Security Box Score — August 19, 2026

CISA adds 1 to KEV; 673 CVEs published, led by Splunk (110).

673 CVEs published August 19, 2026: 100 critical, 283 high, 228 medium, 36 low; 2 in the KEV catalog at press time; 2 with a public exploit reference; 26 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 273 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	8342	30506	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1688 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	1263	3578	363	1781	637	1	11	2	0.1	7.8	.0017	+793 ▲
microsoft	446	1868	132	1273	449	14	286	27	1.4	7.8	.0044	-200 ▼
google	64	1825	224	758	786	57	77	6	0.3	7.5	.0025	-30 ▼
red hat	172	558	39	227	261	31	2	0	0.0	6.7	.0028	+107 ▲
apple	34	305	58	82	160	5	88	8	2.6	6.5	.0029	+34 ▲
freebsd	23	39	0	23	4	0	0	0	0.0	7.8	.0015	+23 ▲
canonical	11	38	12	9	12	5	0	0	0.0	7.8	.0020	+7 ▲
suse	5	26	5	14	6	1	0	0	0.0	8.1	.0039	-3 ▼

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	46	84	21	39	24	0	56	13	15.5	7.5	.0044	+31 ▲
palo alto networks	12	37	1	3	21	12	13	2	5.4	4.7	.0020	-2 ▼
ubiquiti	0	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
netgear	9	32	0	0	27	5	0	0	0.0	4.3	.0025	+3 ▲
fortinet	7	30	7	8	14	1	28	6	20.0	7.0	.0050	-6 ▼
vmware	0	17	4	9	2	2	7	2	11.8	8.3	.0040	-8 ▼
f5	0	16	5	8	3	0	4	1	6.3	8.6	.0057	-8 ▼
ivanti	3	14	4	8	2	0	25	5	35.7	8.3	.0754	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	102	438	87	189	149	12	33	2	0.5	7.5	.0049	+24 ▲
mozilla	59	186	68	68	50	0	9	0	0.0	8.1	.0031	+53 ▲
gitlab	15	66	2	14	42	8	4	2	3.0	5.1	.0029	+8 ▲
drupal	0	51	6	5	35	5	4	1	2.0	5.9	.0026	-46 ▼
github	5	17	1	7	9	0	0	0	0.0	6.6	.0043	0
docker	2	9	0	6	3	0	0	0	0.0	7.2	.0016	+2 ▲
wordpress	2	5	1	3	1	0	2	2	40.0	8.8	.3120	+2 ▲
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	889	2268	487	1172	513	96	27	3	0.1	7.8	.0034	+888 ▲
ibm	299	528	120	237	162	9	6	1	0.2	7.5	.0030	+263 ▲
adobe	60	312	39	145	123	5	19	3	1.0	7.8	.0026	-34 ▼
progress	19	61	14	37	10	0	6	1	1.6	8.1	.0037	+9 ▲
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	10	16	5	9	2	0	1	0	0.0	8.6	.0034	+10 ▲
zohocorp	4	10	3	5	2	0	0	0	0.0	8.7	.0140	+4 ▲
atlassian	3	6	1	5	0	0	13	0	0.0	8.1	.0034	+3 ▲

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	16	36	15	5	9	7	3	7.4	.0157	+15 ▲
siemens	19	35	2	23	8	2	0	7.3	.0016	+12 ▲
rockwell automation	1	25	4	18	3	0	0	8.7	.0029	-16 ▼
synology	1	24	2	6	13	3	0	5.6	.0025	+1 ▲
schneider electric	0	9	1	6	2	0	0	8.6	.0037	0
abb	0	7	0	4	3	0	0	7.2	.0018	-1 ▼
hikvision	0	6	0	4	2	0	0	7.2	.0040	0
moxa	0	5	0	3	2	0	0	7.0	.0029	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	56	155	10	83	57	5	2	1	0.6	7.2	.0019	+19 ▲
sourcecodester	30	150	0	0	83	67	0	0	0.0	5.5	.0031	-16 ▼
splunk	110	128	6	47	70	5	1	1	0.8	6.5	.0025	+107 ▲
openclaw	0	111	0	58	39	14	0	0	0.0	7.0	.0026	-44 ▼
nvidia	24	106	14	71	21	0	0	0	0.0	7.5	.0034	-16 ▼
siyuan-note	68	90	41	19	28	1	0	0	0.0	8.7	.0028	+62 ▲
zephyrproject	37	90	2	32	47	9	0	0	0.0	6.5	.0022	+22 ▲
gitea	48	89	19	36	30	4	0	0	0.0	7.5	.0034	+8 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-34486	.9862	99.9	7.5
CVE-2026-63030	.9779	99.9	9.8
CVE-2026-16232	.8912	99.8	9.3
CVE-2026-63077	.8473	99.7	9.8
CVE-2026-60137	.7979	99.6	5.9
CVE-2026-72898	.7922	99.6	10.0
CVE-2026-0770	.6342	99.1	9.8
CVE-2026-59310	.4588	98.7	9.8
CVE-2026-61511	.3399	98.3	9.3

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.7922	KEV
CVE-2026-8985	10.0	.0660
CVE-2026-6516	10.0	.0486
CVE-2026-48362	10.0	.0431
CVE-2026-47668	10.0	.0388
CVE-2026-19188	10.0	.0193
CVE-2026-58231	10.0	.0171
CVE-2026-16812	10.0	.0157	KEV
CVE-2026-73299	10.0	.0121
CVE-2025-71389	10.0	.0120

Most disclosures (vendor)
Vendor	CVEs
oracle	1997
linux	1619
microsoft	465
google	459
ibm	368
red hat	263
apple	201
apache	195
mozilla	124
splunk	110

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	13
apple	8
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	58
PyPI	6
npm	5
Go	3
Packagist	2
crates.io	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2021-27137	DD-WRT	0
CVE-2025-68686	Fortinet	0
CVE-2026-0770	Langflow	0
CVE-2026-16232	checkpoint	0
CVE-2026-16812	Arista Networks	0
CVE-2026-18556	N-able	0
CVE-2026-18577	N-able	0
CVE-2026-20316	Cisco	0
CVE-2026-20349	Cisco	0
CVE-2026-34486	Apache Software Foundation	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1736
CVE-2021-27102	n/a	2021-11-17	1736
CVE-2021-27101	n/a	2021-11-17	1736
CVE-2021-27103	n/a	2021-11-17	1736
CVE-2021-21017	Adobe	2021-11-17	1736
CVE-2021-28550	Adobe	2021-11-17	1736
CVE-2021-42013	Apache Software Foundation	2021-11-17	1736
CVE-2021-41773	Apache Software Foundation	2021-11-17	1736
CVE-2021-30858	Apple	2021-11-17	1736
CVE-2021-30860	Apple	2021-11-17	1736

Transactions

ADDED TO KEV — CVE-2026-64849 (mlflow). Remediation due September 2, 2026.

