boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Sunday, August 9, 2026 · all times UTC← 2026-08-08 · archive · 2026-08-10 →

78 CVEs published, led by code-projects (5).

78 CVEs published August 9, 2026: 3 critical, 11 high, 28 medium, 36 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 53 in the results table.

Standings

League
MTDYTD2025 same span2025 full
CVEs published20482419514022564
KEV catalog size1671

1321 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
linux462363211125463512730.17.8.0014+9 ▲
google431803222739783567460.37.5.0023-36 ▼
microsoft33146411999332914380322.27.8.0041-19 ▼
red hat423982015719625400.06.5.0024+9 ▲
apple1267577312739472.66.8.0024+1 ▲
canonical02738115000.05.6.0011-1 ▼
suse52651461000.08.1.0030-1 ▼
freebsd01601240000.07.8.00150
Network & Infrastructure
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
cisco30701134170961318.67.5.0033+22 ▲
ubiquiti036142110438.38.8.0036-25 ▼
palo alto networks025021471428.04.7.0021-14 ▼
fortinet0233611028626.16.7.00390
netgear02300221800.04.6.00220
f50175830715.98.6.00570
vmware01648222200.08.2.0039-1 ▼
checkpoint11346303215.47.8.0436+1 ▲
Open Source Ecosystems
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
apache6139577176129124020.57.5.0048+9 ▲
mozilla112851423501300.08.1.0029-2 ▼
gitlab05307377423.84.9.0025-7 ▼
drupal05165355512.05.9.00180
github2141490000.06.2.0032+1 ▲
docker070520100.08.2.00160
wordpress1412105250.08.8.3700+1 ▲
kubernetes010001000.02.4.00240
Enterprise Applications
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
oracle01379342653322614030.28.1.00320
adobe82623311610647541.57.8.0021+5 ▲
ibm3226172104841710.47.5.0026+30 ▲
progress1153143270911.98.1.0032+1 ▲
solarwinds0231623011417.49.1.00440
veeam10165920400.08.6.0028+10 ▲
zohocorp062220000.07.8.01090
atlassian0303001300.08.0.00260
Industrial & Embedded
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
d-link1536155962612.87.4.0105+14 ▲
synology12426133000.05.6.0025+1 ▲
rockwell automation02441820000.08.7.00250
siemens0161870100.07.6.0019-4 ▼
schneider electric091620100.08.6.00240
abb070430000.07.2.00180
hikvision0704202114.37.2.00250
moxa050320000.07.0.00290
Other
VendorMTDYTDCHMLKEVKEV YTDKEV/100Med CVSSMed EPSSΔ
sourcecodester11131007061000.05.5.0026-17 ▼
openclaw01110583914000.07.0.0022-1 ▼
dell8107850453210.97.2.0020-19 ▼
nvidia16981366190000.07.7.0025-1 ▼
capgo083242381000.07.1.0028-7 ▼
itsourcecode879001960000.02.1.0020-2 ▼
spring079234412000.06.5.00220
imagemagick078156012300.05.3.0017-10 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVEEPSS%ileCVSS
CVE-2026-8037.993199.99.8
CVE-2026-63030.956099.99.8
CVE-2026-39808.912199.8—
CVE-2026-34486.829399.67.5
CVE-2026-50522.769899.59.8
CVE-2026-15410.763599.57.2
CVE-2026-15409.742299.410.0
CVE-2026-25089.736099.49.8
CVE-2026-16232.733099.49.3
CVE-2026-60137.731099.45.9
Highest CVSS
CVECVSSEPSSNote
CVE-2026-1540910.0.7422KEV
CVE-2026-898510.0.0660
CVE-2026-651610.0.0473
CVE-2026-4766810.0.0434
CVE-2026-4633910.0.0239
CVE-2026-6144710.0.0223
CVE-2026-5782710.0.0160
CVE-2026-4435910.0.0100
CVE-2025-7138910.0.0093
CVE-2026-4816810.0.0091
Most disclosures (vendor)
VendorCVEs
oracle1109
linux843
microsoft646
google460
apache181
red hat170
apple168
ibm135
adobe113
mozilla69
Most KEV additions (YTD)
VendorKEV
microsoft32
cisco13
apple7
fortinet6
google6
ivanti5
adobe4
solarwinds4
synacor4
langflow3
Most-affected ecosystems
EcosystemAdvisories
Maven65
PyPI5
Go3
npm3
Packagist2
crates.io2
NuGet1
Fastest to KEV
CVEVendorDays
CVE-2008-4128Cisco0
CVE-2021-27137DD-WRT0
CVE-2023-4346KNX Association0
CVE-2025-68686Fortinet0
CVE-2026-0770Langflow0
CVE-2026-15409SonicWall0
CVE-2026-15410SonicWall0
CVE-2026-16232checkpoint0
CVE-2026-16812Arista Networks0
CVE-2026-18556N-able0
Longest unpatched (KEV due date passed)
CVEVendorDueDays over
CVE-2021-27104Accellion2021-11-171726
CVE-2021-27102Accellion2021-11-171726
CVE-2021-27101Accellion2021-11-171726
CVE-2021-27103Accellion2021-11-171726
CVE-2021-21017Adobe2021-11-171726
CVE-2021-28550Adobe2021-11-171726
CVE-2021-42013Apache2021-11-171726
CVE-2021-41773Apache2021-11-171726
CVE-2021-30858Apple2021-11-171726
CVE-2021-30860Apple2021-11-171726

