A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?
433 CVEs published, led by IBM (68).
433 CVEs published August 12, 2026: 70 critical, 149 high, 184 medium, 16 low; 0 in the KEV catalog at press time; 1 with a public exploit reference; 14 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 33 on continuation pages.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 4084 | 26248 | — | — |
| KEV catalog size | 1675 | |||
Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.
Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.
1508 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 412 | 2727 | 234 | 1396 | 637 | 1 | 11 | 2 | 0.1 | 7.8 | .0016 | +374 ▲ |
| microsoft | 439 | 1861 | 132 | 1268 | 447 | 14 | 286 | 25 | 1.3 | 7.8 | .0044 | +385 ▲ |
| 49 | 1810 | 222 | 749 | 783 | 56 | 77 | 6 | 0.3 | 7.5 | .0025 | -30 ▼ | |
| red hat | 125 | 511 | 30 | 210 | 240 | 31 | 2 | 0 | 0.0 | 6.6 | .0029 | +89 ▲ |
| apple | 2 | 273 | 58 | 79 | 133 | 3 | 88 | 7 | 2.6 | 7.0 | .0027 | +2 ▲ |
| canonical | 11 | 38 | 12 | 9 | 12 | 5 | 0 | 0 | 0.0 | 7.8 | .0020 | +10 ▲ |
| suse | 5 | 26 | 5 | 14 | 6 | 1 | 0 | 0 | 0.0 | 8.1 | .0039 | -1 ▼ |
| freebsd | 0 | 16 | 0 | 12 | 4 | 0 | 0 | 0 | 0.0 | 7.8 | .0016 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cisco | 31 | 69 | 13 | 37 | 19 | 0 | 56 | 13 | 18.8 | 7.5 | .0046 | +23 ▲ |
| ubiquiti | 0 | 36 | 14 | 21 | 1 | 0 | 3 | 3 | 8.3 | 8.8 | .0049 | -25 ▼ |
| netgear | 9 | 32 | 0 | 0 | 27 | 5 | 0 | 0 | 0.0 | 4.3 | .0025 | +9 ▲ |
| fortinet | 7 | 30 | 7 | 8 | 14 | 1 | 28 | 6 | 20.0 | 7.0 | .0050 | +7 ▲ |
| palo alto networks | 0 | 25 | 1 | 3 | 14 | 7 | 13 | 2 | 8.0 | 4.7 | .0028 | -14 ▼ |
| vmware | 0 | 17 | 4 | 9 | 2 | 2 | 7 | 1 | 5.9 | 8.3 | .0040 | -1 ▼ |
| f5 | 0 | 16 | 5 | 8 | 3 | 0 | 4 | 1 | 6.3 | 8.6 | .0057 | 0 |
| ivanti | 3 | 14 | 4 | 8 | 2 | 0 | 25 | 5 | 35.7 | 8.3 | .0754 | +3 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 95 | 431 | 86 | 185 | 147 | 12 | 33 | 2 | 0.5 | 7.5 | .0049 | +34 ▲ |
| mozilla | 1 | 128 | 51 | 42 | 35 | 0 | 9 | 0 | 0.0 | 8.1 | .0031 | -2 ▼ |
| gitlab | 13 | 64 | 1 | 13 | 42 | 8 | 4 | 2 | 3.1 | 4.9 | .0028 | +6 ▲ |
| drupal | 0 | 51 | 6 | 5 | 35 | 5 | 4 | 1 | 2.0 | 5.9 | .0026 | -46 ▼ |
| github | 4 | 16 | 1 | 6 | 9 | 0 | 0 | 0 | 0.0 | 6.4 | .0042 | +3 ▲ |
| docker | 1 | 8 | 0 | 5 | 3 | 0 | 0 | 0 | 0.0 | 7.7 | .0015 | +1 ▲ |
| wordpress | 1 | 4 | 1 | 2 | 1 | 0 | 2 | 2 | 50.0 | 8.8 | .5550 | +1 ▲ |
| kubernetes | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 0 | 0.0 | 2.4 | .0035 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 0 | 1379 | 343 | 653 | 322 | 61 | 27 | 3 | 0.2 | 8.1 | .0036 | 0 |
| ibm | 100 | 329 | 84 | 140 | 102 | 3 | 6 | 1 | 0.3 | 7.5 | .0031 | +98 ▲ |
| adobe | 60 | 312 | 39 | 145 | 123 | 5 | 19 | 3 | 1.0 | 7.8 | .0026 | +57 ▲ |
| progress | 16 | 58 | 14 | 34 | 10 | 0 | 6 | 1 | 1.7 | 8.1 | .0036 | +6 ▲ |
| solarwinds | 0 | 23 | 17 | 3 | 3 | 0 | 10 | 4 | 17.4 | 9.1 | .0058 | 0 |
| veeam | 10 | 16 | 5 | 9 | 2 | 0 | 1 | 0 | 0.0 | 8.6 | .0034 | +10 ▲ |
| zohocorp | 2 | 8 | 3 | 3 | 2 | 0 | 0 | 0 | 0.0 | 8.4 | .0142 | +2 ▲ |
| atlassian | 0 | 3 | 0 | 3 | 0 | 0 | 13 | 0 | 0.0 | 8.0 | .0026 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| d-link | 15 | 35 | 15 | 5 | 9 | 6 | 3 | 0 | 0.0 | 7.4 | .0157 | +14 ▲ |
| siemens | 17 | 33 | 2 | 23 | 8 | 0 | 0 | 0 | 0.0 | 7.3 | .0016 | +13 ▲ |
| synology | 1 | 24 | 2 | 6 | 13 | 3 | 0 | 0 | 0.0 | 5.6 | .0025 | +1 ▲ |
| rockwell automation | 0 | 24 | 4 | 18 | 2 | 0 | 0 | 0 | 0.0 | 8.7 | .0029 | 0 |
| schneider electric | 0 | 9 | 1 | 6 | 2 | 0 | 0 | 0 | 0.0 | 8.6 | .0037 | 0 |
| abb | 0 | 7 | 0 | 4 | 3 | 0 | 0 | 0 | 0.0 | 7.2 | .0018 | 0 |
| hikvision | 0 | 6 | 0 | 4 | 2 | 0 | 0 | 0 | 0.0 | 7.2 | .0040 | 0 |
| moxa | 0 | 5 | 0 | 3 | 2 | 0 | 0 | 0 | 0.0 | 7.0 | .0029 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| sourcecodester | 12 | 132 | 0 | 0 | 71 | 61 | 0 | 0 | 0.0 | 5.5 | .0033 | -16 ▼ |
| dell | 12 | 111 | 9 | 54 | 45 | 3 | 2 | 1 | 0.9 | 7.2 | .0021 | -21 ▼ |
| openclaw | 0 | 111 | 0 | 58 | 39 | 14 | 0 | 0 | 0.0 | 7.0 | .0026 | -1 ▼ |
| nvidia | 16 | 98 | 13 | 66 | 19 | 0 | 0 | 0 | 0.0 | 7.7 | .0034 | -1 ▼ |
| capgo | 0 | 83 | 2 | 42 | 38 | 1 | 0 | 0 | 0.0 | 7.1 | .0037 | -22 ▼ |
| itsourcecode | 8 | 79 | 0 | 0 | 19 | 60 | 0 | 0 | 0.0 | 2.1 | .0033 | -2 ▼ |
| spring | 0 | 79 | 2 | 34 | 41 | 2 | 0 | 0 | 0.0 | 6.5 | .0022 | 0 |
| imagemagick | 0 | 78 | 1 | 5 | 60 | 12 | 0 | 0 | 0.0 | 5.3 | .0018 | -18 ▼ |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-8037 | .9957 | 99.9 | 9.8 |
| CVE-2026-34486 | .9862 | 99.9 | 7.5 |
| CVE-2026-63030 | .9779 | 99.9 | 9.8 |
| CVE-2026-16232 | .8912 | 99.8 | 9.3 |
| CVE-2026-63077 | .8473 | 99.7 | 9.8 |
| CVE-2026-50522 | .8461 | 99.7 | 9.8 |
| CVE-2026-15409 | .8366 | 99.7 | 10.0 |
| CVE-2026-60137 | .7979 | 99.6 | 5.9 |
| CVE-2026-72898 | .7922 | 99.6 | 10.0 |
| CVE-2026-25089 | .7611 | 99.5 | 9.8 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-15409 | 10.0 | .8366 | KEV |
| CVE-2026-72898 | 10.0 | .7922 | KEV |
| CVE-2026-8985 | 10.0 | .0660 | |
| CVE-2026-6516 | 10.0 | .0486 | |
| CVE-2026-48362 | 10.0 | .0431 | |
| CVE-2026-47668 | 10.0 | .0388 | |
| CVE-2026-46339 | 10.0 | .0335 | |
| CVE-2026-44359 | 10.0 | .0180 | |
| CVE-2026-58231 | 10.0 | .0171 | |
| CVE-2026-16812 | 10.0 | .0157 | KEV |
| Vendor | CVEs |
|---|---|
| linux | 1207 |
| oracle | 1109 |
| microsoft | 1050 |
| 466 | |
| red hat | 250 |
| apache | 211 |
| ibm | 203 |
| apple | 169 |
| adobe | 163 |
| mozilla | 68 |
| Vendor | KEV |
|---|---|
| microsoft | 25 |
| cisco | 13 |
| apple | 7 |
| fortinet | 6 |
| 6 | |
| ivanti | 5 |
| solarwinds | 4 |
| adobe | 3 |
| berriai | 3 |
| oracle | 3 |
| Ecosystem | Advisories |
|---|---|
| Maven | 66 |
| PyPI | 5 |
| Go | 3 |
| Packagist | 3 |
| npm | 3 |
| crates.io | 2 |
| NuGet | 1 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2021-27137 | DD-WRT | 0 |
| CVE-2025-68686 | Fortinet | 0 |
| CVE-2026-0770 | Langflow | 0 |
| CVE-2026-15409 | SonicWall | 0 |
| CVE-2026-15410 | SonicWall | 0 |
| CVE-2026-16232 | checkpoint | 0 |
| CVE-2026-16812 | Arista Networks | 0 |
| CVE-2026-18556 | N-able | 0 |
| CVE-2026-18577 | N-able | 0 |
| CVE-2026-20316 | Cisco | 0 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | n/a | 2021-11-17 | 1729 |
| CVE-2021-27102 | n/a | 2021-11-17 | 1729 |
| CVE-2021-27101 | n/a | 2021-11-17 | 1729 |
| CVE-2021-27103 | n/a | 2021-11-17 | 1729 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1729 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1729 |
| CVE-2021-42013 | Apache Software Foundation | 2021-11-17 | 1729 |
| CVE-2021-41773 | Apache Software Foundation | 2021-11-17 | 1729 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1729 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1729 |
EXPLOIT PUBLISHED — CVE-2017-10271 (Oracle Corporation WebLogic Server). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2018-11138. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2018-15982. Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2018-20250 (Check Point Software Technologies Ltd. WinRAR). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2018-7602 (Drupal core). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2018-8120 (Microsoft Windows Server 2008). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2018-8174 (Microsoft Windows 7). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2019-0752 (Microsoft Internet Explorer 11). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2019-1069 (Microsoft Windows 10 Version 1703). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2019-1458 (Microsoft Windows). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2019-1579 (Palo Alto Networks GlobalProtect Portal/Gateway Interface). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2020-0787 (Microsoft Windows). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2020-0796 (Microsoft Windows 10 Version 1903 for 32-bit Systems). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2020-3153 (Cisco AnyConnect Secure Mobility Client). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2020-3433 (Cisco AnyConnect Secure Mobility Client). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-1675 (Microsoft Windows 10 Version 1809). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-1732 (Microsoft Windows 10 Version 1803). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-21972 (VMware vCenter Server). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-21975 (VMware vRealize Operations). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-21983 (VMware vRealize Operations). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-21985 (VMware vCenter Server and VMware Cloud Foundation). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-26855 (Microsoft Exchange Server 2016 Cumulative Update 19). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2021-27065 (Microsoft Exchange Server 2019). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2023-42787 (Fortinet FortiAnalyzer). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2024-14042 (Open5GS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-10681 (zephyrproject zephyr). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-14548 (Unknown Ray Enterprise Translation). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-14549 (Unknown Ray Enterprise Translation). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-17022 (Unknown Salon Booking System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19351 (dresende node-sql-query). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19361 (macrozheng mall). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19376 (Uasoft Badaso). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-19382 (Almico Speedfan). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-45799 (square wire). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-5241 (huggingface/transformers). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55653 (Red Hat Enterprise Linux 10). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-55654 (Red Hat Enterprise Linux 10). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-67579 (ash-project ash). Public exploit reference added.
RESCORED — CVE-2019-2725 (Oracle Corporation Tape Library ACSLS). CVSS 7.5 → 9.8 (NVD).
RESCORED — CVE-2023-42787 (Fortinet FortiAnalyzer). CVSS 6.2 → 6.5 (NVD).
RESCORED — CVE-2024-14043 (Open5GS). CVSS 5.3 → 2.1 (NVD).
RESCORED — CVE-2024-26882 (Linux). CVSS 7.3 → 7.8 (NVD).
RESCORED — CVE-2024-31245 (ConvertKit). CVSS 5.3 → 7.5 (NVD).
RESCORED — CVE-2024-31249 (WPKube Subscribe To Comments Reloaded). CVSS 5.3 → 7.5 (NVD).
RESCORED — CVE-2025-61848 (Fortinet FortiManager). CVSS 6.5 → 7.2 (NVD).
RESCORED — CVE-2026-49261 (MariaDB server). CVSS 10 → 9.8 (NVD).
RESCORED — CVE-2026-4942 (IBM i). CVSS 5.9 → 7.5 (NVD).
RESCORED — CVE-2026-50656 (Microsoft Malware Protection Engine). CVSS 7.8 → 7 (NVD).
RESCORED — CVE-2026-5241 (huggingface/transformers). CVSS 8 → 9.6 (NVD).
RESCORED — CVE-2026-55653 (Red Hat Enterprise Linux 10). CVSS 4.3 → 6.5 (NVD).
RESCORED — CVE-2026-55655 (Red Hat Enterprise Linux 10). CVSS 5 → 6.1 (NVD).
ENRICHED — CVE-2018-9206 (Blueimp jQuery-File-Upload). Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2021-21983 (VMware vRealize Operations). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2022-50073 (Linux). Received CVSS 5.5 and CPE data from NVD.
How to read these box scores · glossary
433 CVEs published. 25 box scores and 375 table rows below; the remaining 33 continue on page 2 — every CVE is listed, nothing truncated.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H L 9.4 .0261 84.2 —
AFFECTED Product Versions Fixed UFO < 3.0.8 – —
TIMELINE Aug 11 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P N N N N N 6.9 .0162 74.2 —
AFFECTED Product Versions Fixed UFO < 3.0.8 – —
TIMELINE Aug 11 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N C H H L 9.0 .0145 71.4 —
AFFECTED Product Versions Fixed Red Hat Advanced Cluster Management for Kubernetes 2 unspecified —
TIMELINE Aug 6 Reserved by CNA Aug 12 Published (CNA: redhat)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H H 10.0 .0121 66.2 —
AFFECTED Product Versions Fixed prompty < 0.1.5 – —
TIMELINE Aug 11 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0120 65.9 —
AFFECTED Product Versions Fixed FUXA = 1.3.0 – —
TIMELINE May 19 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0104 61.5 —
AFFECTED Product Versions Fixed Db2 Mirror for i 7.4 – —
TIMELINE Jul 24 Reserved by CNA Aug 12 Published (CNA: ibm)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C H H H 9.9 .0102 60.7 —
AFFECTED Product Versions Fixed LXD 4.0.0 – —
TIMELINE Jul 16 Reserved by CNA Aug 12 Published (CNA: canonical)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C H H N 9.6 .0088 56.4 —
AFFECTED Product Versions Fixed UpSnap < 5.4.0 – —
TIMELINE May 30 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0082 54.6 —
AFFECTED Product Versions Fixed i 7.6 – —
TIMELINE Aug 3 Reserved by CNA Aug 12 Published (CNA: ibm)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L P N N H H H 7.5 .0080 54.0 —
AFFECTED Product Versions Fixed ash 1.17.0 – — ash f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9 – —
TIMELINE Aug 9 Reserved by CNA Aug 12 Public exploit reference published Aug 12 Published (CNA: EEF)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0079 53.3 —
AFFECTED Product Versions Fixed WolfStack unspecified —
TIMELINE Aug 12 Reserved by CNA Aug 12 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U L L L 7.3 .0078 53.1 —
AFFECTED Product Versions Fixed Apache Airflow 3.3.0 – —
TIMELINE Jul 29 Reserved by CNA Aug 12 Published (CNA: apache)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H H H 8.1 .0077 52.8 —
AFFECTED Product Versions Fixed FortiManager 7.6.1 – — FortiManager Cloud 7.6.1 – —
TIMELINE Aug 4 Reserved by CNA Aug 12 Published (CNA: fortinet)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H H H 8.1 .0070 50.4 —
AFFECTED Product Versions Fixed FortiClientWindows 7.4.0 – —
TIMELINE Aug 4 Reserved by CNA Aug 12 Published (CNA: fortinet)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H H H 8.7 .0068 49.5 —
AFFECTED Product Versions Fixed Container-Migration-Solution-Accelerator <= 2.1.2 – —
TIMELINE Aug 11 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0065 48.4 —
AFFECTED Product Versions Fixed FortiWeb 8.0.0 – —
TIMELINE Feb 10 Reserved by CNA Aug 12 Published (CNA: fortinet)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0064 47.9 —
AFFECTED Product Versions Fixed AXC F 1152 2019.0.4 – — AXC F 1252 2019.0.4 – — AXC F 2152 2019.0.4 – — AXC F 3152 2019.0.4 – — BPC 9102S 2019.0.4 – — BPC 9202S 2019.0.4 – — RFC 4072R 2019.0.4 – — RFC 4072S 2019.0.4 – — VL3 UPC 2440 EDGE 2019.0.4 – — VPLCNEXT CONTROL 1000 2019.0.4 – — + 5 more
TIMELINE Apr 16 Reserved by CNA Aug 12 Published (CNA: CERTVDE)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0062 46.7 —
AFFECTED Product Versions Fixed UpSnap >= 4.4.1, < 5.4.0 – —
TIMELINE Jun 1 Reserved by CNA Aug 12 Published (CNA: GitHub_M)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0061 46.6 —
AFFECTED Product Versions Fixed Apache Airflow 3.3.0 – —
TIMELINE Jul 29 Reserved by CNA Aug 12 Published (CNA: apache)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0061 46.4 —
AFFECTED Product Versions Fixed WooCommerce Subscriptions 4.7.0 – —
TIMELINE Jul 30 Reserved by CNA Aug 12 Published (CNA: WPScan)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0059 45.5 —
AFFECTED Product Versions Fixed wpmudev-updates unspecified —
TIMELINE Jul 17 Reserved by CNA Aug 12 Published (CNA: WPScan)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N H N H N H H H 7.5 .0059 45.4 —
AFFECTED Product Versions Fixed CamaleonCMS unspecified —
TIMELINE Aug 11 Reserved by CNA Aug 12 Published (CNA: VulnCheck)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U L L N 5.4 .0058 45.3 —
AFFECTED Product Versions Fixed Apache Airflow unspecified —
TIMELINE Jul 4 Reserved by CNA Aug 12 Published (CNA: apache)
AV AC PR UI S C I A CVSS EPSS %ile KEV L L N R U L H N 6.1 .0058 45.2 —