EXPLOIT PUBLISHED — GNOME GLib: 5 CVEs (CVE-2026-58010, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2017-20252 (nextgeneditor NextGen Editor). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20253 (Gegabyte My Projects). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20254 (Gegabyte User Bench). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20255 (Joombooking JB Visa). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20256 (Joomplace Survey Force Deluxe). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20257 (Joomplace Quiz Deluxe). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20258 (Extro RPC). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20259 (Joomlashack OSDownloads). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20260 (Weborange Price Alert). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20261 (Weborange Bargain Product VM3). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20262 (Webkul Ajax Quiz). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20263 (Focalpointx FocalPoint Pro / Free). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20264 (Pulseextensions Sponsor Wall). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20265 (Pulseextensions Flip Wall). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20266 (Joomshaper SP Movie Database). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20267 (Joomlathat Calendar Planner). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20272 (Faboba Ultimate Property Listing). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20274 (King-products LMS King Professional). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20276 (Simbunch SIMGenealogy). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20277 (Joomboost Joomla JoomRecipe). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20278 (Joomboost JoomRecipe). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20279 (Extensions Joomla Payage). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20280 (Myportfolio). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20281 (Joomlaboat Extra Search). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2017-20282 (Soft-Php jCart for OpenCart). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25748 (Cmsjunkie JHotelReservation). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25749 (Cmsjunkie J-CruisePortal). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25750 (Cmsjunkie MultipleHotelReservation). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25751 (Cmsjunkie ClassifiedsManager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25752 (Cmsjunkie J-BusinessDirectory). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25753 (Wdmtech VMap). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-1048 (Microsoft Windows 10 Version 1507). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-1054 (Microsoft Windows 10 Version 1507). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-1106 (Microsoft SharePoint Enterprise Server 2016). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-26855 (Microsoft Exchange Server 2013 Cumulative Update 21). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-26863 (Microsoft Windows 10 Version 1803). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-27065 (Microsoft Exchange Server 2013 Cumulative Update 21). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-27074 (Microsoft Azure Sphere). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-27080 (Microsoft Azure Sphere). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-42297 (Microsoft Windows Update Assistant). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-42321 (Microsoft Exchange Server 2016 Cumulative Update 21). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-26485 (Mozilla Firefox). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-26486 (Mozilla Firefox). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-12228 (parisneo/lollms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-17106 (moby go-archive). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-5241 (huggingface/transformers). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-57828 (phoca.cz Phoca Download extension for Joomla). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-70667 (Netflix lemur). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71225 (Stephan Muelle libkcapi). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71227 (Stephan Muelle libkcapi). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72529 (TrueConf Server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-72530 (TrueConf Server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75086 (itsourcecode Hospital Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75093 (sonos tract). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75130 (Uptash Context7). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75773 (karakeep-app karakeep). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75778 (code-projects Task Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75784 (TRENDnet TEW-WLC100). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75876 (xianrendzw EasyReport). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-75877 (TRENDnet TV-IP751WIC). Public exploit reference added.

RESCORED — IBM i: 9 CVEs (CVE-2026-17074, CVE-2026-17075, CVE-2026-17101, CVE-2026-17272, CVE-2026-17476, CVE-2026-17502, CVE-2026-18086, CVE-2026-18193, CVE-2026-18249). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2020-1106 (Microsoft SharePoint Enterprise Server 2016). CVSS 5.4 → 6.1 (NVD).

RESCORED — CVE-2023-21695 (Microsoft Windows 10 Version 1507). CVSS 7.5 → 8.8 (NVD).

RESCORED — CVE-2023-21697 (Microsoft Windows 10 Version 1507). CVSS 6.2 → 5.5 (NVD).

RESCORED — CVE-2023-21703 (Microsoft Azure Data Box Gateway). CVSS 6.5 → 7.2 (NVD).

RESCORED — CVE-2024-43481 (Microsoft Power BI Report Server - May 2024). CVSS 6.5 → 8.8 (NVD).

RESCORED — CVE-2024-43612 (Microsoft Power BI Report Server - May 2024). CVSS 6.9 → 4.7 (NVD).

RESCORED — CVE-2026-12228 (parisneo/lollms). CVSS 8.7 → 5.4 (NVD).

RESCORED — CVE-2026-16627 (GitLab). CVSS 7.7 → 9 (NVD).

RESCORED — CVE-2026-21229 (Microsoft Power BI Report Server). CVSS 8 → 8.8 (NVD).

RESCORED — CVE-2026-48617 (nodejs node). CVSS 1.8 → 8.2 (NVD).

RESCORED — CVE-2026-7427 (GitLab). CVSS 5.3 → 7.5 (NVD).

RESCORED — CVE-2026-75587 (Mattermost). CVSS 3.6 → 3.3 (NVD).

RESCORED — CVE-2026-75976 (TRENDnet TEW-823DRU). CVSS 9.4 → 8.6 (NVD).

PATCH SHIPPED — Stephan Muelle libkcapi: 3 CVEs (CVE-2026-71225, CVE-2026-71226, CVE-2026-71227). Fix versions published.

PATCH SHIPPED — CVE-2026-72694 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:2.17.10-12.el10_2.1.

PATCH SHIPPED — CVE-2026-74012 (TaxoPress). Fixed in TaxoPress 3.52.0.

ENRICHED — Microsoft SharePoint Enterprise Server 2016: 7 CVEs (CVE-2020-1023, CVE-2020-1024, CVE-2020-1069, CVE-2020-1102, CVE-2020-1103, CVE-2020-1104, CVE-2020-1105). Received CVSS/CPE analysis.

ENRICHED — CVE-2020-0901 (Microsoft 365 Apps for Enterprise). Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2020-1063 (Microsoft Dynamics 365 (on-premises) version 8.2). Received CVSS 5.4 and CPE data from NVD.

ENRICHED — CVE-2020-1066 (Microsoft .NET Framework 3.0 Service Pack 2). Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2020-1107 (Microsoft SharePoint Enterprise Server 2013 Service Pack 1). Received CVSS 5.4 and CPE data from NVD.

ENRICHED — CVE-2020-1108 (Microsoft .NET 5.0). Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2020-1161 (Microsoft ASP.NET Core 3.1). Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2020-1171 (Microsoft Python extension for Visual Studio Code). Received CVSS 8.8 and CPE data from NVD.

ENRICHED — CVE-2020-1173 (Microsoft Power BI Report Server). Received CVSS 6.8 and CPE data from NVD.

ENRICHED — CVE-2020-1179 (Microsoft Windows 10 Version 1507). Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2020-1192 (Microsoft Visual Studio Code). Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2026-23394 (Linux). Received CVSS 4.7 and CPE data from NVD.

ENRICHED — CVE-2026-43491 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

673 CVEs published. 25 box scores and 375 table rows below; the remaining 273 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-72530CRITICAL

TrueConf TrueConf Server — A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X …

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   N   H   H   H    9.5   .0183   77.2   YES

AFFECTED
  Product          Versions     Fixed
  TrueConf Server  unspecified  —

TIMELINE
  Aug 10  Reserved by CNA
  Aug 19  Public exploit reference published
  Aug 19  Published (CNA: Kaspersky)
  Aug 20  Added to CISA KEV, due Sep 3

CWE-94 · CNA: Kaspersky · CVSS v4.0 · 3 references · NVD status: Analyzed · KEV due September 3, 2026

CVE-2026-72529CRITICAL

TrueConf TrueConf Server — A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X …

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0155   73.2   YES

AFFECTED
  Product          Versions     Fixed
  TrueConf Server  unspecified  —

TIMELINE
  Aug 10  Reserved by CNA
  Aug 19  Public exploit reference published
  Aug 19  Published (CNA: Kaspersky)
  Aug 20  Added to CISA KEV, due Aug 23

CWE-306 · CNA: Kaspersky · CVSS v4.0 · 3 references · NVD status: Analyzed · KEV due August 23, 2026

CVE-2026-71961HIGH

Shenzhen Cudy Technology Co., Ltd. WR3000 2.0 — Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0305   86.5     —

AFFECTED
  Product     Versions     Fixed
  WR3000 2.0  unspecified  —

TIMELINE
  Aug 8   Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-54795HIGH

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Element…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0239   82.7     —

AFFECTED
  Product                Versions     Fixed
  OpenManage Enterprise  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Aug 19  Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-54796HIGH

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Element…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0236   82.5     —

AFFECTED
  Product                Versions     Fixed
  OpenManage Enterprise  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Aug 19  Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-75616HIGH

TP-Link Systems Inc. Archer C20 v6 — Command Injection in Router Web Management Interface

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   H   N   H   H   H    8.5   .0191   78.2     —

AFFECTED
  Product        Versions     Fixed
  Archer C20 v6  unspecified  —

TIMELINE
  Aug 17  Reserved by CNA
  Aug 19  Published (CNA: TPLink)

CWE-78 · CNA: TPLink · CVSS v4.0 · 3 references · NVD status: Received

CVE-2024-58376CRITICAL

renovatebot renovate — Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0167   75.0     —

AFFECTED
  Product   Versions    Fixed
  renovate  37.158.0 –  37.199.0

TIMELINE
  Aug 16  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-76761MEDIUM

chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0158   73.7     —

AFFECTED
  Product     Versions  Fixed
  cc-connect  1.4.0 –   —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-76591LOW

TRENDnet TEW-755AP ssi email.cgi log_email_server command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0132   68.6     —

AFFECTED
  Product    Versions    Fixed
  TEW-755AP  20260702 –  —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-75984LOW

TRENDnet TEW-823DRU admin.cgi command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0129   68.1     —

AFFECTED
  Product     Versions     Fixed
  TEW-823DRU  1.1.02b01 –  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 19  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-75985LOW

TRENDnet Router ping.cgi command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0129   68.1     —

AFFECTED
  Product  Versions     Fixed
  Router   1.1.02b01 –  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 19  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-23501HIGH

Dell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Eleme…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0129   67.9     —

AFFECTED
  Product                            Versions     Fixed
  RecoverPoint for Virtual Machines  unspecified  —

TIMELINE
  Jan 13  Reserved by CNA
  Aug 19  Published (CNA: dell)

CWE-78 · CNA: dell · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-76582LOW

TRENDnet TEW-821DAP ssi ping.cgi system command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0128   67.9     —

AFFECTED
  Product     Versions     Fixed
  TEW-821DAP  2.2.01b05 –  —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-76583LOW

TRENDnet TV-IP751WIC alphapd set_time.cgi command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.2     —

AFFECTED
  Product      Versions    Fixed
  TV-IP751WIC  11.03.03 –  —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-15068CRITICAL

IBM AIX — Vulnerabilities in IBM AIX and PowerVM VIOS

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0105   61.7     —

AFFECTED
  Product       Versions  Fixed
  AIX           7.2 –     —
  PowerVM VIOS  4.1 –     —

TIMELINE
  Jul 8   Reserved by CNA
  Aug 19  Published (CNA: ibm)

CWE-78 · CNA: ibm · CVSS v3.1 · 1 reference · NVD status: Analyzed

CVE-2026-63722HIGH

ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0098   59.7     —

AFFECTED
  Product   Versions     Fixed
  ICEcoder  unspecified  —

TIMELINE
  Jul 17  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-306 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-76850CRITICAL

InternLM lmdeploy — LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0098   59.6     —

AFFECTED
  Product   Versions  Fixed
  lmdeploy  0.9.2 –   —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-502 · CNA: VulnCheck · CVSS v4.0 · 7 references · NVD status: Received

CVE-2026-45741HIGH

Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  C  H  L  N    7.5   .0087   56.2     —

AFFECTED
  Product    Versions    Fixed
  gotenberg  < 8.33.0 –  —

TIMELINE
  May 13  Reserved by CNA
  Aug 19  Published (CNA: GitHub_M)

CWE-184, CWE-918 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-76832HIGH

Agno PythonTools Path Traversal via joinpath file_name argument

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   A   H   H   H    8.5   .0084   55.2     —

AFFECTED
  Product  Versions     Fixed
  Agno     unspecified  —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-76166MEDIUM

Red Hat Red Hat JBoss Enterprise Application Platform 7 — Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   N  U  N  N  L    4.3   .0084   55.1     —

AFFECTED
  Product                                                       Versions     Fixed
  Red Hat JBoss Enterprise Application Platform 7               unspecified  —
  Red Hat JBoss Enterprise Application Platform 8               unspecified  —
  Red Hat JBoss Enterprise Application Platform Expansion Pack  unspecified  —
  Red Hat JBoss Web Server 5                                    unspecified  —
  Red Hat JBoss Web Server 6                                    unspecified  —
  Red Hat JBoss Web Server 7                                    unspecified  —
  Red Hat Single Sign-On 7                                      unspecified  —

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: redhat)

CWE-476 · CNA: redhat · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-76231HIGH

renovatebot renovate — Renovate 32.135.0 before 40.33.0 Command Injection via hermit

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   H   N   H   H   H    8.4   .0073   51.6     —

AFFECTED
  Product   Versions    Fixed
  renovate  32.135.0 –  40.33.0

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-77 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-76230HIGH

renovatebot renovate — Renovate 35.63.0 before 40.33.0 Command Injection via npm

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   H   N   H   H   H    8.4   .0073   51.5     —

AFFECTED
  Product   Versions   Fixed
  renovate  35.63.0 –  40.33.0

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-77 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-76232HIGH

renovatebot renovate — Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   H   N   H   H   H    8.4   .0073   51.5     —

AFFECTED
  Product   Versions   Fixed
  renovate  31.51.0 –  40.33.0

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-77 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-53451CRITICAL

sgoudelis ground-station — Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0073   51.3     —

AFFECTED
  Product         Versions    Fixed
  ground-station  < 0.4.13 –  —

TIMELINE
  Jun 9   Reserved by CNA
  Aug 19  Published (CNA: GitHub_M)

CWE-22, CWE-73, CWE-94 · CNA: GitHub_M · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-76229HIGH

renovatebot renovate — Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   H   N   H   H   H    8.4   .0072   51.2     —

AFFECTED
  Product   Versions    Fixed
  renovate  39.218.0 –  40.33.0

TIMELINE
  Aug 19  Reserved by CNA
  Aug 19  Published (CNA: VulnCheck)

CWE-77 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-76233	8.4	51.2	renovatebot	renovate	CWE-77	Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager
CVE-2026-16865	8.8	51.0	IBM	AIX	CWE-78	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76228	8.4	50.4	renovatebot	renovate	CWE-78	Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper
CVE-2026-19942	8.1	49.9	wpfeedback	Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback	CWE-22	Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_at…
CVE-2026-52889	9.8	49.7	verbb	formie	CWE-1336	Formie: Server-Side Template Injection in Formie Hidden field defaults
CVE-2026-76314	8.8	49.0	Splunk	Splunk Enterprise	CWE-94	Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splun…
CVE-2026-69550	6.5	48.4	Microsoft	Windows App for Mac	CWE-125	Windows App for Mac Information Disclosure Vulnerability
CVE-2026-32475	9.0	48.2	Elementor	Elementor Pro	CWE-434	WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability
CVE-2026-16919	9.8	48.1	IBM	AIX	CWE-843	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-48024	9.1	47.9	wazuh	wazuh	CWE-22	Wazuh: merged-file header path traversal in cluster sync allows arbitrary fil…
CVE-2026-75149	8.7	47.8	marimo-team	marimo	CWE-94	marimo < 0.23.15 Code Injection via MCP Server Configuration
CVE-2026-16894	9.8	46.8	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16913	9.8	46.8	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76589	8.6	46.7	TRENDnet	TEW-755AP	CWE-119	TRENDnet TEW-755AP mycli FUN_401000 stack-based overflow
CVE-2026-76590	8.6	46.7	TRENDnet	TEW-755AP	CWE-119	TRENDnet TEW-755AP ssi wan.cgi stack-based overflow
CVE-2026-16885	9.8	46.2	IBM	AIX	CWE-121	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16850	8.8	46.2	IBM	AIX	CWE-269	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16917	9.8	45.9	IBM	AIX	CWE-190	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-18315	9.8	46.0	themetechmount	TrueBooker – Appointment Booking and Scheduler System	CWE-639	TrueBooker <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Contr…
CVE-2026-16840	9.8	45.4	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76224	8.7	45.2	ArcadeData	arcadedb	CWE-94	ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback
CVE-2026-16911	8.8	45.0	IBM	AIX	CWE-121	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76008	10.0	44.8	Comfast	CF-N1-S	CWE-119	Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-bas…
CVE-2026-76404	9.1	44.1	Splunk	Splunk MCP Server app	CWE-502	Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splu…
CVE-2026-49289	7.5	44.0	simplesamlphp	saml2	CWE-400	SimpleSAMLphp SAML2: Possible DoS via XPath Transform
CVE-2026-16882	9.8	43.7	IBM	AIX	CWE-78	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-20357	10.0	43.5	Cisco	Cisco Crosswork Planning	CWE-306	Cisco Crosswork Security Hardening Release: August 2026
CVE-2026-20030	10.0	43.3	Cisco	Cisco Crosswork Planning	CWE-89	Cisco Crosswork Security Hardening Release: August 2026
CVE-2026-72717	9.3	43.3	orval-labs	orval	CWE-94	Orval: Import-time RCE via schema default -> zod module-level template literal
CVE-2026-71960	9.3	43.2	Shenzhen Cudy Technology Co., Ltd.	WR3000 2.0	CWE-798	Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT
CVE-2026-16616	8.6	43.2	Unknown	Simple File List	CWE-22	Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via…
CVE-2026-73136	8.2	43.2	ZenHive	mpp	CWE-294	Static memo configuration in mpp Tempo disables per-challenge attribution bin…
CVE-2026-75593	7.2	43.0	moby	buildkit	CWE-22	BuildKit: Malicious client can bypass destination directory validation on loc…
CVE-2026-53545	9.8	42.8	Termix-SSH	Termix	CWE-78	Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection
CVE-2026-67189	5.3	42.4	Netgate	pfSense Plus	CWE-79	pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record
CVE-2026-49255	8.8	42.2	electerm	electerm	CWE-78	electerm: Command Injection in File System Operations (rmrf, mv, cp)
CVE-2026-62681	9.3	42.0	orval-labs	orval	CWE-94	Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backti…
CVE-2026-72716	9.3	42.0	orval-labs	orval	CWE-1336	Orval: Import-time RCE via query-parameter default -> zod module-level templa…
CVE-2026-55087	6.1	42.0	ether	etherpad	CWE-79	Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoni…
CVE-2026-62317	7.5	41.9	logto-io	logto	CWE-1333	Logto: ReDoS via unescaped user input in email subaddressing regex (blockSuba…
CVE-2026-45274	6.9	41.7	PoxenStudio	talebook	CWE-602	MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_RE…
CVE-2026-48162	9.1	41.1	wazuh	wazuh	CWE-73	Wazuh: cluster peer can read arbitrary master files and forge offline REST AP…
CVE-2026-20231	9.9	40.6	Cisco	Cisco Secure Workload	CWE-74	Cisco Secure Workload Software Security Hardening Release August 2026 - Impro…
CVE-2026-62682	9.3	40.5	orval-labs	orval	CWE-94	Orval: RCE via servers[].url -> unescaped request-URL template literal (with …
CVE-2026-76313	8.8	40.5	Splunk	Splunk Enterprise	CWE-284	Remote Code Execution (RCE) through the REST API in Splunk Enterprise
CVE-2026-67581	8.7	40.4	ZenHive	mpp	CWE-294	On-chain transfer proof is not single-use in mpp EVM payment method, enabling…
CVE-2026-50173	7.2	40.4	Rheosoph	flow-like	CWE-863	Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents…
CVE-2026-45798	7.5	40.3	wazuh	wazuh	CWE-121	Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable fro…
CVE-2026-76584	8.6	40.1	TRENDnet	TV-IP751WIC	CWE-119	TRENDnet TV-IP751WIC alphapd set_time.cgi stack-based overflow
CVE-2026-76218	7.7	40.0	gitpython-developers	GitPython	CWE-88	GitPython before 3.1.58 Remote Code Execution via Repo.init
CVE-2026-45742	7.5	39.9	gotenberg	gotenberg	CWE-362	Gotenberg: Concurrent Execution using Shared Resource with Improper Synchroni…
CVE-2026-16845	9.8	39.9	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16862	9.8	39.9	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-53542	8.8	39.8	Termix-SSH	Termix	CWE-78	Termix: Tar option injection in file-manager archive creation allows command …
CVE-2026-55193	8.7	39.9	FreeRDP	FreeRDP	CWE-122	FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to…
CVE-2026-76395	8.8	39.7	Splunk	Splunk AI Toolkit	CWE-502	Remote Code Execution (RCE) through Deserialization of Untrusted Data in the …
CVE-2026-16816	9.9	39.6	IBM	AIX	CWE-78	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2022-4996	5.5	39.5	n/a	mruby	CWE-1077	mruby bigint.c udiv floating point comparison with incorrect operator
CVE-2026-15065	9.1	39.4	IBM	AIX	CWE-312	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-55191	8.7	39.2	FreeRDP	FreeRDP	CWE-122	FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation
CVE-2026-66613	9.8	39.1	Crocoblock. Jetimpex Inc.	JetEngine	CWE-1336	WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability
CVE-2026-71864	9.3	39.1	orval-labs	orval	CWE-94	Orval: Import-time RCE via header parameter name -> computed-property-key inj…
CVE-2026-71865	9.3	39.1	orval-labs	orval	CWE-94	Orval: Import-time RCE via query parameter name -> computed-property-key inje…
CVE-2026-71866	9.3	39.1	orval-labs	orval	CWE-89	Orval: Import-time RCE via schema property name -> computed-property-key inje…
CVE-2026-71867	9.3	39.1	orval-labs	orval	CWE-89	Orval: RCE via schema property name -> computed-property-key injection in the…
CVE-2026-71868	9.3	39.1	orval-labs	orval	CWE-94	Orval: Import-time RCE via enum-typed default -> zod module-level template li…
CVE-2026-71869	9.3	39.1	orval-labs	orval	CWE-94	Orval: Import-time RCE via array-items default -> zod module-level template l…
CVE-2026-71871	9.3	39.1	orval-labs	orval	CWE-94	Orval: Import-time RCE via header-parameter default -> zod module-level templ…
CVE-2026-76878	8.4	39.0	OpenStack	Aodh	CWE-688	In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping …
CVE-2026-16877	8.8	38.5	IBM	AIX	CWE-121	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16872	9.8	38.2	IBM	AIX	CWE-121	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76220	8.7	38.1	gitpython-developers	GitPython	CWE-88	GitPython before 3.1.58 Command Execution via split_single_char_options
CVE-2026-76003	8.6	38.1	UTT	HiPER 1200GW	CWE-119	UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
CVE-2026-49441	9.1	38.0	wazuh	wazuh	CWE-73	Wazuh : peer-controlled metadata key in process_files_from_worker non-merged …
CVE-2026-55194	8.7	37.8	FreeRDP	FreeRDP	CWE-122	FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due t…
CVE-2026-63633	7.7	37.8	FreeRDP	FreeRDP	CWE-122	FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus`…
CVE-2026-16834	9.8	37.8	IBM	AIX	CWE-190	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-20358	10.0	37.7	Cisco	Cisco Crosswork Planning	CWE-73	Cisco Crosswork Security Hardening Release: August 2026
CVE-2026-16864	9.8	37.6	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76315	8.8	36.7	Splunk	Splunk Enterprise	CWE-94	Code Injection through Splunk Web Manager Configuration in Splunk Enterprise
CVE-2026-20317	10.0	36.5	Cisco	Cisco Secure Workload	CWE-287	Cisco Secure Workload Software Security Hardening Release August 2026 - Impro…
CVE-2026-63188	8.7	36.5	logto-io	logto	CWE-22	logto-tunnel serves files outside --experience-path via path traversal
CVE-2026-44255	5.3	36.4	wazuh	wazuh	CWE-208	Wazuh: Username Enumeration via Timing Side-Channel
CVE-2026-18051	10.0	36.3	Unknown	W3 Total Cache	CWE-22	W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and …
CVE-2026-76004	8.6	36.3	UTT	HiPER 1250GW	CWE-119	UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow
CVE-2026-54739	6.9	35.8	LemmyNet	lemmy	CWE-204	Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
CVE-2026-68560	7.7	35.6	wekan	wekan	CWE-78	Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
CVE-2026-15061	8.2	35.5	IBM	AIX	CWE-22	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-52792	8.7	35.5	xyproto	algernon	CWE-69	Algernon: Server-side script source disclosure on Windows via NTFS filename
CVE-2026-53549	7.7	35.4	Termix-SSH	Termix	CWE-918	Termix: Server-Side Request Forgery via Proxy Connectivity Test
CVE-2026-54738	6.5	35.4	LemmyNet	lemmy	CWE-799	Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web Con…
CVE-2026-62666	8.8	35.3	getgrav	grav-plugin-api	CWE-639	Grav API Plugin: non-super api.users.write manager -> super-admin via createA…
CVE-2026-16656	9.8	35.1	IBM	AIX	CWE-287	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-75987	6.9	35.1	SPLWare	esProc	CWE-20	SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization
CVE-2026-73541	8.3	34.7	ZenHive	mpp	CWE-770	Tempo fee sponsorship in mpp bounds each transaction but not aggregate exposu…
CVE-2026-54742	5.1	34.7	LemmyNet	lemmy	CWE-863	Lemmy: `CollectionAdd::Featured` does not check the post is in the community
CVE-2026-44253	4.9	34.4	wazuh	wazuh	CWE-770	Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str all…
CVE-2026-20315	10.0	34.3	Cisco	Cisco Secure Workload	CWE-284	Cisco Secure Workload Software Security Hardening Release August 2026 - Impro…
CVE-2026-47187	9.3	34.2	libfuse	sshfs	CWE-59	SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write
CVE-2026-55090	5.3	34.1	ether	etherpad	CWE-79	Etherpad: Stored XSS in HTML export via unescaped attribute-pool values
CVE-2026-44901	8.4	33.9	wazuh	wazuh	CWE-502	Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Exe…
CVE-2026-45273	8.7	33.7	PoxenStudio	talebook	CWE-862	MyBooks: Privilege Escalation via Missing Authorization on Admin Settings End…
CVE-2026-75143	9.3	33.4	FFmpeg	FFmpeg	CWE-122	FFmpeg Heap Buffer Overflow via RIST Protocol Reader
CVE-2026-16824	7.5	33.3	IBM	AIX	CWE-400	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16831	7.5	33.3	IBM	AIX	CWE-400	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16836	7.5	33.3	IBM	AIX	CWE-400	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-61712	2.3	33.3	moby	buildkit	CWE-770	BuildKit: Possible runtime DoS via unbounded group parsing
CVE-2026-68899	8.7	33.2	wekan	wekan	CWE-434	Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing Syste…
CVE-2026-19490	9.3	33.0	NetScaler	ADC	CWE-288	NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
CVE-2026-62673	8.2	33.1	getgrav	grav	CWE-178	Grav: .htaccess file extension rules bypass via case variation on case-insens…
CVE-2026-54743	6.4	33.0	LemmyNet	lemmy	CWE-79	Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed
CVE-2026-55648	6.1	32.9	FreeRDP	FreeRDP	CWE-190	FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bou…
CVE-2026-76243	9.2	32.8	eidetic-labs	stigmem	CWE-285	stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth
CVE-2026-53547	8.8	32.9	Termix-SSH	Termix	CWE-862	Termix: Account Takeover via Global Settings Disclosure
CVE-2026-76345	6.0	32.9	Splunk	Splunk Enterprise	CWE-284	Remote Code Execution (RCE) through the REST API in Splunk Enterprise
CVE-2026-16888	3.7	32.9	IBM	AIX	CWE-22	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-55192	7.2	32.7	FreeRDP	FreeRDP	CWE-125	FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/sur…
CVE-2026-75919	6.9	32.6	thorsten	phpMyFAQ	CWE-306	phpMyFAQ before 4.1.7 Authentication Bypass via Setup API
CVE-2026-18937	9.0	32.4	Unknown	Broken Link Checker	CWE-94	Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection
CVE-2026-15780	7.2	32.2	veronalabs	WP Statistics – Simple, privacy-friendly Google Analytics alternative	CWE-79	WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'u…
CVE-2026-63117	6.5	31.7	FreeRDP	FreeRDP	CWE-369	FreeRDP: Denial of service through ADPCM frame size calculation
CVE-2026-20177	5.3	31.7	Cisco	Cisco Industrial Ethernet Switches	CWE-770	Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability
CVE-2026-19489	8.8	31.6	NetScaler	ADC	CWE-120	Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC:…
CVE-2026-76317	8.8	31.4	Splunk	Splunk Enterprise	CWE-26	Path Traversal through the Lookup Configuration REST API in Splunk Enterprise
CVE-2026-16852	7.5	31.4	IBM	AIX	CWE-190	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-62669	7.4	31.3	getgrav	grav	CWE-287	Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotati…
CVE-2026-53654	5.3	31.4	getgrav	grav	CWE-601	Grav: Unauthenticated open redirect via login twofa_cancel _redirect
CVE-2026-16839	9.4	31.2	IBM	AIX	CWE-125	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-20320	7.5	31.3	Cisco	Cisco BroadWorks	CWE-611	A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadW…
CVE-2026-53452	5.3	31.1	sgoudelis	ground-station	CWE-22	Ground Station: Unauthenticated out-of-containment file read via `sigmfplayba…
CVE-2026-76319	8.8	30.7	Splunk	Splunk Enterprise	CWE-862	Remote Code Execution (RCE) through Federated Search in Splunk Enterprise
CVE-2025-36254	7.4	30.7	IBM	DS8A00 (R10.0 - R10.1)	CWE-116	DS8900F and DS8A00 Authentication Bypass
CVE-2026-61690	6.5	30.3	getgrav	grav	CWE-409	Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits
CVE-2026-68901	6.5	30.3	wekan	wekan	CWE-476	WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authTo…
CVE-2026-68561	8.8	30.2	wekan	wekan	CWE-269	Wekan: a low-privilege board member escalates to board admin and takes over a…
CVE-2025-14600	9.3	30.1	vsDesk	vsDesk	CWE-305	Admin Account Takeover via Path Traversal in vsDesk
CVE-2026-76221	8.7	30.1	gitpython-developers	GitPython	CWE-74	GitPython before 3.1.58 Config Injection via option-name
CVE-2026-76262	7.5	30.0	Splunk	Splunk Enterprise	CWE-200	Exposure of Sensitive Information to an Unauthorized Actor through the REST A…
CVE-2026-44829	8.8	29.9	gotenberg	gotenberg	CWE-22	Gotenberg: Path traversal in zip entry name via Windows-style separators in u…
CVE-2026-76310	9.4	29.7	Splunk	Splunk Enterprise	CWE-284	Improper Access Control through Embedded Report REST API Requests in Splunk E…
CVE-2026-76311	9.4	29.7	Splunk	Splunk Enterprise	CWE-284	Improper Access Control in Embedded Report Dispatch Archives in Splunk Enterp…
CVE-2026-45272	9.4	29.4	PoxenStudio	talebook	CWE-94	MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python C…
CVE-2026-20319	7.5	29.4	Cisco	Cisco Secure Workload	CWE-119	Cisco Secure Workload Software Security Hardening Release August 2026 - Buffe…
CVE-2026-18430	7.2	29.4	HumHub	HumHub	CWE-79	HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescape…
CVE-2026-69222	7.5	29.3	harttle	liquidjs	CWE-400	LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template …
CVE-2026-76576	2.1	29.2	yangzongzhuan	RuoYi-Vue	CWE-22	yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resour…
CVE-2026-53546	9.6	28.9	Termix-SSH	Termix	CWE-639	Termix: Missing authorization in SSH host credential resolution exposes store…
CVE-2026-55085	9.6	28.9	ether	etherpad	CWE-79	Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross…
CVE-2026-76312	9.4	28.9	Splunk	Splunk Enterprise	CWE-284	Improper Access Control through Embedded Reports in Splunk Enterprise
CVE-2026-76356	8.1	28.9	Splunk	Splunk SOAR	CWE-290	Authentication Bypass through IP Address Spoofing in the Automation Broker in…
CVE-2026-14334	8.8	28.8	Unknown	Booking calendar, Appointment Booking System	CWE-79	Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stor…
CVE-2026-76358	6.5	28.7	Splunk	Splunk SOAR	CWE-22	Path Traversal through App Installation Tar Extraction in Splunk SOAR
