{ "day": "2026-08-20", "boundary": "UTC calendar day", "published_count": 468, "by_severity": { "CRITICAL": 72, "HIGH": 214, "MEDIUM": 150, "LOW": 25 }, "kev_count": 0, "exploit_reference_count": 5, "awaiting_enrichment_count": 7, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-19586", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.05035, "epss_percentile": 0.91611, "kev": false, "kev_due_at": null, "vendor": "TP-Link Systems Inc.", "product": "ER7212PC v2", "cwe": "CWE-78", "title": "Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19586" }, { "rank": 2, "cve_id": "CVE-2026-69836", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.01589, "epss_percentile": 0.73743, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Entra", "cwe": "CWE-502", "title": "Microsoft Entra ID Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69836" }, { "rank": 3, "cve_id": "CVE-2026-77031", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.01318, "epss_percentile": 0.68617, "kev": false, "kev_due_at": null, "vendor": "Tenda", "product": "CH22", "cwe": "CWE-74", "title": "Tenda CH22 formcreateFileName command injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77031" }, { "rank": 4, "cve_id": "CVE-2026-18274", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.01295, "epss_percentile": 0.6813, "kev": false, "kev_due_at": null, "vendor": "Heimdall Data", "product": "Database Proxy", "cwe": "CWE-22", "title": "Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18274" }, { "rank": 5, "cve_id": "CVE-2026-77004", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.01282, "epss_percentile": 0.6786, "kev": false, "kev_due_at": null, "vendor": "Comfast", "product": "CF-N1-S", "cwe": "CWE-74", "title": "Comfast CF-N1-S mbox-config sprintf command injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77004" }, { "rank": 6, "cve_id": "CVE-2026-53804", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.01248, "epss_percentile": 0.67045, "kev": false, "kev_due_at": null, "vendor": "Centuran Consulting", "product": "OTRS Community Edition", "cwe": "CWE-78", "title": "OTRS Community Edition OS Command Injection via PGP Configuration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53804" }, { "rank": 7, "cve_id": "CVE-2026-18264", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01242, "epss_percentile": 0.66896, "kev": false, "kev_due_at": null, "vendor": "NoMachine", "product": "NoMachine", "cwe": "CWE-78", "title": "NoMachine getstat Command Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18264" }, { "rank": 8, "cve_id": "CVE-2026-19446", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.01033, "epss_percentile": 0.61203, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-400", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19446" }, { "rank": 9, "cve_id": "CVE-2026-14947", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.0094, "epss_percentile": 0.58274, "kev": false, "kev_due_at": null, "vendor": "Frauscher Sensortechnik", "product": "FDS 102", "cwe": "CWE-24", "title": "Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP file", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14947" }, { "rank": 10, "cve_id": "CVE-2026-18272", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00881, "epss_percentile": 0.5641, "kev": false, "kev_due_at": null, "vendor": "Kenwood", "product": "DNR1007XR", "cwe": "CWE-78", "title": "Kenwood DNR1007XR startUpdateProcess Command Injection Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18272" }, { "rank": 11, "cve_id": "CVE-2026-77647", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00816, "epss_percentile": 0.54334, "kev": false, "kev_due_at": null, "vendor": "SPIP", "product": "SPIP", "cwe": "CWE-94", "title": "SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of element on public permalink page", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50190" }, { "rank": 256, "cve_id": "CVE-2026-76569", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00258, "epss_percentile": 0.17069, "kev": false, "kev_due_at": null, "vendor": "phoca.cz", "product": "Phoca Download extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76569" }, { "rank": 257, "cve_id": "CVE-2026-76999", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00256, "epss_percentile": 0.16944, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "CET Automated Grading System with AI Predictive Analytics", "cwe": "CWE-266", "title": "SourceCodester CET Automated Grading System with AI Predictive Analytics index.php add_grade improper authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76999" }, { "rank": 258, "cve_id": "CVE-2026-62945", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00256, "epss_percentile": 0.1687, "kev": false, "kev_due_at": null, "vendor": "mauriceboe", "product": "TREK", "cwe": "CWE-639", "title": "TREK: Cross-trip