AFFECTED Product Versions Fixed PDF::WebKit unspecified —
TIMELINE Jul 25 Reserved by CNA Aug 12 Published (CNA: CPANSec)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 10.0 .0058 45.1 —
AFFECTED Product Versions Fixed Fabrik extension for Joomla 1.0.0-4.6.7 – —
TIMELINE Jul 29 Reserved by CNA Aug 12 Published (CNA: Joomla)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-73415 | 7.5 | 44.8 | jupyterlab | jupyterlab | CWE-79 | jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious imag… |
| CVE-2026-15039 | 9.8 | 44.5 | Unknown | giftware | CWE-434 | Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload |
| CVE-2026-17218 | 9.8 | 43.9 | IBM | i | CWE-787 | IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daem… |
| CVE-2026-71408 | 5.3 | 43.8 | Fortinet | FortiOS | CWE-770 | A allocation of resources without limits or throttling vulnerability in Forti… |
| CVE-2026-13476 | 7.3 | 43.5 | IBM | Informix Dynamic Server | CWE-78 | IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution |
| CVE-2026-73240 | 9.8 | 43.1 | Apache Software Foundation | Apache Allura | CWE-88 | Apache Allura: Git command injection |
| CVE-2025-59321 | 9.8 | 42.7 | n/a | n/a | CWE-1188 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM… |
| CVE-2026-73414 | 9.2 | 42.1 | ericcornelissen | shescape | CWE-78 | Shescape: Shell injection via unescaped parentheses on Windows with CMD |
| CVE-2026-16906 | 8.8 | 42.1 | IBM | i | CWE-78 | IBM i is Affected By Multiple Vulnerabilities in Domain Name System |
| CVE-2026-16904 | 8.1 | 42.1 | IBM | i | CWE-269 | IBM i is Affected By improper privilege management in Navigator for i |
| CVE-2026-48553 | 7.7 | 42.0 | Nagios Enterprises, LLC. | Nagios Core | CWE-78 | Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection |
| CVE-2026-48554 | 7.7 | 42.0 | Nagios Enterprises, LLC. | Nagios Core | CWE-78 | Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro S… |
| CVE-2026-16860 | 9.9 | 41.9 | IBM | i | CWE-427 | IBM i is Affected By Remote Code Execution Vulnerability [] |
| CVE-2026-11325 | 8.8 | 41.3 | Cloudflare | https://github.com/cloudflare/pages-action | CWE-78 | cloudflare/pages-action is deprecated — migration required by September 18th,… |
| CVE-2026-18669 | 8.8 | 41.3 | IBM | i | CWE-250 | IBM i is Affected By A Privilege Escalation Vulnerability [] |
| CVE-2026-18713 | 8.8 | 41.0 | IBM | i | CWE-269 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-17110 | 8.8 | 40.7 | IBM | i | CWE-250 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-71407 | 5.6 | 40.2 | Fortinet | FortiOS | CWE-121 | A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortin… |
| CVE-2026-58076 | 8.8 | 39.5 | Apache Software Foundation | Apache Airflow | CWE-502 | Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser e… |
| CVE-2026-68868 | 6.5 | 39.2 | Apache Software Foundation | Apache Airflow Google provider | CWE-1220 | Apache Airflow Google provider: google Secret Manager backend: team scope is … |
| CVE-2026-7427 | 7.5 | 38.9 | GitLab | GitLab | CWE-770 | Allocation of Resources Without Limits or Throttling in GitLab |
| CVE-2026-54183 | 4.3 | 38.4 | Apache Software Foundation | Apache Airflow | CWE-200 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated… |
| CVE-2026-17083 | 9.8 | 38.2 | IBM | i | CWE-787 | IBM i is Affected By Multiple Vulnerabilities in the Debug Server |
| CVE-2026-73418 | 7.5 | 37.9 | nextauthjs | next-auth | CWE-20 | NextAuth.js: getToken() throws an uncaught exception on malformed Bearer auth… |
| CVE-2025-59319 | 7.2 | 38.0 | n/a | n/a | CWE-290 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the i… |
| CVE-2026-18961 | 8.1 | 37.5 | fahdaslam | Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect | CWE-287 | Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by Ventra… |
| CVE-2026-73294 | 9.9 | 37.1 | semaphoreui | semaphore | CWE-78 | Semaphore U: OS Command Injection |
| CVE-2025-59326 | 9.8 | 37.1 | n/a | n/a | CWE-693 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA p… |
| CVE-2026-65941 | 8.8 | 36.2 | Progress Software Corporation | WhatsUp Gold | CWE-73 | WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code … |
| CVE-2026-17266 | 6.5 | 36.2 | IBM | i | CWE-22 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-18663 | 5.9 | 35.7 | Red Hat | Red Hat Directory Server 11 | CWE-415 | 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_c… |
| CVE-2026-16770 | 9.8 | 35.7 | MITHALDU | PDF::WebKit | CWE-88 | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtm… |
| CVE-2026-73237 | 6.1 | 35.6 | Apache Software Foundation | Apache Allura | CWE-80 | Apache Allura: XSS in markdown pipeline |
| CVE-2026-73238 | 6.1 | 35.6 | Apache Software Foundation | Apache Allura | CWE-80 | Apache Allura: XSS in code display |
| CVE-2025-15684 | 5.5 | 35.5 | n/a | Open5GS | CWE-617 | Open5GS CER init.c diam_log_func assertion |
| CVE-2026-17642 | 8.8 | 35.3 | IBM | i | CWE-78 | IBM i is Affected By Remote Code Execution Vulnerabilities [, ] |
| CVE-2026-73407 | 9.0 | 35.0 | Budibase | budibase | CWE-22 | Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin A… |
| CVE-2026-17417 | 8.8 | 34.6 | IBM | i | CWE-78 | IBM i is Affected By Remote Code Execution Vulnerabilities [, ] |
| CVE-2026-68968 | 7.5 | 34.4 | Apache Software Foundation | Apache Airflow | CWE-436 | Apache Airflow: Authorization bypass in the Backfill API through conflicting … |
| CVE-2026-19311 | 8.6 | 34.3 | AWS | OpenSearch | CWE-475 | Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin |
| CVE-2025-41770 | 8.7 | 34.0 | Phoenix Contact | AXC F 1152 | CWE-770 | Unauthenticated Denial of Service |
| CVE-2026-49467 | 8.8 | 33.9 | smp46 | pingvin-share-x | CWE-303 | TOTP enrollment hijack: password gate skipped due to unawaited promise |
| CVE-2026-16907 | 7.6 | 33.6 | IBM | i | CWE-787 | IBM i is Affected By Multiple Vulnerabilities in the Debug Server |
| CVE-2026-19001 | 9.5 | 33.1 | MongoDB | BI Connector ODBC Driver | CWE-190 | MongoDB BI Connector ODBC driver may write outside an allocated buffer when h… |
| CVE-2026-19654 | 7.5 | 33.1 | Red Hat | Red Hat Enterprise Linux 10 | CWE-125 | Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input m… |
| CVE-2026-73293 | 8.8 | 32.9 | semaphoreui | semaphore | CWE-269 | Semaphore UI: Manager-to-owner privilege escalation via custom-role slug coll… |
| CVE-2026-17094 | 7.1 | 32.6 | IBM | i | CWE-22 | IBM i is Affected By Path Traversal Vulnerability in Navigator for i |
| CVE-2026-73500 | 8.7 | 32.5 | etcd-io | etcd | CWE-770 | etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no … |
| CVE-2026-19594 | 8.1 | 32.3 | Snowflake | Snowflake Python APIs | CWE-22 | Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflak… |
| CVE-2026-18366 | 9.8 | 31.8 | Unknown | Events Manager | CWE-269 | Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator |
| CVE-2026-65017 | 6.5 | 31.6 | Apache Software Foundation | Apache Airflow | CWE-200 | Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a V… |
| CVE-2026-16931 | 7.5 | 31.4 | IBM | i | CWE-835 | IBM i is Affected By A Denial of Service Vulnerability [] |
| CVE-2026-17271 | 7.5 | 31.4 | IBM | i | CWE-770 | IBM i is Affected By Multiple Vulnerabilities in the Debug Server |
| CVE-2026-67286 | 6.3 | 31.2 | joomshaper.com | SP Page Builder extension for Joomla | CWE-22 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creat… |
| CVE-2026-18675 | 5.3 | 31.2 | Kong Inc. | Kong Mesh | CWE-248 | Kong Mesh: control plane denial of service via a malformed dataplane token wi… |
| CVE-2026-17095 | 8.3 | 31.1 | IBM | i | CWE-915 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-63293 | 9.9 | 31.0 | Canonical | LXD | CWE-59 | Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesys… |
| CVE-2026-73300 | 9.6 | 30.8 | Budibase | budibase | CWE-89 | Budibase: SQL Injection via `multipleStatements: true` |
| CVE-2026-72508 | 9.9 | 30.6 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-250 | Multicloud-operators-subscription: multicloud-operators-subscription: hub and… |
