Security Box Score — August 14, 2026

201 CVEs published, led by IBM (18).

201 CVEs published August 14, 2026: 24 critical, 84 high, 72 medium, 20 low; 0 in the KEV catalog at press time; 2 with a public exploit reference; 1 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 176 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	4891	27055	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1556 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	416	2731	234	1400	637	1	11	2	0.1	7.8	.0016	+376 ▲
microsoft	442	1864	132	1271	447	14	286	25	1.3	7.8	.0044	-182 ▼
google	49	1810	222	749	783	56	77	6	0.3	7.5	.0025	-45 ▼
red hat	142	528	30	215	252	31	2	0	0.0	6.5	.0028	+96 ▲
apple	2	273	58	79	133	3	88	7	2.6	7.0	.0027	+2 ▲
canonical	11	38	12	9	12	5	0	0	0.0	7.8	.0020	+10 ▲
suse	5	26	5	14	6	1	0	0	0.0	8.1	.0039	-3 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	31	69	13	37	19	0	56	13	18.8	7.5	.0046	+23 ▲
palo alto networks	12	37	1	3	21	12	13	2	5.4	4.7	.0020	-2 ▼
ubiquiti	0	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
netgear	9	32	0	0	27	5	0	0	0.0	4.3	.0025	+3 ▲
fortinet	7	30	7	8	14	1	28	6	20.0	7.0	.0050	-4 ▼
vmware	0	17	4	9	2	2	7	1	5.9	8.3	.0040	-1 ▼
f5	0	16	5	8	3	0	4	1	6.3	8.6	.0057	0
ivanti	3	14	4	8	2	0	25	5	35.7	8.3	.0754	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	97	433	86	187	147	12	33	2	0.5	7.5	.0049	+25 ▲
mozilla	1	128	51	42	35	0	9	0	0.0	8.1	.0031	-5 ▼
gitlab	13	64	1	13	42	8	4	2	3.1	4.9	.0028	+6 ▲
drupal	0	51	6	5	35	5	4	1	2.0	5.9	.0026	-46 ▼
github	5	17	1	7	9	0	0	0	0.0	6.6	.0043	+4 ▲
docker	1	8	0	5	3	0	0	0	0.0	7.7	.0015	+1 ▲
wordpress	1	4	1	2	1	0	2	2	50.0	8.8	.5550	+1 ▲
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	1379	343	653	322	61	27	3	0.2	8.1	.0036	0
ibm	192	421	99	180	137	5	6	1	0.2	7.5	.0031	+190 ▲
adobe	60	312	39	145	123	5	19	3	1.0	7.8	.0026	-33 ▼
progress	16	58	14	34	10	0	6	1	1.7	8.1	.0036	+6 ▲
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	10	16	5	9	2	0	1	0	0.0	8.6	.0034	+10 ▲
zohocorp	4	10	3	5	2	0	0	0	0.0	8.7	.0140	+4 ▲
atlassian	0	3	0	3	0	0	13	0	0.0	8.0	.0026	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
siemens	19	35	2	23	8	2	0	7.3	.0016	+12 ▲
d-link	15	35	15	5	9	6	3	7.4	.0157	+14 ▲
synology	1	24	2	6	13	3	0	5.6	.0025	+1 ▲
rockwell automation	0	24	4	18	2	0	0	8.7	.0029	-17 ▼
schneider electric	0	9	1	6	2	0	0	8.6	.0037	0
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0
moxa	0	5	0	3	2	0	0	7.0	.0029	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	16	136	0	0	73	63	0	0	0.0	5.5	.0033	-21 ▼
dell	18	117	9	58	47	3	2	1	0.9	7.2	.0021	-15 ▼
openclaw	0	111	0	58	39	14	0	0	0.0	7.0	.0026	-16 ▼
nvidia	16	98	13	66	19	0	0	0	0.0	7.7	.0034	-24 ▼
gitea	48	89	19	36	30	4	0	0	0.0	7.5	.0034	+8 ▲
elastic	48	86	0	18	68	0	1	0	0.0	6.5	.0029	+39 ▲
capgo	0	83	2	42	38	1	0	0	0.0	7.1	.0037	-22 ▼
zephyrproject	27	80	2	29	40	9	0	0	0.0	6.5	.0023	+13 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-34486	.9862	99.9	7.5
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-63077	.8473	99.7	9.8
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-72898	.7922	99.6	10.0
CVE-2026-25089	.7611	99.5	9.8
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-59310	.4588	98.7	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.7922	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-48362	10.0	.0431
CVE-2026-47668	10.0	.0388
CVE-2026-19188	10.0	.0193
CVE-2026-44359	10.0	.0180
CVE-2026-58231	10.0	.0171
CVE-2026-16812	10.0	.0157	KEV
CVE-2026-73299	10.0	.0121