reservation title disclosure via file links", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62945" }, { "rank": 259, "cve_id": "CVE-2026-49436", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00255, "epss_percentile": 0.16781, "kev": false, "kev_due_at": null, "vendor": "Kovah", "product": "LinkAce", "cwe": "CWE-79", "title": "LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49436" }, { "rank": 260, "cve_id": "CVE-2026-18286", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00254, "epss_percentile": 0.16637, "kev": false, "kev_due_at": null, "vendor": "aeon", "product": "aeon", "cwe": "CWE-94", "title": "Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18286" }, { "rank": 261, "cve_id": "CVE-2026-76783", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00254, "epss_percentile": 0.16591, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "DeDeCMS", "cwe": "CWE-74", "title": "DeDeCMS advancedsearch.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76783" }, { "rank": 262, "cve_id": "CVE-2026-77506", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00254, "epss_percentile": 0.1656, "kev": false, "kev_due_at": null, "vendor": "Znuny", "product": "Znuny", "cwe": "CWE-79", "title": "Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77506" }, { "rank": 263, "cve_id": "CVE-2026-49217", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00253, "epss_percentile": 0.1653, "kev": false, "kev_due_at": null, "vendor": "Mailu", "product": "Mailu", "cwe": "CWE-306", "title": "Mailu missing authentication on PATCH /api/v1/token/, which allows unauthenticated removal of IP restrictions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49217" }, { "rank": 264, "cve_id": "CVE-2026-44725", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.00253, "epss_percentile": 0.16521, "kev": false, "kev_due_at": null, "vendor": "emqx", "product": "emqx", "cwe": "CWE-345", "title": "EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44725" }, { "rank": 265, "cve_id": "CVE-2026-71428", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.0025, "epss_percentile": 0.16105, "kev": false, "kev_due_at": null, "vendor": "Unstructured-IO", "product": "unstructured", "cwe": "CWE-601", "title": "unstructured: Server-Side Request Forgery in the URL-based partitioning", "url": "https://www.cve.org/CVERecord?id=CVE-2026-71428" }, { "rank": 266, "cve_id": "CVE-2026-76956", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.0025, "epss_percentile": 0.16102, "kev": false, "kev_due_at": null, "vendor": "libexpat project", "product": "libexpat", "cwe": "CWE-394", "title": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76956" }, { "rank": 267, "cve_id": "CVE-2026-18287", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00249, "epss_percentile": 0.15971, "kev": false, "kev_due_at": null, "vendor": "aeon", "product": "aeon", "cwe": "CWE-94", "title": "Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18287" }, { "rank": 268, "cve_id": "CVE-2026-50192", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.15957, "kev": false, "kev_due_at": null, "vendor": "kerberos-io", "product": "agent", "cwe": "CWE-200", "title": "Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-50192" }, { "rank": 269, "cve_id": "CVE-2026-16964", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.16023, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-200", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16964" }, { "rank": 270, "cve_id": "CVE-2026-18269", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00247, "epss_percentile": 0.15768, "kev": false, "kev_due_at": null, "vendor": "Kenwood", "product": "DNR1007XR", "cwe": "CWE-787", "title": "Kenwood DNR1007XR tchdr_bytestream_read Out-Of-Bounds Write Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18269" }, { "rank": 271, "cve_id": "CVE-2026-77639", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00246, "epss_percentile": 0.15652, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-420", "title": "Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77639" }, { "rank": 272, "cve_id": "CVE-2026-76633", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00245, "epss_percentile": 0.15429, "kev": false, "kev_due_at": null, "vendor": "LabRedesCefetRJ", "product": "WeGIA", "cwe": "CWE-620", "title": "WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76633" }, { "rank": 273, "cve_id": "CVE-2026-54624", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00244, "epss_percentile": 0.15287, "kev": false, "kev_due_at": null, "vendor": "django-cms", "product": "django-cms", "cwe": "CWE-285", "title": "django CMS: Structure endpoint bypasses page-view permission", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54624" }, { "rank": 274, "cve_id": "CVE-2026-77080", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00243, "epss_percentile": 