Security Box Score — August 8, 2026

62 CVEs published, led by D-Link Corporation (15).

62 CVEs published August 8, 2026: 27 critical, 8 high, 16 medium, 10 low; 0 in the KEV catalog at press time; 1 with a public exploit reference; 1 awaiting enrichment. 25 rendered as box scores below; the remaining 37 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1970	24134	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1307 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	46	2361	211	1254	637	1	11	2	0.1	7.8	.0016	+9 ▲
google	43	1804	222	743	783	56	77	6	0.3	7.5	.0025	-36 ▼
microsoft	33	1455	121	991	329	14	286	24	1.6	7.8	.0047	-19 ▼
red hat	42	428	20	166	212	30	2	0	0.0	6.5	.0029	+11 ▲
apple	1	272	58	78	133	3	88	7	2.6	6.8	.0027	+1 ▲
canonical	0	27	3	8	11	5	0	0	0.0	5.6	.0014	-1 ▼
suse	5	26	5	14	6	1	0	0	0.0	8.1	.0039	-1 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	30	68	13	36	19	0	56	12	17.6	7.5	.0046	+22 ▲
ubiquiti	0	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
palo alto networks	0	25	1	3	14	7	13	2	8.0	4.7	.0028	-1 ▼
fortinet	0	23	6	6	11	0	28	6	26.1	7.2	.0040	0
netgear	0	23	0	0	22	1	0	0	0.0	4.6	.0024	0
vmware	0	17	4	9	2	2	7	1	5.9	8.3	.0040	0
f5	0	16	5	8	3	0	4	1	6.3	8.6	.0057	0
checkpoint	1	13	4	6	3	0	3	2	15.4	7.8	.0436	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	61	397	77	176	131	12	33	2	0.5	7.5	.0050	+10 ▲
mozilla	1	128	51	42	35	0	9	0	0.0	8.1	.0031	-2 ▼
drupal	0	51	6	5	35	5	4	1	2.0	5.9	.0026	0
gitlab	0	51	0	7	37	7	4	2	3.9	4.9	.0029	-7 ▼
github	2	14	1	4	9	0	0	0	0.0	6.2	.0043	+1 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	0
wordpress	1	4	1	2	1	0	2	2	50.0	8.8	.5550	+1 ▲
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	1379	343	653	322	61	27	3	0.2	8.1	.0036	0
ibm	32	261	72	104	84	1	6	1	0.4	7.5	.0031	+30 ▲
adobe	8	260	33	117	106	4	19	3	1.2	7.8	.0026	+5 ▲
progress	11	53	14	32	7	0	6	1	1.9	8.1	.0037	+1 ▲
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	10	16	5	9	2	0	1	0	0.0	8.6	.0034	+10 ▲
zohocorp	0	6	2	2	2	0	0	0	0.0	7.8	.0146	0
atlassian	0	3	0	3	0	0	13	0	0.0	8.0	.0026	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	15	35	15	5	9	6	3	7.4	.0157	+15 ▲
synology	1	24	2	6	13	3	0	5.6	.0025	+1 ▲
rockwell automation	0	24	4	18	2	0	0	8.7	.0029	0
siemens	0	16	1	8	7	0	0	7.6	.0024	0
schneider electric	0	9	1	6	2	0	0	8.6	.0037	0
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0
moxa	0	5	0	3	2	0	0	7.0	.0029	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	11	131	0	0	70	61	0	0	0.0	5.5	.0033	-16 ▼
openclaw	0	111	0	58	39	14	0	0	0.0	7.0	.0026	-1 ▼
dell	8	107	9	50	45	3	2	1	0.9	7.2	.0021	-19 ▼
nvidia	16	98	13	66	19	0	0	0	0.0	7.7	.0034	-1 ▼
capgo	0	83	2	42	38	1	0	0	0.0	7.1	.0037	-7 ▼
spring	0	79	2	34	41	2	0	0	0.0	6.5	.0022	0
imagemagick	0	78	1	5	60	12	0	0	0.0	5.3	.0018	-10 ▼
itsourcecode	6	77	0	0	19	58	0	0	0.0	2.1	.0033	-4 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-34486	.9862	99.9	7.5
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-63077	.8473	99.7	9.8
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-48939	10.0	.1973	KEV
CVE-2026-56291	10.0	.1459	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-47668	10.0	.0388
CVE-2026-46339	10.0	.0335
CVE-2026-61447	10.0	.0249
CVE-2026-57827	10.0	.0233
CVE-2026-44359	10.0	.0180