Most disclosures (vendor)
Vendor	CVEs
linux	1211
oracle	1108
microsoft	483
google	451
ibm	295
red hat	256
apache	202
apple	169
adobe	75
elastic	67

Most KEV additions (YTD)
Vendor	KEV
microsoft	25
cisco	13
apple	7
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	67
PyPI	5
Go	3
npm	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-18556	N-able	0
CVE-2026-18577	N-able	0
CVE-2026-20316	Cisco	0
CVE-2026-20349	Cisco	0
CVE-2026-25089	Fortinet	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1731
CVE-2021-27102	n/a	2021-11-17	1731
CVE-2021-27101	n/a	2021-11-17	1731
CVE-2021-27103	n/a	2021-11-17	1731
CVE-2021-21017	Adobe	2021-11-17	1731
CVE-2021-28550	Adobe	2021-11-17	1731
CVE-2021-42013	Apache Software Foundation	2021-11-17	1731
CVE-2021-41773	Apache Software Foundation	2021-11-17	1731
CVE-2021-30858	Apple	2021-11-17	1731
CVE-2021-30860	Apple	2021-11-17	1731

Transactions

EXPLOIT PUBLISHED — Unknown ECS: 3 CVEs (CVE-2026-14229, CVE-2026-14230, CVE-2026-18807). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2010-0738. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2010-1428. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2010-2861. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2012-0507. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2016-3351. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25765 (ASP-CMS Project ASP-CMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-30116. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-30119. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13328 (Unknown Food Menu). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-13610 (Unknown KiviCare). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16007 (AppFlowy-IO AppFlowy-Cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16541 (Unknown Simply Schedule Appointments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16611 (Unknown Product Feed PRO for WooCommerce by AdTribes). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-18216 (Unknown Backup Migration). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19710 (SourceCodester Simple Student Information System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19750 (Tenda CH). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19752 (EnzoVezzaro mcp-dominican-layer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19753 (Model Context Protocol mcp-rdf-explorer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19895 (opensourcepos Open Source Point of Sale). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19897 (mangroup dtale). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19900 (LB-LINK X-PRO). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19903 (SourceCodester Online Clothing Store). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19917 (code-projects Online Food Order System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19920 (code-projects Online Shopping System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-34881 (OpenStack Glance). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-39883 (open-telemetry opentelemetry-go). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4035 (mlflow/mlflow). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-43001 (OpenStack Keystone). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-54297 (lostisland faraday). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-59109 (Zalktis Programmas (SIA "Zalktis Programmas") Zalktis). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-62241 (MohibShaikh clawvet). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72777 (DayuanJiang next-ai-draw-io). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73037 (DayuanJiang next-ai-draw-io). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73481 (phplist3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73482 (phplist3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73506 (JanDeDobbeleer oh-my-posh). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73514 (PostGIS address_standardizer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73515 (PostGIS). Public exploit reference added.

RESCORED — CVE-2016-1019. CVSS 7.8 → 9.8 (NVD).

RESCORED — CVE-2021-30116. CVSS 10 → 9.8 (NVD).

RESCORED — CVE-2021-30120. CVSS 9.9 → 7.5 (NVD).

RESCORED — CVE-2026-13601 (Red Hat Enterprise Linux 8). CVSS 7.1 → 6.5 (NVD).

RESCORED — CVE-2026-19757 (Dromara lamp-cloud). CVSS 6.9 → 5.5 (NVD).

RESCORED — CVE-2026-19758 (dromara lamp-cloud). CVSS 6.9 → 5.5 (NVD).

RESCORED — CVE-2026-20156 (Cisco RoomOS Software). CVSS 8.1 → 9.8 (NVD).

RESCORED — CVE-2026-20157 (Cisco RoomOS Software). CVSS 7.5 → 9.8 (NVD).

RESCORED — CVE-2026-34993 (aio-libs aiohttp). CVSS 6.4 → 7.3 (NVD).

RESCORED — CVE-2026-4035 (mlflow/mlflow). CVSS 9.1 → 7.7 (NVD).

RESCORED — CVE-2026-43001 (OpenStack Keystone). CVSS 7.9 → 8 (NVD).

Yesterday's Results

How to read these box scores · glossary

201 CVEs published. 25 box scores, 176 table rows — nothing truncated.

CVE-2026-19682CRITICAL

Tenable, Inc. Security Center — Command Injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4   .0284   85.6     —

AFFECTED
  Product          Versions     Fixed
  Security Center  unspecified  —

TIMELINE
  Aug 12  Reserved by CNA
  Aug 14  Published (CNA: tenable)

CWE-78 · CNA: tenable · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-19771HIGH

Baicells EG3661M LuCI Web luci os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    7.3   .0279   85.3     —

AFFECTED
  Product  Versions                Fixed
  EG3661M  BaiCE_BQ6_2.0.5.3_NA –  —

TIMELINE
  Aug 13  Reserved by CNA
  Aug 14  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-19681CRITICAL