0.15223, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-78", "title": "n8n before 1.123.69 Arbitrary File Read and Write via Snowflake", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77080" }, { "rank": 275, "cve_id": "CVE-2026-77072", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00243, "epss_percentile": 0.15223, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-79", "title": "n8n before 1.123.69 Stored XSS via Form Completion Page", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77072" }, { "rank": 276, "cve_id": "CVE-2026-66595", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00243, "epss_percentile": 0.15233, "kev": false, "kev_due_at": null, "vendor": "Passionate Programmer Peter", "product": "WP Data Access", "cwe": "CWE-862", "title": "WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66595" }, { "rank": 277, "cve_id": "CVE-2025-53999", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00242, "epss_percentile": 0.15088, "kev": false, "kev_due_at": null, "vendor": "ThemeGoods", "product": "Altair", "cwe": "CWE-862", "title": "WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53999" }, { "rank": 278, "cve_id": "CVE-2026-49825", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.0024, "epss_percentile": 0.1481, "kev": false, "kev_due_at": null, "vendor": "lxml", "product": "lxml", "cwe": "CWE-79", "title": "lxml: javascript: URL bypass in Cleaner via xlink:href", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49825" }, { "rank": 279, "cve_id": "CVE-2026-19448", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00239, "epss_percentile": 0.14738, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-908", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19448" }, { "rank": 280, "cve_id": "CVE-2026-54622", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00239, "epss_percentile": 0.14662, "kev": false, "kev_due_at": null, "vendor": "django-cms", "product": "django-cms", "cwe": "CWE-639", "title": "django CMS: Clipboard copy IDOR discloses unauthorized plugin content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54622" }, { "rank": 281, "cve_id": "CVE-2026-63003", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00239, "epss_percentile": 0.14662, "kev": false, "kev_due_at": null, "vendor": "django-cms", "product": "django-cms", "cwe": "CWE-639", "title": "django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63003" }, { "rank": 282, "cve_id": "CVE-2026-49996", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00239, "epss_percentile": 0.14654, "kev": false, "kev_due_at": null, "vendor": "freedomofpress", "product": "securedrop-client", "cwe": "CWE-601", "title": "securedrop-proxy origin limitation can be bypassed with redirects", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49996" }, { "rank": 283, "cve_id": "CVE-2026-18297", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00238, "epss_percentile": 0.14539, "kev": false, "kev_due_at": null, "vendor": "GStreamer", "product": "GStreamer", "cwe": "CWE-121", "title": "GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18297" }, { "rank": 284, "cve_id": "CVE-2026-18298", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00238, "epss_percentile": 0.14539, "kev": false, "kev_due_at": null, "vendor": "GStreamer", "product": "GStreamer", "cwe": "CWE-122", "title": "GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18298" }, { "rank": 285, "cve_id": "CVE-2026-77070", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00237, "epss_percentile": 0.14429, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-943", "title": "n8n before 1.123.69 NoSQL Injection via MongoDB Node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77070" }, { "rank": 286, "cve_id": "CVE-2026-77113", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00237, "epss_percentile": 0.14515, "kev": false, "kev_due_at": null, "vendor": "Canonical", "product": "Apport", "cwe": "CWE-23", "title": "Path Traversal Vulnerability in apport-unpack", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77113" }, { "rank": 287, "cve_id": "CVE-2026-17024", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00236, "epss_percentile": 0.14411, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-295", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17024" }, { "rank": 288, "cve_id": "CVE-2026-18294", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00234, "epss_percentile": 0.14071, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "Origin Viewer", "cwe": "CWE-119", "title": "OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18294" }, { "rank": 289, "cve_id": "CVE-2026-66001", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00233, "epss_percentile": 0.13927, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "frappe", "cwe": "CWE-352", "title": "Frappe: Improper Authorization in OAuth2 