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	844
microsoft	646
google	460
apache	190
red hat	173
apple	168
ibm	135
adobe	113
mozilla	69

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	12
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	66
PyPI	5
Go	3
npm	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-18556	N-able	0
CVE-2026-18577	N-able	0
CVE-2026-20316	Cisco	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1725
CVE-2021-27102	n/a	2021-11-17	1725
CVE-2021-27101	n/a	2021-11-17	1725
CVE-2021-27103	n/a	2021-11-17	1725
CVE-2021-21017	Adobe	2021-11-17	1725
CVE-2021-28550	Adobe	2021-11-17	1725
CVE-2021-42013	Apache Software Foundation	2021-11-17	1725
CVE-2021-41773	Apache Software Foundation	2021-11-17	1725
CVE-2021-30858	Apple	2021-11-17	1725
CVE-2021-30860	Apple	2021-11-17	1725

Transactions

EXPLOIT PUBLISHED — CVE-2026-19192 (DeepCool DisplayService). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19193 (Jiangmin Antivirus). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19195 (V-Secure Jingyun Antivirus). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19207 (PHPGurukul Company Visitor Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19212 (WonderTrader). Public exploit reference added.

DUE DATE PASSED — CVE-2026-18556 (N-able N-central). CISA remediation deadline was August 7, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-34486 (Apache Software Foundation Apache Tomcat). CISA remediation deadline was August 7, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-9198 (IBM Langflow OSS). CISA remediation deadline was August 7, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

62 CVEs published. 25 box scores, 37 table rows — nothing truncated.

CVE-2026-71944CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71945CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeFibocom

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71946CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71947CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71948CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71949CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71950CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formSmsManage

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71951CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.1     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71954CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.0     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71955CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formWsc

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0208   80.0     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71952CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formPinManageSetup

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0204   79.6     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71953CRITICAL

D-Link DWR-M961 Command Injection via /boafrm/formNtp

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0204   79.6     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71956CRITICAL

D-Link DWR-M961 Command Injection via app.cgi

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0169   75.4     —

AFFECTED
  Product   Versions     Fixed
  DWR-M961  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71983CRITICAL

MSI Radix AXE6600 v781521 Command Injection via wps.cgi

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0162   74.2     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-19266MEDIUM

Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   L   N   L   L   L    5.1   .0152   72.6     —

AFFECTED
  Product         Versions  Fixed
  context-engine  1.0 –     1.9.1

TIMELINE
  Aug 7   Reserved by CNA
  Aug 8   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-71984CRITICAL

MSI Radix AXE6600 v781521 Command Injection via urlfilter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.3     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71985CRITICAL

MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.4     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71986CRITICAL

MSI Radix AXE6600 v781521 Command Injection via dmz Function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.4     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71987CRITICAL

MSI Radix AXE6600 v781521 Command Injection via alg function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.4     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71988CRITICAL

MSI Radix AXE6600 v781521 Command Injection via portFw function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.3     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71989CRITICAL

MSI Radix AXE6600 v781521 Command Injection via porTrigger function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.3     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71990CRITICAL

MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.4     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71991CRITICAL

MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.4     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-71992CRITICAL

MSI Radix AXE6600 v781521 Command Injection via macfilter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.3     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 8   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-19263MEDIUM

INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0134   69.0     —

AFFECTED
  Product         Versions                                    Fixed
  mcp-bridge-api  b30a82aa1d1d1139e0de846c41c8aadee6e06114 –  —