| CVE-2026-19004 | 8.8 | 30.7 | MongoDB | BI Connector ODBC Driver | CWE-122 | MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Pro… |
| CVE-2026-18952 | 8.6 | 30.5 | AWS | Opensearch | CWE-918 | Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security A… |
| CVE-2026-67285 | 9.2 | 30.2 | joomshaper.com | SP Page Builder extension for Joomla | CWE-22 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file … |
| CVE-2026-68760 | 5.3 | 30.1 | jfrog | artifactory | CWE-287 | Potential remember-me authentication bypass in JFrog Artifactory |
| CVE-2026-73406 | 7.5 | 30.0 | Budibase | budibase | CWE-200 | Budibase: Unauthenticated user information disclosure via public tenant user … |
| CVE-2026-64826 | 7.1 | 30.0 | rConfig | rConfig | CWE-22 | rConfig < 8.2.13 Path Traversal File Read via FileDownloadController |
| CVE-2026-73268 | 9.9 | 29.7 | Red Hat | Multicluster Engine for Kubernetes | CWE-94 | Cluster-curator-controller: cluster-curator-controller: spec.install.override… |
| CVE-2026-71193 | 9.6 | 29.7 | OpenStack | Designate | CWE-863 | In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_… |
| CVE-2026-50561 | 9.4 | 29.7 | xerrors | Yuxi | CWE-287 | Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator … |
| CVE-2026-57858 | 9.3 | 29.7 | Cal.com | Cal.com Self-Hosted (Cal.diy) | CWE-79 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID |
| CVE-2026-12005 | 7.2 | 29.7 | IBM | Security Verify Access | CWE-78 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-12618 | 7.2 | 29.7 | IBM | Security Verify Access | CWE-74 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-18106 | 4.3 | 29.5 | IBM | i | CWE-22 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-68431 | 9.1 | 29.3 | Linux | Linux | — | ksmbd: validate minimum PDU size for transform requests |
| CVE-2026-73499 | 7.1 | 29.2 | etcd-io | etcd | CWE-863 | etcd: Watch API authorization bypass via open-ended range requests |
| CVE-2025-15687 | 2.1 | 29.0 | n/a | Open5GS | CWE-404 | Open5GS SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb denial of service |
| CVE-2025-59322 | 7.5 | 28.7 | n/a | n/a | CWE-329 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly hand… |
| CVE-2026-71469 | 7.5 | 28.5 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-770 | Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows u… |
| CVE-2026-73374 | 6.1 | 28.6 | vulnerability-lookup | vulnerability-lookup | CWE-79 | Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnera… |
| CVE-2026-68969 | 6.5 | 28.4 | Apache Software Foundation | Apache Airflow | CWE-532 | Apache Airflow: Bulk Variable and Connection endpoints record secret values i… |
| CVE-2026-16627 | 9.0 | 28.3 | GitLab | GitLab | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scri… |
| CVE-2026-63298 | 9.9 | 28.2 | Canonical | LXD | CWE-78 | LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration |
| CVE-2026-69106 | 8.8 | 28.2 | jfrog | artifactory | CWE-20 | Potential cache poisoning in JFrog Artifactory |
| CVE-2026-73263 | 9.9 | 27.8 | prowler-cloud | prowler | CWE-78 | Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path |
| CVE-2026-16856 | 8.8 | 27.8 | IBM | i | CWE-78 | IBM i is Affected By Multiple Vulnerabilities in Domain Name System |
| CVE-2026-18749 | 9.8 | 27.7 | CERT/CC | VINCE | CWE-639 | CVE-2026-18749 |
| CVE-2026-13105 | 8.8 | 27.6 | IBM | i Access Client Solutions | CWE-22 | IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities |
| CVE-2026-44741 | 8.8 | 27.6 | pimcore | pimcore | CWE-89 | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid … |
| CVE-2026-12004 | 8.7 | 27.4 | IBM | Security Verify Access | CWE-134 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-73412 | 6.3 | 27.4 | ericcornelissen | shescape | CWE-78 | Shescape: Path disclosure on Unix with Zsh |
| CVE-2026-64639 | 9.3 | 27.2 | WebPros | Plesk | CWE-266 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and… |
| CVE-2026-19566 | 7.5 | 27.1 | RRWO | Net::CIDR::Set | CWE-789 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malf… |
| CVE-2026-73285 | 7.5 | 27.1 | rustfs | rustfs | CWE-863 | RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-ba… |
| CVE-2026-73493 | 7.5 | 27.1 | http4s | blaze | CWE-770 | http4s-blaze-server: Unbounded WebSocket message aggregation |
| CVE-2026-66898 | 9.9 | 27.0 | Canonical | LXD | CWE-22 | Path traversal via unvalidated instance name in backup tarball restore enable… |
| CVE-2026-73501 | 9.1 | 26.9 | getkin | kin-openapi | CWE-287 | kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via Noo… |
| CVE-2026-15803 | 8.7 | 26.9 | Eclipse Foundation | Eclipse RDF4J | CWE-611 | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML E… |
| CVE-2026-73239 | 6.5 | 26.8 | Apache Software Foundation | Apache Allura | CWE-280 | Apache Allura: Missing permission checks IDOR |
| CVE-2026-16863 | 7.7 | 26.8 | IBM | i | CWE-125 | IBM i is Affected By Out-of-Bounds Read Vulnerability [] |
| CVE-2026-68076 | 5.4 | 26.8 | Apache Software Foundation | Apache Airflow | CWE-639 | Apache Airflow: Connections test API: team-scope guard bypass resolves anothe… |
| CVE-2026-68756 | 6.6 | 26.6 | jfrog | artifactory | CWE-502 | Potential insecure deserialization in JFrog Artifactory |
| CVE-2026-19643 | 6.0 | 26.4 | AWS | aws-sdk-cpp | CWE-125 | Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char… |
| CVE-2026-73413 | 8.7 | 26.0 | ericcornelissen | shescape | CWE-400 | Shescape: Quadratic-time denial of service in flag-protection |
| CVE-2026-73411 | 6.3 | 26.0 | ericcornelissen | shescape | CWE-116 | Shescape: Home-directory disclosure in assignment context on Unix with Dash |
| CVE-2026-68752 | 7.2 | 26.0 | jfrog | artifactory | CWE-269 | Project Resource Managers may escalate privileges in JFrog Artifactory |
| CVE-2026-16494 | 7.1 | 25.7 | GitLab | GitLab | CWE-862 | Missing Authorization in GitLab |
| CVE-2026-17248 | 6.5 | 25.6 | IBM | i | CWE-78 | IBM i is Affected By Multiple Vulnerabilities in the Debug Server |
| CVE-2026-73430 | 5.3 | 25.6 | Eugeny | russh | CWE-754 | Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encod… |
| CVE-2026-12359 | 8.1 | 25.4 | IBM | Security Verify Access | CWE-287 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-72526 | 9.9 | 25.3 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-441 | Multicloud-integrations: multicloud-integrations: pull-model propagation allo… |
| CVE-2026-68971 | 6.5 | 25.1 | Apache Software Foundation | Apache Airflow | CWE-862 | Apache Airflow: Cross-team authorization bypass in the asset materialization … |
| CVE-2026-73498 | 7.7 | 25.1 | sooperset | mcp-atlassian | CWE-22 | MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via miss… |
| CVE-2026-72786 | 7.1 | 25.0 | craftcms | cms | CWE-285 | Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset |
| CVE-2026-17109 | 4.3 | 24.9 | IBM | i | CWE-20 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-73427 | 2.1 | 24.9 | basecamp | trix | CWE-79 | Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputContro… |
| CVE-2026-11932 | 7.5 | 24.7 | IBM | Security Verify Access | CWE-835 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-73306 | 5.3 | 24.3 | Budibase | budibase | CWE-204 | Budibase: Account Enumeration via Login Lockout Response Differential |
| CVE-2026-73264 | 7.6 | 24.1 | prowler-cloud | prowler | CWE-918 | Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider |
| CVE-2026-18235 | 8.3 | 23.9 | IBM | i | CWE-78 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2024-27253 | 10.0 | 23.8 | IBM | DOORS Next | CWE-287 | IBM Engineering Requirements Management DOORS Next is impacted by vulnerabili… |
| CVE-2026-14925 | 7.5 | 23.8 | Unknown | Import WP | CWE-200 | Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Expo… |
| CVE-2026-18677 | 6.0 | 23.5 | Kong Inc. | Kong Mesh | CWE-290 | Kong Mesh: a dataplane token without a workload binding can claim any workloa… |
| CVE-2026-73307 | 4.9 | 23.5 | Budibase | budibase | CWE-918 | Budibase: SSRF via bare fetch() in uploadUrl during AI table generation |
