Security Box Score — August 2, 2026

49 CVEs published, led by Red Hat (4).

49 CVEs published August 2, 2026: 4 critical, 21 high, 23 medium, 1 low; 0 in the KEV catalog at press time; 2 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 24 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	196	22360	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1079 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	0	2315	207	1231	637	1	11	2	0.1	7.8	.0016	-33 ▼
google	0	1761	214	713	781	53	77	6	0.3	7.5	.0025	-52 ▼
microsoft	0	1422	106	981	321	14	286	24	1.7	7.8	.0047	-7 ▼
red hat	4	390	16	155	194	25	2	0	0.0	6.5	.0030	-5 ▼
apple	0	271	57	78	133	3	88	7	2.6	6.5	.0027	0
canonical	0	27	3	8	11	5	0	0	0.0	5.6	.0014	0
suse	0	21	4	12	4	1	0	0	0.0	8.5	.0039	-2 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	38	8	18	12	0	56	12	31.6	7.5	.0057	-8 ▼
ubiquiti	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
palo alto networks	25	1	3	14	7	13	2	8.0	4.7	.0028	0
fortinet	23	6	6	11	0	28	6	26.1	7.2	.0040	0
netgear	23	0	0	22	1	0	0	0.0	4.6	.0024	0
vmware	17	4	9	2	2	7	1	5.9	8.3	.0040	0
f5	16	5	8	3	0	4	1	6.3	8.6	.0057	0
checkpoint	12	3	6	3	0	3	2	16.7	7.7	.0455	0

Open Source Ecosystems
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	336	65	143	116	11	33	1	0.3	7.5	.0053	-2 ▼
mozilla	127	51	42	34	0	9	0	0.0	8.1	.0031	-2 ▼
drupal	51	6	5	35	5	4	1	2.0	5.9	.0026	0
gitlab	51	0	7	37	7	4	2	3.9	4.9	.0029	0
github	12	1	3	8	0	0	0	0.0	6.0	.0042	-1 ▼
docker	7	0	5	2	0	0	0	0.0	8.2	.0016	0
wordpress	3	1	1	1	0	2	2	66.7	8.6	.7979	0
kubernetes	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	1379	343	653	322	61	27	3	0.2	8.1	.0036	0
adobe	252	27	116	105	4	19	3	1.2	7.8	.0026	0
ibm	229	67	86	76	0	6	0	0.0	7.5	.0032	0
progress	42	6	29	7	0	6	0	0.0	8.0	.0038	-2 ▼
solarwinds	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	6	2	3	1	0	1	0	0.0	8.5	.0035	0
zohocorp	6	2	2	2	0	0	0	0.0	7.8	.0146	0
atlassian	3	0	3	0	0	13	0	0.0	8.0	.0026	0

Industrial & Embedded
Vendor	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS
rockwell automation	24	4	18	2	0	0	8.7	.0029
synology	23	2	5	13	3	0	5.6	.0025
d-link	20	0	5	9	6	3	5.5	.0105
siemens	16	1	8	7	0	0	7.6	.0024
schneider electric	9	1	6	2	0	0	8.6	.0037
abb	7	0	4	3	0	0	7.2	.0018
hikvision	6	0	4	2	0	0	7.2	.0040
moxa	5	0	3	2	0	0	7.0	.0029

Other
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	120	0	0	62	58	0	0	0.0	5.5	.0034	0
openclaw	111	0	58	39	14	0	0	0.0	7.0	.0026	0
dell	99	5	47	44	3	2	1	1.0	7.1	.0021	-1 ▼
capgo	83	2	42	38	1	0	0	0.0	7.1	.0037	0
nvidia	82	12	54	16	0	0	0	0.0	7.8	.0037	-17 ▼
spring	79	2	34	41	2	0	0	0.0	6.5	.0022	0
imagemagick	78	1	5	60	12	0	0	0.0	5.3	.0018	-8 ▼
itsourcecode	71	0	0	19	52	0	0	0.0	2.1	.0033	0

