Security Box Score — Sunday, August 2, 2026

49 CVEs published August 2, 2026: 4 critical, 21 high, 23 medium, 1 low; 0 in the KEV catalog at press time; 2 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 24 in the results table.

League
	MTD	YTD	2025 same span	2025 full
CVEs published	196	22343	1391	2564
KEV catalog size	1671

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	0	2317	207	1231	635	1	27	3	0.1	7.8	.0014	-33 ▼
google	0	1760	214	709	781	53	74	6	0.3	7.5	.0023	-52 ▼
microsoft	0	1431	104	983	321	14	380	32	2.2	7.8	.0041	-7 ▼
red hat	4	360	16	146	178	20	4	0	0.0	6.5	.0025	-5 ▼
apple	0	266	56	73	127	3	94	7	2.6	6.5	.0024	0
canonical	0	27	3	8	11	5	0	0	0.0	5.6	.0011	0
suse	0	21	4	12	4	1	0	0	0.0	8.5	.0033	-2 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0015	0

Network & Infrastructure
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	40	6	16	10	0	96	13	32.5	7.5	.0050	-8 ▼
ubiquiti	36	14	21	1	0	4	3	8.3	8.8	.0036	-25 ▼
palo alto networks	25	0	2	14	7	14	2	8.0	4.7	.0021	0
fortinet	23	3	6	11	0	28	6	26.1	6.7	.0039	0
netgear	23	0	0	22	1	8	0	0.0	4.6	.0022	0
f5	17	5	8	3	0	7	1	5.9	8.6	.0057	0
vmware	16	4	8	2	2	22	0	0.0	8.2	.0039	0
checkpoint	12	3	6	3	0	3	2	16.7	7.7	.0445	0

Open Source Ecosystems
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	334	65	143	114	11	40	1	0.3	7.5	.0048	-2 ▼
mozilla	127	51	42	34	0	13	0	0.0	8.1	.0029	-2 ▼
gitlab	53	0	7	37	7	4	2	3.8	4.9	.0025	0
drupal	51	6	5	35	5	5	1	2.0	5.9	.0018	0
github	12	1	3	8	0	0	0	0.0	6.0	.0027	-1 ▼
docker	7	0	5	2	0	1	0	0.0	8.2	.0016	0
wordpress	3	1	1	1	0	5	2	66.7	8.6	.7310	0
kubernetes	1	0	0	0	1	0	0	0.0	2.4	.0024	0

Enterprise Applications
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1379	342	653	322	61	40	3	0.2	8.1	.0032	0
adobe	254	27	115	105	4	75	4	1.6	7.8	.0021	0
ibm	229	67	86	76	0	7	0	0.0	7.5	.0026	0
progress	42	6	29	7	0	9	0	0.0	8.0	.0033	-2 ▼
solarwinds	23	16	2	3	0	11	4	17.4	9.1	.0044	0
veeam	6	2	3	1	0	4	0	0.0	8.5	.0030	0
zohocorp	6	2	2	2	0	0	0	0.0	7.8	.0109	0
atlassian	3	0	3	0	0	13	0	0.0	8.0	.0026	0

Industrial & Embedded
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS
rockwell automation	24	4	18	2	0	0	0	0.0	8.7	.0025
synology	23	2	5	13	3	0	0	0.0	5.6	.0025
d-link	21	0	5	9	6	26	1	4.8	5.5	.0069
siemens	16	1	8	7	0	1	0	0.0	7.6	.0019
schneider electric	9	1	6	2	0	1	0	0.0	8.6	.0024
abb	7	0	4	3	0	0	0	0.0	7.2	.0018
hikvision	7	0	4	2	0	2	1	14.3	7.2	.0025
moxa	5	0	3	2	0	0	0	0.0	7.0	.0029