Transactions

EXPLOIT PUBLISHED — Unknown Easy Appointments: 6 CVEs (CVE-2026-14188, CVE-2026-14221, CVE-2026-14222, CVE-2026-14223, CVE-2026-14224, CVE-2026-14226). Public exploit references added.

EXPLOIT PUBLISHED — Unknown WP Directory Kit: 3 CVEs (CVE-2026-16590, CVE-2026-16594, CVE-2026-16595). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-9242 (WatchGuard Fireware OS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-10849 (zephyrproject zephyr). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-11974 (Unknown wp-media-folder-addon). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13692 (Unknown PayU CommercePro Plugin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16535 (Unknown Link Library). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16558 (Unknown YMC Filter). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16562 (Unknown WP Statistics). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16578 (Unknown Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19211 (SourceCodester Photo Share Website). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19231 (SourceCodester Simple Doctors Appointment System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19245 (HKUDS nanobot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19259 (MZ Automation libiec61850). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19268 (abdullah1854 MCPGateway). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67620 (FlowiseAI Flowise). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71959 (bitwarden server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71969 (OP-TEE optee_os). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72743 (dataease SQLBot). Public exploit reference added.

DUE DATE PASSED — CVE-2026-63077 (JetBrains TeamCity). CISA remediation deadline was August 8, 2026; still in catalog.

RESCORED — CVE-2026-16089 (Red Hat Build of Keycloak). CVSS 5.4 → 5.9 (NVD).

PATCH SHIPPED — CVE-2026-72898 (Metabase). Fixed in Metabase x.58.24.