Consent Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66001" }, { "rank": 290, "cve_id": "CVE-2026-16932", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00232, "epss_percentile": 0.13824, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-78", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16932" }, { "rank": 291, "cve_id": "CVE-2026-55013", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00232, "epss_percentile": 0.13879, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Windows Remote Help", "cwe": "CWE-427", "title": "Windows Remote Help Defense Spoofing Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55013" }, { "rank": 292, "cve_id": "CVE-2026-77014", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00232, "epss_percentile": 0.13886, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-197", "title": "Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77014" }, { "rank": 293, "cve_id": "CVE-2026-75948", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.0023, "epss_percentile": 0.13606, "kev": false, "kev_due_at": null, "vendor": "icagenda.com", "product": "iCagenda extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75948" }, { "rank": 294, "cve_id": "CVE-2026-73259", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.0023, "epss_percentile": 0.13605, "kev": false, "kev_due_at": null, "vendor": "cesanta", "product": "mongoose", "cwe": "CWE-79", "title": "Mongoose: Reflected XSS via decoded URI in directory listing render", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73259" }, { "rank": 295, "cve_id": "CVE-2026-18296", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00229, "epss_percentile": 0.13423, "kev": false, "kev_due_at": null, "vendor": "GStreamer", "product": "GStreamer", "cwe": "CWE-122", "title": "GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18296" }, { "rank": 296, "cve_id": "CVE-2026-77079", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00228, "epss_percentile": 0.13396, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-639", "title": "n8n before 2.34.1 Authorization Bypass via Custom Role Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77079" }, { "rank": 297, "cve_id": "CVE-2026-77085", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00228, "epss_percentile": 0.13396, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-918", "title": "n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77085" }, { "rank": 298, "cve_id": "CVE-2026-77069", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00228, "epss_percentile": 0.13397, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-918", "title": "n8n before 1.123.69 SSRF Protection Bypass via OAuth2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77069" }, { "rank": 299, "cve_id": "CVE-2026-64777", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00227, "epss_percentile": 0.13168, "kev": false, "kev_due_at": null, "vendor": "Apple", "product": "container", "cwe": "CWE-22", "title": "A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64777" }, { "rank": 300, "cve_id": "CVE-2026-18283", "cvss_base": 2.4, "cvss_severity": "LOW", "epss_score": 0.00227, "epss_percentile": 0.13185, "kev": false, "kev_due_at": null, "vendor": "Sony", "product": "XAV-9500ES", "cwe": "CWE-285", "title": "Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18283" }, { "rank": 301, "cve_id": "CVE-2026-76995", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00227, "epss_percentile": 0.13194, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "Simple Online Food Ordering System", "cwe": "CWE-284", "title": "SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76995" }, { "rank": 302, "cve_id": "CVE-2026-74011", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00226, "epss_percentile": 0.13108, "kev": false, "kev_due_at": null, "vendor": "revmakx", "product": "InfiniteWP Client", "cwe": "CWE-89", "title": "WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74011" }, { "rank": 303, "cve_id": "CVE-2026-14163", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00226, "epss_percentile": 0.13055, "kev": false, "kev_due_at": null, "vendor": "Octopus Deploy", "product": "Octopus Server", "cwe": "CWE-532", "title": "In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14163" }, { "rank": 304, "cve_id": "CVE-2026-76993", "cvss_base": 1.3, "cvss_severity": "LOW", "epss_score": 0.00224, "epss_percentile": 0.12852, "kev": false, "kev_due_at": null, "vendor": "GreyDGL", "product": "PentestGPT", "cwe": "CWE-74", "title": "GreyDGL PentestGPT Web-Page Crawling injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76993" }, { "rank": 305, "cve_id": "CVE-2026-77587", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12631, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-911", "title": "Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77587" }, { "rank": 