Other
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	120	0	0	62	58	0	0	0.0	5.5	.0026	0
openclaw	111	0	58	39	14	0	0	0.0	7.0	.0022	0
dell	99	4	47	44	3	2	1	1.0	7.0	.0020	-1 ▼
capgo	83	2	42	38	1	0	0	0.0	7.1	.0028	0
nvidia	82	12	54	16	0	0	0	0.0	7.8	.0019	-17 ▼
spring	79	2	34	41	2	0	0	0.0	6.5	.0022	0
imagemagick	78	1	5	60	12	3	0	0.0	5.3	.0017	-8 ▼
itsourcecode	71	0	0	19	52	0	0	0.0	2.1	.0020	0

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-48282	.9924	99.9	10.0
CVE-2026-63030	.9560	99.9	9.8
CVE-2026-39808	.9121	99.8	—
CVE-2026-48908	.8813	99.8	10.0
CVE-2026-56290	.8325	99.7	10.0
CVE-2026-48939	.8250	99.6	10.0
CVE-2026-50522	.7698	99.5	9.8
CVE-2026-15410	.7635	99.5	7.2
CVE-2026-56291	.7607	99.5	10.0
CVE-2026-15409	.7422	99.4	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-48282	10.0	.9924	KEV
CVE-2026-48908	10.0	.8813	KEV
CVE-2026-56290	10.0	.8325	KEV
CVE-2026-48939	10.0	.8250	KEV
CVE-2026-56291	10.0	.7607	KEV
CVE-2026-15409	10.0	.7422	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0473
CVE-2026-47668	10.0	.0434
CVE-2026-46339	10.0	.0239

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	802
microsoft	615
google	444
apache	176
apple	167
red hat	153
adobe	108
ibm	105
mozilla	69

Most KEV additions (YTD)
Vendor	KEV
microsoft	32
cisco	13
apple	7
fortinet	6
google	6
ivanti	5
adobe	4
solarwinds	4
synacor	4
langflow	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	65
PyPI	6
Go	3
npm	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2008-4128	Cisco	0
CVE-2021-27137	DD-WRT	0
CVE-2023-4346	KNX Association	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-20316	Cisco	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	Accellion	2021-11-17	1719
CVE-2021-27102	Accellion	2021-11-17	1719
CVE-2021-27101	Accellion	2021-11-17	1719
CVE-2021-27103	Accellion	2021-11-17	1719
CVE-2021-21017	Adobe	2021-11-17	1719
CVE-2021-28550	Adobe	2021-11-17	1719
CVE-2021-42013	Apache	2021-11-17	1719
CVE-2021-41773	Apache	2021-11-17	1719
CVE-2021-30858	Apple	2021-11-17	1719
CVE-2021-30860	Apple	2021-11-17	1719

Yesterday's Results

How to read these box scores · glossary

49 CVEs published. 25 box scores, 24 table rows — nothing truncated.

CVE-2026-9335MEDIUM

keras-team keras-team/keras — Improper Handling of HDF5 ExternalLinks in keras-team/keras

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  N  N    6.5   .0065   48.2     —

AFFECTED
  Product           Versions       Fixed
  keras-team/keras  unspecified –  —

TIMELINE
  May 22  Reserved by CNA
  Aug 2   Published (CNA: @huntr_ai)

CWE-22 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Received

CVE-2026-65321CRITICAL

laughingman7743 PyAthena — PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0046   37.9     —

AFFECTED
  Product   Versions     Fixed
  PyAthena  unspecified  3.35.4

TIMELINE
  Jul 21  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-16540HIGH

Unknown Simply Schedule Appointments — Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0036   29.1     —

AFFECTED
  Product                       Versions     Fixed
  Simply Schedule Appointments  unspecified  —

TIMELINE
  Jul 22  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-863 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-16062MEDIUM

Unknown Event Booking Manager for WooCommerce — Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  H  H    6.6   .0035   28.3     —

AFFECTED
  Product                                Versions     Fixed
  Event Booking Manager for WooCommerce  unspecified  —