ENRICHED — CVE-2026-23385 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

78 CVEs published. 25 box scores, 53 table rows — nothing truncated.

CVE-2026-19348HIGH
Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0246   83.2     —
AFFECTED
  Product              Versions      Fixed
  M300 Wi-Fi Repeater  r0-ea7890a –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2026-19346HIGH
Tenda CH22 CertListInfo formCertListInfo command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0222   81.2     —
AFFECTED
  Product  Versions   Fixed
  CH22     1.0.0.1 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-71993CRITICAL
MSI Radix AXE6600 v781521 Command Injection via openvpn function
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0135   69.3     —
AFFECTED
  Product        Versions     Fixed
  Radix AXE6600  unspecified  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulnCheck)
CWE-78 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received
CVE-2026-19329LOW
andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —
AFFECTED
  Product    Versions                                    Fixed
  codex_mcp  1ff521cc6cc57cfe56ddef946c644b8534771390 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19332LOW
NellyW8 MCP4EDA run_openlane/view_waveform command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —
AFFECTED
  Product  Versions  Fixed
  MCP4EDA  1.0.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19333LOW
NightTrek Supabase-MCP generate_types command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —
AFFECTED
  Product       Versions                                    Fixed
  Supabase-MCP  cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19334LOW
NightTrek Ollama-mcp index.ts command injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   L   N   L   L   L    1.9   .0062   47.1     —
AFFECTED
  Product     Versions                                    Fixed
  Ollama-mcp  80cf2e17cfc144963a475b619093a2d13c13dbc9 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19345MEDIUM
code-projects Task Management System UpdateTaskStatus.php authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0052   42.2     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-862, CWE-863 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19351MEDIUM
dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0050   41.0     —
AFFECTED
  Product         Versions  Fixed
  node-sql-query  0.1.25 –  0.1.29
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred
CVE-2026-10595HIGH
parisneo parisneo/lollms — Path Traversal Vulnerability in parisneo/lollms
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0049   40.2     —
AFFECTED
  Product          Versions       Fixed
  parisneo/lollms  unspecified –  —
TIMELINE
  Jun 1   Reserved by CNA
  Aug 9   Published (CNA: @huntr_ai)
CWE-23 · CNA: @huntr_ai · CVSS v3.0 · 2 references · NVD status: Received
CVE-2026-17510HIGH
JONASBN Crypt::OpenSSL::PKCS12 — Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0045   37.3     —
AFFECTED
  Product                 Versions     Fixed
  Crypt::OpenSSL::PKCS12  unspecified  —
TIMELINE
  Jul 27  Reserved by CNA
  Aug 9   Published (CNA: CPANSec)
CWE-476 · CNA: CPANSec · CVSS v3.1 · 3 references · NVD status: Received
CVE-2026-19341HIGH
UTT HiPER 1200GW pptpSrvGlobalConfig strcpy stack-based overflow
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0044   36.9     —
AFFECTED
  Product       Versions        Fixed
  HiPER 1200GW  2.5.3-170306 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-15038CRITICAL
Unknown InfiniteWP Client — InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0042   35.4     —
AFFECTED
  Product            Versions     Fixed
  InfiniteWP Client  unspecified  —
TIMELINE
  Jul 8   Reserved by CNA
  Aug 9   Published (CNA: WPScan)
CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received
CVE-2026-19344MEDIUM
code-projects Task Management System comment_count_user.php sql injection
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.6     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19342MEDIUM
code-projects Task Management System Login index.php improper authentication
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0040   33.9     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-287 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19363MEDIUM
lmammino oidc-authorizer Lambda Authorizer handler.rs log file
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0039   32.4     —
AFFECTED
  Product          Versions  Fixed
  oidc-authorizer  0.1 –     —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-200, CWE-532 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-19362MEDIUM
lmammino oidc-authorizer Authorization Header Parsing parse_token_from_header.rs parse_token_from_header denial of service
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    5.5   .0037   30.5     —
AFFECTED
  Product          Versions  Fixed
  oidc-authorizer  0.4.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-404 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-19374MEDIUM
adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0037   30.4     —
AFFECTED
  Product  Versions                                    Fixed
  api-mcp  92b9a5d04acfec165c7d4ef852496593aa87be06 –  —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19375LOW
dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0036   29.6     —
AFFECTED
  Product              Versions  Fixed
  article-scraper-mcp  1.0.0 –   —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19359MEDIUM
nxp-auto-goldvip gvip Lambda Function SitewiseCustomFunction access control
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    5.1   .0036   29.3     —
AFFECTED
  Product  Versions  Fixed
  gvip     1.0 –     1.15.0
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-266, CWE-284 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-19376MEDIUM
Uasoft Badaso File API api.php class permission
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0035   28.7     —
AFFECTED
  Product  Versions       Fixed
  Badaso   3.0.0-alpha –  —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-266, CWE-275 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred
CVE-2026-19350MEDIUM
Dolibarr ERP TakePOS invoice.php fail authorization
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0035   28.2     —
AFFECTED
  Product  Versions  Fixed
  ERP      23.0.0 –  —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-862, CWE-863 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred
CVE-2026-19378LOW
code-projects Task Management System CommentSave.php cross site scripting
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0035   27.9     —
AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —
TIMELINE