| CVE-2026-18673 | 5.3 | 23.2 | Kong Inc. | Kong Mesh | CWE-200 | Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without … |
| CVE-2026-73422 | 5.3 | 23.2 | withastro | astro | CWE-79 | Astro: Reflected XSS via unescaped View Transition animation properties |
| CVE-2026-18888 | 7.1 | 23.0 | MongoDB | BI Connector ODBC Driver | CWE-787 | MongoDB BI Connector ODBC driver may write outside an allocated buffer when r… |
| CVE-2026-70466 | 5.3 | 23.0 | Fortinet | FortiWeb | CWE-184 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0… |
| CVE-2026-62420 | 9.9 | 22.8 | Canonical | LXD | CWE-863 | Cross-project cluster migration bypasses project restrictions via cluster not… |
| CVE-2026-72806 | 6.9 | 22.8 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Authentication Bypass via Attribute View |
| CVE-2026-12233 | 5.9 | 22.7 | zephyrproject | zephyr | CWE-665 | Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-dere… |
| CVE-2026-19002 | 8.8 | 22.6 | MongoDB | BI Connector ODBC Driver | CWE-120 | Crafted database metadata may cause memory corruption in MongoDB BI Connector… |
| CVE-2026-71194 | 6.8 | 22.6 | OpenStack | Designate | CWE-669 | In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lo… |
| CVE-2026-67287 | 6.3 | 22.5 | joomshaper.com | SP Page Builder extension for Joomla | CWE-284 | Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Pa… |
| CVE-2026-42018 | 7.5 | 22.5 | jfrog | artifactory | CWE-287 | Anonymous user token generation exposure in JFrog Artifactory |
| CVE-2026-73265 | 6.5 | 22.5 | rustfs | rustfs | CWE-862 | RustFS: Version-specific object reads authorize the non-version action |
| CVE-2025-15686 | 2.1 | 22.3 | n/a | Open5GS | CWE-404 | Open5GS HSS Service fd_msg_sess_get denial of service |
| CVE-2026-19642 | 6.0 | 22.1 | AWS | aws-sdk-cpp | CWE-787 | Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp |
| CVE-2026-18744 | 6.5 | 22.0 | CERT/CC | VINCE | CWE-639 | CVE-2026-18744 |
| CVE-2026-19426 | 8.8 | 21.7 | FitSoft | POS System | CWE-306 | FitSoft｜POS Sytstem - Missing Authentication |
| CVE-2026-17485 | 8.2 | 21.6 | IBM | i | CWE-125 | IBM i is Affected By Denial of Service Vulnerability [] |
| CVE-2026-16033 | 8.5 | 21.4 | Canonical | LXD | CWE-22 | Arbitrary file read+write on host via templates/ symlink in malicious image |
| CVE-2024-14044 | 2.1 | 21.4 | n/a | Open5GS | CWE-119 | Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow |
| CVE-2026-72789 | 9.2 | 21.2 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks |
| CVE-2026-73308 | 5.7 | 21.3 | Budibase | budibase | CWE-200 | Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Ot… |
| CVE-2026-72788 | 6.9 | 21.2 | siyuan-note | siyuan | CWE-863 | SiYuan before v3.7.4 Information Disclosure via UILayout Filter |
| CVE-2026-63300 | 9.9 | 21.0 | Canonical | LXD | CWE-862 | Cross-project instance move bypasses all project restrictions allowing host c… |
| CVE-2026-68433 | 8.6 | 21.0 | Linux | Linux | — | libceph: bound get_version reply decode to front len |
| CVE-2026-66381 | 5.3 | 21.0 | jfrog | artifactory | CWE-22 | Repository readers may access content outside configured upstream paths |
| CVE-2026-73429 | 5.3 | 21.1 | Eugeny | russh | CWE-704 | Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) |
| CVE-2026-66659 | 9.3 | 20.8 | Essekia | Tablesome Table | CWE-89 | WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability |
| CVE-2026-73495 | 7.4 | 20.9 | http4s | blaze | CWE-444 | blaze: Chunked-body trailer fields promoted into Request.headers in blaze-ser… |
| CVE-2026-19656 | 9.9 | 20.5 | SCADA-LTS | ScadaLTS | CWE-862 | ScadaLTS Authenticated Remote Code Execution |
| CVE-2026-13613 | 8.8 | 20.5 | Unknown | KiviCare | CWE-89 | KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing RE… |
| CVE-2026-73405 | 5.3 | 20.4 | vulnerability-lookup | vulnerability-lookup | CWE-862 | Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Str… |
| CVE-2026-63299 | 9.9 | 20.2 | Canonical | LXD | CWE-770 | Storage volume cross-project move and snapshot restore bypass project disk li… |
| CVE-2026-73284 | 8.8 | 20.3 | rustfs | rustfs | CWE-269 | RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Acco… |
| CVE-2026-72808 | 6.9 | 20.3 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via getFileAnnotation |
| CVE-2026-17082 | 8.8 | 20.2 | IBM | i | CWE-269 | IBM i is Affected By Multiple Vulnerabilities in the Debug Server |
| CVE-2026-18474 | 8.6 | 20.1 | Unknown | WP Directory Kit | CWE-89 | WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location … |
| CVE-2026-69107 | 5.9 | 20.0 | jfrog | artifactory | CWE-862 | Potential unauthorized artifact access in JFrog Artifactory |
| CVE-2026-6821 | 4.3 | 20.1 | GitLab | GitLab | CWE-862 | Missing Authorization in GitLab |
| CVE-2026-16253 | 7.5 | 19.9 | Unknown | Total Upkeep | CWE-200 | Total Upkeep (BoldGrid Backup) < 1.17.3 - Unauthenticated Sensitive Data Disc… |
| CVE-2026-18049 | 7.5 | 19.9 | Unknown | WP Photo Album Plus | CWE-200 | WP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogo |
| CVE-2026-73431 | 8.8 | 19.8 | vulnerability-lookup | vulnerability-lookup | CWE-294 | Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeov… |
| CVE-2026-13361 | 8.8 | 19.7 | IBM | Informix Dynamic Server | CWE-121 | IBM Informix Server Vulnerability in SQL Interface Handler Could Allow Remote… |
| CVE-2026-49473 | 8.8 | 19.5 | cedar-policy | authorization-for-expressjs | CWE-436 | @cedar-policy/authorization-for-expressjs has an authorization bypass via que… |
| CVE-2026-10543 | 9.8 | 19.4 | IBM | Db2 | CWE-285 | IBM® Db2® is vulnerable to privilege escalation with a specially crafted query |
| CVE-2026-18499 | 8.1 | 19.4 | IBM | WebSphere Application Server - Liberty | CWE-285 | IBM WebSphere Application Server Liberty is affected by a privilege escalation |
| CVE-2026-66375 | 8.1 | 19.3 | jfrog | artifactory | CWE-862 | Low-privilege users may remove protected Artifactory metadata |
| CVE-2026-73326 | 7.2 | 19.2 | owen2345 | CamaleonCMS | CWE-862 | CamaleonCMS Missing Authorization via Plugin Administration Endpoints |
| CVE-2026-18652 | 4.9 | 19.3 | Rapid7 | Velociraptor | CWE-862 | Velociraptor STACK Type Download Path Bypasses Denied Prefix Check |
| CVE-2026-73291 | 7.1 | 19.2 | seerr-team | seerr | CWE-22 | Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstr… |
| CVE-2026-17616 | 9.8 | 18.8 | IBM | Security Verify Access | CWE-310 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-47718 | 5.5 | 18.8 | frangoteam | FUXA | CWE-287 | FUXA provides guest and invalid-token access to protected read APIs in secure… |
| CVE-2026-12976 | 6.5 | 18.7 | Unknown | LearnPress | CWE-200 | LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant |
| CVE-2026-13168 | 6.5 | 18.7 | Unknown | Eventin | CWE-200 | Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API |
| CVE-2026-17420 | 6.3 | 18.5 | IBM | i | CWE-78 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-15216 | 8.7 | 18.0 | GitLab | GitLab | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scri… |
| CVE-2026-48550 | 5.1 | 18.0 | Nagios Enterprises, LLC. | Nagios Core | CWE-79 | Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter |
| CVE-2026-17276 | 9.9 | 17.8 | IBM | i | CWE-269 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-73331 | 7.1 | 17.8 | owen2345 | CamaleonCMS | CWE-89 | CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field |
| CVE-2026-66384 | 5.3 | 17.8 | jfrog | artifactory | CWE-22 | Authenticated users may write data outside the intended Docker cache path |
| CVE-2026-18789 | 7.5 | 17.6 | Unknown | Ezoic | CWE-862 | Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes |
| CVE-2026-15217 | 8.7 | 17.4 | GitLab | GitLab | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scri… |
| CVE-2026-15423 | 8.5 | 17.2 | GitLab | GitLab | CWE-863 | Incorrect Authorization in GitLab |
| CVE-2026-73269 | 9.9 | 17.1 | Red Hat | Multicluster Engine for Kubernetes | CWE-269 | Cluster-curator-controller: cluster-curator-controller: tenant-controllable t… |
| CVE-2026-71473 | 8.5 | 17.1 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-915 | Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannot… |
