Security Box Score — August 9, 2026

78 CVEs published, led by code-projects (5).

78 CVEs published August 9, 2026: 3 critical, 11 high, 28 medium, 36 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 53 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	2048	24212	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1325 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	46	2361	211	1254	637	1	11	2	0.1	7.8	.0016	+9 ▲
google	43	1804	222	743	783	56	77	6	0.3	7.5	.0025	-36 ▼
microsoft	33	1455	121	991	329	14	286	24	1.6	7.8	.0047	-19 ▼
red hat	42	428	20	166	212	30	2	0	0.0	6.5	.0029	+9 ▲
apple	1	272	58	78	133	3	88	7	2.6	6.8	.0027	+1 ▲
canonical	0	27	3	8	11	5	0	0	0.0	5.6	.0014	-1 ▼
suse	5	26	5	14	6	1	0	0	0.0	8.1	.0039	-1 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	30	68	13	36	19	0	56	12	17.6	7.5	.0046	+22 ▲
ubiquiti	0	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
palo alto networks	0	25	1	3	14	7	13	2	8.0	4.7	.0028	-14 ▼
fortinet	0	23	6	6	11	0	28	6	26.1	7.2	.0040	0
netgear	0	23	0	0	22	1	0	0	0.0	4.6	.0024	0
vmware	0	17	4	9	2	2	7	1	5.9	8.3	.0040	-1 ▼
f5	0	16	5	8	3	0	4	1	6.3	8.6	.0057	0
checkpoint	1	13	4	6	3	0	3	2	15.4	7.8	.0436	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	61	397	77	176	131	12	33	2	0.5	7.5	.0050	+9 ▲
mozilla	1	128	51	42	35	0	9	0	0.0	8.1	.0031	-2 ▼
drupal	0	51	6	5	35	5	4	1	2.0	5.9	.0026	0
gitlab	0	51	0	7	37	7	4	2	3.9	4.9	.0029	-7 ▼
github	2	14	1	4	9	0	0	0	0.0	6.2	.0043	+1 ▲
docker	0	7	0	5	2	0	0	0	0.0	8.2	.0016	0
wordpress	1	4	1	2	1	0	2	2	50.0	8.8	.5550	+1 ▲
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	1379	343	653	322	61	27	3	0.2	8.1	.0036	0
ibm	32	261	72	104	84	1	6	1	0.4	7.5	.0031	+30 ▲
adobe	8	260	33	117	106	4	19	3	1.2	7.8	.0026	+5 ▲
progress	11	53	14	32	7	0	6	1	1.9	8.1	.0037	+1 ▲
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	10	16	5	9	2	0	1	0	0.0	8.6	.0034	+10 ▲
zohocorp	0	6	2	2	2	0	0	0	0.0	7.8	.0146	0
atlassian	0	3	0	3	0	0	13	0	0.0	8.0	.0026	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	15	35	15	5	9	6	3	7.4	.0157	+14 ▲
synology	1	24	2	6	13	3	0	5.6	.0025	+1 ▲
rockwell automation	0	24	4	18	2	0	0	8.7	.0029	0
siemens	0	16	1	8	7	0	0	7.6	.0024	-4 ▼
schneider electric	0	9	1	6	2	0	0	8.6	.0037	0
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0
moxa	0	5	0	3	2	0	0	7.0	.0029	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	11	131	0	0	70	61	0	0	0.0	5.5	.0033	-17 ▼
openclaw	0	111	0	58	39	14	0	0	0.0	7.0	.0026	-1 ▼
dell	8	107	9	50	45	3	2	1	0.9	7.2	.0021	-19 ▼
nvidia	16	98	13	66	19	0	0	0	0.0	7.7	.0034	-1 ▼
capgo	0	83	2	42	38	1	0	0	0.0	7.1	.0037	-7 ▼
itsourcecode	8	79	0	0	19	60	0	0	0.0	2.1	.0033	-2 ▼
spring	0	79	2	34	41	2	0	0	0.0	6.5	.0022	0
imagemagick	0	78	1	5	60	12	0	0	0.0	5.3	.0018	-10 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-34486	.9862	99.9	7.5
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-63077	.8473	99.7	9.8
CVE-2026-50522	.8461	99.7	9.8
CVE-2026-15409	.8366	99.7	10.0
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-6875	.7758	99.5	9.5
CVE-2026-25089	.7611	99.5	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-15409	10.0	.8366	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-47668	10.0	.0388
CVE-2026-46339	10.0	.0335
CVE-2026-61447	10.0	.0249
CVE-2026-57827	10.0	.0233
CVE-2026-44359	10.0	.0180
CVE-2026-16812	10.0	.0157	KEV
CVE-2025-71389	10.0	.0120