Tenable, Inc. Security Center — Command Injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4   .0278   85.3     —

AFFECTED
  Product          Versions     Fixed
  Security Center  unspecified  —

TIMELINE
  Aug 12  Reserved by CNA
  Aug 14  Published (CNA: tenable)

CWE-78 · CNA: tenable · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-19628HIGH

Tenable, Inc. Security Center — Remote Code Execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    8.6   .0266   84.5     —

AFFECTED
  Product          Versions     Fixed
  Security Center  unspecified  —

TIMELINE
  Aug 12  Reserved by CNA
  Aug 14  Published (CNA: tenable)

CWE-78 · CNA: tenable · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-19188CRITICAL

Haiwell IoT Cloud HMI Gateway OS Command Injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0   .0193   78.5     —

AFFECTED
  Product                        Versions     Fixed
  Haiwell IoT Cloud HMI Gateway  3.40.1.12 –  3.50.1.19

TIMELINE
  Aug 6   Reserved by CNA
  Aug 14  Published (CNA: icscert)

CWE-78 · CNA: icscert · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-73680HIGH

Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0148   71.9     —

AFFECTED
  Product      Versions     Fixed
  Cockpit CMS  unspecified  —

TIMELINE
  Aug 13  Reserved by CNA
  Aug 14  Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-17179MEDIUM

IBM Db2 Mirror for i is affected by multiple vulnerabilities

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  N  H    6.5   .0118   65.2     —

AFFECTED
  Product           Versions  Fixed
  Db2 Mirror for i  7.4 –     —

TIMELINE
  Jul 24  Reserved by CNA
  Aug 14  Published (CNA: ibm)

CWE-78 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-73678CRITICAL

MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec()

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0   .0114   64.3     —

AFFECTED
  Product         Versions     Fixed
  Minds Platform  unspecified  —

TIMELINE
  Aug 13  Public exploit reference published
  Aug 13  Reserved by CNA
  Aug 14  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-19679HIGH

Tenable, Inc. Security Center — Improper Input Validation

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0107   62.2     —

AFFECTED
  Product          Versions     Fixed
  Security Center  unspecified  —

TIMELINE
  Aug 12  Reserved by CNA
  Aug 14  Published (CNA: tenable)

CWE-78 · CNA: tenable · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-73679HIGH

ImpressCMS Authenticated RCE via PHP Custom Tag eval()

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    8.6   .0061   46.5     —

AFFECTED
  Product     Versions     Fixed
  ImpressCMS  unspecified  —

TIMELINE
  Aug 13  Reserved by CNA
  Aug 14  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-73633HIGH

Apache Struts: Unbounded read of a JSON request body

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0060   46.1     —

AFFECTED
  Product        Versions  Fixed
  Apache Struts  2.1.8 –   —

TIMELINE
  Aug 13  Reserved by CNA
  Aug 14  Published (CNA: apache)

CWE-400 · CNA: apache · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-19813HIGH

TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0060   46.1     —

AFFECTED
  Product  Versions                  Fixed
  A800R    4.1.2cu.5137_B20200730 –  —

TIMELINE
  Aug 14  Reserved by CNA
  Aug 14  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19822HIGH

Tenda W20E QoS Edit editQos lstAdd stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0060   46.1     —

AFFECTED
  Product  Versions                           Fixed
  W20E     15.11.0.6(1068_1546_841)_CN_TDC –  —

TIMELINE
  Aug 14  Reserved by CNA
  Aug 14  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19847HIGH

TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0060   46.1     —

AFFECTED
  Product  Versions                  Fixed
  A800R    4.1.2cu.5137_B20200730 –  —

TIMELINE
  Aug 14  Reserved by CNA
  Aug 14  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-16915HIGH

IBM Db2 Mirror for i is affected by multiple vulnerabilities

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0057   44.6     —

AFFECTED
  Product           Versions  Fixed
  Db2 Mirror for i  7.4 –     —

TIMELINE
  Jul 24  Reserved by CNA
  Aug 14  Published (CNA: ibm)

CWE-22 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-18554HIGH

IBM Db2 Mirror for i is affected by multiple vulnerabilities

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0057   44.6     —

AFFECTED
  Product           Versions  Fixed
  Db2 Mirror for i  7.4 –     —

TIMELINE
  Aug 1   Reserved by CNA
  Aug 14  Published (CNA: ibm)

CWE-22 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-69414HIGH

Microsoft Defender Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0056   43.9     —

AFFECTED
  Product                              Versions  Fixed
  Microsoft Malware Protection Engine  - –       —

TIMELINE
  Aug 3   Reserved by CNA
  Aug 14  Published (CNA: microsoft)

CWE-284 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Modified

CVE-2026-72970HIGH

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  L    8.3   .0053   42.6     —

AFFECTED
  Product                          Versions   Fixed
  Microsoft Edge (Chromium-based)  1.0.0.0 –  —

