260810131422.1674d574
  Red Hat Enterprise Linux 10                                            unspecified  0:3.2.0-9.el10_2
  Red Hat Enterprise Linux 10.0 Extended Update Support                  unspecified  0:3.0.6-20.el10_0
  Red Hat Enterprise Linux 7 Extended Lifecycle Support                  unspecified  0:1.3.11.1-14.el7_9
  Red Hat Enterprise Linux 8                                             unspecified  8100020260806150504.25e700aa
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support  unspecified  8040020260803141511.96015a92
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On  unspecified  8040020260803141511.96015a92
  + 11 more

TIMELINE
  Jun 9   Reserved by CNA
  Jul 31  Published (CNA: redhat)

CWE-90 · CNA: redhat · CVSS v3.1 · 18 references · NVD status: Modified

CVE-2026-62391HIGH

Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  N    8.1   .0052   41.9     —

AFFECTED
  Product        Versions  Fixed
  Apache Kyuubi  1.6.0 –   —

TIMELINE
  Jul 14  Reserved by CNA
  Jul 31  Published (CNA: apache)

CWE-22, CWE-27 · CNA: apache · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-18358HIGH

Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0052   41.9     —

AFFECTED
  Product                      Versions     Fixed
  gnome-remote-desktop         unspecified  —
  Red Hat Enterprise Linux 10  unspecified  0:49.3-4.el10_2
  Red Hat Enterprise Linux 8   unspecified  —
  Red Hat Enterprise Linux 9   unspecified  —

TIMELINE
  Jul 30  Reserved by CNA
  Jul 31  Published (CNA: redhat)

CWE-400 · CNA: redhat · CVSS v3.1 · 3 references · NVD status: Awaiting Analysis

CVE-2026-68770CRITICAL

Hugging Face sentence-transformers — sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0052   41.8     —

AFFECTED
  Product                Versions     Fixed
  sentence-transformers  unspecified  —

TIMELINE
  Jul 31  Reserved by CNA
  Jul 31  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-17566CRITICAL

pgadmin.org pgAdmin 4 — pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4   .0049   39.7     —

AFFECTED
  Product    Versions     Fixed
  pgAdmin 4  unspecified  —

TIMELINE
  Jul 27  Reserved by CNA
  Jul 31  Published (CNA: PostgreSQL)

CWE-78, CWE-115 · CNA: PostgreSQL · CVSS v4.0 · 2 references · NVD status: Analyzed

CVE-2026-64607MEDIUM

Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  L    5.3   .0048   39.4     —

AFFECTED
  Product                       Versions     Fixed
  Apache HttpComponents Client  5.0-alpha –  —

TIMELINE
  Jul 20  Reserved by CNA
  Jul 31  Published (CNA: apache)

CWE-772 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Modified

CVE-2026-16843HIGH

Hikvision DS-3WAP521-SI — Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient in…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0046   38.1     —

AFFECTED
  Product         Versions                             Fixed
  DS-3WAP521-SI   V1.1.6601 build251223 and earlier –  —
  DS-3WAP522-SI   V1.1.6601 build251223 and earlier –  —
  DS-3WAP621E-SI  V1.1.6601 build251223 and earlier –  —
  DS-3WAP622E-SI  V1.1.6601 build251223 and earlier –  —
  DS-3WAP623E-SI  V1.1.6601 build251223 and earlier –  —
  DS-3WAP622G-SI  V1.1.6601 build251223 and earlier –  —
  DS-3WG105G-SI   V1.1.6601 build251223 and earlier –  —
  DS-3WG105GP-SI  V1.1.6601 build251223 and earlier –  —
  DS-3WG210GP-SI  V1.1.6601 build251223 and earlier –  —
  DS-3WG507G-SI   V1.1.6601 build251223 and earlier –  —

TIMELINE
  Jul 24  Reserved by CNA
  Jul 31  Published (CNA: hikvision)

CWE-78 · CNA: hikvision · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-63222HIGH

codeigniter4 CodeIgniter4 — CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  N    7.5   .0045   37.2     —

AFFECTED
  Product       Versions   Fixed
  CodeIgniter4  < 4.7.4 –  —

TIMELINE
  Jul 15  Reserved by CNA
  Jul 31  Published (CNA: GitHub_M)