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-59310	.4588	98.7	9.8
CVE-2026-48282	.4239	98.6	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-48282	10.0	.4239	KEV
CVE-2026-56290	10.0	.3038	KEV
CVE-2026-48939	10.0	.1973	KEV
CVE-2026-48908	10.0	.1482	KEV
CVE-2026-56291	10.0	.1459	KEV
CVE-2026-59726	10.0	.0688
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-47668	10.0	.0388

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	802
microsoft	615
google	444
apache	176
apple	167
red hat	153
adobe	108
ibm	105
mozilla	69

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	12
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	65
PyPI	6
Go	3
npm	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-20316	Cisco	0
CVE-2026-25089	Fortinet	0
CVE-2026-46817	Oracle Corporation	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1719
CVE-2021-27102	n/a	2021-11-17	1719
CVE-2021-27101	n/a	2021-11-17	1719
CVE-2021-27103	n/a	2021-11-17	1719
CVE-2021-21017	Adobe	2021-11-17	1719
CVE-2021-28550	Adobe	2021-11-17	1719
CVE-2021-42013	Apache Software Foundation	2021-11-17	1719
CVE-2021-41773	Apache Software Foundation	2021-11-17	1719
CVE-2021-30858	Apple	2021-11-17	1719
CVE-2021-30860	Apple	2021-11-17	1719

Transactions

EXPLOIT PUBLISHED — CVE-2025-15669 (Unknown Bit Form). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10774 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10848 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-12696 (Unknown wpForo Forum). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-12966 (Unknown Direct Payments for WooCommerce). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13329 (Unknown Buckaroo Woocommerce Payments Plugin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13596 (Unknown Participants Database). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14292 (Unknown Download Manager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14315 (Unknown Pixel Tag Manager for WooCommerce). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14561 (Unknown Authora : Easy login with mobile number). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14839 (Unknown Mapster WP Maps). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-15234 (Unknown Codeless Page Builder). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-15262 (Unknown Admin Columns for ACF Fields). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67206 (wolfcms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67207 (wolfcms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67288 (FreeRDP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67298 (FreeRDP). Public exploit reference added.

DUE DATE PASSED — CVE-2026-20316 (Cisco Secure Firewall Management Center (FMC)). CISA remediation deadline was August 1, 2026; still in catalog.

RESCORED — CVE-2026-6492 (arnobt78 Hotel Booking Management System). CVSS 6.9 → 5.5 (NVD).

Yesterday's Results

How to read these box scores · glossary

49 CVEs published. 25 box scores, 24 table rows — nothing truncated.

CVE-2026-65321CRITICAL

laughingman7743 PyAthena — PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0098   59.6     —

AFFECTED
  Product   Versions     Fixed
  PyAthena  unspecified  3.35.4

TIMELINE
  Jul 21  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-9335MEDIUM

keras-team keras-team/keras — Improper Handling of HDF5 ExternalLinks in keras-team/keras

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  N  N    6.5   .0065   48.2     —

AFFECTED
  Product           Versions       Fixed
  keras-team/keras  unspecified –  —

TIMELINE
  May 22  Reserved by CNA
  Aug 2   Published (CNA: @huntr_ai)

CWE-22 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Received

CVE-2026-16540HIGH

Unknown Simply Schedule Appointments — Simply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0042   34.7     —

AFFECTED
  Product                       Versions     Fixed
  Simply Schedule Appointments  unspecified  —

TIMELINE
  Jul 22  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-863 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-68581HIGH

go-vikunja vikunja — Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   N    8.6   .0034   26.4     —

AFFECTED
  Product  Versions  Fixed
  vikunja  0.22.0 –  —

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-16062MEDIUM

Unknown Event Booking Manager for WooCommerce — Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   H   N  U  H  H  H    6.6   .0034   26.6     —

AFFECTED
  Product                                Versions     Fixed
  Event Booking Manager for WooCommerce  unspecified  —

TIMELINE
  Jul 17  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-502 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-16261HIGH

Unknown login-social — Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0033   25.7     —