Most disclosures (vendor)
Vendor	CVEs
oracle	1109
linux	843
microsoft	646
google	460
apache	181
red hat	170
apple	168
ibm	135
adobe	113
mozilla	69

Most KEV additions (YTD)
Vendor	KEV
microsoft	24
cisco	12
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	65
PyPI	5
Go	3
npm	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-15409	SonicWall	0
CVE-2026-15410	SonicWall	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-18556	N-able	0
CVE-2026-18577	N-able	0
CVE-2026-20316	Cisco	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1726
CVE-2021-27102	n/a	2021-11-17	1726
CVE-2021-27101	n/a	2021-11-17	1726
CVE-2021-27103	n/a	2021-11-17	1726
CVE-2021-21017	Adobe	2021-11-17	1726
CVE-2021-28550	Adobe	2021-11-17	1726
CVE-2021-42013	Apache Software Foundation	2021-11-17	1726
CVE-2021-41773	Apache Software Foundation	2021-11-17	1726
CVE-2021-30858	Apple	2021-11-17	1726
CVE-2021-30860	Apple	2021-11-17	1726

Transactions

EXPLOIT PUBLISHED — Unknown Easy Appointments: 6 CVEs (CVE-2026-14188, CVE-2026-14221, CVE-2026-14222, CVE-2026-14223, CVE-2026-14224, CVE-2026-14226). Public exploit references added.

EXPLOIT PUBLISHED — Unknown WP Directory Kit: 3 CVEs (CVE-2026-16590, CVE-2026-16594, CVE-2026-16595). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-9242 (WatchGuard Fireware OS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10849 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-11974 (Unknown wp-media-folder-addon). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13692 (Unknown PayU CommercePro Plugin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16535 (Unknown Link Library). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16558 (Unknown YMC Filter). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16562 (Unknown WP Statistics). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16578 (Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19211 (SourceCodester Photo Share Website). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19231 (SourceCodester Simple Doctors Appointment System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19245 (HKUDS nanobot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19259 (MZ Automation libiec61850). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19268 (abdullah1854 MCPGateway). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67620 (FlowiseAI Flowise). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71959 (bitwarden server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71969 (OP-TEE optee_os). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72743 (dataease SQLBot). Public exploit reference added.

DUE DATE PASSED — CVE-2026-63077 (JetBrains TeamCity). CISA remediation deadline was August 8, 2026; still in catalog.

RESCORED — CVE-2026-16089 (Red Hat Build of Keycloak). CVSS 5.4 → 5.9 (NVD).

PATCH SHIPPED — CVE-2026-72898 (Metabase). Fixed in Metabase x.58.24.

ENRICHED — CVE-2026-23385 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

78 CVEs published. 25 box scores, 53 table rows — nothing truncated.

CVE-2026-19348HIGH

Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0197   78.9     —

AFFECTED
  Product              Versions      Fixed
  M300 Wi-Fi Repeater  r0-ea7890a –  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-19346HIGH

Tenda CH22 CertListInfo formCertListInfo command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0160   73.9     —

AFFECTED
  Product  Versions   Fixed
  CH22     1.0.0.1 –  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-71993CRITICAL

MSI Radix AXE6600 v781521 Command Injection via openvpn function

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.4     —

AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-19329LOW

andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —

AFFECTED
  Product    Versions                                    Fixed
  codex_mcp  1ff521cc6cc57cfe56ddef946c644b8534771390 –  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19332LOW

NellyW8 MCP4EDA run_openlane/view_waveform command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —

AFFECTED
  Product  Versions  Fixed
  MCP4EDA  1.0.0 –   —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19333LOW

NightTrek Supabase-MCP generate_types command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —

AFFECTED
  Product       Versions                                    Fixed
  Supabase-MCP  cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170 –  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19334LOW

NightTrek Ollama-mcp index.ts command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —

AFFECTED
  Product     Versions                                    Fixed
  Ollama-mcp  80cf2e17cfc144963a475b619093a2d13c13dbc9 –  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-15038CRITICAL

Unknown InfiniteWP Client — InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0059   45.5     —

AFFECTED
  Product            Versions     Fixed
  InfiniteWP Client  unspecified  —

TIMELINE
  Jul 8   Reserved by CNA
  Aug 9   Published (CNA: WPScan)

CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-10595HIGH

parisneo parisneo/lollms — Path Traversal Vulnerability in parisneo/lollms

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0049   39.9     —

AFFECTED
  Product          Versions       Fixed
  parisneo/lollms  unspecified –  —

TIMELINE
  Jun 1   Reserved by CNA
  Aug 9   Published (CNA: @huntr_ai)

CWE-23 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Received

CVE-2026-19341HIGH

UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0044   36.5     —

AFFECTED
  Product       Versions        Fixed
  HiPER 1200GW  2.5.3-170306 –  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-17510HIGH

JONASBN Crypt::OpenSSL::PKCS12 — Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0044   36.5     —

AFFECTED
  Product                 Versions     Fixed
  Crypt::OpenSSL::PKCS12  unspecified  —

TIMELINE
  Jul 27  Reserved by CNA
  Aug 9   Published (CNA: CPANSec)

CWE-476 · CNA: CPANSec · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-19342MEDIUM

code-projects Task Management System Login index.php improper authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0040   33.4     —

AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-287 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19351MEDIUM

dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0040   33.2     —

AFFECTED
  Product         Versions  Fixed
  node-sql-query  0.1.25 –  0.1.29

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-19345MEDIUM

code-projects Task Management System UpdateTaskStatus.php authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0040   32.8     —

AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-862, CWE-863 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19363MEDIUM

lmammino oidc-authorizer Lambda Authorizer handler.rs log file

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0039   31.9     —

AFFECTED
  Product          Versions  Fixed
  oidc-authorizer  0.1 –     —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-200, CWE-532 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-19362MEDIUM

lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    5.5   .0037   30.0     —

AFFECTED
  Product          Versions  Fixed
  oidc-authorizer  0.4.0 –   —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-404 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-19374MEDIUM

adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0037   29.9     —

AFFECTED
  Product  Versions                                    Fixed
  api-mcp  92b9a5d04acfec165c7d4ef852496593aa87be06 –  —

TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19375LOW

dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0036   29.1     —

AFFECTED
  Product              Versions  Fixed
  article-scraper-mcp  1.0.0 –   —

TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19376MEDIUM

Uasoft Badaso File API api.php class permission

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0035   28.1     —

AFFECTED
  Product  Versions       Fixed
  Badaso   3.0.0-alpha –  —

TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-266, CWE-275 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-19378LOW

code-projects Task Management System CommentSave.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0035   27.3     —

AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —

TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-18464HIGH

Unknown WP MAPS PRO — WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0030   22.0     —

AFFECTED
  Product      Versions     Fixed
  WP MAPS PRO  unspecified  —

TIMELINE
  Jul 31  Reserved by CNA
  Aug 9   Published (CNA: WPScan)

CWE-400 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-19359MEDIUM

nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    5.1   .0030   21.6     —

AFFECTED
  Product  Versions  Fixed
  gvip     1.0 –     1.15.0

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-266, CWE-284 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-19356MEDIUM

MingSoft MCMS ms-mdiy list information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   20.6     —

AFFECTED
  Product  Versions  Fixed
  MCMS     3.0.0 –   —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-19357MEDIUM

MingSoft MCMS ms-mdiy get information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   20.6     —

AFFECTED
  Product  Versions  Fixed
  MCMS     3.0.0 –   —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-19340LOW

anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0028   20.2     —

AFFECTED
  Product         Versions  Fixed
  ProjectHub-Mcp  5.0 –     —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-18473	9.1	20.1	Unknown	WP Directory Kit	CWE-89	WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' P…
CVE-2026-19361	2.9	19.5	macrozheng	mall	CWE-640	macrozheng mall mall-portal getAuthCode password recovery
CVE-2026-19343	5.5	17.8	code-projects	Task Management System	CWE-74	code-projects Task Management System AdminLogin.php sql injection
CVE-2026-19344	5.5	17.8	code-projects	Task Management System	CWE-74	code-projects Task Management System comment_count_user.php sql injection
CVE-2026-17044	8.6	17.6	Unknown	Iptanus File Upload	CWE-89	WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid
CVE-2026-12372	3.7	17.3	nltk	nltk/nltk	CWE-918	Server-Side Request Forgery (SSRF) in nltk/nltk
CVE-2026-16988	7.5	16.9	Unknown	GeoDirectory	CWE-200	GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via…
CVE-2026-18032	7.5	16.9	Unknown	WP Data Access	CWE-200	WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autoc…
CVE-2026-18357	7.5	16.9	Unknown	WPC Order Tip for WooCommerce	CWE-200	WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
CVE-2026-19355	5.5	16.6	MingSoft	MCMS	CWE-74	MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection
CVE-2026-18465	6.5	16.0	Unknown	WP MAPS PRO	CWE-22	WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion
CVE-2026-18603	6.5	15.1	Unknown	PiWeb Cancel order / Refund request for WooCommerce	CWE-862	Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content…
CVE-2026-19353	1.3	14.9	n/a	DedeCMS	CWE-73	DedeCMS Installation Wizard index.php _4_Setup file inclusion
CVE-2026-17017	8.1	12.5	Unknown	CubeWP Framework	CWE-89	CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
CVE-2026-19360	5.1	12.1	wongcyrus	ExcelLexBot	CWE-266	wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges…
CVE-2026-19350	5.3	11.0	Dolibarr	ERP	CWE-862	Dolibarr ERP TakePOS invoice.php fail authorization
CVE-2026-19339	2.1	11.0	aliyun	alibabacloud-dataworks-mcp-server	CWE-918	aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequest…
CVE-2026-19367	2.1	11.0	NocteDefensor	LudusMCP	CWE-918	NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request f…
CVE-2026-19352	1.3	10.7	mifi	lossless-cut	CWE-918	mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request…
CVE-2026-19358	5.3	10.0	3CORESec	Trapdoor	CWE-266	3CORESec Trapdoor DefaultFunction access control
CVE-2026-19347	2.1	9.8	itsourcecode	Hospital Management System	CWE-74	itsourcecode Hospital Management System viewdoctor.php sql injection
CVE-2026-19364	2.1	9.8	itsourcecode	Hospital Management System	CWE-74	itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql i…
CVE-2026-17014	5.3	9.1	Unknown	WP Photo Album Plus	CWE-73	WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion v…
CVE-2026-19354	5.3	8.9	lock-upme	OPMS	CWE-74	lock-upme OPMS IN Clause message.go sql injection
CVE-2026-16957	2.7	7.4	Unknown	Slim SEO	CWE-639	Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
CVE-2026-16032	6.1	6.9	Unknown	LWS Optimize	CWE-79	LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
CVE-2026-19335	1.9	6.8	Jane-xiaoer	skill-vision-control	CWE-22	Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal
CVE-2026-16992	6.5	5.8	Unknown	Create	CWE-862	Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure …
CVE-2026-18037	6.5	5.8	Unknown	Create	CWE-862	Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure …
CVE-2026-15534	5.7	5.5	LEONT	perl	CWE-125	Perl versions through 5.45.1 have out-of-bounds heap reads and writes during …
CVE-2026-19366	1.9	3.7	NocteDefensor	LudusMCP	CWE-22	NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts pa…
CVE-2026-19372	1.9	3.6	Handwriting-OCR	handwriting-ocr-mcp-server	CWE-22	Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFi…
CVE-2026-19368	4.8	3.4	PV-Bhat	gemsuite-mcp	CWE-22	PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal
CVE-2026-70395	2.1	3.4	ash-project	ash	CWE-943	Predicate injection in manage_relationship belongs_to lookup discloses secret…
CVE-2026-19324	1.9	3.4	HelloGGX	shadcn-vue-mcp	CWE-22	HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
CVE-2026-19328	1.9	3.4	aktsmm	skill-ninja-mcp-server	CWE-22	aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
CVE-2026-19331	1.9	3.4	bazylhorsey	obsidian-mcp-server	CWE-22	bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal
CVE-2026-19338	1.9	3.4	automateyournetwork	MCPyATS	CWE-22	automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerat…
CVE-2026-19370	1.9	3.4	bartekke8it56w2	new-mcp	CWE-22	bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal
CVE-2026-19371	1.9	3.4	Nikolaibibo	claude-comfyui-mcp	CWE-22	Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path …
CVE-2026-19336	4.8	3.3	Pimzino	spec-workflow-mcp	CWE-22	Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path tr…
CVE-2026-19323	1.9	3.3	azer	react-analyzer-mcp	CWE-22	azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path trav…
CVE-2026-19325	1.9	3.3	IncomeStreamSurfer	roo-code-memory-bank-mcp-server	CWE-22	IncomeStreamSurfer roo-code-memory-bank-mcp-server read_memory_bank_file/appe…
CVE-2026-19326	1.9	3.3	Jevon-Zhong	Ai-doctor	CWE-22	Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal
CVE-2026-19327	1.9	3.3	abracadabra50	claude-sesh	CWE-22	abracadabra50 claude-sesh enricher.ts enrichSession path traversal
CVE-2026-19330	1.9	3.3	angrysky56	advanced-reasoning-mcp	CWE-22	angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversal
CVE-2026-19365	1.9	3.3	Ichigo3766	image-gen-mcp	CWE-22	Ichigo3766 image-gen-mcp upscale_images index.ts path traversal
CVE-2026-69659	5.9	2.9	ash-project	ash	CWE-502	Memory exhaustion via unbounded deserialization of keyset pagination cursors …
CVE-2026-17011	3.8	2.0	Unknown	Nexter Blocks	CWE-345	Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
CVE-2026-19337	1.9	1.6	adenot	mcp-google-search	CWE-918	adenot mcp-google-search read_webpage index.ts server-side request forgery
CVE-2026-19373	1.9	1.4	PhialsBasement	KoboldCPP-MCP-Server	CWE-918	PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest ser…
CVE-2026-19369	1.9	1.1	KS-GEN-AI	jira-mcp-server	CWE-918	KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get s…
CVE-2026-16965	4.3	0.9	Unknown	Solace Extra	CWE-352	Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebui…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-09 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.