TIMELINE
  Jul 17  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-502 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-16261HIGH

Unknown login-social — Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0033   26.3     —

AFFECTED
  Product       Versions     Fixed
  login-social  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-68581HIGH

go-vikunja vikunja — Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   N    8.6   .0032   25.0     —

AFFECTED
  Product  Versions  Fixed
  vikunja  0.22.0 –  —

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2025-71399HIGH

better-auth better-auth — Better Auth before 1.4.5 Path Normalization Bypass via rou3

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   H    8.8   .0031   23.3     —

AFFECTED
  Product      Versions     Fixed
  better-auth  unspecified  1.4.5

TIMELINE
  Jul 18  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-20 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-16256CRITICAL

Unknown POUCO Import Users — Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0030   23.0     —

AFFECTED
  Product             Versions     Fixed
  POUCO Import Users  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-269 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-9856HIGH

huggingface huggingface/transformers — Path Traversal in huggingface/transformers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  H  L    7.1   .0029   22.1     —

AFFECTED
  Product                   Versions       Fixed
  huggingface/transformers  unspecified –  —

TIMELINE
  May 28  Reserved by CNA
  Aug 2   Published (CNA: @huntr_ai)

CWE-22 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Received

CVE-2026-13389MEDIUM

Unknown webtoffee-cookie-consent — WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  N    6.5   .0029   22.1     —

AFFECTED
  Product                   Versions     Fixed
  webtoffee-cookie-consent  unspecified  —

TIMELINE
  Jun 26  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-14817MEDIUM

Unknown Element Pack Addons for Elementor — Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  U  H  H  H    6.8   .0029   21.6     —

AFFECTED
  Product                            Versions     Fixed
  Element Pack Addons for Elementor  unspecified  —

TIMELINE
  Jul 6   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15236HIGH

Unknown Gallery for Google Photos — Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0028   20.5     —

AFFECTED
  Product                    Versions     Fixed
  Gallery for Google Photos  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15248MEDIUM

Unknown Meta Box — Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  L    5.5   .0028   20.6     —

AFFECTED
  Product   Versions     Fixed
  Meta Box  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-14920HIGH

Unknown AcyMailing — AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  L  N    8.2   .0027   19.9     —

AFFECTED
  Product     Versions     Fixed
  AcyMailing  unspecified  —

TIMELINE
  Jul 7   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-89 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-68579HIGH

FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0027   19.1     —

AFFECTED
  Product  Versions     Fixed
  FreeRDP  unspecified  3.30.0

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-787 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-15206HIGH

Unknown SMS Alert — SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   18.1     —

AFFECTED
  Product    Versions     Fixed
  SMS Alert  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15241HIGH

Unknown AI ChatBot for WooCommerce — ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   18.1     —

AFFECTED
  Product                     Versions     Fixed
  AI ChatBot for WooCommerce  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-284 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-16285HIGH

Unknown Product Attachment for WooCommerce — WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   18.1     —

AFFECTED
  Product                             Versions     Fixed
  Product Attachment for WooCommerce  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2025-71401CRITICAL

better-auth before 1.4.2 basePath Modification DoS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0026   17.9     —

AFFECTED
  Product      Versions     Fixed
  better-auth  unspecified  1.4.2

TIMELINE
  Jul 18  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-770 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-12231MEDIUM

timstrifler Exclusive Addons for Elementor — Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0026   17.4     —

AFFECTED
  Product                         Versions     Fixed
  Exclusive Addons for Elementor  unspecified  —

TIMELINE
  Jun 14  Reserved by CNA
  Aug 2   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-67357HIGH

ArcadeData arcadedb — ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   L   N   H   H   H    7.7   .0025   16.7     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.7.3

TIMELINE
  Jul 29  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-67356HIGH

ArcadeData arcadedb — ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0025   16.1     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.7.3

TIMELINE
  Jul 29  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-269 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-18571HIGH