AFFECTED
  Product       Versions     Fixed
  login-social  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2025-71399HIGH

better-auth better-auth — Better Auth before 1.4.5 Path Normalization Bypass via rou3

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   H    8.8   .0031   22.6     —

AFFECTED
  Product      Versions     Fixed
  better-auth  unspecified  1.4.5

TIMELINE
  Jul 18  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-20 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-16256CRITICAL

Unknown POUCO Import Users — Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0030   22.3     —

AFFECTED
  Product             Versions     Fixed
  POUCO Import Users  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-269 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-9856HIGH

huggingface huggingface/transformers — Path Traversal in huggingface/transformers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  N  H  L    7.1   .0029   21.5     —

AFFECTED
  Product                   Versions       Fixed
  huggingface/transformers  unspecified –  —

TIMELINE
  May 28  Reserved by CNA
  Aug 2   Published (CNA: @huntr_ai)

CWE-22 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Received

CVE-2026-13389MEDIUM

Unknown webtoffee-cookie-consent — WebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  N    6.5   .0029   21.5     —

AFFECTED
  Product                   Versions     Fixed
  webtoffee-cookie-consent  unspecified  —

TIMELINE
  Jun 26  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-14817MEDIUM

Unknown Element Pack Addons for Elementor — Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   R  U  H  H  H    6.8   .0028   20.1     —

AFFECTED
  Product                            Versions     Fixed
  Element Pack Addons for Elementor  unspecified  —

TIMELINE
  Jul 6   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15236HIGH

Unknown Gallery for Google Photos — Gallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token Disclosure

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0028   19.9     —

AFFECTED
  Product                    Versions     Fixed
  Gallery for Google Photos  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15248MEDIUM

Unknown Meta Box — Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  N  H  L    5.5   .0028   19.9     —

AFFECTED
  Product   Versions     Fixed
  Meta Box  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-10774MEDIUM

zephyrproject zephyr — PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   N  U  N  N  H    6.5   .0027   19.1     —

AFFECTED
  Product  Versions  Fixed
  zephyr   3.6.0 –   —

TIMELINE
  Jun 3   Reserved by CNA
  Aug 2   Public exploit reference published
  Aug 2   Published (CNA: zephyr)

CWE-401 · CNA: zephyr · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-68579HIGH

FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0027   18.5     —

AFFECTED
  Product  Versions     Fixed
  FreeRDP  unspecified  3.30.0

TIMELINE
  Jul 31  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-787 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-14920HIGH

Unknown AcyMailing — AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  L  N    8.2   .0027   18.3     —

AFFECTED
  Product     Versions     Fixed
  AcyMailing  unspecified  —

TIMELINE
  Jul 7   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-89 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15206HIGH

Unknown SMS Alert — SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   17.6     —

AFFECTED
  Product    Versions     Fixed
  SMS Alert  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15241HIGH

Unknown AI ChatBot for WooCommerce — ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   17.6     —

AFFECTED
  Product                     Versions     Fixed
  AI ChatBot for WooCommerce  unspecified  —

TIMELINE
  Jul 9   Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-284 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-16285HIGH

Unknown Product Attachment for WooCommerce — WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0026   17.6     —

AFFECTED
  Product                             Versions     Fixed
  Product Attachment for WooCommerce  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Aug 2   Published (CNA: WPScan)

CWE-862 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2025-71401CRITICAL

better-auth before 1.4.2 basePath Modification DoS

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0026   17.3     —

AFFECTED
  Product      Versions     Fixed
  better-auth  unspecified  1.4.2

TIMELINE
  Jul 18  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-770 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-10848HIGH

zephyrproject zephyr — Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  H    8.6   .0026   16.7     —

AFFECTED
  Product  Versions  Fixed
  zephyr   4.3.0 –   —

TIMELINE
  Jun 4   Reserved by CNA
  Aug 2   Public exploit reference published
  Aug 2   Published (CNA: zephyr)

CWE-125, CWE-787 · CNA: zephyr · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-67357HIGH

ArcadeData arcadedb — ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   L   N   H   H   H    7.7   .0025   16.1     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.7.3