TIMELINE
  Aug 10  Reserved by CNA
  Aug 14  Published (CNA: microsoft)

CWE-122 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-66271HIGH

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with D…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0052   41.9     —

AFFECTED
  Product                      Versions     Fixed
  Wyse Management Suite (WMS)  unspecified  —

TIMELINE
  Jul 24  Reserved by CNA
  Aug 14  Published (CNA: dell)

CWE-434 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-17184CRITICAL

IBM Db2 Mirror for i is affected by multiple vulnerabilities

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0051   41.4     —

AFFECTED
  Product           Versions  Fixed
  Db2 Mirror for i  7.4 –     —

TIMELINE
  Jul 24  Reserved by CNA
  Aug 14  Published (CNA: ibm)

CWE-73 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-73673HIGH

Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    8.7   .0051   41.2     —

AFFECTED
  Product                            Versions     Fixed
  Netis NC63 Wireless AC1200 Router  unspecified  —

TIMELINE
  Aug 13  Reserved by CNA
  Aug 14  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-50027CRITICAL

doobidoo mcp-memory-service — mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0050   40.7     —

AFFECTED
  Product             Versions     Fixed
  mcp-memory-service  < 10.67.1 –  —

TIMELINE
  Jun 2   Reserved by CNA
  Aug 14  Published (CNA: GitHub_M)

CWE-306 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-72819HIGH

getgrav grav — Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0050   40.6     —

AFFECTED
  Product  Versions     Fixed
  grav     unspecified  2.0.13

TIMELINE
  Aug 10  Reserved by CNA
  Aug 14  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-19626CRITICAL

Tenable, Inc. Security Center — Remote Code Execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4   .0050   40.4     —

AFFECTED
  Product          Versions     Fixed
  Security Center  unspecified  —

TIMELINE
  Aug 12  Reserved by CNA
  Aug 14  Published (CNA: tenable)

CWE-95 · CNA: tenable · CVSS v4.0 · 1 reference · NVD status: Analyzed

CVE-2026-19812HIGH

TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0049   40.1     —

AFFECTED
  Product  Versions                  Fixed
  A800R    4.1.2cu.5137_B20200730 –  —

