{
  "day": "2026-08-01",
  "boundary": "UTC calendar day",
  "published_count": 147,
  "by_severity": {
    "CRITICAL": 17,
    "HIGH": 48,
    "MEDIUM": 74,
    "LOW": 8
  },
  "kev_count": 0,
  "exploit_reference_count": 7,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-67325",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.01483,
      "epss_percentile": 0.71904,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gitpython-developers",
      "product": "GitPython",
      "cwe": "CWE-78",
      "title": "GitPython before 3.1.51 Command Injection via option prefix abbreviation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67325"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-67323",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.01016,
      "epss_percentile": 0.60571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gitpython-developers",
      "product": "GitPython",
      "cwe": "CWE-77",
      "title": "GitPython before 3.1.51 Command Injection via unguarded Git options",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67323"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-15006",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00835,
      "epss_percentile": 0.54873,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bitpressadmin",
      "product": "Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation",
      "cwe": "CWE-22",
      "title": "Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15006"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-15601",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00767,
      "epss_percentile": 0.52699,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeum",
      "product": "Kirki – Freeform Page Builder, Website Builder & Customizer",
      "cwe": "CWE-22",
      "title": "Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15601"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-15244",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00723,
      "epss_percentile": 0.5117,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "HUSKY",
      "cwe": "CWE-22",
      "title": "HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15244"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-17605",
      "cvss_base": 6.6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0071,
      "epss_percentile": 0.50723,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stiofansisland",
      "product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
      "cwe": "CWE-98",
      "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17605"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-16144",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00688,
      "epss_percentile": 0.49919,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpchill",
      "product": "Kali Forms — Contact Form & Drag-and-Drop Builder",
      "cwe": "CWE-94",
      "title": "Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16144"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-18352",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00676,
      "epss_percentile": 0.49448,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gm_alex",
      "product": "User Access Manager",
      "cwe": "CWE-22",
      "title": "User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18352"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-13339",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00641,
      "epss_percentile": 0.47952,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cubewp1211",
      "product": "CubeWP Framework",
      "cwe": "CWE-22",
      "title": "CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13339"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-67340",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00523,
      "epss_percentile": 0.42182,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ArcadeData",
      "product": "arcadedb",
      "cwe": "CWE-94",
      "title": "ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67340"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-67309",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00492,
      "epss_percentile": 0.40262,
      "kev": false,
      "kev_due_at": null,
      "vendor": "traefik",
      "product": "traefik",
      "cwe": "CWE-22",
      "title": "Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67309"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-15964",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00489,
      "epss_percentile": 0.4012,
      "kev": false,
      "kev_due_at": null,
      "vendor": "britcoder",
      "product": "Single Sign On For TNG",
      "cwe": "CWE-620",
      "title": "Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15964"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-67305",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00489,
      "epss_percentile": 0.4015,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-122",
      "title": "FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67305"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-15932",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00483,
      "epss_percentile": 0.39695,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Support Genix",
      "cwe": "CWE-22",
      "title": "Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15932"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-3141",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00467,
      "epss_percentile": 0.38702,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpwax",
      "product": "FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More",
      "cwe": "CWE-862",
      "title": "FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3141"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-67308",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00451,
      "epss_percentile": 0.37631,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wazuh",
      "product": "wazuh",
      "cwe": "CWE-78",
      "title": "Wazuh GitHub Actions Shell Injection via Fork Pull Request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67308"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-67290",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00432,
      "epss_percentile": 0.36145,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67290"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-8457",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.004,
      "epss_percentile": 0.33417,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPWeb",
      "product": "WooCommerce - Social Login",
      "cwe": "CWE-289",
      "title": "WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8457"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2025-71404",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00399,
      "epss_percentile": 0.33225,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-79",
      "title": "better-auth before 1.1.16 Reflected XSS via error parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71404"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-67298",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00381,
      "epss_percentile": 0.3136,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-191",
      "title": "FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67298"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-67289",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0038,
      "epss_percentile": 0.3132,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-113",
      "title": "FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67289"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-67324",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00379,
      "epss_percentile": 0.31151,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gitpython-developers",
      "product": "GitPython",
      "cwe": "CWE-78",
      "title": "GitPython 3.1.50 Authentication Bypass via Joined Short Options",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67324"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-15450",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00376,
      "epss_percentile": 0.309,
      "kev": false,
      "kev_due_at": null,
      "vendor": "webaways",
      "product": "NEX-Forms – Ultimate Forms Plugin for WordPress",
      "cwe": "CWE-22",
      "title": "NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15450"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-67314",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00365,
      "epss_percentile": 0.29764,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-1321",