TIMELINE
  Aug 7   Reserved by CNA
  Aug 8   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-19268	2.1	62.2	abdullah1854	MCPGateway	CWE-74	abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageB…
CVE-2026-14526	9.8	49.2	wupsales	AI Copilot – Content Generator	CWE-269	AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalatio…
CVE-2026-19279	1.9	47.2	MIMICLab	mcp-pdf-vision	CWE-74	MIMICLab mcp-pdf-vision index.ts load_pdf command injection
CVE-2026-19281	1.9	47.2	adolfosalasgomez3011	slidev-builder-mcp	CWE-74	adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts…
CVE-2026-19284	1.9	47.1	MauricioMilano	coder-api	CWE-74	MauricioMilano coder-api Projects Endpoint projects.ts createProject command …
CVE-2026-19282	1.9	46.7	andreahaku	llm_memory_mcp	CWE-74	andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection
CVE-2026-71957	9.3	45.8	D-Link Corporation	DWR-M961	CWE-120	D-Link DWR-M961 Buffer Overflow via app.cgi
CVE-2026-71958	9.3	44.2	D-Link Corporation	DWR-M961	CWE-120	D-Link DWR-M961 Buffer Overflow via quicksetup.cgi
CVE-2026-68082	9.8	32.7	Linux	Linux	—	libceph: fix two unsafe bare decodes in decode_lockers()
CVE-2026-8798	8.7	25.3	Legion of the Bouncy Castle Inc.	BC-FJA	CWE-835	Native entropy source retries the CPU entropy instructions without limit
CVE-2026-67620	6.3	24.4	FlowiseAI	Flowise	CWE-918	Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List
CVE-2026-16578	7.5	23.7	Unknown	Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection	CWE-200	Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app…
CVE-2026-16267	8.1	18.4	Unknown	Newsletters	CWE-502	Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
CVE-2026-18988	6.4	17.1	shapedplugin	Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ	CWE-79	Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-13505	8.7	16.5	Legion of the Bouncy Castle Inc.	BC-FJA	CWE-772	Zeroisation of sensitive key material on garbage collection relies on finaliz…
CVE-2026-16594	7.5	15.5	Unknown	WP Directory Kit	CWE-200	WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
CVE-2026-16559	6.8	13.4	Unknown	YMC Filter	CWE-79	YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload
CVE-2026-16269	4.8	13.1	Unknown	Newsletters	CWE-287	Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling
CVE-2026-16955	5.0	12.9	Unknown	AI Engine	CWE-22	AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription
CVE-2026-16562	6.5	12.2	Unknown	WP Statistics	CWE-200	WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox …
CVE-2026-16590	6.5	12.2	Unknown	WP Directory Kit	CWE-200	WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
CVE-2026-16595	6.5	12.2	Unknown	WP Directory Kit	CWE-200	WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure
CVE-2026-16948	8.1	11.1	Unknown	Solace Extra	CWE-284	Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wi…
CVE-2026-16589	7.7	10.9	Unknown	WP Directory Kit	CWE-89	WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Par…
CVE-2026-16608	5.3	9.6	Unknown	Download Monitor	CWE-862	Download Monitor < 5.2.6 - Unauthenticated Download Log Injection
CVE-2026-16953	4.8	8.2	Unknown	AI Engine	CWE-639	AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via F…
CVE-2026-16282	5.3	7.7	Unknown	Appointment Hour Booking	CWE-287	Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulatio…
CVE-2026-42170	7.8	6.6	Red Hat	Red Hat Enterprise Linux 6	CWE-131	Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_la…
CVE-2026-16535	6.1	5.6	Unknown	Link Library	CWE-79	Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel
CVE-2026-68081	await	4.9	Linux	Linux	—	KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
CVE-2026-16574	5.4	3.4	Unknown	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution	CWE-639	Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via O…
CVE-2026-19287	1.9	3.4	abrinsmead	mindpilot-mcp	CWE-22	abrinsmead mindpilot-mcp HistoryService path traversal
CVE-2026-19270	1.9	3.3	Hulupeep	mcp-ui-probe	CWE-22	Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal
CVE-2026-19285	1.9	3.3	aaronsb	memory-graph	CWE-22	aaronsb memory-graph memoryTools.ts JsonMemoryStorage.saveMemories path trave…
CVE-2026-19288	1.9	3.3	astralisone	rive-mcp-server-core	CWE-22	astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path t…
CVE-2026-16558	5.4	2.8	Unknown	YMC Filter	CWE-79	YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
CVE-2026-19259	1.9	2.4	MZ Automation	libiec61850	CWE-119	MZ Automation libiec61850 MMS Protocol Workflow iec61850_common.c MmsMapping_…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-08 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.