TIMELINE
  Aug 14  Reserved by CNA
  Aug 14  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-19815	7.4	40.1	TOTOLINK	A800R	CWE-119	TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow
CVE-2026-19844	7.4	40.1	TOTOLINK	A800R	CWE-119	TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow
CVE-2026-73849	9.8	39.5	emlog	emlog	CWE-306	emlog allows unauthenticated reinstallation via `install.php?action=reinstall`.
CVE-2026-19827	5.5	39.2	alldatacenter	alldata	CWE-22	alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputSt…
CVE-2026-19830	5.5	38.9	TRENDnet	TEW-816DRM	CWE-400	TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources
CVE-2026-72827	8.7	38.8	getgrav	grav	CWE-1336	Grav CMS before 2.0.13 Remote Code Execution via Twig
CVE-2026-72824	9.3	38.4	getgrav	grav	CWE-862	Grav before 1.0.13 API Key Scope Bypass via PagesController
CVE-2026-19788	7.4	38.3	Tenda	AC1206	CWE-119	Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name …
CVE-2026-19789	7.4	38.3	Tenda	AC1206	CWE-119	Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist …
CVE-2026-19790	7.4	38.3	Tenda	G0	CWE-119	Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow
CVE-2026-19791	7.4	38.3	Tenda	G0	CWE-119	Tenda G0 httpd web management interface module addStaticRoute stack-based ove…
CVE-2026-19792	7.4	38.3	Tenda	G0	CWE-119	Tenda G0 httpd web management interface module setPortMapping buffer overflow
CVE-2026-19811	7.4	38.3	TOTOLINK	A800R	CWE-119	TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow
CVE-2026-19814	7.4	38.3	TOTOLINK	A800R	CWE-119	TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow
CVE-2026-19821	7.4	38.3	Tenda	AC12	CWE-119	Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTi…
CVE-2026-19823	7.4	38.3	Tenda	W20E	CWE-119	Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow
CVE-2026-19824	7.4	38.3	Tenda	W20E	CWE-119	Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow
CVE-2026-19845	7.4	38.3	TOTOLINK	A800R	CWE-119	TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
CVE-2026-19846	7.4	38.3	TOTOLINK	A800R	CWE-119	TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow
CVE-2026-73683	9.2	36.6	Laravel	Socialite	CWE-294	Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay
CVE-2026-72830	9.3	36.5	getgrav	grav	CWE-269	Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
CVE-2026-17182	9.8	36.4	IBM	Db2 Mirror for i	CWE-287	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-17173	6.5	36.2	IBM	Db2 Mirror for i	CWE-22	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19762	5.5	35.1	DTStack	Taier	CWE-22	DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path tra…
CVE-2026-66270	7.2	35.1	Dell	Wyse Management Suite (WMS)	CWE-434	Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unre…
CVE-2026-46603	7.5	34.5	golang.org/x/image	golang.org/x/image/vp8l	CWE-789	Excessive memory allocation during VP8L decoding in golang.org/x/image
CVE-2026-48528	9.8	33.2	NCEAS	metacat	CWE-89	Metacat has an unauthenticated SQL injection vulnerability
CVE-2026-72815	6.9	32.5	go-chi	chi	CWE-290	go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header
CVE-2026-72813	6.9	32.3	actix	actix-web	CWE-248	actix-files before 0.6.10 Denial of Service via empty Range header
CVE-2026-17181	8.6	31.7	IBM	Db2 Mirror for i	CWE-22	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19871	9.3	31.4	Roskus	Prospero Flow CRM	CWE-798	Use of hard-coded credentials in Prospero Flow CRM employee onboarding
CVE-2026-72814	6.3	30.9	actix	actix-web	CWE-22	actix-web before 0.6.10 Information Disclosure via Files
CVE-2026-19763	5.1	30.9	DTStack	Taier	CWE-22	DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirecto…
CVE-2026-19837	2.0	30.0	Webkul	Bagisto	CWE-200	Webkul Bagisto Customer Search search information disclosure
CVE-2026-19829	2.1	29.2	648540858	wvp-GB28181-pro	CWE-22	648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path …
CVE-2026-17081	7.5	28.8	IBM	Db2 Mirror for i	CWE-22	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-72822	9.3	27.1	getgrav	grav	CWE-306	Grav before 1.0.13 Authentication Bypass via disable2fa
CVE-2026-69101	8.3	26.5	datavane	tis	CWE-611	Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
CVE-2026-12949	9.8	26.4	Wishlist Member	Wishlist Member	CWE-640	Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith…
CVE-2026-72820	6.9	26.4	getgrav	grav	CWE-22	Grav 2.0.11 Path Traversal via Backup Profile Configuration
CVE-2026-72835	7.6	26.2	filebrowser	filebrowser	CWE-41	filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
CVE-2026-18178	8.1	26.2	IBM	Db2 Mirror for i	CWE-22	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-45699	7.5	25.9	Netatalk	netatalk	CWE-191	Netatalk has Integer Underflow → Stack Buffer Overflow in copydir()
CVE-2026-73051	6.3	25.9	actix	actix-web	CWE-444	actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
CVE-2026-19909	7.5	25.8	PAX Technology	Q80	CWE-59	PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vuln…
CVE-2025-7639	6.1	25.7	AVEVA	AVEVA Enterprise SCADA	CWE-502	AVEVA Enterprise SCADA Deserialization of Untrusted Data