      "title": "axios before 1.18.0 Prototype Pollution via auth subfields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-67317",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00359,
      "epss_percentile": 0.2914,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-770",
      "title": "axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67317"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-67318",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00356,
      "epss_percentile": 0.28824,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-400",
      "title": "axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67318"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-67304",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00354,
      "epss_percentile": 0.28643,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-476",
      "title": "FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67304"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-67330",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00352,
      "epss_percentile": 0.28367,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "scim",
      "cwe": "CWE-20",
      "title": "better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67330"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-67288",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0035,
      "epss_percentile": 0.28222,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-476",
      "title": "FreeRDP before 3.29.0 Denial of Service via smartcard cache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67288"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-67296",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00343,
      "epss_percentile": 0.27469,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-20",
      "title": "FreeRDP before 3.29.0 Denial of Service via RDPEI PDU",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67296"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-67297",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00343,
      "epss_percentile": 0.2747,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-770",
      "title": "FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67297"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-67291",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.26957,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67291"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-67301",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00339,
      "epss_percentile": 0.26959,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67301"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-67312",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00338,
      "epss_percentile": 0.26873,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-400",
      "title": "axios 0.28.0 before 0.33.0 Denial of Service via formToJSON",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67312"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-67313",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00338,
      "epss_percentile": 0.26872,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-400",
      "title": "axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-15414",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00335,
      "epss_percentile": 0.26541,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpswings",
      "product": "Subscriptions for WooCommerce",
      "cwe": "CWE-269",
      "title": "Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15414"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-18059",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00331,
      "epss_percentile": 0.26155,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pixelyoursite",
      "product": "PixelYourSite – Your smart PIXEL (TAG) & API Manager",
      "cwe": "CWE-200",
      "title": "PixelYourSite <= 11.2.1 - Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18059"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-67299",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00329,
      "epss_percentile": 0.25934,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-416",
      "title": "FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67299"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-67300",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00329,
      "epss_percentile": 0.25934,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-416",
      "title": "FreeRDP before 3.29.0 Use-After-Free via async message proxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67300"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-11995",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00323,
      "epss_percentile": 0.25238,
      "kev": false,
      "kev_due_at": null,
      "vendor": "saadiqbal",
      "product": "Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder",
      "cwe": "CWE-862",
      "title": "Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11995"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-67341",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00319,
      "epss_percentile": 0.24781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ArcadeData",
      "product": "arcadedb",
      "cwe": "CWE-863",
      "title": "ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67341"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-67342",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00319,
      "epss_percentile": 0.2478,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ArcadeData",
      "product": "arcadedb",
      "cwe": "CWE-639",
      "title": "ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67342"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-67302",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00316,
      "epss_percentile": 0.24475,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-369",
      "title": "FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67302"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-17580",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00314,
      "epss_percentile": 0.24262,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wplakeorg",
      "product": "Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…",
      "cwe": "CWE-862",
      "title": "Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17580"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-16635",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00309,
      "epss_percentile": 0.23616,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pronamic",
      "product": "Pronamic Pay",
      "cwe": "CWE-269",
      "title": "Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16635"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-13458",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00307,
      "epss_percentile": 0.23374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edge22",
      "product": "GenerateBlocks",
      "cwe": "CWE-79",
      "title": "GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13458"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-67320",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00304,
      "epss_percentile": 0.23143,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-200",
      "title": "axios before 0.33.0 Prototype Pollution via Node HTTP adapter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-67343",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00298,
      "epss_percentile": 0.22496,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ArcadeData",
      "product": "arcadedb",
      "cwe": "CWE-200",
      "title": "ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67343"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-10782",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00295,
      "epss_percentile": 0.22179,
      "kev": false,
      "kev_due_at": null,
      "vendor": "inspirythemes",
      "product": "RealHomes Memberships",
      "cwe": "CWE-862",
      "title": "RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10782"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-67315",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00291,
      "epss_percentile": 0.21693,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-183",
      "title": "axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67315"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-67321",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00291,
      "epss_percentile": 0.21693,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-674",
      "title": "axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-66402",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0029,