  Aug 9   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred
CVE-2026-19356MEDIUM
MingSoft MCMS ms-mdiy list information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   21.2     —
AFFECTED
  Product  Versions  Fixed
  MCMS     3.0.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
CVE-2026-19357MEDIUM
MingSoft MCMS ms-mdiy get information disclosure
  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0029   21.2     —
AFFECTED
  Product  Versions  Fixed
  MCMS     3.0.0 –   —
TIMELINE
  Aug 8   Reserved by CNA
  Aug 9   Published (CNA: VulDB)
CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred
Remainder (ranked, continued)
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-193402.120.8anubissbeProjectHub-McpCWE-918anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request…
CVE-2026-193612.920.2macrozhengmallCWE-640macrozheng mall mall-portal getAuthCode password recovery
CVE-2026-184647.519.9UnknownWP MAPS PROCWE-400WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service
CVE-2026-193435.518.3code-projectsTask Management SystemCWE-74code-projects Task Management System AdminLogin.php sql injection
CVE-2026-184739.118.2UnknownWP Directory KitCWE-89WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' P…
CVE-2026-170448.618.2UnknownIptanus File UploadCWE-89WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid
CVE-2026-123723.717.8nltknltk/nltkCWE-918Server-Side Request Forgery (SSRF) in nltk/nltk
CVE-2026-169887.517.4UnknownGeoDirectoryCWE-200GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via…
CVE-2026-180327.517.4UnknownWP Data AccessCWE-200WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autoc…
CVE-2026-183577.517.4UnknownWPC Order Tip for WooCommerceCWE-200WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure
CVE-2026-193555.517.2MingSoftMCMSCWE-74MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection
CVE-2026-193531.315.5n/aDedeCMSCWE-73DedeCMS Installation Wizard index.php _4_Setup file inclusion
CVE-2026-184656.513.8UnknownWP MAPS PROCWE-22WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion
CVE-2026-186036.513.0UnknownPiWeb Cancel order / Refund request for WooCommerceCWE-862Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content…
CVE-2026-170178.113.0UnknownCubeWP FrameworkCWE-89CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation
CVE-2026-193605.112.6wongcyrusExcelLexBotCWE-266wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges…
CVE-2026-193392.111.4aliyunalibabacloud-dataworks-mcp-serverCWE-918aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequest…
CVE-2026-193672.111.4NocteDefensorLudusMCPCWE-918NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request f…
CVE-2026-193521.311.1mifilossless-cutCWE-918mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request…
CVE-2026-193585.310.43CORESecTrapdoorCWE-2663CORESec Trapdoor DefaultFunction access control
CVE-2026-193472.110.3itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System viewdoctor.php sql injection
CVE-2026-193642.110.2itsourcecodeHospital Management SystemCWE-74itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql i…
CVE-2026-170145.39.5UnknownWP Photo Album PlusCWE-73WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion v…
CVE-2026-193545.39.3lock-upmeOPMSCWE-74lock-upme OPMS IN Clause message.go sql injection
CVE-2026-169572.77.7UnknownSlim SEOCWE-639Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure
CVE-2026-193351.97.1Jane-xiaoerskill-vision-controlCWE-22Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal
CVE-2026-169926.56.2UnknownCreateCWE-862Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure …
CVE-2026-180376.56.2UnknownCreateCWE-862Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure …
CVE-2026-160326.15.9UnknownLWS OptimizeCWE-79LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
CVE-2026-155345.75.8LEONTperlCWE-125Perl versions through 5.45.1 have out-of-bounds heap reads and writes during …
CVE-2026-193661.94.0NocteDefensorLudusMCPCWE-22NocteDefensor LudusMCP insert_creds_range_config insertCredsRangeConfig.ts pa…
CVE-2026-193721.93.9Handwriting-OCRhandwriting-ocr-mcp-serverCWE-22Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFi…
CVE-2026-193684.83.6PV-Bhatgemsuite-mcpCWE-22PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal
CVE-2026-703952.13.7ash-projectashCWE-943Predicate injection in manage_relationship belongs_to lookup discloses secret…
CVE-2026-193241.93.7HelloGGXshadcn-vue-mcpCWE-22HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal
CVE-2026-193281.93.6aktsmmskill-ninja-mcp-serverCWE-22aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal
CVE-2026-193311.93.6bazylhorseyobsidian-mcp-serverCWE-22bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal
CVE-2026-193381.93.6automateyournetworkMCPyATSCWE-22automateyournetwork MCPyATS generate_mermaid_markdown index.ts processGenerat…
CVE-2026-193701.93.6bartekke8it56w2new-mcpCWE-22bartekke8it56w2 new-mcp geminithinking index.ts fs.readFileSync path traversal
CVE-2026-193711.93.6Nikolaibiboclaude-comfyui-mcpCWE-22Nikolaibibo claude-comfyui-mcp comfy_upload_image utils.ts copyFileSync path …
CVE-2026-193364.83.6Pimzinospec-workflow-mcpCWE-22Pimzino spec-workflow-mcp approvals.ts ApprovalStorage.createApproval path tr…
CVE-2026-193231.93.6azerreact-analyzer-mcpCWE-22azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path trav…
CVE-2026-193251.93.6IncomeStreamSurferroo-code-memory-bank-mcp-serverCWE-22IncomeStreamSurfer roo-code-memory-bank-mcp-server read_memory_bank_file/appe…
CVE-2026-193261.93.6Jevon-ZhongAi-doctorCWE-22Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal
CVE-2026-193271.93.6abracadabra50claude-seshCWE-22abracadabra50 claude-sesh enricher.ts enrichSession path traversal
CVE-2026-193301.93.6angrysky56advanced-reasoning-mcpCWE-22angrysky56 advanced-reasoning-mcp index.ts switch_memory_library path traversal
CVE-2026-193651.93.6Ichigo3766image-gen-mcpCWE-22Ichigo3766 image-gen-mcp upscale_images index.ts path traversal
CVE-2026-696595.93.2ash-projectashCWE-502Memory exhaustion via unbounded deserialization of keyset pagination cursors …
CVE-2026-170113.82.1UnknownNexter BlocksCWE-345Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection
CVE-2026-193371.91.7adenotmcp-google-searchCWE-918adenot mcp-google-search read_webpage index.ts server-side request forgery
CVE-2026-193731.91.5PhialsBasementKoboldCPP-MCP-ServerCWE-918PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest ser…
CVE-2026-193691.91.1KS-GEN-AIjira-mcp-serverCWE-918KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get s…
CVE-2026-169654.31.0UnknownSolace ExtraCWE-352Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebui…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-09 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion.