Security Box Score — August 18, 2026

CISA adds 4 to KEV; 1407 CVEs published, led by Oracle Corporation (889).

1407 CVEs published August 18, 2026: 225 critical, 741 high, 380 medium, 60 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 1 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 1007 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	7669	29833	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1641 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	1263	3578	363	1781	637	1	11	2	0.1	7.8	.0017	+1222 ▲
microsoft	444	1866	132	1272	448	14	286	27	1.4	7.8	.0044	-202 ▼
google	64	1825	224	758	786	57	77	6	0.3	7.5	.0025	-30 ▼
red hat	161	547	36	223	257	31	2	0	0.0	6.6	.0028	+96 ▲
apple	34	305	58	82	160	5	88	8	2.6	6.5	.0029	+34 ▲
canonical	11	38	12	9	12	5	0	0	0.0	7.8	.0020	+7 ▲
suse	5	26	5	14	6	1	0	0	0.0	8.1	.0039	-3 ▼
freebsd	0	16	0	12	4	0	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	31	69	13	37	19	0	56	13	18.8	7.5	.0046	+16 ▲
palo alto networks	12	37	1	3	21	12	13	2	5.4	4.7	.0020	-2 ▼
ubiquiti	0	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
netgear	9	32	0	0	27	5	0	0	0.0	4.3	.0025	+3 ▲
fortinet	7	30	7	8	14	1	28	6	20.0	7.0	.0050	-6 ▼
vmware	0	17	4	9	2	2	7	2	11.8	8.3	.0040	-8 ▼
f5	0	16	5	8	3	0	4	1	6.3	8.6	.0057	-8 ▼
ivanti	3	14	4	8	2	0	25	5	35.7	8.3	.0754	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	102	438	87	189	149	12	33	2	0.5	7.5	.0049	+24 ▲
mozilla	59	186	68	68	50	0	9	0	0.0	8.1	.0031	+53 ▲
gitlab	15	66	2	14	42	8	4	2	3.0	5.1	.0029	+8 ▲
drupal	0	51	6	5	35	5	4	1	2.0	5.9	.0026	-46 ▼
github	5	17	1	7	9	0	0	0	0.0	6.6	.0043	0
docker	2	9	0	6	3	0	0	0	0.0	7.2	.0016	+2 ▲
wordpress	2	5	1	3	1	0	2	2	40.0	8.8	.3120	+2 ▲
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	889	2268	487	1172	513	96	27	3	0.1	7.8	.0034	+888 ▲
ibm	192	421	99	180	137	5	6	1	0.2	7.5	.0031	+156 ▲
adobe	60	312	39	145	123	5	19	3	1.0	7.8	.0026	-34 ▼
progress	19	61	14	37	10	0	6	1	1.6	8.1	.0037	+9 ▲
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	10	16	5	9	2	0	1	0	0.0	8.6	.0034	+10 ▲
zohocorp	4	10	3	5	2	0	0	0	0.0	8.7	.0140	+4 ▲
atlassian	3	6	1	5	0	0	13	0	0.0	8.1	.0034	+3 ▲

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	16	36	15	5	9	7	3	7.4	.0157	+15 ▲
siemens	19	35	2	23	8	2	0	7.3	.0016	+12 ▲
synology	1	24	2	6	13	3	0	5.6	.0025	+1 ▲
rockwell automation	0	24	4	18	2	0	0	8.7	.0029	-17 ▼
schneider electric	0	9	1	6	2	0	0	8.6	.0037	0
abb	0	7	0	4	3	0	0	7.2	.0018	-1 ▼
hikvision	0	6	0	4	2	0	0	7.2	.0040	0
moxa	0	5	0	3	2	0	0	7.0	.0029	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	27	147	0	0	80	67	0	0	0.0	5.5	.0031	-14 ▼
dell	33	132	10	68	49	5	2	1	0.8	7.2	.0020	-4 ▼
openclaw	0	111	0	58	39	14	0	0	0.0	7.0	.0026	-44 ▼
nvidia	24	106	14	71	21	0	0	0	0.0	7.5	.0034	-16 ▼
gitea	48	89	19	36	30	4	0	0	0.0	7.5	.0034	+8 ▲
siyuan-note	66	88	39	19	28	1	0	0	0.0	8.7	.0028	+60 ▲
itsourcecode	17	88	0	0	19	69	0	0	0.0	2.1	.0032	+3 ▲
zephyrproject	34	87	2	30	46	9	0	0	0.0	6.5	.0022	+19 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-34486	.9862	99.9	7.5
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-63077	.8473	99.7	9.8
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-72898	.7922	99.6	10.0
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-59310	.4588	98.7	9.8
CVE-2026-61511	.3399	98.3	9.3

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.7922	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-48362	10.0	.0431
CVE-2026-47668	10.0	.0388
CVE-2026-19188	10.0	.0193
CVE-2026-58231	10.0	.0171
CVE-2026-16812	10.0	.0157	KEV
CVE-2026-73299	10.0	.0121
CVE-2025-71389	10.0	.0120

Most disclosures (vendor)
Vendor	CVEs
oracle	1997
linux	1628
google	466
microsoft	463
ibm	261
red hat	260
apache	205
apple	201
mozilla	124
adobe	74

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	13
apple	8
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	66
PyPI	5
npm	5
Go	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-18556	N-able	0
CVE-2026-18577	N-able	0
CVE-2026-20316	Cisco	0
CVE-2026-20349	Cisco	0
CVE-2026-34486	Apache Software Foundation	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1735
CVE-2021-27102	n/a	2021-11-17	1735
CVE-2021-27101	n/a	2021-11-17	1735
CVE-2021-27103	n/a	2021-11-17	1735
CVE-2021-21017	Adobe	2021-11-17	1735
CVE-2021-28550	Adobe	2021-11-17	1735
CVE-2021-42013	Apache Software Foundation	2021-11-17	1735
CVE-2021-41773	Apache Software Foundation	2021-11-17	1735
CVE-2021-30858	Apple	2021-11-17	1735
CVE-2021-30860	Apple	2021-11-17	1735

Transactions

ADDED TO KEV — CVE-2026-33824 (Microsoft Windows 10 Version 1607). Remediation due August 21, 2026.

ADDED TO KEV — CVE-2026-55040 (Microsoft SharePoint Enterprise Server 2016). Remediation due August 21, 2026.

ADDED TO KEV — CVE-2026-59310 (VMware Cloud Foundation). Remediation due August 21, 2026.

ADDED TO KEV — CVE-2026-65400 (Apple macOS). Remediation due August 21, 2026.

EXPLOIT PUBLISHED — itsourcecode Hospital Management System: 6 CVEs (CVE-2026-19894, CVE-2026-19934, CVE-2026-19972, CVE-2026-75086, CVE-2026-75087, CVE-2026-75088). Public exploit references added.

EXPLOIT PUBLISHED — Webkul Bagisto: 6 CVEs (CVE-2026-19834, CVE-2026-19836, CVE-2026-19993, CVE-2026-19996, CVE-2026-75081, CVE-2026-75082). Public exploit references added.

EXPLOIT PUBLISHED — code-projects Online Shopping System: 4 CVEs (CVE-2026-19919, CVE-2026-19921, CVE-2026-19923, CVE-2026-19998). Public exploit references added.

EXPLOIT PUBLISHED — OpenBoxes: 4 CVEs (CVE-2024-14045, CVE-2024-14046, CVE-2026-19928, CVE-2026-19929). Public exploit references added.

EXPLOIT PUBLISHED — SourceCodester Class and Exam Timetabling System: 4 CVEs (CVE-2026-19899, CVE-2026-75077, CVE-2026-75079, CVE-2026-75080). Public exploit references added.

EXPLOIT PUBLISHED — TOTOLINK A800R: 4 CVEs (CVE-2026-19811, CVE-2026-19813, CVE-2026-19844, CVE-2026-19847). Public exploit references added.

EXPLOIT PUBLISHED — Edimax EW-7478APC: 3 CVEs (CVE-2026-19959, CVE-2026-19960, CVE-2026-19962). Public exploit references added.

EXPLOIT PUBLISHED — parallax jsPDF: 3 CVEs (CVE-2026-24737, CVE-2026-25535, CVE-2026-25755). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2024-21626 (opencontainers runc). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-25256 (Fortinet FortiSIEM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-62593 (ray-project ray). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-17106 (moby go-archive). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19751 (EnzoVezzaro mcp-dominican-layer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19756 (Dromara lamp-cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19758 (dromara lamp-cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19765 (eyaushev swagger-testcase-mcp). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19771 (Baicells EG3661M). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19788 (Tenda AC1206). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19790 (Tenda G0). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19821 (Tenda AC12). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19823 (Tenda W20E). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19826 (alldatacenter alldata). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19828 (648540858 wvp-GB28181-pro). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19839 (SourceCodester Simple Doctors Appointment System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19896 (mangroup dtale). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19898 (VictoriaMetrics). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19901 (LB-LINK X-PRO). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19904 (SourceCodester Online Book Store System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19905 (Jinher OA). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19916 (code-projects Online Food Order System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19918 (SpaceX Starlink Router Gen 3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19924 (Tenda AC10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19926 (Evergreen). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19932 (DefaultFuction Notice-System-Managent). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19955 (TrailDB). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19957 (graphlit-mcp-server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19964 (Jij-Inc Jij-MCP-Server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19967 (Open Asset Import Library Assimp). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19969 (Open Asset Import Library Assimp). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19974 (treefrogframework treefrog-framework). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19977 (EFM ipTIME A3004T). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19984 (jkawamoto mcp-florence2). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19988 (Alaev SEO Tools Extension). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-25896 (NaturalIntelligence fast-xml-parser). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-26278 (NaturalIntelligence fast-xml-parser). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-53365 (Linux). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-58049 (FFmpeg). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-60113 (NASA-AMMOS AIT-DSN). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67579 (ash-project ash). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-69414 (Microsoft Malware Protection Engine). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-70667 (Netflix lemur). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-7246 (Pallets Click Click). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72741 (goodrain rainbond). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73482 (phplist3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-74842 (Kira-Pgr PromptShopMCP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-74899 (jahlives openssl_encrypt). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75012 (TOTOLINK EX1200L). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75013 (TOTOLINK EX1200L). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75089 (PHPGurukul Complaint Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75090 (EricLBuehler Mistral.rs). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75093 (sonos tract). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75094 (COMFAST CF-N1-S). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75130 (Uptash Context7). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75773 (karakeep-app karakeep). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75774 (karakeep-app karakeep). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75778 (code-projects Task Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75783 (TRENDnet TEW-WLC100P). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75784 (TRENDnet TEW-WLC100). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75876 (xianrendzw EasyReport). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75877 (TRENDnet TV-IP751WIC). Public exploit reference added.

REJECTED — CVE-2026-64158 (Linux). Record withdrawn by the CNA.

REJECTED — CVE-2026-73682 (semaphoreui semaphore). Record withdrawn by the CNA.

REJECTED — CVE-2026-74511 (Linux). Record withdrawn by the CNA.

RESCORED — parallax jsPDF: 3 CVEs (CVE-2026-25755, CVE-2026-31898, CVE-2026-31938). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2024-44004 (Arni Cinco WPCargo Track & Trace). CVSS 9.3 → 9.8 (NVD).

RESCORED — CVE-2026-40478 (thymeleaf). CVSS 9.1 → 9 (NVD).

RESCORED — CVE-2026-41245 (junrar). CVSS 5.9 → 7.5 (NVD).

RESCORED — CVE-2026-75079 (SourceCodester Class and Exam Timetabling System). CVSS 6.9 → 5.5 (NVD).

RESCORED — CVE-2026-75080 (SourceCodester Class and Exam Timetabling System). CVSS 6.9 → 5.5 (NVD).

RESCORED — CVE-2026-75081 (Webkul Bagisto). CVSS 5.3 → 2.1 (NVD).

PATCH SHIPPED — rrrene html_sanitize_ex: 6 CVEs (CVE-2026-66370, CVE-2026-66829, CVE-2026-66843, CVE-2026-68747, CVE-2026-68749, CVE-2026-68750). Fix versions published.

PATCH SHIPPED — Red Hat OpenShift Container Platform 4.20: 3 CVEs (CVE-2026-42965, CVE-2026-50236, CVE-2026-50237). Fix versions published.

PATCH SHIPPED — CVE-2026-18739 (rpm-software-management popt). Fixed in Red Hat Hardened Images 1.19-11.1.hum1.

PATCH SHIPPED — CVE-2026-64611 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 1:2.0.0-13.el10_2.

PATCH SHIPPED — CVE-2026-64612 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 1:2.0.0-13.el10_2.

Yesterday's Results

How to read these box scores · glossary

1407 CVEs published. 25 box scores and 375 table rows below; the remaining 1007 continue on page 2 · page 3 — every CVE is listed, nothing truncated.

CVE-2026-15748CRITICAL

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0443   90.6     —

AFFECTED
  Product                                                              Versions     Fixed
  Forminator Forms – Contact Form, Payment Form & Custom Form Builder  unspecified  —

TIMELINE
  Jul 14  Reserved by CNA
  Aug 18  Published (CNA: Wordfence)

CWE-434 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Deferred

CVE-2026-24301HIGH

Microsoft Copilot Information Disclosure Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0222   81.3     —

AFFECTED
  Product      Versions  Fixed
  Copilot Web  - –       —

TIMELINE
  Jan 21  Reserved by CNA
  Aug 18  Published (CNA: microsoft)

CWE-77 · CNA: microsoft · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-75094HIGH

COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    8.5   .0211   80.3     —

AFFECTED
  Product  Versions   Fixed
  CF-N1-S  2.6.0.1 –  —

TIMELINE
  Aug 17  Reserved by CNA
  Aug 18  Public exploit reference published
  Aug 18  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-75854CRITICAL

ArcadeData arcadedb — ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0107   62.3     —

AFFECTED
  Product   Versions     Fixed
  arcadedb  unspecified  26.8.1

TIMELINE
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-75784CRITICAL

TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0102   60.8     —

AFFECTED
  Product     Versions     Fixed
  TEW-WLC100  1v2.07b01 –  —

TIMELINE
  Aug 18  Public exploit reference published
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-63639HIGH

valkey-io valkey — Valkey: UAF in stream deserialization may lead to remote code execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0089   56.6     —

AFFECTED
  Product  Versions    Fixed
  valkey   < 7.2.14 –  —

TIMELINE
  Jul 17  Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-416 · CNA: GitHub_M · CVSS v3.1 · 12 references · NVD status: Received

CVE-2026-52610CRITICAL

n/a n/a — An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0082   54.4     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 8   Reserved by CNA
  Aug 18  Published (CNA: mitre)

CWE-22 · CNA: mitre · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-76036CRITICAL

Google Chrome — Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  H  H  H    9.6   .0081   54.1     —

AFFECTED
  Product  Versions          Fixed
  Chrome   151.0.7922.169 –  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: Chrome)

CWE-122 · CNA: Chrome · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-73343CRITICAL

AresIT WP Compress — WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0080   53.8     —

AFFECTED
  Product      Versions  Fixed
  WP Compress  n/a –     7.20.01

TIMELINE
  Aug 12  Reserved by CNA
  Aug 18  Published (CNA: Patchstack)

CWE-94 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-45117CRITICAL

MyBB: Installer database configuration RCE

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0079   53.6     —

AFFECTED
  Product  Versions    Fixed
  mybb     < 1.8.40 –  —

TIMELINE
  May 8   Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-94 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Received

CVE-2026-75872MEDIUM

maalfer MailerUp — HTML Injection in MailerUp double opt-in verification email

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   N    6.9   .0071   50.7     —

AFFECTED
  Product   Versions     Fixed
  MailerUp  unspecified  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: Secur0)

CWE-80 · CNA: Secur0 · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-70415HIGH

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. A…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0070   50.5     —

AFFECTED
  Product           Versions     Fixed
  PowerStore 500T   unspecified  —
  PowerStore 1000T  unspecified  —
  PowerStore 1200T  unspecified  —
  PowerStore 3000T  unspecified  —
  PowerStore 3200Q  unspecified  —
  PowerStore 3200T  unspecified  —
  PowerStore 5000T  unspecified  —
  PowerStore 5200Q  unspecified  —
  PowerStore 5200T  unspecified  —
  PowerStore 7000T  unspecified  —
  + 2 more

TIMELINE
  Aug 4   Reserved by CNA
  Aug 18  Published (CNA: dell)

CWE-120 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-76034HIGH

Google Chrome — Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbi…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0070   50.3     —

AFFECTED
  Product  Versions          Fixed
  Chrome   151.0.7922.169 –  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: Chrome)

CWE-122 · CNA: Chrome · CVSS v3.1 · 2 references · NVD status: Analyzed

CVE-2026-67920HIGH

n/a n/a — An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.i…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0065   48.4     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jul 30  Reserved by CNA
  Aug 18  Published (CNA: mitre)

CWE-73 · CNA: mitre · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-75976HIGH

TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0063   47.3     —

AFFECTED
  Product     Versions     Fixed
  TEW-823DRU  1.1.02b01 –  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-67443CRITICAL

frangoteam FUXA — FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.2   .0062   47.1     —

AFFECTED
  Product  Versions   Fixed
  FUXA     < 1.3.3 –  —

TIMELINE
  Jul 29  Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-862 · CNA: GitHub_M · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-53457MEDIUM

ha-china blueprint-studio — Blueprint Studio terminal command working directory not bounded to config directory

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    5.1   .0062   47.1     —

AFFECTED
  Product           Versions   Fixed
  blueprint-studio  < 2.5.2 –  —

TIMELINE
  Jun 9   Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-22 · CNA: GitHub_M · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-59940CRITICAL

lxsmnsyc seroval — Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0062   46.7     —

AFFECTED
  Product  Versions   Fixed
  seroval  < 1.5.3 –  —

TIMELINE
  Jul 7   Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-502, CWE-843 · CNA: GitHub_M · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-75877HIGH

TRENDnet TV-IP751WIC alphapd FUN_0043372C stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0061   46.7     —

AFFECTED
  Product      Versions    Fixed
  TV-IP751WIC  11.03.03 –  —

TIMELINE
  Aug 18  Public exploit reference published
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-54348HIGH

Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0061   46.6     —

AFFECTED
  Product  Versions   Fixed
  froxlor  < 2.3.8 –  —

TIMELINE
  Jun 12  Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-89 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-52608CRITICAL

n/a n/a — An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to i…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0061   46.5     —

AFFECTED
  Product  Versions  Fixed
  n/a      n/a –     —

TIMELINE
  Jun 8   Reserved by CNA
  Aug 18  Published (CNA: mitre)

CWE-284 · CNA: mitre · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-75827CRITICAL

getgrav grav — Grav before 2.0.15 Arbitrary File Write via error_log

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0059   45.5     —

AFFECTED
  Product  Versions     Fixed
  grav     unspecified  2.0.15

TIMELINE
  Aug 18  Reserved by CNA
  Aug 18  Published (CNA: VulnCheck)

CWE-94 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-62988CRITICAL

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  C  H  H  L    9.0   .0059   45.3     —

AFFECTED
  Product  Versions   Fixed
  froxlor  < 2.3.8 –  —

TIMELINE
  Jul 14  Reserved by CNA
  Aug 18  Published (CNA: GitHub_M)

CWE-200 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Received

CVE-2026-66793HIGH

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 — Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0057   44.8     —

AFFECTED
  Product                                               Versions     Fixed
  Red Hat Advanced Cluster Management for Kubernetes 2  unspecified  —

TIMELINE
  Jul 27  Reserved by CNA
  Aug 18  Published (CNA: redhat)

CWE-20 · CNA: redhat · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-74943CRITICAL

Mozilla Firefox — Use-after-free in the Graphics: ImageLib component

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0057   44.5     —

AFFECTED
  Product      Versions     Fixed
  Firefox      unspecified  115.39
  Thunderbird  unspecified  140.14

TIMELINE
  Aug 17  Reserved by CNA
  Aug 18  Published (CNA: mozilla)

CWE-416 · CNA: mozilla · CVSS v3.1 · 8 references · NVD status: Modified

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-50142	7.5	43.8	strukturag	libheif	CWE-190	libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size m…
CVE-2026-52607	6.5	43.8	n/a	n/a	CWE-22	A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote a…
CVE-2026-61241	10.0	43.3	Oracle Corporation	Oracle Internet Directory	CWE-284	Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middl…
CVE-2026-74990	9.8	42.7	Mozilla	Firefox	CWE-119	Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefo…
CVE-2026-73366	9.8	42.2	supsystic	Easy Google Maps	CWE-502	WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
CVE-2026-73380	9.8	42.2	supsystic	Popup by Supsystic	CWE-502	WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerab…
CVE-2026-75773	2.9	42.1	karakeep-app	karakeep	CWE-307	karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication
CVE-2026-74987	9.8	42.0	Mozilla	Firefox	CWE-119	Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Fire…
CVE-2026-56684	7.5	42.0	valkey-io	valkey	CWE-416	Valkey: TLS pending-data processing use-after-free may allow remote code exec…
CVE-2026-62626	9.8	41.9	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62632	9.8	41.9	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62633	9.8	41.9	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62635	9.8	41.9	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-18963	9.1	41.8	Red Hat	Red Hat build of Keycloak 26.4	CWE-640	Keycloak-services: keycloak-services: unauthenticated account takeover via re…
CVE-2026-75090	2.1	41.5	EricLBuehler	Mistral.rs	CWE-119	EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_t…
CVE-2026-73381	9.1	41.3	supsystic	Popup by Supsystic	CWE-288	WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnera…
CVE-2026-60672	9.8	41.1	Oracle Corporation	Oracle WebLogic Server	CWE-306	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-60696	9.8	41.1	Oracle Corporation	Oracle WebLogic Server	CWE-306	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-60698	9.8	41.0	Oracle Corporation	Oracle WebLogic Server	CWE-306	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-60977	9.8	41.1	Oracle Corporation	Oracle WebLogic Server	CWE-284	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-76040	8.8	41.0	Google	Chrome	CWE-416	Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 …
CVE-2026-60728	9.1	40.8	Oracle Corporation	Oracle WebCenter Portal	CWE-284	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middlew…
CVE-2026-75897	8.7	40.8	OpenSearch	OpenSearch Dashboards	CWE-1284	Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards
CVE-2026-75915	8.7	40.8	Hmbown	CodeWhale	CWE-200	CodeWhale before 0.8.64 Environment Variable Leak via js_execution
CVE-2026-34884	9.8	40.7	Apache Software Foundation	Apache SkyWalking MCP	CWE-918	Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expressio…
CVE-2026-70689	9.8	40.5	Oracle Corporation	Oracle Essbase	—	Vulnerability in Oracle Essbase (component: Infrastructure). The supported ve…
CVE-2026-70820	7.2	40.5	Oracle Corporation	Oracle Call Center Technology	CWE-284	Vulnerability in the Oracle Call Center Technology product of Oracle E-Busine…
CVE-2026-76039	6.5	40.3	Google	Chrome	CWE-706	Incorrect reference resolution in Core in Google Chrome on on Android prior t…
CVE-2026-50187	8.8	40.2	ohmyzsh	ohmyzsh	CWE-94	Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious …
CVE-2026-67440	6.9	39.9	frangoteam	FUXA	CWE-862	FUXA: Unauthenticated Socket.IO read events
CVE-2026-47720	5.3	39.9	frangoteam	FUXA	CWE-89	FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeT…
CVE-2026-19500	7.5	39.8	SureForms	SureForms	CWE-400	SureForms contains an uncontrolled resource consumption vulnerability
CVE-2026-62457	9.8	39.7	Oracle Corporation	Oracle Hyperion Infrastructure Technology	CWE-284	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62544	9.8	39.7	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62609	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62611	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62614	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62617	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62621	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62622	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62624	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62630	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62634	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62639	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-62640	9.8	39.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-70739	9.8	39.7	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70740	9.8	39.7	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70745	9.8	39.7	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70817	9.8	39.7	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70873	9.8	39.7	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-47719	8.2	39.5	frangoteam	FUXA	CWE-918	FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PRO…
CVE-2026-17084	6.0	39.5	Python Software Foundation	CPython	CWE-436	stringprep.map_table_b2() deviates from RFC 3454 Table B.2
CVE-2026-60858	9.8	39.4	Oracle Corporation	Oracle Hyperion Calculation Manager	CWE-306	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hy…
CVE-2026-60958	9.8	39.4	Oracle Corporation	Oracle WebCenter Enterprise Capture	CWE-284	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fu…
CVE-2026-61318	9.8	39.4	Oracle Corporation	Siebel CRM Cloud Applications	CWE-284	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel C…
CVE-2026-62592	9.8	39.4	Oracle Corporation	Siebel CRM Integration	CWE-284	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (com…
CVE-2026-70926	9.8	39.4	Oracle Corporation	Oracle Workflow	CWE-306	Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (comp…
CVE-2026-74012	8.8	39.4	TaxoPress	TaxoPress	CWE-502	WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability
CVE-2026-70737	8.8	39.2	Oracle Corporation	Oracle Enterprise Manager for Systems Infrastructure	—	Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure pro…
CVE-2026-70710	8.8	39.2	Oracle Corporation	Oracle Sales Foundation	—	Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Sui…
CVE-2026-70729	8.8	39.2	Oracle Corporation	Oracle Teleservice	—	Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (c…
CVE-2026-70747	8.8	39.2	Oracle Corporation	Oracle Customers Online	—	Vulnerability in the Oracle Customers Online product of Oracle E-Business Sui…
CVE-2026-70813	8.8	39.2	Oracle Corporation	Oracle Call Center Technology	CWE-284	Vulnerability in the Oracle Call Center Technology product of Oracle E-Busine…
CVE-2026-71878	9.2	39.1	GBIF	Integrated Publishing Toolkit	CWE-306	Authentication bypass in Integrated Publishing Toolkit
CVE-2026-71879	9.1	39.1	GBIF	Integrated Publishing Toolkit	CWE-288	Authentication bypass in Integrated Publishing Toolkit
CVE-2026-60821	9.8	38.8	Oracle Corporation	PeopleSoft Enterprise PeopleTools	CWE-284	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle Peop…
CVE-2026-63643	6.3	38.9	MagicMirrorOrg	MagicMirror	CWE-441	MagicMirror: ssrf calendar .js
CVE-2026-60721	9.8	38.8	Oracle Corporation	Oracle Identity Manager	CWE-306	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-60727	9.8	38.8	Oracle Corporation	Oracle Identity Manager	CWE-284	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-60921	9.8	38.8	Oracle Corporation	Oracle WebCenter Enterprise Capture	CWE-284	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fu…
CVE-2026-60946	9.8	38.8	Oracle Corporation	Oracle WebCenter Enterprise Capture	CWE-284	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fu…
CVE-2026-60947	9.8	38.8	Oracle Corporation	Oracle WebCenter Enterprise Capture	CWE-284	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fu…
CVE-2026-60970	9.8	38.8	Oracle Corporation	Oracle WebCenter Enterprise Capture	CWE-284	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fu…
CVE-2026-70905	9.8	38.8	Oracle Corporation	Oracle Access Manager	CWE-287	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middlewar…
CVE-2026-70854	9.1	38.8	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-61118	8.8	38.7	Oracle Corporation	Oracle Identity Manager	CWE-284	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-65984	7.5	38.4	frangoteam	FUXA	CWE-613	FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged…
CVE-2026-73181	7.5	38.4	ThemeComplete	Extra Product Options & Add-Ons for WooCommerce	CWE-22	WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbi…
CVE-2026-74964	9.8	38.3	Mozilla	Firefox	CWE-190	Integer overflow in the Graphics component
CVE-2026-19501	8.8	38.3	SureForms	SureForms	CWE-1236	CVE-2026-19501
CVE-2026-70876	9.1	38.2	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-70735	7.2	38.2	Oracle Corporation	Oracle Hyperion Profitability and Cost Management	—	Vulnerability in the Oracle Hyperion Profitability and Cost Management produc…
CVE-2026-70781	7.2	38.2	Oracle Corporation	Oracle Proposals	—	Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (com…
CVE-2026-75774	2.9	38.2	karakeep-app	karakeep	CWE-287	karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
CVE-2026-67271	9.8	38.0	Dell	PowerStore 500T	CWE-787	Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in the S…
CVE-2026-70700	7.5	37.9	Oracle Corporation	Oracle Payables	—	Vulnerability in the Oracle Payables product of Oracle E-Business Suite (comp…
CVE-2026-47627	9.8	37.8	NVIDIA	Triton Inference Server	CWE-22	NVIDIA Triton Inference Server for Linux contains a vulnerability where an at…
CVE-2026-70688	8.8	37.8	Oracle Corporation	Oracle Essbase	—	Vulnerability in Oracle Essbase (component: Calculator). The supported versio…
CVE-2026-70906	7.5	37.4	Oracle Corporation	Oracle Java SE	CWE-400	Vulnerability in Oracle Java SE (component: 2D). Supported versions that are …
CVE-2026-60883	7.2	37.4	Oracle Corporation	PeopleSoft Enterprise PeopleTools	CWE-284	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle Peop…
CVE-2026-59949	6.5	37.4	yawkat	lz4-java	CWE-476	yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash J…
CVE-2026-75852	9.3	37.3	ArcadeData	arcadedb	CWE-306	ArcadeDB MongoDB wire protocol authentication bypass cross-database
CVE-2026-60782	9.8	37.2	Oracle Corporation	Oracle Payments	CWE-306	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (comp…
CVE-2026-70970	9.8	37.2	Oracle Corporation	Oracle WebCenter Portal	CWE-284	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middlew…
CVE-2026-71040	9.8	37.2	Oracle Corporation	Oracle Agile PLM	CWE-284	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (compone…
CVE-2026-71074	9.8	37.2	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-71152	9.8	37.2	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-71164	9.8	37.2	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-60754	9.1	37.2	Oracle Corporation	Siebel Apps - Marketing	CWE-284	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (co…
CVE-2026-62292	8.7	37.2	strukturag	libheif	CWE-125	libheif: Out-of-bounds read in uncompressed unci tile range slicing
CVE-2026-76043	8.8	37.1	Google	Chrome	CWE-682	Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed …
CVE-2026-32474	9.9	37.0	wpWax	Templatiq	CWE-434	WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
CVE-2026-62608	9.9	37.0	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-66627	9.9	37.0	EDGE22 Studios Ltd.	GP Premium	CWE-434	WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability
CVE-2026-61002	8.8	37.0	Oracle Corporation	Oracle SOA Suite	CWE-284	Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (co…
CVE-2026-61319	8.8	37.0	Oracle Corporation	Oracle U.S. Federal Financials	CWE-284	Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Busin…
CVE-2026-62450	8.8	37.0	Oracle Corporation	Oracle Flow Manufacturing	CWE-284	Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business S…
CVE-2026-62500	8.8	37.0	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62612	8.8	37.0	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-70686	8.8	37.0	Oracle Corporation	Oracle General Ledger	—	Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite…
CVE-2026-70742	8.8	37.0	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70761	8.8	37.0	Oracle Corporation	Oracle Risk Management	—	Vulnerability in the Oracle Risk Management product of Oracle E-Business Suit…
CVE-2026-70818	8.8	37.0	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70821	8.8	37.0	Oracle Corporation	Oracle Hyperion Financial Management	—	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70863	8.8	37.0	Oracle Corporation	Oracle Application Testing Suite	CWE-284	Vulnerability in Oracle Application Testing Suite. The supported version that…
CVE-2026-70877	8.8	37.0	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-52736	8.7	36.8	ZcashFoundation	zebra	CWE-459	ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache
CVE-2026-75627	9.3	36.7	bastillion-io	Bastillion	CWE-288	Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
CVE-2026-74945	6.5	36.7	Mozilla	Firefox	CWE-200	Information disclosure in the Graphics: Text component
CVE-2026-61003	9.9	36.5	Oracle Corporation	Oracle Managed File Transfer	CWE-284	Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Mi…
CVE-2026-57580	9.4	36.6	goauthentik	authentik	CWE-436	authentik: Account Takeover via SAML NameID Comment Truncation
CVE-2026-62638	9.1	36.5	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-60722	8.8	36.5	Oracle Corporation	Oracle Identity Manager	CWE-306	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-60731	8.8	36.5	Oracle Corporation	Oracle WebCenter Portal	CWE-306	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middlew…
CVE-2026-75935	8.7	36.5	Amazon Ion	Amazon Ion Java	CWE-789	Memory-amplification denial of service via declared-length preallocation in A…
CVE-2026-75936	8.7	36.5	Amazon Ion	Amazon Ion Java	CWE-409	Memory-amplification denial of service via GZIP decompression bomb in Amazon …
CVE-2026-70908	7.5	36.5	Oracle Corporation	Helidon	CWE-400	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-70927	7.5	36.5	Oracle Corporation	Oracle Workflow	CWE-400	Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (comp…
CVE-2026-32444	9.9	36.3	Cwicly	Cwicly	CWE-94	WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
CVE-2026-44472	8.1	36.4	saleor	saleor	CWE-287	Saleor: Account pre-hijacking vulnerability due to unverified anonymous order…
CVE-2026-73400	8.1	36.1	jetmonsters	Restaurant Menu by MotoPress	CWE-98	WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusio…
CVE-2026-18929	6.9	36.0	Carbone	Carbone	CWE-409	Resource Exhaustion in Carbone
CVE-2026-52854	8.6	35.8	ProfessionalWiki	Maps	CWE-79	mediawiki/maps: Stored XSS through the overlays parameter in the display_map …
CVE-2026-50186	8.8	35.7	RARgames	4gaBoards	CWE-22	4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Boar…
CVE-2026-60716	8.8	35.8	Oracle Corporation	Oracle Identity Manager	CWE-306	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-52829	7.5	35.7	ZcashFoundation	zebra	CWE-617	ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book
CVE-2026-70861	7.2	35.7	Oracle Corporation	PeopleSoft Enterprise FIN Common Objects Brazil	CWE-284	Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product …
CVE-2026-71099	7.2	35.7	Oracle Corporation	Oracle Business Intelligence Enterprise Edition	CWE-284	Vulnerability in the Oracle Business Intelligence Enterprise Edition product …
CVE-2026-70939	7.2	35.6	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70950	7.2	35.6	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-73997	7.5	35.4	Nexcess	Starter Templates by Kadence WP	CWE-770	WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service…
CVE-2026-54543	5.4	35.5	froxlor	froxlor	CWE-74	Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
CVE-2026-60737	9.1	35.2	Oracle Corporation	Oracle Web Services Manager	CWE-284	Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Mid…
CVE-2026-49224	8.3	35.1	givanz	Vvveb	CWE-639	Vvveb post revision authorization bypass allows Authors to read, restore, or …
CVE-2026-49225	8.3	35.1	givanz	Vvveb	CWE-639	Vvveb product revision authorization bypass allows Vendors to read, restore, …
CVE-2026-70909	8.2	35.1	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-76035	9.6	35.0	Google	Chrome	CWE-20	Inappropriate implementation in Media in Google Chrome on on Mac prior to 151…
CVE-2026-75914	8.7	35.0	Hmbown	CodeWhale	CWE-22	CodeWhale before 0.8.64 Path Traversal via image_analyze symlink
CVE-2026-76038	8.8	35.0	Google	Chrome	CWE-843	Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remot…
CVE-2026-69219	8.7	35.0	rabbitmq	rabbitmq-java-client	CWE-789	RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers …
CVE-2026-50167	5.3	35.0	kurrier-org	kurrier	CWE-639	Kurrier: Authenticated cross-user authorization bypass in Kurrier API
CVE-2026-61302	8.2	34.9	Oracle Corporation	Oracle Business Intelligence Enterprise Edition	CWE-284	Vulnerability in the Oracle Business Intelligence Enterprise Edition product …
CVE-2026-70743	8.2	34.9	Oracle Corporation	Oracle Hyperion Financial Reporting	CWE-284	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-60976	8.8	34.5	Oracle Corporation	Oracle Scripting	CWE-284	Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (com…
CVE-2026-61206	9.9	34.5	Oracle Corporation	Oracle Hyperion Calculation Manager	CWE-284	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hy…
CVE-2026-61317	9.9	34.5	Oracle Corporation	Siebel CRM Cloud Applications	CWE-284	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel C…
CVE-2026-70920	9.9	34.5	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-71102	9.1	34.4	Oracle Corporation	Oracle Database Server	CWE-284	Vulnerability in the Portable Clusterware component of Oracle Database Server…
CVE-2026-60751	8.8	34.5	Oracle Corporation	Siebel Apps - Marketing	CWE-284	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (co…
CVE-2026-61276	8.8	34.5	Oracle Corporation	Oracle Hyperion Calculation Manager	CWE-284	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hy…
CVE-2026-70918	8.8	34.5	Oracle Corporation	Oracle Product Hub	CWE-306	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (c…
CVE-2026-70922	8.8	34.5	Oracle Corporation	Oracle Financial Services Enterprise Case Management	CWE-287	Vulnerability in the Oracle Financial Services Enterprise Case Management pro…
CVE-2026-68924	4.9	34.4	MobSF	Mobile-Security-Framework-MobSF	CWE-400	MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK E…
CVE-2026-62550	7.5	34.3	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62554	7.5	34.3	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-70752	7.5	34.3	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70772	7.5	34.3	Oracle Corporation	Oracle Warehouse Management	CWE-284	Vulnerability in the Oracle Warehouse Management product of Oracle E-Business…
CVE-2026-70799	7.5	34.3	Oracle Corporation	Oracle SDP Number Portability	—	Vulnerability in the Oracle SDP Number Portability product of Oracle E-Busine…
CVE-2026-70822	7.5	34.3	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70832	7.5	34.3	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-73927	7.5	34.4	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-73936	7.5	34.4	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-60707	8.7	34.3	Oracle Corporation	Oracle Identity Manager	CWE-284	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-75859	8.7	34.2	Hmbown	CodeWhale	CWE-22	CodeWhale before 0.8.64 Arbitrary File Read via instructions
CVE-2026-60699	8.6	34.2	Oracle Corporation	Oracle WebLogic Server	CWE-284	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-62586	8.6	34.2	Oracle Corporation	Siebel CRM Administration	CWE-284	Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (…
CVE-2026-74940	9.8	34.0	Mozilla	Firefox	CWE-416	Use-after-free in the Graphics: Text component
CVE-2026-62588	9.9	33.9	Oracle Corporation	Siebel CRM Integration	CWE-284	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (com…
CVE-2026-60715	8.8	33.9	Oracle Corporation	Oracle Identity Manager	CWE-284	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-60729	8.8	33.9	Oracle Corporation	Oracle WebCenter Portal	CWE-284	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middlew…
CVE-2026-61032	8.8	33.9	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-61040	8.8	33.9	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-70886	8.8	33.9	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-47606	6.5	33.7	NVIDIA	Triton Inference Server	CWE-36	NVIDIA Triton Inference Server for Linux contains a vulnerability where an at…
CVE-2026-62629	9.4	33.7	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-71113	7.5	33.6	Oracle Corporation	Oracle VM VirtualBox	CWE-284	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (c…
CVE-2026-60591	9.1	33.6	Oracle Corporation	Oracle Hospitality Simphony	CWE-306	Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and B…
CVE-2026-70977	9.1	33.6	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-306	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-70981	9.1	33.6	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-70984	9.1	33.6	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-71153	7.5	33.6	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-53959	6.5	33.6	RARgames	4gaBoards	CWE-200	4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users t…
CVE-2026-15806	6.0	33.6	Python Software Foundation	CPython	CWE-319	`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorr…
CVE-2026-73916	9.1	33.3	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-70921	10.0	33.3	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2021-43717	9.8	33.3	n/a	n/a	CWE-798	An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identi…
CVE-2026-70675	8.1	33.2	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-70684	8.1	33.2	Oracle Corporation	Oracle Enterprise Manager Base Platform	—	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracl…
CVE-2026-70704	8.1	33.2	Oracle Corporation	Oracle Trading Community	—	Vulnerability in the Oracle Trading Community product of Oracle E-Business Su…
CVE-2026-70814	8.1	33.2	Oracle Corporation	Oracle Call Center Technology	CWE-284	Vulnerability in the Oracle Call Center Technology product of Oracle E-Busine…
CVE-2026-45734	5.3	33.3	mybb	mybb	CWE-837	MyBB: Default CAPTCHA missing invalidation
CVE-2026-75874	10.0	33.1	Mozilla	Firefox	CWE-693	Sandbox escape in the Remote Settings Client component
CVE-2026-60702	9.9	33.1	Oracle Corporation	Oracle WebLogic Server	CWE-284	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-60730	9.9	33.1	Oracle Corporation	Oracle WebCenter Portal	CWE-284	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middlew…
CVE-2026-74936	9.8	33.2	Mozilla	Firefox	CWE-416	Use-after-free in the JavaScript: WebAssembly component
CVE-2026-74944	9.8	33.2	Mozilla	Firefox	CWE-416	Use-after-free in the DOM: Core & HTML component
CVE-2026-71166	9.4	33.2	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-60879	8.8	33.1	Oracle Corporation	PeopleSoft Enterprise PeopleTools	CWE-284	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle Peop…
CVE-2026-60796	8.2	33.2	Oracle Corporation	Siebel CRM Integration	CWE-284	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (com…
CVE-2026-70952	8.2	33.2	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-60720	9.9	33.1	Oracle Corporation	Oracle Identity Manager	CWE-306	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-60726	8.8	33.1	Oracle Corporation	Oracle Access Manager	CWE-284	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middlewar…
CVE-2026-61017	8.8	33.1	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-61022	8.8	33.1	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-61058	8.8	33.1	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-75783	8.6	32.9	TRENDnet	TEW-WLC100P	CWE-119	TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow
CVE-2026-71055	8.8	32.9	Oracle Corporation	Oracle Business Intelligence Enterprise Edition	CWE-284	Vulnerability in the Oracle Business Intelligence Enterprise Edition product …
CVE-2026-69220	8.7	32.8	rabbitmq	rabbitmq-java-client	CWE-674	RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting cau…
CVE-2026-73399	6.5	32.8	flutterwave	Flutterwave WooCommerce	CWE-288	WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vul…
CVE-2026-70730	9.1	32.6	Oracle Corporation	Oracle Hyperion Profitability and Cost Management	—	Vulnerability in the Oracle Hyperion Profitability and Cost Management produc…
CVE-2026-70741	9.1	32.6	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70884	9.1	32.6	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-62599	8.6	32.6	Oracle Corporation	Oracle Trading Community	—	Vulnerability in the Oracle Trading Community product of Oracle E-Business Su…
CVE-2026-62628	8.6	32.6	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-70721	8.6	32.6	Oracle Corporation	Oracle Hyperion Profitability and Cost Management	—	Vulnerability in the Oracle Hyperion Profitability and Cost Management produc…
CVE-2026-60393	7.5	32.6	Oracle Corporation	Oracle Hyperion Infrastructure Technology	CWE-200	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-70810	7.5	32.6	Oracle Corporation	Oracle Scripting	—	Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (com…
CVE-2026-73878	7.5	32.6	Oracle Corporation	Helidon	—	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-73883	7.5	32.6	Oracle Corporation	Helidon	—	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-73884	7.5	32.6	Oracle Corporation	Helidon	—	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-61008	9.1	32.5	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-73917	9.1	32.5	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-60415	8.1	32.4	Oracle Corporation	Oracle WebLogic Server	CWE-200	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa…
CVE-2026-60850	7.5	32.5	Oracle Corporation	Oracle Unified Directory	CWE-284	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middle…
CVE-2026-60889	7.5	32.5	Oracle Corporation	Oracle Unified Directory	CWE-284	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middle…
CVE-2026-60914	7.5	32.5	Oracle Corporation	Oracle Unified Directory	CWE-284	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middle…
CVE-2026-61007	7.5	32.5	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-73907	7.5	32.5	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-73938	7.5	32.5	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-21580	9.3	32.3	Atlassian	Confluence Data Center	CWE-79	This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Securi…
CVE-2026-73350	8.2	32.4	PSM Plugins	SupportCandy	CWE-266	WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability
CVE-2026-61001	9.6	32.3	Oracle Corporation	Oracle Web Services Manager	CWE-284	Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Mid…
CVE-2026-47628	7.5	32.2	NVIDIA	Triton Inference Server	CWE-770	NVIDIA Triton Inference Server for Linux contains a vulnerability where an at…
CVE-2026-47629	7.5	32.2	NVIDIA	Triton Inference Server	CWE-20	NVIDIA Triton Inference Server for Linux contains a vulnerability where an at…
CVE-2026-70889	7.5	32.2	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-70891	7.5	32.2	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-52739	5.9	32.2	ZcashFoundation	zebra	CWE-248	ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplic…
CVE-2026-21582	8.8	32.1	Atlassian	Crowd Data Center	CWE-287	This High severity BASM (Broken Authentication & Session Management) vulnerab…
CVE-2026-75853	8.7	32.1	ArcadeData	arcadedb	CWE-862	ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
CVE-2026-62684	2.7	32.1	filebrowser	filebrowser	CWE-200	File Browser: Share API exposes the password hash and bypass token
CVE-2026-62463	9.6	32.0	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62619	8.8	31.9	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-60849	8.5	32.0	Oracle Corporation	Oracle Unified Directory	—	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middle…
CVE-2026-70722	8.2	31.9	Oracle Corporation	Oracle Advanced Inbound Telephony	CWE-284	Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Bu…
CVE-2026-60992	8.1	32.0	Oracle Corporation	Oracle Identity Manager Connector	CWE-284	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusi…
CVE-2026-62477	8.1	32.0	Oracle Corporation	Oracle Hyperion Infrastructure Technology	CWE-284	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62491	8.1	32.0	Oracle Corporation	Oracle Purchasing	—	Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (co…
CVE-2026-62502	8.1	32.0	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-70701	8.1	32.0	Oracle Corporation	Oracle Payables	—	Vulnerability in the Oracle Payables product of Oracle E-Business Suite (comp…
CVE-2026-70762	8.1	32.0	Oracle Corporation	Oracle Risk Management	—	Vulnerability in the Oracle Risk Management product of Oracle E-Business Suit…
CVE-2026-70811	8.1	32.0	Oracle Corporation	Oracle Purchasing	CWE-284	Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (co…
CVE-2026-70815	8.1	32.0	Oracle Corporation	Oracle Internet Procurement Connector	CWE-284	Vulnerability in the Oracle Internet Procurement Connector product of Oracle …
CVE-2026-70835	8.1	32.0	Oracle Corporation	Oracle iRecruitment	CWE-284	Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (…
CVE-2026-70878	8.1	32.0	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-70881	8.1	32.0	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-70924	8.1	32.0	Oracle Corporation	Oracle Web Services Manager	CWE-306	Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Mid…
CVE-2026-71676	7.5	32.0	n/a	n/a	CWE-122	Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to …
CVE-2026-66046	8.7	31.9	libexpat project	libexpat	CWE-407	Expat Denial of Service via storeAtts() Quadratic Complexity
CVE-2026-75855	8.4	31.8	ArcadeData	arcadedb	CWE-22	ArcadeDB before 26.8.1 Path Traversal via create/drop database
CVE-2026-62512	9.9	31.7	Oracle Corporation	Siebel CRM Cloud Applications	CWE-284	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel C…
CVE-2026-60767	8.8	31.7	Oracle Corporation	Siebel Apps - Marketing	CWE-284	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (co…
CVE-2026-61284	8.8	31.7	Oracle Corporation	Oracle Enterprise Manager Base Platform	CWE-284	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracl…
CVE-2026-61330	8.8	31.7	Oracle Corporation	Siebel CRM Cloud Applications	CWE-284	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel C…
CVE-2026-61341	8.8	31.7	Oracle Corporation	Siebel CRM Cloud Applications	CWE-284	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel C…
CVE-2026-70928	8.8	31.7	Oracle Corporation	Oracle Hyperion Financial Management	CWE-269	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70940	8.8	31.7	Oracle Corporation	Oracle Hyperion Financial Management	CWE-306	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70944	8.8	31.7	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70948	8.8	31.7	Oracle Corporation	Oracle Purchasing	CWE-284	Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (co…
CVE-2026-70949	8.8	31.7	Oracle Corporation	Siebel CRM Deployment	CWE-284	Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (comp…
CVE-2026-70966	8.8	31.7	Oracle Corporation	Oracle Hyperion Infrastructure Technology	CWE-284	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-71039	8.8	31.7	Oracle Corporation	Oracle Agile PLM	CWE-284	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (compone…
CVE-2026-71067	8.8	31.7	Oracle Corporation	Oracle Agile PLM MCAD Connector	CWE-306	Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply…
CVE-2026-61066	9.9	31.6	Oracle Corporation	Oracle Identity Manager	CWE-284	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middlew…
CVE-2026-61248	9.9	31.6	Oracle Corporation	Oracle Internet Directory	—	Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middl…
CVE-2026-61231	8.8	31.6	Oracle Corporation	Oracle Virtual Directory	—	Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middle…
CVE-2026-76047	8.8	31.6	Google	Chrome	CWE-843	Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remot…
CVE-2026-61332	8.7	31.5	Oracle Corporation	Siebel CRM Cloud Applications	CWE-284	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel C…
CVE-2026-76044	8.3	31.5	Google	Chrome	CWE-367	Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remo…
CVE-2026-73341	9.8	31.4	Metagauss	RegistrationMagic	CWE-502	WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerab…
CVE-2026-73376	9.8	31.4	supsystic	Ultimate Maps by Supsystic	CWE-502	WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vu…
CVE-2026-73397	9.8	31.4	Youzify	Youzify	CWE-502	WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnera…
CVE-2026-73937	8.2	31.4	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-70690	8.0	31.4	Oracle Corporation	Oracle HRMS (US)	—	Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (com…
CVE-2026-70802	8.0	31.4	Oracle Corporation	Oracle Public Sector Human Resources	—	Vulnerability in the Oracle Public Sector Human Resources product of Oracle E…
CVE-2026-71675	7.5	31.4	n/a	n/a	CWE-401	An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of ser…
CVE-2026-62475	6.6	31.4	Oracle Corporation	Oracle Shipping Execution	CWE-284	Vulnerability in the Oracle Shipping Execution product of Oracle E-Business S…
CVE-2026-73396	7.1	31.3	MakeWebBetter	MWB HubSpot for WooCommerce	CWE-288	WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication…
CVE-2026-53533	6.9	31.3	cole	aiosmtplib	CWE-77	aiosmtplib: SMTP command injection via CR/LF in sender/recipient address
CVE-2026-70669	9.8	31.1	Oracle Corporation	Oracle Reports Developer	—	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middle…
CVE-2026-45118	9.3	31.1	mybb	mybb	CWE-83	MyBB: Contact page reflected XSS
CVE-2026-50161	9.3	31.2	baresip	re	CWE-190	libre: Integer overflow in websock_decode() masked frame length check leads t…
CVE-2026-74959	9.1	31.1	Mozilla	Firefox	CWE-693	Mitigation bypass in the Storage: Cache API component
CVE-2026-62357	8.8	31.1	dragonflydb	dragonfly	CWE-190	DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-cont…
CVE-2026-73187	9.3	31.1	gingerplugins	Sticky Chat Widget	CWE-89	WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability
CVE-2026-73339	9.3	31.1	Webnus Inc.	Modern Events Calendar	CWE-89	WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
CVE-2026-73355	9.3	31.1	wp.insider	Affiliates Manager	CWE-89	WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability
CVE-2026-73365	9.3	31.1	Crocoblock. Jetimpex Inc.	JetAppointment	CWE-89	WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability
CVE-2026-73392	9.3	31.1	highwarden	Super Store Finder	CWE-89	WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability
CVE-2026-45532	8.7	30.9	dataease	dataease	CWE-22	DataEase has a Path Traversal Vulnerability
CVE-2026-54347	8.7	30.9	froxlor	froxlor	CWE-79	Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Accoun…
CVE-2026-62607	8.7	30.8	Oracle Corporation	Oracle Customer Care	—	Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite …
CVE-2026-71085	4.9	30.8	Oracle Corporation	Oracle Hyperion Financial Management	CWE-200	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-61258	9.8	30.8	Oracle Corporation	Oracle Internet Directory	CWE-284	Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middl…
CVE-2026-49221	8.8	30.7	givanz	Vvveb	CWE-639	Vvveb digital asset authorization bypass allows Vendors to list, read, edit, …
CVE-2026-49228	8.8	30.7	givanz	Vvveb	CWE-639	Vvveb product authorization bypass allows Vendors to read, duplicate, or dele…
CVE-2026-48798	7.1	30.8	sshnet	SSH.NET	CWE-22	SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-…
CVE-2026-73930	9.9	30.6	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-71880	7.6	30.7	GBIF	Integrated Publishing Toolkit	CWE-1336	Server-side template injection in Integrated Publishing Toolkit
CVE-2026-60865	6.8	30.7	Oracle Corporation	Service Delivery Platform	CWE-284	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middl…
CVE-2026-74044	7.0	30.5	Wazuh	wazuh-manager	CWE-22	Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster …
CVE-2026-70978	9.1	30.4	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-71015	9.1	30.4	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-306	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-71026	9.1	30.4	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-73866	9.1	30.4	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-32472	7.5	30.4	wbolt.com	Online Contact Widget	CWE-862	WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulne…
CVE-2026-32549	7.5	30.4	Codexpert, Inc	ThumbPress	CWE-862	WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
CVE-2026-60391	7.5	30.4	Oracle Corporation	Oracle Hyperion Financial Reporting	CWE-284	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-60590	7.5	30.4	Oracle Corporation	Oracle Hospitality Simphony	CWE-284	Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and B…
CVE-2026-60906	7.5	30.4	Oracle Corporation	Oracle WebCenter Content	CWE-284	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middle…
CVE-2026-70896	7.5	30.4	Oracle Corporation	Oracle Hyperion Data Relationship Management	CWE-284	Vulnerability in the Oracle Hyperion Data Relationship Management product of …
CVE-2026-70910	7.5	30.4	Oracle Corporation	Siebel CRM Integration	CWE-284	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (com…
CVE-2026-70986	7.5	30.4	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-70987	7.5	30.4	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-71034	7.5	30.4	Oracle Corporation	Oracle Commerce Guided Search / Oracle Commerce Experience Manager	CWE-284	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experien…
CVE-2026-71107	7.5	30.5	Oracle Corporation	Oracle Business Intelligence Enterprise Edition	CWE-284	Vulnerability in the Oracle Business Intelligence Enterprise Edition product …
CVE-2026-71142	7.5	30.4	Oracle Corporation	Oracle Communications Unified Inventory Management	CWE-284	Vulnerability in the Oracle Communications Unified Inventory Management produ…
CVE-2026-71158	7.5	30.4	Oracle Corporation	Helidon	CWE-284	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: …
CVE-2026-53455	8.6	30.4	ha-china	blueprint-studio	CWE-78	Blueprint Studio Git credential helper command injection
CVE-2026-62501	8.1	30.3	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62531	8.1	30.3	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-70744	8.1	30.3	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70749	8.1	30.3	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70868	8.1	30.3	Oracle Corporation	Oracle Application Testing Suite	CWE-284	Vulnerability in Oracle Application Testing Suite. The supported version that…
CVE-2026-71068	8.1	30.3	Oracle Corporation	Oracle Agile PLM MCAD Connector	CWE-306	Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply…
CVE-2026-52731	6.5	30.3	ZcashFoundation	zebra	CWE-248	ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
CVE-2026-32470	9.8	30.2	Roxnor	FundEngine	CWE-502	WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
CVE-2026-52481	7.5	30.2	n/a	n/a	CWE-200	An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote att…
CVE-2026-61029	9.0	30.1	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-54730	8.6	30.1	goauthentik	authentik	CWE-284	authentik: Authentication Flow Bypass via Unguarded challenge_valid() in Auth…
CVE-2026-70770	8.3	30.1	Oracle Corporation	Oracle Warehouse Management	CWE-284	Vulnerability in the Oracle Warehouse Management product of Oracle E-Business…
CVE-2026-62595	8.1	30.2	Oracle Corporation	Siebel CRM Integration	CWE-284	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (com…
CVE-2026-61011	8.2	30.0	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-61016	8.2	30.0	Oracle Corporation	Oracle WebCenter Sites	CWE-284	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middlewa…
CVE-2026-61265	8.1	30.0	Oracle Corporation	JD Edwards EnterpriseOne Orchestrator	CWE-284	Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle …
CVE-2026-15585	7.5	30.0	AKIN Software Computer Import Export Industry and Trade Ltd.	AKINSOFT Wolvox9 ERP / KontrolPanel.exe	CWE-22	Path Traversal in AKIN Software's Wolvox9 ERP
CVE-2026-43971	6.3	29.9	ninenines	cowlib	CWE-116	Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in co…
CVE-2026-73502	5.3	29.9	getkin	kin-openapi	CWE-476	kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating…
CVE-2026-62467	7.7	29.8	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-62571	7.7	29.8	Oracle Corporation	Oracle Hyperion Calculation Manager	—	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hy…
CVE-2026-70771	7.7	29.8	Oracle Corporation	Oracle Warehouse Management	CWE-284	Vulnerability in the Oracle Warehouse Management product of Oracle E-Business…
CVE-2026-70827	7.7	29.8	Oracle Corporation	Oracle MES for Process Manufacturing	—	Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E…
CVE-2026-70828	7.7	29.8	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-52738	6.9	29.8	ZcashFoundation	zebra	CWE-248	ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks
CVE-2026-62506	6.5	29.8	Oracle Corporation	Oracle Hyperion Infrastructure Technology	—	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Ora…
CVE-2026-70720	6.5	29.8	Oracle Corporation	Oracle Production Scheduling	—	Vulnerability in the Oracle Production Scheduling product of Oracle E-Busines…
CVE-2026-70767	6.5	29.8	Oracle Corporation	Oracle Hyperion Financial Reporting	—	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hy…
CVE-2026-70826	6.5	29.8	Oracle Corporation	Oracle Hyperion Financial Management	—	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-70831	6.5	29.8	Oracle Corporation	Oracle Hyperion Financial Management	CWE-284	Vulnerability in the Oracle Hyperion Financial Management product of Oracle H…
CVE-2026-52732	5.3	29.8	ZcashFoundation	zebra	CWE-770	ZEBRA: Mempool transaction admission denial via single-peer inbound queue sat…
CVE-2026-52734	5.3	29.8	ZcashFoundation	zebra	CWE-401	ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path ca…
CVE-2026-75856	9.2	29.7	Hmbown	CodeWhale	CWE-918	CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
CVE-2026-60956	7.5	29.8	Oracle Corporation	JD Edwards EnterpriseOne US Payroll	CWE-284	Vulnerability in the JD Edwards EnterpriseOne US Payroll product of Oracle JD…
CVE-2026-70713	7.5	29.8	Oracle Corporation	Oracle iSetup	—	Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (compon…
CVE-2026-70829	7.5	29.8	Oracle Corporation	Oracle Process Manufacturing Systems	CWE-284	Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E…
CVE-2026-66620	7.2	29.7	Derek Herman	OptionTree	CWE-502	WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Results continue: ranks 401–1407.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-18 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.