CVE-2026-19880	6.3	25.5	QOS.CH Sarl	Logback-classic	CWE-22	Incomplete protection against CVE-2025-11226
CVE-2026-19826	5.5	25.2	alldatacenter	alldata	CWE-20	alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.r…
CVE-2026-15205	8.6	24.7	Unknown	Paymob for WooCommerce	CWE-89	Paymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Cal…
CVE-2026-17186	9.8	24.5	IBM	Db2 Mirror for i	CWE-78	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-72836	9.2	24.3	filebrowser	filebrowser	CWE-178	FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
CVE-2026-72810	9.2	23.4	siyuan-note	siyuan	CWE-862	SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
CVE-2026-17177	7.5	23.5	IBM	Db2 Mirror for i	CWE-674	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19834	2.0	22.9	Webkul	Bagisto	CWE-285	Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authori…
CVE-2025-71405	5.1	22.8	go-chi	chi	CWE-601	go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
CVE-2026-63361	8.5	22.5	LimeSurvey	LimeSurvey	CWE-79	LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup
CVE-2026-74245	7.5	22.6	Red Hat	Red Hat OpenShift Update Service	CWE-306	Quay: unauthenticated exported logs download in quay
CVE-2026-17175	6.5	22.6	IBM	Db2 Mirror for i	CWE-287	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-72826	9.3	22.2	getgrav	grav	CWE-266	Grav before 1.0.13 Scope Bypass via createApiKey
CVE-2026-72829	9.3	22.2	getgrav	grav	CWE-269	Grav before 1.0.13 API Key Scope Bypass via UsersController
CVE-2026-72831	8.7	22.2	getgrav	grav	CWE-863	Grav through 2.0.11 Authentication Bypass via Flex Objects
CVE-2026-72837	8.7	22.0	filebrowser	filebrowser	CWE-284	File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
CVE-2026-49826	0.0	21.9	concourse	concourse	CWE-601	Concourse login flow has an open redirect issue
CVE-2026-72838	7.1	21.5	filebrowser	filebrowser	CWE-770	FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
CVE-2026-19836	2.1	21.3	Webkul	Bagisto	CWE-285	Webkul Bagisto Backend Customer Detail Feature view authorization
CVE-2026-19838	2.1	21.3	Webkul	Bagisto	CWE-285	Webkul Bagisto Backend Reporting Endpoint sales authorization
CVE-2026-19828	2.1	20.8	648540858	wvp-GB28181-pro	CWE-22	648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal
CVE-2026-1621	5.3	20.6	Universal Software Inc.	E-Municipality	CWE-305	Register Bypass in Universal Sotware's E-Municipality
CVE-2026-16879	8.8	20.4	IBM	Db2 Mirror for i	CWE-285	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19870	8.6	20.1	Roskus	Prospero Flow CRM	CWE-639	IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation
CVE-2026-14290	6.8	20.1	Unknown	Embed Google Photos album	CWE-79	Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link …
CVE-2026-18403	6.0	19.9	LimeSurvey	LimeSurvey	CWE-89	LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB
CVE-2026-18039	8.1	19.8	Unknown	Essential Addons for Elementor	CWE-269	Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation…
CVE-2026-19768	8.1	19.7	Devolutions	PowerShell Universal	CWE-94	Improper control of generation of code ('Code Injection') in the settings fea…
CVE-2026-72812	6.9	19.3	siyuan-note	siyuan	CWE-862	SiYuan before v3.7.4 Missing Authorization via refreshBacklink
CVE-2026-72828	8.6	19.0	getgrav	grav	CWE-269	Grav before 1.0.13 API Key Scope Bypass via InvitationsController
CVE-2026-73850	8.6	18.5	emlog	emlog	CWE-89	Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase()…
CVE-2026-49989	7.1	18.5	crate	crate	CWE-863	CrateDB's Blob HTTP handler bypasses authorization
CVE-2026-19784	2.1	18.4	francoisjacquet	RosarioSIS	CWE-285	francoisjacquet RosarioSIS Referrals.php DBUpdate authorization
CVE-2026-34492	7.0	18.4	Johnson Controls	Airwall	CWE-73	Airwall - Arbitrary file read
CVE-2026-16905	6.5	18.0	IBM	Db2 Mirror for i	CWE-287	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-12743	4.9	18.3	cservit	affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display	CWE-89	affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via…
CVE-2026-74243	8.2	17.9	Red Hat	Red Hat OpenShift Update Service	CWE-306	Quay: unauthenticated secscan notification endpoint in quay when psk is unset
CVE-2026-18109	7.2	17.9	boldgrid	W3 Total Cache	CWE-79	W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Co…
CVE-2026-58224	6.5	17.7	Red Hat	Red Hat Enterprise Linux 10	CWE-353	Samba: ctdb fails to do integrity checking of received packets
CVE-2026-19825	5.5	17.7	SourceCodester	Simple Client Management System	CWE-74	SourceCodester Simple Client Management System Master.php save_service sql in…
CVE-2026-19835	2.0	17.6	Webkul	Bagisto	CWE-266	Webkul Bagisto Customer Item Deletion Endpoint access control
CVE-2026-72833	8.7	17.4	getgrav	grav	CWE-269	Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
CVE-2026-16810	6.5	17.2	bitpressadmin	Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder	CWE-89	Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterT…
CVE-2026-74242	4.4	17.2	Red Hat	Red Hat OpenShift Update Service	CWE-639	Quay: repository notification uuid idor in quay api
CVE-2026-74250	6.3	16.6	OpenStack	Ironic	CWE-226	In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail t…
CVE-2026-19764	5.5	16.6	Raisecom	Communication Command and Dispatch Management Platform	CWE-74	Raisecom Communication Command and Dispatch Management Platform getpwd.php sq…
CVE-2026-66272	5.3	16.6	Dell	Wyse Management Suite (WMS)	CWE-200	Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missi…
CVE-2026-72811	9.9	16.1	siyuan-note	siyuan	CWE-89	SiYuan before v3.7.4 SQL Injection via backlink search
CVE-2026-19767	2.1	16.1	itsourcecode	Hospital Management System	CWE-74	itsourcecode Hospital Management System viewdoctortimings.php sql injection
CVE-2026-53472	6.3	15.9	—	migration-planner	CWE-79	Migration-planner: credentialurl validator accepts javascript: urls
CVE-2026-71570	5.1	15.2	icagenda.com	iCagenda extension for Joomla	CWE-284	Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumerat…
CVE-2026-16708	8.3	14.5	IBM	Db2 Mirror for i	CWE-15	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19879	5.3	14.2	Red Hat	Red Hat build of Apache Camel for Spring Boot 4	CWE-681	Io.undertow/undertow: undertow: http response header integrity issue due to c…
CVE-2026-63649	4.1	14.3	OpenVPN	OpenVPN	CWE-183	The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha…
CVE-2026-19680	7.1	13.8	Tenable, Inc.	Security Center	CWE-89	SQL Injection
CVE-2026-50029	5.3	13.9	sunnyadn	js-toml	CWE-697	js-toml has silent type confusion via falsy-primitive duplicate-key bypass
CVE-2026-19631	6.9	13.7	Tenable, Inc.	Security Center	CWE-89	SQL Injection
CVE-2026-67365	9.2	13.3	icagenda.com	iCagenda extension for Joomla	CWE-89	Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda <…
CVE-2026-19629	8.6	13.3	Tenable, Inc.	Security Center	CWE-863	Privilege Escalation
CVE-2026-72834	5.3	13.4	filebrowser	filebrowser	CWE-200	filebrowser before 2.63.19 Permission Bypass via checksum
CVE-2026-63650	2.0	13.4	OpenVPN	OpenVPN	CWE-295	OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated us…
CVE-2026-19839	2.0	13.2	SourceCodester	Simple Doctors Appointment System	CWE-284	SourceCodester Simple Doctors Appointment System save_file.php save_doctor un…
CVE-2026-19908	7.1	12.9	PAX Technology	Q80	CWE-306	PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability
CVE-2026-73845	5.3	12.8	ondata	ckan-mcp-server	CWE-20	CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMq…
CVE-2026-57469	5.1	12.8	KUNBUS	PiCtory	CWE-352	Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
CVE-2026-73844	3.7	12.7	ondata	ckan-mcp-server	CWE-209	CKAN MCP Server: Information disclosure via verbose error reflection
CVE-2026-16739	5.9	12.4	Unknown	Epeken All Kurir for Woocommerce	CWE-287	Epeken All Kurir <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery
CVE-2026-19639	5.3	12.2	Tenable, Inc.	Security Center	CWE-1284	Improper Access Control
CVE-2026-72816	6.9	12.2	go-chi	chi	CWE-290	go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware
CVE-2026-71571	8.6	12.1	icagenda.com	iCagenda extension for Joomla	CWE-89	Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped n…
CVE-2026-50523	7.8	11.8	Microsoft	PowerShell 7.4	CWE-77	Microsoft PowerShell Remote Code Execution Vulnerability
CVE-2026-19787	2.0	11.0	SourceCodester	Air Cargo Management System	CWE-74	SourceCodester Air Cargo Management System Master.php save_cargo_type sql inj…
CVE-2026-19765	2.1	11.0	eyaushev	swagger-testcase-mcp	CWE-918	eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource serv…
CVE-2026-74248	4.3	10.8	OpenStack	Octavia	CWE-863	OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy a…
CVE-2026-73630	6.9	10.4	siyuan-note	siyuan	CWE-203	SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess
CVE-2026-17209	5.4	10.4	IBM	Db2 Mirror for i	CWE-79	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19785	5.3	10.4	francoisjacquet	RosarioSIS	CWE-74	francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection
CVE-2026-17227	6.5	10.0	IBM	Db2 Mirror for i	CWE-89	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-16772	8.1	9.9	Akaunting	Akaunting	CWE-269	CVE-2026-16772
CVE-2026-72825	7.2	9.7	getgrav	grav	CWE-862	Grav before 1.0.13 API-key scope cap bypass via ReportsController
CVE-2026-73847	6.8	9.4	emlog	emlog	CWE-352	Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full dat…
CVE-2026-73048	6.9	9.1	siyuan-note	siyuan	CWE-862	SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID
CVE-2026-73049	6.9	9.1	siyuan-note	siyuan	CWE-863	SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks
CVE-2026-72823	5.3	8.9	getgrav	grav	CWE-862	Grav before 1.0.13 API-key scope cap bypass via DemoController
CVE-2026-17079	4.3	8.9	IBM	Db2 Mirror for i	CWE-693	IBM Db2 Mirror for i is affected by multiple vulnerabilities
CVE-2026-19794	7.2	8.7	gamerz	WP-Stats	CWE-79	WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting
CVE-2026-19910	7.5	8.2	PAX Technology	Q80	CWE-347	PAX Technology Q80 Application Installer Signature Verification Bypass Remote…
CVE-2026-19841	2.3	8.1	TRENDNET	TEW-813DRU	CWE-266	TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission
CVE-2026-74241	6.5	7.9	Red Hat	Red Hat OpenShift Update Service	CWE-90	Quay: ldap referral filter injection in quay external ldap authentication
CVE-2026-72859	8.3	7.7	budibase	server	CWE-863	Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL
CVE-2026-72832	5.1	7.6	getgrav	grav	CWE-79	Grav before 2.0.12 Stored XSS via quoted-attribute bypass
CVE-2026-27871	2.9	7.3	Johnson Controls	TL280	CWE-327	TL280
CVE-2026-46439	7.8	6.9	oscal-compass	compliance-trestle	CWE-94	compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-S…
CVE-2026-74240	5.4	6.7	Red Hat	Red Hat OpenShift Update Service	CWE-287	Quay: jwt claim validation bypasses in quay federated robot and sso authentic…
CVE-2026-53970	7.5	6.5	lucasgelfond	ZeroBrew	CWE-494	ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb
CVE-2026-12363	4.2	6.2	zephyrproject	zephyr	CWE-787	Out-of-bounds write in LoRaWAN fragmented transport from a fragment index of 0
CVE-2026-19786	5.3	6.0	francoisjacquet	RosarioSIS	CWE-352	francoisjacquet RosarioSIS Modules.php cross-site request forgery
CVE-2026-47192	2.1	5.8	siemens	kas	CWE-347	kas's late signature validation may allow unnoticed repository manipulations
CVE-2026-47766	5.1	5.5	containers	crun	CWE-61	crun follows rootfs /dev symlink while creating default devices
CVE-2026-47191	2.1	5.2	siemens	kas	CWE-347	kas checks out SHA-like git branches as valid commits
CVE-2026-19636	6.0	5.0	Tenable, Inc.	Security Center	CWE-1270	Insuffucient Protections Lead to Brute Force
CVE-2026-67366	5.3	4.5	icagenda.com	iCagenda extension for Joomla	CWE-352	Joomla Extension - icagenda.com - CSRF on frontend registration actions in iC…
CVE-2025-10308	4.3	4.5	alian	Astro Booking Engine	CWE-352	Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
CVE-2026-72817	6.9	4.4	go-chi	chi	CWE-345	go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
CVE-2026-49457	9.1	4.3	benoitc	erlang_quic	CWE-295	QUIC has Broken TLS verification
CVE-2026-74247	7.1	4.0	Red Hat	Red Hat OpenShift Update Service	CWE-918	Quay: ssrf via build archive_url in quay build api
CVE-2026-74244	7.5	3.7	Red Hat	Red Hat OpenShift Update Service	CWE-347	Quay: stripe webhook accepts forged events without signature verification in …
CVE-2026-72821	5.1	3.4	getgrav	grav	CWE-79	Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle
CVE-2026-73846	6.5	3.3	ondata	ckan-mcp-server	CWE-345	CKAN MCP Server: Cache-key canonicalization collision enables cache confusion…
CVE-2026-19635	8.5	3.0	Tenable, Inc.	Security Center	CWE-78	Local Privilege Escalation
CVE-2026-49282	5.1	2.9	capstone-engine	capstone	CWE-125	Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bound…
CVE-2026-19884	8.4	2.9	Eclipse Foundation	Eclipse Theia	CWE-15	In Eclipse Theia versions up to and including 1.69.0, opening a folder starts…
CVE-2026-49263	2.0	2.7	capstone-engine	capstone	CWE-197	Capstone WASM `br_table` instruction-size truncation can cause no-progress di…
CVE-2026-57472	6.9	2.3	KUNBUS	RevPiPyLoad	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…
CVE-2026-57471	6.8	2.3	KUNBUS	RevPiPyLoad	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…
CVE-2026-12366	8.8	2.0	zephyrproject	zephyr	CWE-416	Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr users…
CVE-2026-12364	8.4	2.0	zephyrproject	zephyr	CWE-822	Missing user-space pointer validation in logging syscall z_log_msg_static_cre…
CVE-2026-49986	7.1	1.6	cdeust	Cortex	CWE-829	Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`
CVE-2026-64887	7.0	1.6	Johnson Controls	Airwall	CWE-321	Airwall - Hardcoded Secrets
CVE-2026-19617	5.5	1.4	Red Hat	Red Hat Enterprise Linux 10	CWE-770	Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config pa…
CVE-2026-19770	1.9	1.4	feedmob	fm-mcp-servers	CWE-918	feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side …
CVE-2026-13002	4.4	1.3	Red Hat	Red Hat Enterprise Linux 10	CWE-835	Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing
CVE-2026-46380	6.7	1.0	oscal-compass	compliance-trestle	CWE-918	compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
CVE-2026-12365	5.8	0.9	zephyrproject	zephyr	CWE-416	Use-after-free in Zephyr delayable work-queue cancellation under SMP timing race
CVE-2026-13196	7.3	0.9	KUNBUS	piControl	CWE-787	Out-of-bounds Write in KUNBUS piControl
CVE-2026-13197	7.3	0.8	KUNBUS	piControl	CWE-362	Concurrent Execution using Shared Resource with Improper Synchronization ('Ra…
CVE-2026-13198	5.9	0.8	KUNBUS	piControl	CWE-362	Concurrent Execution using Shared Resource with Improper Synchronization ('Ra…
CVE-2026-63700	7.8	0.4	Dell	Wyse Management Suite (WMS)	CWE-269	Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Inco…
CVE-2026-63701	7.8	0.2	Dell	Wyse Management Suite (WMS)	CWE-269	Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Impr…
CVE-2026-63702	5.5	0.2	Dell	Wyse Management Suite (WMS)	CWE-798	Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use o…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-14 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.