Red Hat Red Hat Build of Keycloak — Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0024   16.0     —

AFFECTED
  Product                                                       Versions     Fixed
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Data Grid 8                                           unspecified  —
  Red Hat JBoss Enterprise Application Platform Expansion Pack  unspecified  —
  Red Hat Single Sign-On 7                                      unspecified  —

TIMELINE
  Aug 2   Reserved by CNA
  Aug 2   Published (CNA: redhat)

CWE-862 · CNA: redhat · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-3245HIGH

Canon Production Printing PRISMAproduction — A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code …

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   H   N   N   N   H   H   H    7.7   .0024   15.5     —

AFFECTED
  Product           Versions          Fixed
  PRISMAproduction  6.5 or earlier –  —

TIMELINE
  Feb 26  Reserved by CNA
  Aug 2   Published (CNA: Canon)

CWE-502 · CNA: Canon · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-68580HIGH

FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   P   H   H   H    7.7   .0024   15.1     —

AFFECTED
  Product  Versions     Fixed
  FreeRDP  unspecified  3.29.0

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-122 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-15151	7.5	14.3	Unknown	Five Star Restaurant Reservations	CWE-284	Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authori…
CVE-2026-18573	6.5	12.9	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: client access-type policy condition byp…
CVE-2026-10848	8.6	12.2	zephyrproject	zephyr	CWE-125	Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)
CVE-2026-68578	7.7	12.0	ArcadeData	arcadedb	CWE-306	ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
CVE-2026-68582	9.3	11.6	go-vikunja	vikunja	CWE-639	Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
CVE-2025-71400	7.1	10.5	better-auth	passkey	CWE-639	better-auth passkey before 1.4.0 IDOR via delete-passkey
CVE-2026-16042	4.3	9.5	Unknown	LWS Optimize	CWE-862	LWS Optimize < 3.4 - Subscriber+ Cache Deletion
CVE-2026-11872	4.3	8.4	Unknown	Clever Mega Menu for Visual Composer	CWE-284	Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Up…
CVE-2026-18572	6.5	8.1	Red Hat	Red Hat Build of Keycloak	CWE-863	Keycloak-services: keycloak-services: uma claim token can override authorizat…
CVE-2026-14841	6.1	8.0	Unknown	King Addons for Elementor	CWE-79	King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
CVE-2026-10774	6.5	7.7	zephyrproject	zephyr	CWE-401	PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhau…
CVE-2026-15939	2.7	7.7	Unknown	Simple Restrict	CWE-863	Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST…
CVE-2025-15675	4.8	7.1	Unknown	Charitable	CWE-79	Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text
CVE-2026-12586	8.1	6.2	Unknown	Lenxel WP	CWE-287	Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password…
CVE-2026-14938	4.3	5.9	Unknown	FluentBoards	CWE-639	FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
CVE-2026-16291	4.3	4.9	Unknown	ProfileGrid	CWE-639	ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
CVE-2026-18570	5.4	4.0	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: full-scope-disabled client policy valid…
CVE-2026-16064	5.4	3.6	Unknown	Event Booking Manager for WooCommerce	CWE-863	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post M…
CVE-2026-68583	5.1	3.7	openwrt	luci	CWE-79	luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
CVE-2026-14864	5.4	3.3	Unknown	JetEngine	CWE-79	JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
CVE-2026-15385	5.4	3.3	Unknown	RT Mega Menu	CWE-79	RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
CVE-2026-16063	5.4	3.3	Unknown	Event Booking Manager for WooCommerce	CWE-79	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event …
CVE-2026-16273	4.6	3.3	Unknown	Narrative Publisher	CWE-79	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_scr…
CVE-2026-16292	5.4	0.7	Unknown	Frontend File Manager Plugin	CWE-352	Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

Standings

Leaders (trailing 30 days unless noted)

Transactions

Yesterday's Results

Methodology