CVE-2026-76359	6.5	28.7	Splunk	Splunk SOAR	CWE-22	Path Traversal through Universal Forwarder Installer Archive Extraction in Sp…
CVE-2026-63408	7.5	28.7	getgrav	grav-plugin-api	CWE-598	Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter
CVE-2026-20359	9.9	28.5	Cisco	Cisco Crosswork Planning	CWE-522	Cisco Crosswork Security Hardening Release: August 2026
CVE-2026-16857	8.2	28.4	IBM	AIX	CWE-287	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-19875	7.5	28.5	IBM	Langflow OSS	CWE-306	Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and …
CVE-2026-55088	6.8	28.4	ether	etherpad	CWE-200	Etherpad: Device-to-device author-token transfer endpoint is replayable, neve…
CVE-2026-61711	5.3	28.3	moby	buildkit	CWE-20	BuildKit: Custom frontend could bypass Seccomp/AppArmor
CVE-2026-55089	9.9	28.1	ether	etherpad	CWE-863	Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users in…
CVE-2026-53548	9.6	28.1	Termix-SSH	Termix	CWE-285	Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by …
CVE-2026-76235	7.5	28.1	Red Hat	Red Hat Enterprise Linux 10	CWE-401	Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockp…
CVE-2026-44254	5.3	28.1	wazuh	wazuh	CWE-131	Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path
CVE-2026-76355	7.5	28.1	Splunk	Splunk Enterprise	CWE-306	Unauthenticated Information Disclosure through an Edge Processor Service Endp…
CVE-2026-54741	5.3	28.1	LemmyNet	lemmy	CWE-862	Lemmy: Blocked users can edit private messages sent before the block
CVE-2026-75596	8.7	27.7	netty	netty	CWE-407	Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassem…
CVE-2026-76253	8.8	27.6	Splunk	Splunk Enterprise	CWE-269	Privilege Escalation through Scheduled Search Alert Action Configuration in S…
CVE-2026-76391	8.3	27.3	Splunk	Splunk AI Toolkit	CWE-863	Improper Privilege Management through Agent Run History in Splunk AI Toolkit
CVE-2026-20318	9.6	27.1	Cisco	Cisco Secure Workload	CWE-20	Cisco Secure Workload Software Security Hardening Release August 2026 - Impro…
CVE-2026-49283	8.7	26.9	simplesamlphp	saml2	CWE-295	SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authenti…
CVE-2026-18544	8.1	26.9	IBM	Portieris	CWE-862	Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference
CVE-2026-64850	8.7	26.8	getgrav	grav	CWE-94	Grav: Remote code execution via unrestricted callable in Blueprint::dynamicDa…
CVE-2026-18756	7.2	26.8	HumHub	HumHub	CWE-79	HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership reque…
CVE-2026-32552	8.5	26.7	YITH	YITH WooCommerce Membership Premium	CWE-89	WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injectio…
CVE-2026-63652	7.1	26.7	FreeRDP	FreeRDP	CWE-415	FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a ma…
CVE-2026-76164	7.1	26.7	ail-project	ail-framework	CWE-918	Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Acc…
CVE-2026-18031	9.8	26.7	Unknown	TabaPay Gateway	CWE-287	TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback
CVE-2026-18776	9.8	26.7	Unknown	TrueBooker	CWE-284	TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via…
CVE-2026-16617	8.8	26.5	Unknown	Simple File List	CWE-79	Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description
CVE-2026-76389	8.8	26.1	Splunk	Cisco Talos Intelligence for Enterprise Security Cloud	CWE-918	Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intell…
CVE-2026-64851	8.5	26.1	getgrav	grav-plugin-shortcode-core	CWE-79	Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers
CVE-2026-18526	7.4	26.1	HumHub	HumHub	CWE-79	HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
CVE-2026-76321	7.3	26.1	Splunk	Splunk Enterprise	CWE-77	SPL Injection through Nearby Event Searches in Splunk Enterprise
CVE-2026-49976	6.5	26.1	grokability	snipe-it	CWE-863	Snipe-IT: User Account Escalation via CSV Import
CVE-2026-41424	8.2	26.0	wazuh	wazuh	CWE-863	Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API En…
CVE-2026-49253	7.1	26.0	electerm	electerm	CWE-22	electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling
CVE-2026-70424	6.5	26.0	Dell	OpenManage Enterprise	CWE-22	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Lim…
CVE-2026-76572	5.1	25.9	pkp	pkp-lib	CWE-610	pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference
CVE-2026-76335	8.8	25.8	Splunk	Splunk Enterprise	CWE-94	Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splun…
CVE-2026-70408	8.7	25.7	Extra Innovation Inc.	acmailer CGI	CWE-863	An incorrect authorization vulnerability exists in acmailer, which may allow …
CVE-2026-62668	9.4	25.3	getgrav	grav	CWE-918	Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols
CVE-2026-65612	5.1	25.3	nnn	nnn	CWE-78	Shell Command Injection in nnn
CVE-2026-76760	5.5	25.3	chenhg5	cc-connect	CWE-74	chenhg5 cc-connect webhook.go authenticate code injection
CVE-2026-66794	9.3	25.1	Red Hat	Multicluster Engine for Kubernetes	CWE-918	Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary m…
CVE-2026-76139	8.0	25.1	Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	CWE-829	Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolost…
CVE-2026-75986	5.5	25.2	code-projects	Online Job Portal System	CWE-74	code-projects Online Job Portal System Password Recovery ForPass.php sql inje…
CVE-2026-76048	5.5	25.2	SourceCodester	Simple Online Food Ordering System	CWE-74	SourceCodester Simple Online Food Ordering System ajax.php login sql injection
CVE-2026-76049	5.5	25.1	SourceCodester	Simple Online Food Ordering System	CWE-74	SourceCodester Simple Online Food Ordering System ajax.php save_menu sql inje…
CVE-2026-76050	5.5	25.2	SourceCodester	Simple Online Food Ordering System	CWE-74	SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql in…
CVE-2026-76574	5.5	25.2	code-projects	Hospital Information System	CWE-74	code-projects Hospital Information System User Login UsersController.php logi…
CVE-2026-16827	5.9	25.0	IBM	AIX	CWE-908	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76357	7.6	24.9	Splunk	Splunk SOAR	CWE-22	Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk …
CVE-2026-71470	9.1	24.8	Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	CWE-913	Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/en…
CVE-2026-12983	8.6	24.7	Unknown	Dinatur	CWE-89	Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection
CVE-2026-16950	8.6	24.7	Unknown	Product Shortlist	CWE-89	Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortliste…
CVE-2026-19672	6.3	24.7	Python Software Foundation	CPython	—	tarfile extraction filter bypass allows creation of directories outside the d…
CVE-2026-65611	5.1	24.6	nnn	nnn	CWE-78	Shell Command Injection in nnn
CVE-2026-16019	9.8	24.3	Faydam Innovation Inc.	FAYDAM Datalogger	CWE-89	SQL Injection in Faydam Innovation's FAYDAM Datalogger
CVE-2026-61842	6.5	24.3	getgrav	grav	CWE-200	Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-…
CVE-2026-73389	9.8	24.2	The4	Kalles Addons	CWE-502	WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
CVE-2026-75955	5.1	24.0	cmsjunkie.com	J-BusinessDirectory extension for Joomla	CWE-79	Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-Busines…
CVE-2026-75595	9.1	23.9	netty	netty	CWE-754	Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to …
CVE-2026-76886	8.1	23.8	Wireshark Foundation	Wireshark	CWE-122	Heap-based Buffer Overflow in Wireshark
CVE-2026-67363	7.7	23.9	balbooa.com	Balbooa Forms extension for Joomla	CWE-472	Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa…
CVE-2026-13174	7.2	23.8	Unknown	Eventin	CWE-284	Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
CVE-2026-70421	7.2	23.8	Dell	OpenManage Enterprise	CWE-269	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Pri…
CVE-2026-61556	8.7	23.6	harttle	liquidjs	CWE-835	LiquidJS: An infinite loop vulnerability in `strip_html` filter
CVE-2026-68552	5.3	23.7	coturn	coturn	CWE-190	Coturn: uint16_t truncation overflow in STUN message length causes TCP stream…
CVE-2026-71176	8.8	23.6	Dell	OpenManage Enterprise	CWE-89	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neu…
CVE-2019-25766	8.7	23.6	renovatebot	renovate	CWE-532	Renovate before 19.38.7 Credential Exposure via Go Modules
CVE-2020-37267	8.7	23.6	renovatebot	renovate	CWE-532	Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
CVE-2026-44252	7.7	23.5	wazuh	wazuh	CWE-863	Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation
CVE-2026-16690	7.5	23.5	IBM	AIX	CWE-400	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16706	7.5	23.5	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16818	7.5	23.5	IBM	AIX	CWE-400	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-73364	9.8	23.5	wpdesk	Flexible Subscriptions	CWE-502	WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulne…
