{ "day": "2026-07-31", "boundary": "UTC calendar day", "published_count": 183, "by_severity": { "CRITICAL": 26, "HIGH": 66, "MEDIUM": 76, "LOW": 15 }, "kev_count": 0, "exploit_reference_count": 2, "awaiting_enrichment_count": 0, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-38708", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.02619, "epss_percentile": 0.84223, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-77", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38708" }, { "rank": 2, "cve_id": "CVE-2026-38711", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.02619, "epss_percentile": 0.84222, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-77", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.upgrade_check interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38711" }, { "rank": 3, "cve_id": "CVE-2026-38713", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.02619, "epss_percentile": 0.84223, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-77", "title": "TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38713" }, { "rank": 4, "cve_id": "CVE-2026-38710", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.02546, "epss_percentile": 0.83737, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-77", "title": "TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-38710" }, { "rank": 5, "cve_id": "CVE-2026-14483", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.02186, "epss_percentile": 0.80965, "kev": false, "kev_due_at": null, "vendor": "realtyna", "product": "Realtyna Organic IDX plugin + WPL Real Estate", "cwe": "CWE-434", "title": "Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14483" }, { "rank": 6, "cve_id": "CVE-2026-51785", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.01149, "epss_percentile": 0.64328, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-94", "title": "An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request", "url": "https://www.cve.org/CVERecord?id=CVE-2026-51785" }, { "rank": 7, "cve_id": "CVE-2026-9044", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.01129, "epss_percentile": 0.63822, "kev": false, "kev_due_at": null, "vendor": "TP-Link Systems Inc.", "product": "AXE75 V1", "cwe": "CWE-78", "title": "Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9044" }, { "rank": 8, "cve_id": "CVE-2026-16843", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00891, "epss_percentile": 0.56617, "kev": false, "kev_due_at": null, "vendor": "Hikvision", "product": "DS-3WAP521-SI", "cwe": "CWE-78", "title": "Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16843" }, { "rank": 9, "cve_id": "CVE-2026-15722", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00869, "epss_percentile": 0.5596, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Directory Server 11.7 E4S for RHEL 8", "cwe": "CWE-121", "title": "389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15722" }, { "rank": 10, "cve_id": "CVE-2026-44615", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0084, "epss_percentile": 0.55023, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Zeppelin", "cwe": "CWE-22", "title": "Path traversal in NotebookRepo note and folder path composition", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44615" }, { "rank": 11, "cve_id": "CVE-2026-52134", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.008, "epss_percentile": 0.53734, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-284", "title": "An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52134" }, { "rank": 12, "cve_id": "CVE-2026-11770", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00687, "epss_percentile": 0.49897, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Directory Server 11.7 E4S for RHEL 8", "cwe": "CWE-90", "title": "389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11770" }, { "rank": 13, "cve_id": "CVE-2026-56671", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00661, "epss_percentile": 0.48866, "kev": false, "kev_due_at": null, "vendor": "Comfy-Org", "product": "ComfyUI", "cwe": "CWE-22", "title": "ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56671" }, { "rank": 14, "cve_id": "CVE-2026-16236", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00629, "epss_percentile": 0.47447, "kev": false, "kev_due_at": null, "vendor": "realtyna", "product": "Realtyna Organic IDX plugin + WPL Real Estate", "cwe": "CWE-434", "title": "Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16236" }, { "rank": 15, "cve_id": "CVE-2026-68771", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00623, "epss_percentile": 0.47205, "kev": false, "kev_due_at": null, "vendor": "Comfy-Org", "product": "ComfyUI", "cwe": "CWE-502", "title": "ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68771" }, { "rank": 16, "cve_id": "CVE-2026-58048", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00561, "epss_percentile": 0.4421, "kev": false, "kev_due_at": null, "vendor": "WebPros", "product": "cPanel", "cwe": "CWE-89", "title": "Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58048" }, { "rank": 17, "cve_id": "CVE-2026-55497", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00531, "epss_percentile": 0.42625, "kev": false, "kev_due_at": null, "vendor": "cloudreve", "product": "cloudreve", "cwe": "CWE-400", "title": "Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55497" }, { "rank": 18, "cve_id": "CVE-2026-62391", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00522, "epss_percentile": 0.42127, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kyuubi", "cwe": "CWE-22", "title": "Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62391" }, { "rank": 19, "cve_id": "CVE-2026-18358", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00522, "epss_percentile": 0.42114, "kev": false, "kev_due_at": null, "vendor": "GNOME", "product": "gnome-remote-desktop", "cwe": "CWE-400", "title": "Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18358" }, { "rank": 20, "cve_id": "CVE-2026-68770", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00521, "epss_percentile": 0.42028, "kev": false, "kev_due_at": null, "vendor": "Hugging Face", "product": "sentence-transformers", "cwe": "CWE-94", "title": "sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68770" }, { "rank": 21, "cve_id": "CVE-2026-58047", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.00519, "epss_percentile": 0.4193, "kev": false, "kev_due_at": null, "vendor": "WebPros", "product": "cPanel", "cwe": "CWE-444", "title": "HTTP Smuggling in cPanel allows potential leak of credentials.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-58047" }, { "rank": 22, "cve_id": "CVE-2026-21662", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00504, "epss_percentile": 0.41036, "kev": false, "kev_due_at": null, "vendor": "Johnson Controls", "product": "FM Systems Employee", "cwe": "CWE-434", "title": "FMS Employee Allows Upload of Unrestricted Files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21662" }, { "rank": 23, "cve_id": "CVE-2026-63223", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00493, "epss_percentile": 0.40354, "kev": false, "kev_due_at": null, "vendor": "codeigniter4", "product": "CodeIgniter4", "cwe": "CWE-434", "title": "CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63223" }, { "rank": 24, "cve_id": "CVE-2026-63222", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0045, "epss_percentile": 0.37558, "kev": false, "kev_due_at": null, "vendor": "codeigniter4", "product": "CodeIgniter4", "cwe": "CWE-22", "title": "CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63222" }, { "rank": 25, "cve_id": "CVE-2026-18452", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00432, "epss_percentile": 0.36151, "kev": false, "kev_due_at": null, "vendor": "Rich Source", "product": "DMS+ (Non-Mobile)", "cwe": "CWE-798", "title": "Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18452" }, { "rank": 26, "cve_id": "CVE-2026-56673", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0043, "epss_percentile": 0.36044, "kev": false, "kev_due_at": null, "vendor": "Comfy-Org", "product": "ComfyUI", "cwe": "CWE-22", "title": "ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56673" }, { "rank": 27, "cve_id": "CVE-2026-53551", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00429, "epss_percentile": 0.35952, "kev": false, "kev_due_at": null, "vendor": "free5gc", "product": "free5gc", "cwe": "CWE-20", "title": "free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53551" }, { "rank": 28, "cve_id": "CVE-2026-17346", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00424, "epss_percentile": 0.35585, "kev": false, "kev_due_at": null, "vendor": "pgadmin.org", "product": "pgAdmin 4", "cwe": "CWE-89", "title": "pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17346" }, { "rank": 29, "cve_id": "CVE-2026-53503", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00417, "epss_percentile": 0.34996, "kev": false, "kev_due_at": null, "vendor": "thumbor", "product": "thumbor", "cwe": "CWE-20", "title": "Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53503" }, { "rank": 30, "cve_id": "CVE-2026-17566", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00408, "epss_percentile": 0.34198, "kev": false, "kev_due_at": null, "vendor": "pgadmin.org", "product": "pgAdmin 4", "cwe": "CWE-78", "title": "pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17566" }, { "rank": 31, "cve_id": "CVE-2026-53510", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00396, "epss_percentile": 0.32948, "kev": false, "kev_due_at": null, "vendor": "savonrb", "product": "savon", "cwe": "CWE-94", "title": "Savon::Model evaluates WSDL operation names as Ruby source", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53510" }, { "rank": 32, "cve_id": "CVE-2026-62959", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00384, "epss_percentile": 0.31692, "kev": false, "kev_due_at": null, "vendor": "coturn", "product": "coturn", "cwe": "CWE-125", "title": "Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62959" }, { "rank": 33, "cve_id": "CVE-2026-55100", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00382, "epss_percentile": 0.31527, "kev": false, "kev_due_at": null, "vendor": "kyndryl-open-source", "product": "hashi-vault-js", "cwe": "CWE-23", "title": "hashi-vault-js has a path traversal and query parameter injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55100" }, { "rank": 34, "cve_id": "CVE-2026-17351", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00381, "epss_percentile": 0.31432, "kev": false, "kev_due_at": null, "vendor": "pgadmin.org", "product": "pgAdmin 4", "cwe": "CWE-89", "title": "pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17351" }, { "rank": 35, "cve_id": "CVE-2026-63221", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00377, "epss_percentile": 0.30989, "kev": false, "kev_due_at": null, "vendor": "codeigniter4", "product": "CodeIgniter4", "cwe": "CWE-89", "title": "CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63221" }, { "rank": 36, "cve_id": "CVE-2026-17567", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00377, "epss_percentile": 0.3098, "kev": false, "kev_due_at": null, "vendor": "wpmanageninja", "product": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder", "cwe": "CWE-639", "title": "Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17567" }, { "rank": 37, "cve_id": "CVE-2026-53573", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00377, "epss_percentile": 0.30995, "kev": false, "kev_due_at": null, "vendor": "geonetwork", "product": "core-geonetwork", "cwe": "CWE-601", "title": "core-geonetwork has an Open Redirect Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53573" }, { "rank": 38, "cve_id": "CVE-2026-55495", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00376, "epss_percentile": 0.3094, "kev": false, "kev_due_at": null, "vendor": "cloudreve", "product": "cloudreve", "cwe": "CWE-22", "title": "Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55495" }, { "rank": 39, "cve_id": "CVE-2026-54909", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00371, "epss_percentile": 0.30388, "kev": false, "kev_due_at": null, "vendor": "pion", "product": "stun", "cwe": "CWE-20", "title": "Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54909" }, { "rank": 40, "cve_id": "CVE-2026-13392", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.0037, "epss_percentile": 0.30231, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "ElementsKit Elementor Addons", "cwe": "CWE-94", "title": "ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13392" }, { "rank": 41, "cve_id": "CVE-2026-55496", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00361, "epss_percentile": 0.29326, "kev": false, "kev_due_at": null, "vendor": "cloudreve", "product": "cloudreve", "cwe": "CWE-200", "title": "Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55496" }, { "rank": 42, "cve_id": "CVE-2026-64607", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00359, "epss_percentile": 0.29146, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache HttpComponents Client", "cwe": "CWE-772", "title": "Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64607" }, { "rank": 43, "cve_id": "CVE-2026-53502", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00357, "epss_percentile": 0.2892, "kev": false, "kev_due_at": null, "vendor": "thumbor", "product": "thumbor", "cwe": "CWE-22", "title": "Thumbor has path traversal via post-validation URL decoding bypass in file_loader", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53502" }, { "rank": 44, "cve_id": "CVE-2026-46594", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00348, "epss_percentile": 0.27963, "kev": false, "kev_due_at": null, "vendor": "PHP Jabbers", "product": "PHP Poll Script", "cwe": "CWE-79", "title": "Reflected XSS in PHP Poll Script", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46594" }, { "rank": 45, "cve_id": "CVE-2026-45376", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00341, "epss_percentile": 0.27284, "kev": false, "kev_due_at": null, "vendor": "decidim", "product": "decidim", "cwe": "CWE-89", "title": "Decidim: Admin user search allows SQL injection through similarity-based sorting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45376" }, { "rank": 46, "cve_id": "CVE-2026-53505", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00339, "epss_percentile": 0.26958, "kev": false, "kev_due_at": null, "vendor": "thumbor", "product": "thumbor", "cwe": "CWE-400", "title": "Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53505" }, { "rank": 47, "cve_id": "CVE-2026-55502", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00338, "epss_percentile": 0.26901, "kev": false, "kev_due_at": null, "vendor": "cloudreve", "product": "cloudreve", "cwe": "CWE-863", "title": "Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55502" }, { "rank": 48, "cve_id": "CVE-2025-69946", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00337, "epss_percentile": 0.26694, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69946" }, { "rank": 49, "cve_id": "CVE-2026-52856", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00335, "epss_percentile": 0.26483, "kev": false, "kev_due_at": null, "vendor": "pterodactyl", "product": "wings", "cwe": "CWE-129", "title": "Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52856" }, { "rank": 50, "cve_id": "CVE-2026-53504", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00335, "epss_percentile": 0.26484, "kev": false, "kev_due_at": null, "vendor": "thumbor", "product": "thumbor", "cwe": "CWE-400", "title": "Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53504" }, { "rank": 51, "cve_id": "CVE-2026-55499", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00331, "epss_percentile": 0.26103, "kev": false, "kev_due_at": null, "vendor": "cloudreve", "product": "cloudreve", "cwe": "CWE-863", "title": "Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55499" }, { "rank": 52, "cve_id": "CVE-2026-54725", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.0032, "epss_percentile": 0.24927, "kev": false, "kev_due_at": null, "vendor": "bank-vaults", "product": "vault-secrets-webhook", "cwe": "CWE-918", "title": "vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54725" }, { "rank": 53, "cve_id": "CVE-2026-65310", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00318, "epss_percentile": 0.24687, "kev": false, "kev_due_at": null, "vendor": "ANDRITZ", "product": "HIPASE-250", "cwe": "CWE-306", "title": "Missing authentication and permissive CORS policy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65310" }, { "rank": 54, "cve_id": "CVE-2026-14319", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00316, "epss_percentile": 0.24425, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "GiveWP", "cwe": "CWE-200", "title": "GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14319" }, { "rank": 55, "cve_id": "CVE-2026-17561", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00314, "epss_percentile": 0.24185, "kev": false, "kev_due_at": null, "vendor": "Innotim Software, Telecommunications and Consulting Trade Ltd. Co.", "product": "Logsign SIEM", "cwe": "CWE-94", "title": "Unauthenticated RCE in Innotim Software's Logsign SIEM", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17561" }, { "rank": 56, "cve_id": "CVE-2026-43830", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00314, "epss_percentile": 0.24186, "kev": false, "kev_due_at": null, "vendor": "tbc", "product": "tbc", "cwe": "CWE-77", "title": "tbc", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43830" }, { "rank": 57, "cve_id": "CVE-2026-53599", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00314, "epss_percentile": 0.24231, "kev": false, "kev_due_at": null, "vendor": "redaxo", "product": "core", "cwe": "CWE-434", "title": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53599" }, { "rank": 58, "cve_id": "CVE-2026-18141", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00309, "epss_percentile": 0.23609, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9", "cwe": "CWE-295", "title": "Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18141" }, { "rank": 59, "cve_id": "CVE-2025-69948", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00307, "epss_percentile": 0.2338, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-89", "title": "SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-69948" }, { "rank": 60, "cve_id": "CVE-2026-62323", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00306, "epss_percentile": 0.23304, "kev": false, "kev_due_at": null, "vendor": "cloudreve", "product": "cloudreve", "cwe": "CWE-863", "title": "Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62323" }, { "rank": 61, "cve_id": "CVE-2026-59232", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00305, "epss_percentile": 0.2316, "kev": false, "kev_due_at": null, "vendor": "Roskus", "product": "Prospero Flow CRM", "cwe": "CWE-79", "title": "Stored Cross-site Scripting in Prospero Flow CRM lead name field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59232" }, { "rank": 62, "cve_id": "CVE-2026-12720", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00304, "epss_percentile": 0.23147, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Kirki", "cwe": "CWE-502", "title": "Kirki < 6.0.13 - Unauthenticated PHP Object Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12720" }, { "rank": 63, "cve_id": "CVE-2026-65841", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.003, "epss_percentile": 0.22692, "kev": false, "kev_due_at": null, "vendor": "xdan", "product": "jodit", "cwe": "CWE-80", "title": "Jodit has cross-site scripting (XSS) via