      "epss_percentile": 0.21608,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-295",
      "title": "FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66402"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-55734",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00286,
      "epss_percentile": 0.21213,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ueberauth",
      "product": "guardian",
      "cwe": "CWE-770",
      "title": "guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55734"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-55735",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00282,
      "epss_percentile": 0.20754,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ueberauth",
      "product": "guardian",
      "cwe": "CWE-347",
      "title": "Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55735"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-6453",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00281,
      "epss_percentile": 0.20682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cubewp1211",
      "product": "CubeWP Framework",
      "cwe": "CWE-89",
      "title": "CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6453"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-67328",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00278,
      "epss_percentile": 0.2035,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "sso",
      "cwe": "CWE-79",
      "title": "@better-auth/sso before 1.6.21 Account Takeover via SSO",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67328"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-13157",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00278,
      "epss_percentile": 0.20273,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Theme Demo Import",
      "cwe": "CWE-434",
      "title": "Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13157"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-13158",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00278,
      "epss_percentile": 0.20273,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Everest Toolkit",
      "cwe": "CWE-434",
      "title": "Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13158"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-67306",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00277,
      "epss_percentile": 0.20202,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67306"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-67294",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00271,
      "epss_percentile": 0.19402,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-295",
      "title": "FreeRDP before 3.29.0 TLS Certificate EKU Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67294"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-54894",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00271,
      "epss_percentile": 0.19398,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ueberauth",
      "product": "guardian",
      "cwe": "CWE-770",
      "title": "Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54894"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-55733",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00271,
      "epss_percentile": 0.19398,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ueberauth",
      "product": "guardian",
      "cwe": "CWE-770",
      "title": "Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55733"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-67337",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00269,
      "epss_percentile": 0.19157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-288",
      "title": "better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67337"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-16087",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.19125,
      "kev": false,
      "kev_due_at": null,
      "vendor": "icegram",
      "product": "Icegram Engage – Popups, Optins, CTAs & Lead Generation",
      "cwe": "CWE-89",
      "title": "Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16087"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-67322",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00266,
      "epss_percentile": 0.18613,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gitpython-developers",
      "product": "GitPython",
      "cwe": "CWE-200",
      "title": "GitPython before 3.1.52 Environment Variable Exfiltration via clone_from",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67322"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-15403",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00266,
      "epss_percentile": 0.18899,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dotonpaper",
      "product": "Pinpoint Booking System – Version 2",
      "cwe": "CWE-89",
      "title": "Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15403"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-15951",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00266,
      "epss_percentile": 0.18901,
      "kev": false,
      "kev_due_at": null,
      "vendor": "icegram",
      "product": "Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs",
      "cwe": "CWE-89",
      "title": "Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15951"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-16614",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00266,
      "epss_percentile": 0.18901,
      "kev": false,
      "kev_due_at": null,
      "vendor": "westerndeal",
      "product": "GSheetConnector – CF7 Google Sheets Connector",
      "cwe": "CWE-89",
      "title": "GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16614"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-17555",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00266,
      "epss_percentile": 0.189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpvividplugins",
      "product": "WPvivid — Backup, Migration & Staging",
      "cwe": "CWE-89",
      "title": "WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17555"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-15018",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00265,
      "epss_percentile": 0.18568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "davejesch",
      "product": "Database Collation Fix",
      "cwe": "CWE-89",
      "title": "Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15018"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-67292",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00264,
      "epss_percentile": 0.18375,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-130",
      "title": "FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67292"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-13596",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00262,
      "epss_percentile": 0.182,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Participants Database",
      "cwe": "CWE-89",
      "title": "Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13596"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-67316",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00258,
      "epss_percentile": 0.17664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-1321",
      "title": "axios before 1.18.0 Prototype Pollution via bodyless methods",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67316"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-67319",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00258,
      "epss_percentile": 0.17664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axios",
      "product": "axios",
      "cwe": "CWE-1321",
      "title": "axios before 0.33.0 Prototype Pollution via nested option objects",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67319"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-67311",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00256,
      "epss_percentile": 0.17416,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Budibase",
      "product": "budibase",
      "cwe": "CWE-918",
      "title": "Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67311"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-14839",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00256,
      "epss_percentile": 0.17419,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Mapster WP Maps",
      "cwe": "CWE-200",
      "title": "Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14839"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-67354",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00252,