CVE-2026-16817	7.5	23.5	IBM	AIX	CWE-476	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-49870	5.9	23.4	grokability	snipe-it	CWE-770	Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-fac…
CVE-2026-74803	10.0	23.3	yootheme.com	Zoo extension for Joomla	CWE-434	Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zo…
CVE-2026-75949	10.0	23.3	cmsjunkie.com	J-BusinessDirectory extension for Joomla	CWE-434	Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path tra…
CVE-2026-61518	8.7	23.4	ispconfig	ispconfig3	CWE-89	ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
CVE-2026-75956	8.7	23.3	cmsjunkie.com	J-BusinessDirectory extension for Joomla	CWE-770	Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handlin…
CVE-2026-54740	6.5	23.3	LemmyNet	lemmy	CWE-862	Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators
CVE-2026-16842	8.8	23.0	IBM	AIX	CWE-78	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16844	8.8	23.0	IBM	AIX	CWE-78	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16848	8.8	23.0	IBM	AIX	CWE-78	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-14861	7.5	23.0	Unknown	User Verification by PickPlugins	CWE-639	User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR
CVE-2026-62680	7.1	23.0	orval-labs	orval	CWE-22	Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
CVE-2026-68555	6.5	22.9	coturn	coturn	CWE-400	coturn: Chained mobility resumes allow authenticated remote memory exhaustion
CVE-2026-18372	4.8	23.0	M-Files Corporation	M-Files Web	CWE-79	CSS injection in M-Files Web
CVE-2026-19508	await	23.0	RDK	RDK-B WebUI	—	RDK WebUI heap-based buffer overflow vulnerability
CVE-2026-76254	8.8	22.9	Splunk	Splunk Enterprise	CWE-943	SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise
CVE-2026-17015	5.4	22.9	IBM	i	CWE-125	IBM i Denial of Service
CVE-2026-76365	6.5	22.6	Splunk	Splunk SOAR	CWE-74	Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR
CVE-2026-16833	5.3	22.6	IBM	AIX	CWE-125	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-75979	2.1	22.6	xianrendzw	EasyReport	CWE-791	xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSql…
CVE-2026-76372	6.6	22.5	Splunk	Nmap Scanner	CWE-732	Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk …
CVE-2026-64852	8.7	22.3	getgrav	grav-plugin-api	CWE-862	Grav API Plugin: Missing authorization on API-key generate/revoke lets any ad…
CVE-2026-18874	6.2	22.3	Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	CWE-94	Volsync-addon-controller: volsync-addon-controller: annotation values rendere…
CVE-2026-55483	4.9	22.4	grokability	snipe-it	CWE-862	Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Cre…
CVE-2026-56088	8.8	22.1	Dell	OpenManage Enterprise	CWE-89	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neu…
CVE-2026-70422	8.8	22.1	Dell	OpenManage Enterprise	CWE-89	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neu…
CVE-2026-76316	8.8	22.1	Splunk	Splunk Enterprise	CWE-943	Stored SPL Injection through Deployment Server Broker Registration in Splunk …
CVE-2026-62672	6.0	22.1	getgrav	grav	CWE-1333	Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
CVE-2026-76337	5.3	22.1	Splunk	Splunk Enterprise	CWE-22	Path Traversal through Splunk Web Static File Serving in Splunk Enterprise
CVE-2026-76402	8.2	21.9	Splunk	Splunk Connect for Kafka	CWE-918	Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for…
CVE-2026-76212	6.9	21.9	thorsten	phpMyFAQ	CWE-88	phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQL
CVE-2026-15421	6.4	21.9	siteground	Speed Optimizer – The All-In-One Performance-Boosting Plugin	CWE-79	Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scr…
CVE-2026-63187	6.3	21.9	logto-io	logto	CWE-94	Logto: OS command injection vulnerability exists in the Commitlint workflow
CVE-2026-68558	8.5	21.7	wekan	wekan	CWE-918	Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (in…
CVE-2026-76344	7.7	21.6	Splunk	Splunk Enterprise	CWE-27	Path Traversal through the Search Dispatch REST API in Splunk Enterprise
CVE-2026-75950	6.9	21.5	cmsjunkie.com	J-BusinessDirectory extension for Joomla	CWE-284	Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover…
CVE-2026-75951	6.9	21.5	cmsjunkie.com	J-BusinessDirectory extension for Joomla	CWE-639	Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple…
CVE-2026-75114	5.1	21.5	yootheme.com	Zoo extension for Joomla	CWE-601	Joomla Extension - yootheme.com - Open redirect in CommentController::twitter…
CVE-2026-67364	10.0	21.3	balbooa.com	Balbooa Forms extension for Joomla	CWE-94	Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms…
CVE-2026-62667	8.1	21.4	getgrav	grav-plugin-api	CWE-862	Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege…
CVE-2026-68559	6.5	21.4	wekan	wekan	CWE-639	Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId…
CVE-2026-16686	8.2	21.2	IBM	AIX	CWE-287	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76366	6.5	21.3	Splunk	Splunk SOAR	CWE-200	Information Disclosure through the REST API in Splunk SOAR
CVE-2026-76214	9.1	21.2	thorsten	phpMyFAQ	CWE-294	phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
CVE-2026-71694	await	21.1	n/a	n/a	—	An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.…
CVE-2026-16841	8.8	21.0	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76390	5.3	21.1	Splunk	Cisco Talos Intelligence for Enterprise Security Cloud	CWE-200	Information Disclosure through Splunk Web in Cisco Talos Intelligence for Ent…
CVE-2026-51366	await	21.1	n/a	n/a	—	SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allo…
CVE-2026-76237	8.6	20.9	eidetic-labs	stigmem-node	CWE-639	stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine
CVE-2026-49428	8.4	21.0	FreeBSD	FreeBSD	CWE-915	posixshm: system calls can incorrectly free memory of largepage objects
CVE-2026-15253	6.8	21.0	Unknown	Easy Media Replace	CWE-79	Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
CVE-2026-18202	6.8	21.0	Unknown	JetEngine	CWE-79	JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload
CVE-2026-76322	8.0	20.9	Splunk	Splunk Enterprise	CWE-862	SPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise
CVE-2026-76363	6.5	20.9	Splunk	Splunk SOAR	CWE-943	Structured Query Language Injection through the REST API in Splunk SOAR
CVE-2026-76203	5.1	20.9	maalfer	Pentestify	CWE-180	CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
CVE-2026-18371	5.1	20.8	M-Files Corporation	M-Files Web	CWE-79	HTML injection in M-Files Web
CVE-2026-76222	8.4	20.6	gitpython-developers	GitPython	CWE-22	GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
CVE-2026-13175	6.5	20.6	Unknown	Eventin	CWE-639	Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
CVE-2026-44256	5.3	20.6	wazuh	wazuh	CWE-117	Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username
CVE-2026-16903	9.6	20.6	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16901	8.8	20.6	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16909	8.8	20.6	IBM	AIX	CWE-128	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-49419	8.8	20.5	FreeBSD	FreeBSD	CWE-911	Jail reference count underflow
CVE-2026-75569	7.7	20.6	Red Hat	Multicluster Engine for Kubernetes	CWE-829	Mce-operator-bundle: mce-operator-bundle: bundle-generation business logic fe…
CVE-2026-76210	7.1	20.5	thorsten	phpMyFAQ	CWE-73	phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export
CVE-2026-76928	7.5	20.4	Wireshark Foundation	Wireshark	CWE-476	NULL Pointer Dereference in Wireshark
CVE-2026-17183	7.1	20.4	Grafana	Grafana OSS	CWE-863	CVE-2026-17183 CVE Record
CVE-2026-76364	6.5	20.4	Splunk	Splunk SOAR	CWE-89	Structured Query Language (SQL) Injection through Custom Function Results in …
CVE-2026-76400	5.9	20.4	Splunk	Splunk Connect for Kafka	CWE-400	Denial of Service (DoS) through the REST API in Splunk Connect for Kafka
CVE-2026-76401	5.9	20.4	Splunk	Splunk Connect for Kafka	CWE-407	Regular Expression Denial of Service (DoS) through the REST API in Splunk Con…
CVE-2026-61807	6.3	20.4	grokability	snipe-it	CWE-79	Snipe-IT: Stored DOM XSS via table selected-count IDs
CVE-2026-76353	5.4	20.3	Splunk	Splunk Enterprise	CWE-24	Path Traversal through Knowledge Bundle Replication in Splunk Enterprise
CVE-2026-76350	8.8	20.1	Splunk	Splunk Enterprise	CWE-269	Improper Privilege Management through PDF Attachments for Email Alert Actions…
CVE-2026-73387	8.1	20.2	SmartDataSoft	Resido	CWE-98	WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability
CVE-2026-74804	9.3	20.0	yootheme.com	Zoo extension for Joomla	CWE-89	Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