| CVE-2026-73325 | 8.4 | 17.1 | Fujitsu Research | OneCompression | CWE-502 | Fujitsu OneCompression 1.2.0 Arbitrary Code Execution via torch.load Deserial… |
| CVE-2026-68758 | 6.5 | 17.1 | jfrog | artifactory | CWE-862 | Authenticated users may access restricted Artifactory support information |
| CVE-2026-72796 | 6.9 | 17.0 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Access Control Bypass via Static Routes |
| CVE-2026-72798 | 9.2 | 16.9 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via renderAttributeView |
| CVE-2026-72804 | 9.2 | 16.7 | siyuan-note | siyuan | CWE-200 | SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints |
| CVE-2026-66382 | 4.3 | 16.7 | jfrog | artifactory | CWE-22 | Authenticated users may write files outside the intended Artifactory work dir… |
| CVE-2026-17111 | 9.8 | 16.2 | IBM | i | CWE-89 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-17222 | 4.3 | 16.2 | IBM | i | CWE-89 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-73301 | 4.3 | 16.2 | Budibase | budibase | CWE-862 | Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumer… |
| CVE-2026-70398 | 9.6 | 16.0 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-441 | Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserv… |
| CVE-2026-72794 | 9.2 | 16.0 | siyuan-note | siyuan | CWE-522 | siyuan before v3.7.4 Session Cookie Key Disclosure via getConf |
| CVE-2026-46382 | 8.7 | 16.0 | meeting-room-booking-system | mrbs-code | CWE-918 | Meeting Room Booking System has server-side request forgery in import functio… |
| CVE-2026-46688 | 6.9 | 16.0 | meeting-room-booking-system | mrbs-code | CWE-601 | Meeting Room Booking System has an unauthenticated open redirect |
| CVE-2026-70467 | 3.8 | 16.0 | Fortinet | FortiSIEM | CWE-918 | A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.… |
| CVE-2026-13267 | 8.1 | 15.8 | IBM | Security Verify Access | CWE-302 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-67283 | 6.9 | 15.8 | tabaoca.org | Cotton Cloud extension for Joomla | CWE-284 | Joomla Extension - tabaoca.org - Improper ACL implementation allows allow fil… |
| CVE-2026-63296 | 9.9 | 15.6 | Canonical | LXD | CWE-863 | Project restriction bypass via instance migration config override |
| CVE-2026-73288 | 6.1 | 15.4 | rustfs | rustfs | CWE-693 | RustFS: Object Lock (WORM) protections are treated as absent when bucket meta… |
| CVE-2026-73491 | 2.3 | 15.4 | flavorjones | loofah | CWE-184 | Loofah `allowed_uri?` does not detect `javascript:` URIs split by named white… |
| CVE-2026-73492 | 2.3 | 15.4 | flavorjones | loofah | CWE-79 | Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric cha… |
| CVE-2026-66377 | 5.3 | 15.3 | jfrog | artifactory | CWE-862 | Anonymous users may access restricted Artifactory repository information |
| CVE-2026-18048 | 7.5 | 15.2 | Unknown | WP Photo Album Plus | CWE-73 | WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletio… |
| CVE-2026-11923 | 7.4 | 15.2 | IBM | Security Verify Access | CWE-287 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-17419 | 6.5 | 15.3 | IBM | i | CWE-89 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-73290 | 5.3 | 15.2 | rustfs | rustfs | CWE-863 | RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through t… |
| CVE-2026-4879 | 4.3 | 15.2 | GitLab | GitLab | CWE-862 | Missing Authorization in GitLab |
| CVE-2026-18433 | 4.3 | 15.2 | GitLab | GitLab | CWE-863 | Incorrect Authorization in GitLab |
| CVE-2026-65937 | 8.0 | 15.1 | Progress Software Corporation | WhatsUp Gold | CWE-79 | WhatsUp Gold versions prior to 26.0.2 contain multiple stored cross-site scri… |
| CVE-2026-73432 | 5.1 | 15.1 | vulnerability-lookup | vulnerability-lookup | CWE-918 | Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows … |
| CVE-2026-72793 | 9.2 | 15.0 | siyuan-note | siyuan | CWE-522 | SiYuan before v3.7.4 Information Disclosure via /api/system/getConf |
| CVE-2026-72795 | 9.2 | 15.0 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via Embed Block |
| CVE-2026-72801 | 8.7 | 15.0 | siyuan-note | siyuan | CWE-522 | SiYuan before v3.7.4 Information Disclosure via Encryption Key Material |
| CVE-2026-8667 | 4.3 | 14.7 | GitLab | GitLab | CWE-863 | Incorrect Authorization in GitLab |
| CVE-2026-73286 | 8.1 | 14.6 | rustfs | rustfs | CWE-863 | RustF: Request headers can populate server-derived IAM condition keys, lettin… |
| CVE-2026-65939 | 6.8 | 14.6 | Progress Software Corporation | WhatsUp Gold | CWE-22 | WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnera… |
| CVE-2026-68753 | 5.3 | 14.6 | jfrog | artifactory | CWE-862 | Anonymous users may access restricted Artifactory content under specific conf… |
| CVE-2026-73292 | 8.3 | 14.4 | semaphoreui | semaphore | CWE-352 | Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token … |
| CVE-2026-16480 | 7.1 | 14.5 | IBM | Db2 | CWE-602 | IBM® Db2® is affected by an improper authorization vulnerability in the certa… |
| CVE-2026-72790 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via getNotebookInfo |
| CVE-2026-72791 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews |
| CVE-2026-72792 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-863 | SiYuan before v3.7.4 Information Disclosure via Tag API |
| CVE-2026-72797 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus |
| CVE-2026-72799 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via Path Resolution |
| CVE-2026-72800 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via Unfiltered API |
| CVE-2026-72802 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-639 | SiYuan before v3.7.4 Information Disclosure via resolveAssetPath |
| CVE-2026-72803 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via getBlockAttrs |
| CVE-2026-72805 | 6.9 | 14.4 | siyuan-note | siyuan | CWE-862 | SiYuan before v3.7.4 Information Disclosure via Block Endpoints |
| CVE-2026-17445 | 6.5 | 14.5 | IBM | i | CWE-250 | IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon [] |
| CVE-2026-18750 | 5.3 | 14.4 | CERT/CC | VINCE | CWE-639 | CVE-2026-18750 |
| CVE-2026-15388 | 4.3 | 14.3 | Unknown | Cookie Consent | CWE-863 | Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log… |
| CVE-2026-18144 | 4.3 | 14.4 | IBM | i | CWE-285 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-13171 | 8.2 | 14.2 | Unknown | Eventin | CWE-284 | Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint |
| CVE-2026-47227 | 6.5 | 14.3 | Admidio | admidio | CWE-639 | Admidio module-administrator can delete or reorder categories owned by other … |
| CVE-2026-16538 | 9.1 | 13.9 | Unknown | Wallet for WooCommerce | CWE-284 | TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inf… |
| CVE-2026-64954 | 8.2 | 13.8 | Rapid7 | Velociraptor | CWE-862 | Velociraptor collect_client() Permissions Bypass |
| CVE-2026-73303 | 8.2 | 13.8 | Budibase | budibase | CWE-639 | Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeov… |
| CVE-2026-73289 | 8.1 | 13.7 | rustfs | rustfs | CWE-863 | RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, in… |
| CVE-2026-19228 | 8.5 | 13.6 | GitLab | GitLab | CWE-639 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-59244 | 6.5 | 13.6 | Apache Software Foundation | Apache Airflow | CWE-312 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the … |
| CVE-2026-68970 | 6.5 | 13.6 | Apache Software Foundation | Apache Airflow | CWE-312 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs … |
| CVE-2026-18676 | 5.1 | 13.7 | Kong Inc. | Kong Mesh | CWE-346 | Kong Mesh: default control plane config leaks the admin token cross-origin vi… |
| CVE-2026-73329 | 9.2 | 13.4 | owen2345 | CamaleonCMS | CWE-79 | CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint |
| CVE-2026-73332 | 9.2 | 13.4 | owen2345 | CamaleonCMS | CWE-89 | CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field |
| CVE-2026-68759 | 7.2 | 13.4 | jfrog | artifactory | CWE-347 | Integration credential holders may impersonate users in JFrog Access |