      "epss_percentile": 0.16901,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guzzle",
      "product": "guzzle",
      "cwe": "CWE-201",
      "title": "guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67354"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-67303",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00248,
      "epss_percentile": 0.16465,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-617",
      "title": "FreeRDP before 3.29.0 Denial of Service via serial DeviceControl",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67303"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-67353",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00247,
      "epss_percentile": 0.16272,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guzzle",
      "product": "guzzle",
      "cwe": "CWE-770",
      "title": "guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67353"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-67295",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00245,
      "epss_percentile": 0.15961,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-22",
      "title": "FreeRDP before 3.29.0 Path Traversal via drive redirection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67295"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-15052",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.15524,
      "kev": false,
      "kev_due_at": null,
      "vendor": "umarbajwa",
      "product": "MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder",
      "cwe": "CWE-79",
      "title": "MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15052"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-16685",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00241,
      "epss_percentile": 0.15539,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codename065",
      "product": "Download Manager",
      "cwe": "CWE-79",
      "title": "Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16685"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-67331",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0024,
      "epss_percentile": 0.15322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "scim",
      "cwe": "CWE-639",
      "title": "better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67331"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2025-71403",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00238,
      "epss_percentile": 0.15132,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-601",
      "title": "better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71403"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-15662",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00235,
      "epss_percentile": 0.14669,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mihail-barinov",
      "product": "Advanced Woo Labels – Product Labels & Badges for WooCommerce",
      "cwe": "CWE-79",
      "title": "Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15662"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-67339",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00233,
      "epss_percentile": 0.14398,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guzzle",
      "product": "guzzle",
      "cwe": "CWE-200",
      "title": "guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67339"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2025-14073",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00232,
      "epss_percentile": 0.14331,
      "kev": false,
      "kev_due_at": null,
      "vendor": "woocommerce",
      "product": "WooCommerce PayPal Payments",
      "cwe": "CWE-639",
      "title": "WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14073"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-67327",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00231,
      "epss_percentile": 0.14147,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-287",
      "title": "better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67327"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-67355",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00229,
      "epss_percentile": 0.13959,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guzzle",
      "product": "guzzle",
      "cwe": "CWE-201",
      "title": "guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67355"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-14309",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00226,
      "epss_percentile": 0.13604,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Chat On Desk Order Notifications",
      "cwe": "CWE-287",
      "title": "Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14309"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-14836",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00226,
      "epss_percentile": 0.13603,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Login & Register Forms",
      "cwe": "CWE-287",
      "title": "Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14836"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-15368",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00226,
      "epss_percentile": 0.13605,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "User Profile Builder",
      "cwe": "CWE-269",
      "title": "Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15368"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-14596",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00223,
      "epss_percentile": 0.13189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "DynamicKit for Elementor",
      "cwe": "CWE-287",
      "title": "DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14596"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-12966",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00221,
      "epss_percentile": 0.12923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Direct Payments for WooCommerce",
      "cwe": "CWE-284",
      "title": "Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12966"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-15988",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00217,
      "epss_percentile": 0.12403,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tigroumeow",
      "product": "AI Engine – The Chatbot, AI Framework & MCP for WordPress",
      "cwe": "CWE-352",
      "title": "AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15988"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-2916",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00217,
      "epss_percentile": 0.1248,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jegtheme",
      "product": "Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress",
      "cwe": "CWE-200",
      "title": "Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2916"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-18344",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00216,
      "epss_percentile": 0.12267,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nik00726",
      "product": "Responsive Thumbnail Slider",
      "cwe": "CWE-79",
      "title": "Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18344"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-67352",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00214,
      "epss_percentile": 0.12112,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openwrt",
      "product": "luci",
      "cwe": "CWE-79",
      "title": "luci-app-https-dns-proxy Stored XSS via resolver_url",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67352"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-17571",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.11643,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpmanageninja",
      "product": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
      "cwe": "CWE-79",
      "title": "Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17571"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-14840",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0021,
      "epss_percentile": 0.11452,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "YOP Poll",
      "cwe": "CWE-290",
      "title": "YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14840"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-7623",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.10946,
      "kev": false,
      "kev_due_at": null,
      "vendor": "brainstormforce",
      "product": "SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz",
      "cwe": "CWE-79",
      "title": "SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7623"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-15644",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.10944,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codesupplyco",
      "product": "Powerkit – Supercharge your WordPress Site",
      "cwe": "CWE-79",
      "title": "Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15644"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-15645",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.10945,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codesupplyco",
      "product": "Powerkit – Supercharge your WordPress Site",
      "cwe": "CWE-79",
      "title": "Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15645"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-18062",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.10945,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stellarwp",
      "product": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
      "cwe": "CWE-79",
      "title": "Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18062"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2025-71402",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00206,
      "epss_percentile": 0.11048,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-347",
      "title": "better-auth before 1.4.0 Session Revocation via Forged Cookie",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71402"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-13362",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00203,
      "epss_percentile": 0.10589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sendpulse",
      "product": "SendPulse Email Marketing Newsletter",
      "cwe": "CWE-79",
      "title": "SendPulse Email Marketing Newsletter <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via _sp_form_code Post Meta",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13362"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-15649",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.10336,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codesupplyco",
      "product": "Powerkit – Supercharge your WordPress Site",
      "cwe": "CWE-79",
      "title": "Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15649"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-16091",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.10335,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rubengc",
      "product": "GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress",
      "cwe": "CWE-79",
      "title": "GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16091"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-67334",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00199,
      "epss_percentile": 0.1009,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-459",
      "title": "better-auth Stale Sessions Persist After User Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67334"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-67329",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00196,
      "epss_percentile": 0.09651,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "stripe",
      "cwe": "CWE-639",
      "title": "@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67329"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-15950",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.09366,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cozythemes",
      "product": "Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates",
      "cwe": "CWE-79",
      "title": "Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15950"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-16090",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.09367,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rubengc",
      "product": "GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress",
      "cwe": "CWE-79",
      "title": "GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16090"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-16684",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.09364,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mervb1",
      "product": "Easy Property Listings",
      "cwe": "CWE-79",
      "title": "Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16684"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-18435",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.09368,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stellarwp",
      "product": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
      "cwe": "CWE-79",
      "title": "Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18435"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-11882",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00192,
      "epss_percentile": 0.0923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Builderall for WordPress",
      "cwe": "CWE-284",
      "title": "Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11882"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-67326",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00191,
      "epss_percentile": 0.09171,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gitpython-developers",
      "product": "GitPython",
      "cwe": "CWE-20",
      "title": "GitPython before 3.1.50 Newline Injection via config_writer section",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67326"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-14822",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00182,
      "epss_percentile": 0.08063,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Event Tickets and Registration",
      "cwe": "CWE-284",
      "title": "Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14822"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-67310",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00182,
      "epss_percentile": 0.08097,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openremote",
      "product": "openremote",
      "cwe": "CWE-863",
      "title": "openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67310"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-10773",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00181,
      "epss_percentile": 0.08001,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-125",
      "title": "Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10773"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-14195",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00179,
      "epss_percentile": 0.07746,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Brizy",
      "cwe": "CWE-639",
      "title": "Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14195"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-13604",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00176,
      "epss_percentile": 0.07431,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Pixelavo",
      "cwe": "CWE-918",
      "title": "Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13604"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-67338",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00175,
      "epss_percentile": 0.07251,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jupyterlab",
      "product": "jupyterlab",
      "cwe": "CWE-84",
      "title": "JupyterLab before 4.5.9 Stored XSS via Extension Manager",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67338"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-13329",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00174,
      "epss_percentile": 0.07232,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Buckaroo Woocommerce Payments Plugin",
      "cwe": "CWE-284",
      "title": "WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13329"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2025-15669",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00173,
      "epss_percentile": 0.07089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Bit Form",
      "cwe": "CWE-79",
      "title": "Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15669"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-67335",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00172,
      "epss_percentile": 0.0696,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-287",
      "title": "better-auth before 1.6.2 OAuth State Validation Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67335"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-67307",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00169,
      "epss_percentile": 0.06661,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wazuh",
      "product": "wazuh",
      "cwe": "CWE-345",