CWE-22 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-17346HIGH

pgadmin.org pgAdmin 4 — pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0043   35.9     —

AFFECTED
  Product    Versions  Fixed
  pgAdmin 4  1.0 –     —
  pgAdmin 4  5.0 –     —

TIMELINE
  Jul 25  Reserved by CNA
  Jul 31  Published (CNA: PostgreSQL)

CWE-89 · CNA: PostgreSQL · CVSS v4.0 · 3 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-18452	10.0	35.7	Rich Source	DMS+ (Non-Mobile)	CWE-798	Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials
CVE-2026-56673	7.5	35.6	Comfy-Org	ComfyUI	CWE-22	ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary fil…
CVE-2026-53551	6.9	35.5	free5gc	free5gc	CWE-20	free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal serv…
CVE-2026-53510	8.1	34.6	savonrb	savon	CWE-94	Savon::Model evaluates WSDL operation names as Ruby source
CVE-2026-53503	7.5	34.0	thumbor	thumbor	CWE-20	Thumbor convolution filter allows divide-by-zero in C extension leading to re…
CVE-2026-17351	9.4	33.6	pgadmin.org	pgAdmin 4	CWE-89	pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL …
CVE-2026-62959	8.2	31.1	coturn	coturn	CWE-125	Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme…
CVE-2026-55100	8.7	31.0	kyndryl-open-source	hashi-vault-js	CWE-23	hashi-vault-js has a path traversal and query parameter injection
CVE-2026-12720	7.5	30.5	Unknown	Kirki	CWE-502	Kirki < 6.0.13 - Unauthenticated PHP Object Injection
CVE-2026-17567	5.3	30.4	wpmanageninja	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder	CWE-639	Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via In…
CVE-2026-53573	4.8	30.4	geonetwork	core-geonetwork	CWE-601	core-geonetwork has an Open Redirect Bypass
CVE-2026-63221	9.4	29.9	codeigniter4	CodeIgniter4	CWE-89	CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when u…
CVE-2026-54909	5.3	29.8	pion	stun	CWE-20	Pion STUN vulnerable to remote denial of service via panic while parsing a ma…
CVE-2026-13392	7.2	28.6	Unknown	ElementsKit Elementor Addons	CWE-94	ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Cu…
CVE-2026-53502	8.7	28.3	thumbor	thumbor	CWE-22	Thumbor has path traversal via post-validation URL decoding bypass in file_lo…
CVE-2026-16504	9.8	27.9	VPS.org	Zulip template	CWE-321	VPS.org one-click Zulip template deployment instance contains multiple vulner…
CVE-2026-46594	5.1	27.4	PHP Jabbers	PHP Poll Script	CWE-79	Reflected XSS in PHP Poll Script
CVE-2026-10686	7.5	27.1	zephyrproject	zephyr	CWE-835	Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet l…
CVE-2026-45376	5.5	26.7	decidim	decidim	CWE-89	Decidim: Admin user search allows SQL injection through similarity-based sorting
CVE-2025-69946	9.8	26.1	n/a	n/a	CWE-89	SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injecti…
CVE-2026-52856	7.5	25.9	pterodactyl	wings	CWE-129	Wings: Maliciously crafted packet during SFTP connection handshake causes den…
CVE-2026-53504	7.5	25.9	thumbor	thumbor	CWE-400	Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
CVE-2026-53505	7.5	25.9	thumbor	thumbor	CWE-400	Thumbor proportion filter allows unbounded post-transform resize leading to r…
CVE-2026-54725	9.6	25.0	bank-vaults	vault-secrets-webhook	CWE-918	vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker UR…
CVE-2026-16503	9.1	24.3	VPS.org	Supabase template	CWE-1188	VPS.org one-click Supabase template deployment instance contains multiple vul…
CVE-2026-65310	7.5	24.0	ANDRITZ	HIPASE-250	CWE-306	Missing authentication and permissive CORS policy
CVE-2026-65841	5.3	23.9	xdan	jodit	CWE-80	Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses…
CVE-2026-14319	7.5	23.8	Unknown	GiveWP	CWE-200	GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure
CVE-2026-17561	9.8	23.5	Innotim Software, Telecommunications and Consulting Trade Ltd. Co.	Logsign SIEM	CWE-94	Unauthenticated RCE in Innotim Software's Logsign SIEM
CVE-2026-43830	9.8	23.5	tbc	tbc	CWE-77	tbc
CVE-2026-53599	7.5	23.6	redaxo	core	CWE-434	Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename t…
CVE-2026-17349	9.3	23.5	pgadmin.org	pgAdmin 4	CWE-522	pgAdmin 4: Adhoc server clone leaks another user's stored database credential…
CVE-2026-67822	9.8	23.3	n/a	n/a	CWE-121	Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability …
CVE-2026-18141	8.2	23.0	Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	CWE-295	Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via f…
CVE-2025-69948	9.8	22.7	n/a	n/a	CWE-89	SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injecti…
CVE-2026-59232	5.3	22.5	Roskus	Prospero Flow CRM	CWE-79	Stored Cross-site Scripting in Prospero Flow CRM lead name field
CVE-2026-10685	7.6	21.8	zephyrproject	zephyr	CWE-416	Use-after-free of GATT subscribe params in Bluetooth host CCC-write response …
CVE-2026-46593	8.6	21.7	PHP Jabbers	PHP Poll Script	CWE-89	Authenticated SQL Injection in PHP Poll Script
CVE-2026-17347	7.7	21.6	pgadmin.org	pgAdmin 4	CWE-78	pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted usernam…
CVE-2026-14333	7.5	21.6	Unknown	Demi	CWE-269	Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticat…
CVE-2026-67607	8.2	21.5	hfiref0x	LightFTP	CWE-367	LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup
CVE-2026-55497	6.5	21.5	cloudreve	cloudreve	CWE-400	Cloudreve: Server crash through image decompression/pixel bomb in thumbnail &…
CVE-2026-62999	7.5	21.4	copier-org	copier	CWE-22	Copier: Percent-encoded dot segments in template URLs can allow trusted-prefi…
CVE-2026-18394	6.9	21.4	AWS	Strands Agents Tools	CWE-863	Incorrect authorization in Strands Agents Tools http_request proxy credential…
CVE-2026-54729	8.7	21.2	HackingRepo	dssrf-js	CWE-918	dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
CVE-2026-12695	8.1	21.1	Unknown	miniOrange 2FA	CWE-287	miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
CVE-2026-52855	9.9	20.9	pterodactyl	wings	CWE-200	Wings exposes node configuration secrets through egg configuration-file templ…
CVE-2026-53500	8.2	20.6	thumbor	thumbor	CWE-918	Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing h…
CVE-2026-18481	6.2	20.1	AWS	AWS Ops Wheel	CWE-79	Stored XSS in Participant URL Field leads to Account Takeover via Session Tok…
CVE-2026-21662	4.8	19.9	Johnson Controls	FM Systems Employee	CWE-434	FMS Employee Allows Upload of Unrestricted Files
CVE-2025-67650	8.6	19.8	PHP Jabbers	Appointment Scheduler	CWE-89	Authenticated SQL Injection in PHP Jabbers scripts
CVE-2026-45330	4.9	19.8	decidim	decidim	CWE-639	Decidim: Veriﬁcation admins can access supplied IDs from other organisations
CVE-2026-54768	6.9	19.6	wp-graphql	wp-graphql	CWE-204	WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that l…
CVE-2026-14919	9.8	19.6	Unknown	ShopMonitor.io	CWE-287	ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via P…
CVE-2026-51953	7.4	19.5	n/a	n/a	CWE-613	An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via th…
CVE-2025-67649	9.3	19.2	PHP Jabbers	Car Rental Script	CWE-89	Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script
CVE-2026-45377	6.5	19.2	decidim	decidim	CWE-200	Decidim: Private exports can be downloaded through reusable links
CVE-2026-65311	5.3	18.5	ANDRITZ	HIPASE-250	CWE-284	Missing authentication for logging-configuration endpoint
CVE-2026-12721	8.6	17.6	Unknown	Kirki	CWE-89	Kirki < 6.0.13 - Unauthenticated SQL Injection
CVE-2026-54737	7.3	17.6	phun-ky	defaults-deep	CWE-1321	@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive P…