| CVE-2025-15685 | 5.3 | 13.4 | n/a | Open5GS | CWE-119 | Open5GS freeDiameter memory corruption |
| CVE-2025-59325 | 7.5 | 13.2 | n/a | n/a | CWE-311 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the i… |
| CVE-2026-11937 | 3.1 | 13.1 | IBM | Security Verify Access | CWE-416 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-10534 | 9.8 | 13.0 | IBM | Db2 | CWE-121 | IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser |
| CVE-2025-9486 | 3.3 | 13.0 | GitLab | GitLab | CWE-266 | Incorrect Privilege Assignment in GitLab |
| CVE-2026-64955 | 6.1 | 12.8 | Rapid7 | Velociraptor | CWE-1236 | Velociraptor CSV Formula Injection in Export Pipeline |
| CVE-2026-47233 | 6.5 | 12.4 | Admidio | admidio | CWE-862 | Admidio: Any logged-in user can delete inventory fields via `mode=field_delet… |
| CVE-2026-68754 | 6.5 | 12.4 | jfrog | artifactory | CWE-862 | Publishers without delete permission can overwrite docker layer information |
| CVE-2026-49349 | 6.8 | 12.2 | regclient | regclient | CWE-522 | regclient may leak authentication credentials to external blob stores |
| CVE-2026-16747 | 6.5 | 12.2 | Unknown | Kirki | CWE-74 | Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email … |
| CVE-2026-18943 | 6.5 | 12.2 | Unknown | WPC Admin Columns | CWE-200 | WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure |
| CVE-2026-16977 | 8.1 | 11.7 | Unknown | Form Maker by 10Web | CWE-89 | Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name |
| CVE-2026-18057 | 8.1 | 11.7 | Unknown | Events Manager | CWE-89 | Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL… |
| CVE-2026-18230 | 8.1 | 11.7 | Unknown | WP Directory Kit | CWE-89 | WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter |
| CVE-2026-18726 | 6.5 | 11.7 | Red Hat | Red Hat Enterprise Linux 10 | CWE-835 | Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement pa… |
| CVE-2026-73262 | 5.4 | 11.7 | prowler-cloud | prowler | CWE-79 | Prowler: Stored XSS in HTML reports through unescaped cloud resource tags |
| CVE-2026-63295 | 4.3 | 11.4 | Canonical | LXD | CWE-863 | Project restriction `restricted.containers.privilege=isolated` bypassable by … |
| CVE-2026-47231 | 8.1 | 11.4 | Admidio | admidio | CWE-639 | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any fold… |
| CVE-2026-66878 | 7.7 | 11.3 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-639 | Multicloud-operators-subscription: multicloud-operators-subscription: fetchch… |
| CVE-2026-73122 | 7.7 | 11.3 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-269 | Multicloud-operators-channel: multicloud-operators-channel: auto-generated ro… |
| CVE-2026-65940 | 6.8 | 11.3 | Progress Software Corporation | WhatsUp Gold | CWE-276 | WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allow… |
| CVE-2026-73287 | 5.4 | 11.3 | rustfs | rustfs | CWE-862 | RustFS: FTPS MKD bypasses IAM CreateBucket authorization |
| CVE-2026-16737 | 5.3 | 11.2 | Unknown | WP Travel Engine | CWE-639 | WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Mod… |
| CVE-2026-18035 | 5.3 | 11.2 | Unknown | User Access Manager | CWE-862 | User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure … |
| CVE-2026-19503 | 6.3 | 11.0 | MongoDB | Atlas SQL ODBC Driver | CWE-20 | Insufficient OIDC endpoint validation could invoke unintended local protocol … |
| CVE-2026-17268 | 6.8 | 10.9 | IBM | i | CWE-294 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-65370 | 7.5 | 10.7 | Apple | servicetalk | CWE-444 | ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which co… |
| CVE-2026-67284 | 5.3 | 10.7 | tabaoca.org | Cotton Cloud extension for Joomla | CWE-284 | Joomla Extension - tabaoca.org - Improper ACL checks allow file operations in… |
| CVE-2026-72809 | 7.1 | 10.6 | siyuan-note | siyuan | CWE-290 | SiYuan before v3.7.4 Authentication Bypass via Localhost Trust |
| CVE-2026-19073 | 5.3 | 10.6 | Unknown | Order Sync with Zendesk for WooCommerce | CWE-200 | Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Or… |
| CVE-2026-18148 | 4.3 | 10.6 | IBM | i | CWE-117 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-18244 | 4.3 | 10.3 | GitLab | GitLab | CWE-862 | Missing Authorization in GitLab |
| CVE-2026-66378 | 4.3 | 10.3 | jfrog | artifactory | CWE-862 | Authenticated users may access private NuGet metadata |
| CVE-2026-66379 | 4.3 | 10.3 | jfrog | artifactory | CWE-862 | Authenticated users may view private Puppet module metadata |
| CVE-2026-66380 | 4.3 | 10.3 | jfrog | artifactory | CWE-862 | Authenticated users may access private OCI referrer metadata |
| CVE-2026-70547 | 4.3 | 10.3 | jfrog | artifactory | CWE-862 | Potential unauthorized metadata exposure in JFrog Artifactory |
| CVE-2026-47226 | 6.5 | 10.1 | Admidio | admidio | CWE-639 | Admidio: Authorization bypass in file_delete enables cross-folder file remova… |
| CVE-2026-19588 | 6.5 | 10.1 | Samsung Open Source | rlottie | CWE-680 | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlot… |
| CVE-2026-72807 | 8.8 | 9.7 | siyuan-note | siyuan | CWE-89 | SiYuan before v3.7.4 SQL Injection via queryBlocks template |
| CVE-2026-19587 | 6.5 | 9.7 | Samsung Open Source | rlottie | CWE-400 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlotti… |
| CVE-2026-18727 | 6.5 | 9.4 | Red Hat | Red Hat Enterprise Linux 10 | CWE-191 | Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing |
| CVE-2026-19657 | 6.1 | 9.5 | SCADA-LTS | ScadaLTS | CWE-79 | ScadaLTS Unauthenticated Reflected XSS |
| CVE-2026-14858 | 4.3 | 9.4 | Unknown | WP Crowdfunding | CWE-639 | WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR |
| CVE-2026-63297 | 9.9 | 9.3 | Canonical | LXD | CWE-367 | Cross-project instance copy bypasses target project restrictions via TOCTOU i… |
| CVE-2026-15045 | 6.5 | 9.2 | Unknown | Wallet System for WooCommerce | CWE-472 | Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulatio… |
| CVE-2026-18098 | 8.1 | 9.1 | IBM | i | CWE-346 | IBM i is Affected By XML injection flaw in Navigator for i |
| CVE-2026-68757 | 7.5 | 9.0 | jfrog | artifactory | CWE-347 | Potential improper SAML signature verification in JFrog Artifactory |
| CVE-2026-16990 | 5.3 | 9.1 | Unknown | Payment Button for PayPal | — | Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipul… |
| CVE-2026-73419 | 6.8 | 9.0 | nextauthjs | next-auth | CWE-345 | NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the … |
| CVE-2026-18246 | 4.3 | 9.0 | IBM | i | CWE-436 | IBM i is Affected By security restrictions bypass in Navigator for i |
| CVE-2026-68755 | 4.3 | 8.9 | jfrog | artifactory | CWE-863 | Bundle writers may alter trusted release information in JFrog Artifactory |
| CVE-2026-73409 | 5.1 | 8.8 | Budibase | budibase | CWE-203 | Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled Mong… |
| CVE-2026-72787 | 5.1 | 8.6 | craftcms | cms | CWE-79 | Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name |
| CVE-2026-65926 | 3.1 | 8.4 | jfrog | artifactory | CWE-862 | Private Release Bundle versions may be disclosed under specific configurations |
| CVE-2026-73295 | 5.4 | 8.1 | squidfunk | mkdocs-material | CWE-79 | Material for MkDocs: DOM XSS in search suggestions via query parameter |
| CVE-2026-13177 | 4.3 | 8.1 | Unknown | Eventin | CWE-639 | Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR |
| CVE-2026-13612 | 4.3 | 8.1 | Unknown | KiviCare | CWE-639 | KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Discl… |
| CVE-2026-14857 | 4.3 | 8.1 | Unknown | WP Crowdfunding | CWE-639 | WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR |
| CVE-2026-14859 | 4.3 | 8.1 | Unknown | WP Crowdfunding | CWE-284 | WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authoriza… |
| CVE-2026-18046 | 4.3 | 8.0 | Unknown | Cookie Consent | CWE-863 | Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update |
| CVE-2026-18099 | 5.4 | 8.0 | IBM | i | CWE-79 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-73423 | 5.1 | 7.8 | withastro | astro | CWE-352 | Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when … |
| CVE-2026-9318 | 4.8 | 7.7 | Jazzband | tablib | CWE-79 | tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title |