TIMELINE
  Jul 29  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-200 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-12231MEDIUM

timstrifler Exclusive Addons for Elementor — Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0025   15.9     —

AFFECTED
  Product                         Versions     Fixed
  Exclusive Addons for Elementor  unspecified  —

TIMELINE
  Jun 14  Reserved by CNA
  Aug 2   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-67356HIGH

ArcadeData arcadedb — ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0025   15.6     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.7.3

TIMELINE
  Jul 29  Reserved by CNA
  Aug 2   Published (CNA: VulnCheck)

CWE-269 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-18571HIGH

Red Hat Red Hat Build of Keycloak — Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0024   15.4     —

AFFECTED
  Product                                                       Versions     Fixed
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Build of Keycloak                                     unspecified  —
  Red Hat Data Grid 8                                           unspecified  —
  Red Hat JBoss Enterprise Application Platform Expansion Pack  unspecified  —
  Red Hat Single Sign-On 7                                      unspecified  —

TIMELINE
  Aug 2   Reserved by CNA
  Aug 2   Published (CNA: redhat)

CWE-862 · CNA: redhat · CVSS v3.1 · 2 references · NVD status: Analyzed

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-3245	7.7	14.9	Canon Production Printing	PRISMAproduction	CWE-502	A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier th…
CVE-2026-68580	7.7	14.5	FreeRDP	FreeRDP	CWE-122	FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
CVE-2026-15151	7.5	13.9	Unknown	Five Star Restaurant Reservations	CWE-284	Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authori…
CVE-2026-18573	6.5	12.4	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: client access-type policy condition byp…
CVE-2026-68578	7.7	11.6	ArcadeData	arcadedb	CWE-306	ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport
CVE-2026-68582	9.3	11.2	go-vikunja	vikunja	CWE-639	Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
CVE-2025-71400	7.1	10.0	better-auth	passkey	CWE-639	better-auth passkey before 1.4.0 IDOR via delete-passkey
CVE-2026-16042	4.3	9.1	Unknown	LWS Optimize	CWE-862	LWS Optimize < 3.4 - Subscriber+ Cache Deletion
CVE-2026-18572	6.5	7.8	Red Hat	Red Hat Build of Keycloak	CWE-863	Keycloak-services: keycloak-services: uma claim token can override authorizat…
CVE-2026-11872	4.3	7.5	Unknown	Clever Mega Menu for Visual Composer	CWE-284	Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Up…
CVE-2026-15939	2.7	7.4	Unknown	Simple Restrict	CWE-863	Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST…
CVE-2026-14841	6.1	7.1	Unknown	King Addons for Elementor	CWE-79	King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget
CVE-2025-15675	4.8	6.3	Unknown	Charitable	CWE-79	Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text
CVE-2026-12586	8.1	5.9	Unknown	Lenxel WP	CWE-287	Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password…
CVE-2026-14938	4.3	5.5	Unknown	FluentBoards	CWE-639	FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR
CVE-2026-16291	4.3	4.6	Unknown	ProfileGrid	CWE-639	ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
CVE-2026-18570	5.4	3.7	Red Hat	Red Hat Build of Keycloak	CWE-862	Keycloak-services: keycloak-services: full-scope-disabled client policy valid…
CVE-2026-16064	5.4	3.4	Unknown	Event Booking Manager for WooCommerce	CWE-863	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post M…
CVE-2026-68583	5.1	3.4	openwrt	luci	CWE-79	luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
CVE-2026-14864	5.4	2.8	Unknown	JetEngine	CWE-79	JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode
CVE-2026-15385	5.4	2.8	Unknown	RT Mega Menu	CWE-79	RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS
CVE-2026-16063	5.4	2.8	Unknown	Event Booking Manager for WooCommerce	CWE-79	Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event …
CVE-2026-16273	4.6	2.8	Unknown	Narrative Publisher	CWE-79	Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_scr…
CVE-2026-16292	5.4	0.6	Unknown	Frontend File Manager Plugin	CWE-352	Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-02 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.