CVE-2026-55495	4.3	17.3	cloudreve	cloudreve	CWE-22	Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation…
CVE-2026-59231	5.3	17.2	ccyl13	Pentestify	CWE-918	Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs
CVE-2026-15048	7.5	16.9	Unknown	Geeky Bot	CWE-200	GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat Hi…
CVE-2026-65981	7.1	16.0	coturn	coturn	CWE-639	Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user…
CVE-2026-43829	7.5	15.5	tbc	tbc	CWE-121	tbc
CVE-2026-43831	7.5	15.5	tbc	tbc	CWE-121	tbc
CVE-2026-43832	7.5	15.5	tbc	tbc	CWE-121	tbc
CVE-2026-54706	4.8	15.3	onionshare	onionshare	CWE-59	OnionShare follows symlinks in shared directories, allowing unintended disclo…
CVE-2026-18157	7.8	14.9	RedHatInsights	yggdrasil-worker-package-manager	CWE-88	Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote co…
CVE-2026-14930	7.5	14.8	Unknown	JS Help Desk	CWE-862	JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
CVE-2026-13609	8.8	14.7	Unknown	Frontend Admin by DynamiApps	CWE-79	Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scr…
CVE-2026-17348	6.9	14.6	pgadmin.org	pgAdmin 4	CWE-306	pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debu…
CVE-2026-56672	8.2	14.4	Comfy-Org	ComfyUI	CWE-79	ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitiza…
CVE-2026-14541	8.0	14.0	Google	mcp-toolbox	CWE-287	Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
CVE-2026-54707	5.4	13.6	onionshare	onionshare	CWE-863	OnionShare Receive mode writes uploaded files even when file uploads are disa…
CVE-2026-14833	6.8	13.4	Unknown	Lightbox with PhotoSwipe	CWE-79	Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption …
CVE-2026-18436	5.3	13.2	mailerpress	MailerPress – Newsletter, email marketing & AI automation	CWE-862	MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Mod…
CVE-2026-18437	5.3	13.2	mailerpress	MailerPress – Newsletter, email marketing & AI automation	CWE-862	MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
CVE-2026-12251	8.1	13.1	Unknown	Ultimate Member	CWE-269	Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Sele…
CVE-2026-56670	8.2	12.8	Comfy-Org	ComfyUI	CWE-79	ComfyUI: Stored XSS via SVG file upload on the /view endpoint
CVE-2026-14554	6.5	12.8	Unknown	Check & Log Email	CWE-89	Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
CVE-2026-52371	6.5	12.8	n/a	n/a	CWE-918	A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger com…
CVE-2026-18446	7.5	12.5	fast-uri	fast-uri	CWE-436	fast-uri vulnerable to host confusion via backslash authority introducer
CVE-2026-14317	5.3	12.4	Unknown	GiveWP	CWE-862	GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass
CVE-2026-14928	6.5	12.2	Unknown	JS Help Desk	CWE-200	JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via check…
CVE-2026-14931	6.5	12.2	Unknown	JS Help Desk	CWE-200	JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
CVE-2026-14537	8.1	11.9	Google	mcp-toolbox	CWE-863	Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
CVE-2026-17350	5.3	11.9	pgadmin.org	pgAdmin 4	CWE-862	pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers
CVE-2026-15258	8.1	11.7	Unknown	Product Feed Manager For WooCommerce	CWE-89	Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via…
CVE-2026-14539	6.6	11.0	Google	mcp-toolbox	CWE-770	Denial of Service via Unrestricted Payload Buffering in MCP Toolbox
CVE-2026-55496	4.3	11.1	cloudreve	cloudreve	CWE-200	Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search …
CVE-2026-55825	3.1	10.9	contao	contao	CWE-22	Contao: Possible path traversal in job download URIs
CVE-2026-53501	8.2	10.8	thumbor	thumbor	CWE-347	Thumbor has HMAC validation bypass via multiple .replace() calls when removin…
CVE-2026-14830	7.5	10.8	Unknown	FlxWoo	CWE-287	FlxWoo < 3.1.1 - Unauthenticated Payment Bypass