      "title": "Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67307"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-14214",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00168,
      "epss_percentile": 0.066,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Booking for Appointments and Events Calendar",
      "cwe": "CWE-287",
      "title": "Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14214"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-67293",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00166,
      "epss_percentile": 0.06281,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-295",
      "title": "FreeRDP before 3.29.0 Improper Certificate Hostname Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67293"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-13725",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.06056,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Dynamic Pricing With Discount Rules for WooCommerce",
      "cwe": "CWE-79",
      "title": "Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13725"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-14315",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00164,
      "epss_percentile": 0.0615,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Pixel Tag Manager for WooCommerce",
      "cwe": "CWE-284",
      "title": "Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14315"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-14561",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00164,
      "epss_percentile": 0.06151,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Authora : Easy login with mobile number",
      "cwe": "CWE-287",
      "title": "Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14561"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-67332",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.05944,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "oauth-provider",
      "cwe": "CWE-285",
      "title": "@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67332"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-18536",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00161,
      "epss_percentile": 0.05755,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RRWO",
      "product": "Data::Entropy",
      "cwe": "CWE-319",
      "title": "Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18536"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-67336",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00159,
      "epss_percentile": 0.05553,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-327",
      "title": "better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67336"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-14292",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00159,
      "epss_percentile": 0.05625,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Download Manager",
      "cwe": "CWE-79",
      "title": "WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14292"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-67333",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00158,
      "epss_percentile": 0.05446,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-79",
      "title": "better-auth before 1.6.13 Stored XSS via javascript redirect_uri",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67333"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-14197",
      "cvss_base": 3.8,
      "cvss_severity": "LOW",
      "epss_score": 0.00152,
      "epss_percentile": 0.0494,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Fluent Support",
      "cwe": "CWE-639",
      "title": "Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14197"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-66401",
      "cvss_base": 2.4,
      "cvss_severity": "LOW",
      "epss_score": 0.00151,
      "epss_percentile": 0.04827,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66401"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-14823",
      "cvss_base": 2.2,
      "cvss_severity": "LOW",
      "epss_score": 0.00147,
      "epss_percentile": 0.04475,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Event Tickets and Registration",
      "cwe": "CWE-639",
      "title": "Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14823"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-67344",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00144,
      "epss_percentile": 0.04219,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ArcadeData",
      "product": "arcadedb",
      "cwe": "CWE-862",
      "title": "ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67344"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-12696",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00133,
      "epss_percentile": 0.03279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "wpForo Forum",
      "cwe": "CWE-79",
      "title": "wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12696"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-15234",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00133,
      "epss_percentile": 0.03278,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Codeless Page Builder",
      "cwe": "CWE-79",
      "title": "Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15234"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-15262",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00133,
      "epss_percentile": 0.03278,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Admin Columns for ACF Fields",
      "cwe": "CWE-79",
      "title": "Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15262"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2025-14469",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00128,
      "epss_percentile": 0.02896,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mndpsingh287",
      "product": "Theme Editor",
      "cwe": "CWE-352",
      "title": "Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14469"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-2411",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00122,
      "epss_percentile": 0.02379,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-863",
      "title": "Bluetooth GATT notify/indicate enforces the wrong attribute's permissions, bypassing encryption/authentication requirements on characteristic values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2411"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-10827",
      "cvss_base": 3.5,
      "cvss_severity": "LOW",
      "epss_score": 0.00106,
      "epss_percentile": 0.01265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Spectra Legacy",
      "cwe": "CWE-345",
      "title": "Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10827"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-13729",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00098,
      "epss_percentile": 0.00882,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Podlove Podcast Publisher",
      "cwe": "CWE-352",
      "title": "Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13729"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2024-21536",
      "detail": "EXPLOIT PUBLISHED — CVE-2024-21536 (http-proxy-middleware). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-10773",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-10773 (zephyrproject zephyr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-2411",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-2411 (zephyrproject zephyr). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-54894",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-54894 (ueberauth guardian). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55733",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55733 (ueberauth guardian). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55734",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55734 (ueberauth guardian). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55735",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55735 (ueberauth guardian). Public exploit reference added."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2024-10918",
      "detail": "RESCORED — CVE-2024-10918 (libmodbus). CVSS 4.8 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2024-21536",
      "detail": "RESCORED — CVE-2024-21536 (http-proxy-middleware). CVSS 8.7 → 7.7 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-15105",
      "detail": "RESCORED — CVE-2026-15105 (davenardella snap7). CVSS 5.3 → 2.1 (NVD)."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-18577",
      "detail": "PATCH SHIPPED — CVE-2026-18577 (N-able N-central). Fixed in N-central 2026.3.1.7."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}