CVE-2026-75954	9.3	20.0	cmsjunkie.com	J-BusinessDirectory extension for Joomla	CWE-89	Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-Busines…
CVE-2025-14603	8.8	20.0	vsDesk	vsDesk	—	Use of user input in raw SQL queries in vsDesk leading to blind SQL injection
CVE-2026-8619	7.1	20.0	TP-Link Systems Inc.	TL-MR100 v3.2	CWE-476	Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL…
CVE-2026-76217	7.1	20.0	gitpython-developers	GitPython	CWE-73	GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
CVE-2026-76213	9.1	19.9	thorsten	phpMyFAQ	CWE-307	phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
CVE-2026-49418	8.8	19.9	FreeBSD	FreeBSD	CWE-416	Use-after-free in device pager page list
CVE-2026-76240	7.5	19.8	eidetic-labs	stigmem	CWE-89	stigmem Postgres SQL Injection via Schema Identifier
CVE-2026-76879	7.5	19.8	Wireshark Foundation	Wireshark	CWE-121	Stack-based Buffer Overflow in Wireshark
CVE-2026-76880	7.5	19.8	Wireshark Foundation	Wireshark	CWE-787	Out-of-bounds Write in Wireshark
CVE-2026-68553	7.1	19.8	coturn	coturn	CWE-134	Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Co…
CVE-2026-59992	5.4	19.8	tinacms	tinacms	CWE-639	Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinac…
CVE-2026-66668	8.5	19.6	PeepSo	Community by PeepSo	CWE-89	WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability
CVE-2026-76387	8.1	19.7	Splunk	Splunk Enterprise Security	CWE-20	SPL Injection through the REST API in Splunk Enterprise Security
CVE-2026-76219	7.2	19.6	gitpython-developers	GitPython	CWE-88	GitPython before 3.1.58 Arbitrary File Overwrite via read-tree
CVE-2026-70423	6.5	19.6	Dell	OpenManage Enterprise	CWE-611	Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Res…
CVE-2026-20314	5.0	19.6	Cisco	Cisco Packaged Contact Center Enterprise	CWE-918	Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enter…
CVE-2026-76343	6.5	19.5	Splunk	Splunk Enterprise	CWE-89	Structured Query Language (SQL) Injection through the REST API in Splunk Ente…
CVE-2026-75978	2.1	19.4	xianrendzw	EasyReport	CWE-266	xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceCont…
CVE-2026-76338	8.1	19.3	Splunk	Splunk Enterprise	CWE-287	Improper Authentication through REST API Distributed Search Token Requests in…
CVE-2026-76762	5.5	19.3	code-projects	Assessment Management	CWE-74	code-projects Assessment Management welcome.php sql injection
CVE-2026-73390	9.8	19.2	KlbTheme	Total Donations	CWE-266	WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability
CVE-2026-49420	8.8	19.3	FreeBSD	FreeBSD	CWE-121	Buffer overflow in libalias RTSP handler
CVE-2026-76614	5.3	19.2	openemr	openemr	CWE-22	OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore
CVE-2026-49427	8.8	19.2	FreeBSD	FreeBSD	CWE-826	posixshm: largepage shared memory objects not explicitly wired
CVE-2026-54494	5.3	19.0	koel	koel	CWE-918	Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var gua…
CVE-2026-16847	8.8	18.8	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-63407	8.2	18.8	getgrav	grav-plugin-api	CWE-942	Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API R…
CVE-2026-76340	5.3	18.7	Splunk	Splunk Enterprise	CWE-862	Missing Authorization for Reloading Token-Signing Keys through the REST API i…
CVE-2026-76207	8.6	18.5	thorsten	phpMyFAQ	CWE-304	phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
CVE-2026-16866	4.8	18.5	IBM	AIX	CWE-125	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-73347	9.8	18.5	ThemetechMount	TrueBooker	CWE-266	WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability
CVE-2026-76242	9.1	18.4	eidetic-labs	stigmem	CWE-295	stigmem Federation Peer Registration Authentication Bypass
CVE-2026-14970	7.5	18.4	IBM	AIX	CWE-120	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-16837	7.5	18.0	IBM	AIX	CWE-400	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-55564	5.4	18.0	FreeRDP	FreeRDP	CWE-125	FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments
CVE-2026-76236	7.2	18.0	eidetic-labs	stigmem-node	CWE-639	stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones
CVE-2026-76238	7.2	18.0	eidetic-labs	stigmem-node	CWE-863	stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep
CVE-2026-76239	5.3	18.0	eidetic-labs	stigmem-node	CWE-918	Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address
CVE-2026-54492	4.3	18.0	koel	koel	CWE-918	Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
CVE-2026-54493	7.7	17.8	koel	koel	CWE-918	Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
CVE-2026-76216	7.7	17.8	go-vikunja	vikunja	CWE-639	Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
CVE-2026-46343	7.5	17.9	wazuh	wazuh	CWE-22	Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validat…
CVE-2026-76369	2.7	17.6	Splunk	Splunk SOAR	CWE-22	Path Traversal through Automation Broker in Splunk SOAR
CVE-2026-75146	7.2	17.5	FFmpeg	FFmpeg	CWE-125	FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c
CVE-2026-76206	6.9	17.4	thorsten	phpMyFAQ	CWE-200	phpMyFAQ before 4.1.7 Information Disclosure via PDF Export
CVE-2026-75920	6.0	17.4	thorsten	phpMyFAQ	CWE-377	phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
CVE-2026-55643	7.6	17.2	grokability	snipe-it	CWE-863	Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
CVE-2026-76260	6.5	17.2	Splunk	Splunk Enterprise	CWE-732	Incorrect Permission Assignment for Critical Resource through the REST API in…
CVE-2026-16825	4.2	17.2	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-70496	9.9	17.1	Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	CWE-250	Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin…
CVE-2026-76225	8.3	17.1	ArcadeData	arcadedb	CWE-918	ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV
CVE-2026-76394	8.3	17.1	Splunk	Splunk AI Toolkit	CWE-862	Missing Authorization in Container and Connection Management through the REST…
CVE-2026-76333	7.1	17.1	Splunk	Splunk Enterprise	CWE-79	Stored Cross-Site Scripting (XSS) through Dashboard Studio Workflow Actions i…
CVE-2026-19709	5.3	17.0	Unknown	Membership For WooCommerce	CWE-287	Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure v…
CVE-2026-76208	8.8	16.6	thorsten	phpMyFAQ	CWE-778	phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP
CVE-2026-76352	8.8	16.6	Splunk	Splunk Enterprise	CWE-285	Improper Authorization through the REST API in Splunk Enterprise
CVE-2026-76397	8.1	16.5	Splunk	Splunk AI Toolkit	CWE-639	Improper Access Control in Experiment History through the REST API in Splunk …
CVE-2026-75918	8.7	16.4	thorsten	phpMyFAQ	CWE-200	phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File
CVE-2026-68900	7.6	16.4	wekan	wekan	CWE-79	Wekan: Stored XSS in HTML board exports through a card-title second parse
CVE-2025-36255	7.5	16.3	IBM	DS8A00( R10.0 - R10.1 )	CWE-267	DS8900F and DS8A00 Privilege Escalation
CVE-2026-76325	7.3	16.2	Splunk	Splunk Enterprise	CWE-79	Stored Cross-Site Scripting (XSS) through Splunk Web in Splunk Enterprise
CVE-2026-18231	5.3	16.2	Unknown	WP Directory Kit	CWE-200	WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2…
CVE-2026-18778	5.3	16.2	Unknown	TrueBooker	CWE-200	TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclos…
CVE-2026-16814	8.8	16.1	IBM	AIX	CWE-787	Vulnerabilities in IBM AIX and PowerVM VIOS
CVE-2026-76223	7.1	16.0	ArcadeData	arcadedb	CWE-862	ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION
CVE-2026-13169	8.1	15.8	Unknown	Eventin	CWE-639	Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ow…
CVE-2026-76388	8.1	15.8	Splunk	Splunk Enterprise Security	CWE-732	Privilege Escalation through Search Macro Permissions in Splunk Enterprise Se…
CVE-2026-76399	8.1	15.8	Splunk	Splunk AI Toolkit	CWE-732	Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit
CVE-2026-19417	6.5	15.8	Unknown	KiviCare	CWE-639	KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
CVE-2026-76257	6.5	15.8	Splunk	Splunk Enterprise	CWE-862	Missing Authorization through REST API Endpoints in Splunk Secure Gateway
CVE-2026-76258	6.5	15.8	Splunk	Splunk Enterprise	CWE-321	Use of Hard-coded Cryptographic Key through Companion App Registration in Spl…
CVE-2026-76354	8.1	15.7	Splunk	Splunk Enterprise	CWE-158	Path Traversal through Search Head Clustering in Splunk Enterprise
CVE-2026-76919	5.3	15.7	Wireshark Foundation	Wireshark	CWE-457	Use of Uninitialized Variable in Wireshark
CVE-2026-76330	7.1	15.7	Splunk	Splunk Enterprise	CWE-20	SPL Injection through Monitoring Console Forwarder Filters in Splunk Enterprise

Results continue: ranks 401–673.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-19 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.