CVE-2026-15227	5.3	10.7	Checkmk GmbH	Checkmk	CWE-862	Missing Authorization Allows Editing of Foreign Reports
CVE-2026-67350	2.1	10.3	s9y	Serendipity	CWE-601	Serendipity < 2.6.1 Open Redirect via exit.php
CVE-2026-15209	6.5	9.9	Unknown	JS Help Desk	CWE-639	JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cr…
CVE-2026-18208	6.5	9.9	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: inactive out-of-audience token introspe…
CVE-2026-18206	3.7	9.9	Red Hat	Red Hat Build of Keycloak	CWE-20	Keycloak-services: keycloak-services: client policy source-host wildcard doma…
CVE-2026-43833	5.3	9.5	tbc	tbc	—	tbc
CVE-2026-56568	5.3	9.3	HCL Software	HCL iControl	CWE-209	HCL iControl is affected by multiple security vulnerabilities.
CVE-2026-55502	7.1	9.1	cloudreve	cloudreve	CWE-863	Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials
CVE-2026-18209	4.7	8.9	Red Hat	Red Hat Build of Keycloak	CWE-1288	Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in ht…
CVE-2026-18217	4.7	8.9	Red Hat	Red Hat Build of Keycloak	CWE-20	Keycloak-services: keycloak-services: saml http-redirect binding response pre…
CVE-2026-55499	4.3	9.0	cloudreve	cloudreve	CWE-863	Cloudreve: Broken access control in file event stream leaks activity events f…
CVE-2026-16105	4.9	8.9	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: missing per-role authorization on rolec…
CVE-2026-18214	8.1	8.5	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: google external access-token exchange b…
CVE-2026-18215	8.1	8.3	Red Hat	Red Hat Build of Keycloak	CWE-287	Keycloak-services: keycloak-services: microsoft external access-token exchang…
CVE-2026-14538	5.7	8.2	Google	mcp-toolbox	CWE-285	BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
CVE-2025-62347	4.3	8.1	HCL	HCL iControl	CWE-20	HCL iControl was affected by Improper Input Validation vulnerability. It is v…
CVE-2026-18203	6.5	7.8	Red Hat	Red Hat Build of Keycloak	CWE-863	Keycloak-services: keycloak-services: group policy extendchildren matches sib…
CVE-2026-14843	5.3	7.7	Unknown	Events Made Easy	CWE-639	Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR
CVE-2026-57232	3.1	7.8	contao	contao	CWE-918	Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Fe…
CVE-2026-62324	5.4	7.5	xdan	jodit	CWE-79	Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement …
CVE-2026-18211	5.4	7.3	Red Hat	Red Hat Build of Keycloak	CWE-20	Keycloak-services: keycloak-services: secure-client-uris policy bypass via lo…
CVE-2026-14849	3.7	7.3	Unknown	Paid Membership Subscriptions	CWE-552	Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exp…
CVE-2026-15381	3.7	7.4	Unknown	WP Go Maps	CWE-89	WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
CVE-2026-56570	5.3	7.3	HCL Software	HCL iControl	CWE-522	HCL iControl is affected by multiple security vulnerabilities.
CVE-2026-65313	8.1	7.2	ANDRITZ	HIPASE-250	CWE-798	Use of hard-coded VNC credentials in the engineering-workstation provisioning
CVE-2026-28144	4.3	7.1	Flipper Code	WP Maps	CWE-201	WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability
CVE-2026-25552	6.3	6.8	TryGhost	Ghost-CLI	CWE-348	Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
CVE-2026-56571	5.3	6.6	HCL Software	HCL iControl	CWE-209	HCL iControl is affected by multiple security vulnerabilities.
CVE-2026-62323	6.3	6.5	cloudreve	cloudreve	CWE-863	Cloudreve: Unauthorized file write via WOPI view sessions whose access token …
CVE-2026-45086	5.4	6.6	decidim	decidim	CWE-862	Decidim: Forms admin question editor lacks authorization
CVE-2025-67651	6.9	6.1	PHP Jabbers	Appointment Scheduler	CWE-352	CSRF in PHP Jabbers scripts
CVE-2026-14862	3.7	6.1	Unknown	Support Genix	CWE-862	Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via …
CVE-2026-12697	5.4	5.9	Unknown	wpForo Forum	CWE-639	wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
CVE-2026-14834	6.5	5.8	Unknown	Mailgun for WordPress	CWE-284	Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscr…
CVE-2026-14845	6.1	5.6	Unknown	NewStatPress	CWE-79	NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget
CVE-2026-12376	4.3	5.5	Unknown	Academy LMS	CWE-639	Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_…
CVE-2026-14847	4.3	5.5	Unknown	Paid Membership Subscriptions	CWE-639	Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR
CVE-2026-14927	3.7	5.6	Unknown	FluentCart A New Era of eCommerce	CWE-639	FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes
CVE-2026-55824	2.6	4.8	contao	contao	CWE-200	Contao crawler leaks auth credentials to external hosts
CVE-2026-65309	7.5	4.6	ANDRITZ	HIPASE-250	CWE-257	Storage of passwords in a reversible format
CVE-2026-14929	4.3	4.6	Unknown	JS Help Desk	CWE-863	JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR
CVE-2026-58039	3.3	4.5	nodejs	node	CWE-284	A flaw in Node.js Permission Model enforcement allows process.report writes (…
CVE-2026-54785	6.2	4.5	eLyiN	gemini-bridge	CWE-22	gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with…
CVE-2026-14921	6.1	4.3	Unknown	Ultimate Addons for WPBakery Page Builder	CWE-79	Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS …
CVE-2026-52232	6.1	4.3	n/a	n/a	CWE-79	A reflected cross-site scripting (XSS) vulnerability in the /logo.asp compone…
CVE-2026-14922	6.1	3.9	Unknown	WP Photo Album Plus	CWE-79	WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment
CVE-2026-65636	2.1	3.6	ufirstgroup	ymlr	CWE-93	YAML injection via unescaped newlines in ymlr document comments
CVE-2026-34641	7.8	3.5	Adobe	Premiere	CWE-787	Premiere Pro \| Out-of-bounds Write (CWE-787)
CVE-2026-8155	5.4	3.4	Unknown	BuddyPress	CWE-639	BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
CVE-2026-34495	4.8	3.4	Johnson Controls	FM Systems Employee	CWE-79	FMS Employee vulnerable to XSS
CVE-2026-34497	4.8	3.4	Johnson Controls	FM Systems Employee	CWE-80	FMS Employee Vulnerable to HTML Injection
CVE-2026-13393	3.5	3.4	Unknown	ElementsKit Elementor Addons	CWE-79	ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu M…
CVE-2026-10079	8.5	3.2	Red Hat	Red Hat Advanced Cluster Security 4	CWE-345	Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via …
CVE-2026-50986	8.8	3.2	n/a	n/a	CWE-352	PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Sit…
CVE-2026-63220	4.8	3.2	codeigniter4	CodeIgniter4	CWE-348	CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
CVE-2026-18218	5.4	2.9	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: client not-before revocation ignored wh…
CVE-2026-14540	8.0	1.7	Google	mcp-toolbox	CWE-918	Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
CVE-2026-52857	5.5	1.6	pterodactyl	wings	CWE-400	Wings: Maliciously or erroneously created parsed config files can cause wings…
CVE-2026-28145	5.3	1.3	StylemixThemes	MasterStudy LMS	CWE-345	WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability
CVE-2026-56567	3.3	1.0	HCL Software	HCL iControl	CWE-15	HCL iControl is affected by multiple security vulnerabilities.
CVE-2026-56569	3.3	1.0	HCL Software	HCL iControl	CWE-497	HCL iControl is affected by multiple security vulnerabilities.
CVE-2026-54787	3.1	0.5	sigstore	sigstore-go	CWE-324	sigstore-go fails to check signature timestamps against a signing key's valid…
CVE-2026-18321	4.7	0.3	NTPsec	ntpsec	CWE-120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec
CVE-2026-34490	4.8	0.2	Johnson Controls	XAAP Application	CWE-312	XAAP Android Data Stored in Unencrypted Database

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-07-31 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.