| CVE-2025-59320 | 4.6 | 7.7 | n/a | n/a | CWE-922 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets … |
| CVE-2025-41771 | 5.3 | 7.6 | Phoenix Contact | AXC F 1152 | CWE-89 | SQL injection |
| CVE-2026-73490 | 4.7 | 7.6 | flavorjones | loofah | CWE-79 | Loofah: SVG `href` attribute bypasses local-reference restriction |
| CVE-2026-19130 | 5.8 | 7.5 | Red Hat | Multicluster Engine for Kubernetes | CWE-639 | Provider-credential-controller: provider-credential-controller: cross-namespa… |
| CVE-2026-68430 | await | 7.2 | Linux | Linux | — | drm/amdgpu/gfx8: drop unecessary BUG_ON() |
| CVE-2026-68434 | await | 7.3 | Linux | Linux | — | serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR plat… |
| CVE-2026-18847 | 9.8 | 7.1 | IBM | i | CWE-346 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-47230 | 6.5 | 6.9 | Admidio | admidio | CWE-639 | Admidio: IDOR in documents-files.php allows cross-folder file rename and desc… |
| CVE-2026-64952 | 6.5 | 6.9 | Rapid7 | Velociraptor | CWE-863 | Velociraptor Hunt Deletion With Insufficient Permission Check |
| CVE-2026-48551 | 6.1 | 6.8 | Nagios Enterprises, LLC. | Nagios Core | CWE-352 | Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie |
| CVE-2026-68444 | await | 6.8 | Linux | Linux | — | firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() |
| CVE-2026-17418 | 7.8 | 6.5 | IBM | i | CWE-89 | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-73425 | 3.7 | 6.6 | withastro | astro | CWE-185 | @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist becaus… |
| CVE-2026-68443 | await | 6.3 | Linux | Linux | — | hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop |
| CVE-2026-18150 | 5.3 | 6.2 | IBM | i | CWE-362 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-68429 | await | 6.3 | Linux | Linux | — | drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue… |
| CVE-2026-16294 | 7.1 | 6.0 | Unknown | PowerPress Podcasting plugin by Blubrry | CWE-918 | Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via P… |
| CVE-2026-16694 | 5.4 | 5.9 | IBM | i | CWE-79 | IBM i is Affected By Stored Cross-site Scripting for i |
| CVE-2026-48552 | 5.1 | 5.9 | Nagios Enterprises, LLC. | Nagios Core | CWE-79 | Nagios Core / XI DOM-based XSS via jsonquery.js |
| CVE-2026-70560 | 4.8 | 5.9 | Ultimate Fosters | Ultimate POS (Stock Management & Point of Sale) | CWE-79 | Ultimate POS Stored XSS via First Name Field in Leave Notifications |
| CVE-2026-17013 | 6.1 | 5.7 | Unknown | WP Photo Album Plus | CWE-79 | WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart |
| CVE-2026-64951 | 3.5 | 5.7 | Rapid7 | Velociraptor | CWE-369 | Velociraptor DoS triggered by Divide by Zero panic |
| CVE-2026-49466 | 6.5 | 5.6 | dartiss | draft-list | CWE-79 | Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custo… |
| CVE-2026-18250 | 5.0 | 5.6 | IBM | i | CWE-362 | IBM i is Affected By Multiple Vulnerabilities in Navigator for i |
| CVE-2026-65938 | 4.3 | 5.5 | Progress Software Corporation | WhatsUp Gold | CWE-602 | WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulne… |
| CVE-2026-68449 | await | 5.5 | Linux | Linux | — | ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning |
| CVE-2026-68450 | await | 5.5 | Linux | Linux | — | btrfs: free mapping node on duplicate reloc root insert |
| CVE-2026-66376 | 4.2 | 5.4 | jfrog | artifactory | CWE-613 | Deleted users may temporarily retain access to JFrog Artifactory |
| CVE-2026-13622 | 8.8 | 5.2 | Red Hat | Red Hat Container Native Virtualization 4.12 | CWE-22 | Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows … |
| CVE-2026-15249 | 5.4 | 5.1 | Unknown | Patterns Kit | CWE-79 | Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link |
| CVE-2026-16066 | 5.4 | 5.1 | Unknown | Welcart e-Commerce | CWE-79 | Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name |
| CVE-2026-68437 | await | 5.0 | Linux | Linux | — | drm/imagination: Fit paired fragment job in the correct CCCB |
| CVE-2026-68439 | await | 5.0 | Linux | Linux | — | wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() |
| CVE-2026-68435 | await | 4.9 | Linux | Linux | — | LoongArch: Fix address space mismatch in kexec command line lookup |
| CVE-2026-68448 | await | 4.9 | Linux | Linux | — | ovl: check access to copy_file_range source with src mounter creds |
| CVE-2026-18962 | 4.3 | 4.6 | Unknown | WP Photo Album Plus | CWE-639 | WP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Mi… |
| CVE-2026-19052 | 4.3 | 4.6 | Unknown | ProSolution WP Client | CWE-862 | ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_a… |
| CVE-2025-59324 | 9.1 | 4.4 | n/a | n/a | CWE-347 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly vali… |
| CVE-2026-16695 | 7.8 | 4.4 | IBM | i Access Client Solutions | CWE-78 | IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities |
| CVE-2025-59327 | 7.5 | 4.4 | n/a | n/a | CWE-347 | In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails … |
| CVE-2026-68441 | await | 4.3 | Linux | Linux | — | net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains |
| CVE-2026-13094 | 7.8 | 4.1 | IBM | i Access Client Solutions | CWE-94 | IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities |
| CVE-2026-68436 | await | 4.0 | Linux | Linux | — | drm/amd/display: use kvzalloc to allocate struct dc |
| CVE-2026-68438 | await | 4.0 | Linux | Linux | — | smp: Make CSD lock acquisition atomic for debug mode |
| CVE-2026-6484 | 8.2 | 3.9 | Insyde Software | InsydeH2O | CWE-1277 | Lack of verified boot to certain FV may cause arbitrary code execution |
| CVE-2026-64927 | 6.4 | 3.8 | Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | CWE-639 | Multicloud-operators-channel: multicloud-operators-channel: cross-namespace s… |
| CVE-2026-19003 | 8.4 | 3.5 | MongoDB | BI Connector ODBC Driver | CWE-121 | MongoDB BI Connector ODBC driver may write outside an allocated buffer when t… |
| CVE-2026-19050 | 6.4 | 3.1 | Unknown | ProSolution WP Client | CWE-918 | ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate |
| CVE-2026-73433 | 6.6 | 2.9 | GStreamer | gst-plugins-good | CWE-191 | Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fu… |
| CVE-2026-73434 | 6.1 | 2.9 | GStreamer | gst-plugins-good | CWE-125 | Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video… |
| CVE-2026-49262 | 3.0 | 2.9 | aimeos | pagible | CWE-367 | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS r… |
| CVE-2026-68432 | 8.8 | 2.8 | Linux | Linux | — | vxlan: require CAP_NET_ADMIN in the device netns for changelink |
| CVE-2026-47234 | 4.4 | 2.9 | Admidio | admidio | CWE-200 | Admidio writes session IDs and auto-login cookie values to application logs |
| CVE-2026-19217 | 5.4 | 2.8 | Unknown | Royal Addons for Elementor | CWE-79 | Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget |
| CVE-2026-69105 | 8.1 | 2.7 | jfrog | artifactory | CWE-345 | Potential package cache integrity issue in JFrog Artifactory |
| CVE-2026-16999 | 6.3 | 2.7 | Ministry of Justice | UYAP Document Editor | CWE-611 | XXE in Ministry of Justice's UYAP Document Editor |
| CVE-2026-68445 | 7.8 | 2.5 | Linux | Linux | — | drm/vc4: Prevent shader BO mappings from becoming writable |
| CVE-2026-68440 | 7.8 | 2.3 | Linux | Linux | — | net: txgbe: fix heap overflow when reading module EEPROM |
| CVE-2026-46731 | 7.8 | 2.3 | Dell | Display and Peripheral Manager (DDPM Windows) | CWE-290 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.1… |
| CVE-2026-59914 | 7.8 | 2.3 | Dell | Display and Peripheral Manager (DDPM Windows) | CWE-284 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.1… |
| CVE-2026-19548 | 5.5 | 2.2 | Red Hat | Red Hat Enterprise Linux 10 | CWE-416 | Binutils: binutils: multiple use-after-free in add_archive_element via lto pl… |
| CVE-2026-68446 | 7.8 | 2.0 | Linux | Linux | — | drm/vmwgfx: Validate vmw_surface_metadata::array_size |
Results continue: ranks 401–433.
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-08-12 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.
Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.