306, "cve_id": "CVE-2026-77067", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12508, "kev": false, "kev_due_at": null, "vendor": "omnivore-app", "product": "omnivore", "cwe": "CWE-918", "title": "Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77067" }, { "rank": 307, "cve_id": "CVE-2026-68921", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.12578, "kev": false, "kev_due_at": null, "vendor": "dicebear", "product": "dicebear", "cwe": "CWE-79", "title": "DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68921" }, { "rank": 308, "cve_id": "CVE-2026-73196", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00221, "epss_percentile": 0.12404, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-770", "title": "Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73196" }, { "rank": 309, "cve_id": "CVE-2026-52021", "cvss_base": null, "cvss_severity": null, "epss_score": 0.00221, "epss_percentile": 0.12409, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52021" }, { "rank": 310, "cve_id": "CVE-2026-72860", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00218, "epss_percentile": 0.12048, "kev": false, "kev_due_at": null, "vendor": "decolua", "product": "9router", "cwe": "CWE-918", "title": "9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72860" }, { "rank": 311, "cve_id": "CVE-2026-19699", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00218, "epss_percentile": 0.12044, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "GutenKit", "cwe": "CWE-863", "title": "GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19699" }, { "rank": 312, "cve_id": "CVE-2026-77640", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00215, "epss_percentile": 0.11672, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-1284", "title": "tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77640" }, { "rank": 313, "cve_id": "CVE-2026-63043", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00214, "epss_percentile": 0.11561, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-23", "title": "Apache InLong: Agent path traversal via unvalidated file source path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63043" }, { "rank": 314, "cve_id": "CVE-2026-73253", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00212, "epss_percentile": 0.11347, "kev": false, "kev_due_at": null, "vendor": "cesanta", "product": "mongoose", "cwe": "CWE-295", "title": "Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73253" }, { "rank": 315, "cve_id": "CVE-2026-18295", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00211, "epss_percentile": 0.11261, "kev": false, "kev_due_at": null, "vendor": "GStreamer", "product": "GStreamer", "cwe": "CWE-787", "title": "GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18295" }, { "rank": 316, "cve_id": "CVE-2026-74019", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00211, "epss_percentile": 0.11222, "kev": false, "kev_due_at": null, "vendor": "paulepro2019", "product": "EPROLO Dropshipping", "cwe": "CWE-862", "title": "WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74019" }, { "rank": 317, "cve_id": "CVE-2026-66601", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00211, "epss_percentile": 0.1125, "kev": false, "kev_due_at": null, "vendor": "David Lingren", "product": "Media LIbrary Assistant", "cwe": "CWE-79", "title": "WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66601" }, { "rank": 318, "cve_id": "CVE-2026-73402", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00211, "epss_percentile": 0.11251, "kev": false, "kev_due_at": null, "vendor": "Hakan Ozevin", "product": "WP BASE Booking", "cwe": "CWE-79", "title": "WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73402" }, { "rank": 319, "cve_id": "CVE-2026-46355", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0021, "epss_percentile": 0.11032, "kev": false, "kev_due_at": null, "vendor": "bigbluebutton", "product": "bigbluebutton", "cwe": "CWE-287", "title": "BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46355" }, { "rank": 320, "cve_id": "CVE-2026-63037", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00209, "epss_percentile": 0.10883, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-89", "title": "Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63037" }, { "rank": 321, "cve_id": "CVE-2026-17060", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00209, "epss_percentile": 0.10946, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-200", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17060" }, { "rank": 322, "cve_id": "CVE-2026-77036", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00209, "epss_percentile": 0.10987, "kev": false, "kev_due_at": null, "vendor": "elunez", "product": "eladmin", "cwe": "CWE-266", "title": "elunez eladmin GenConfigController improper authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77036" }, { "rank": 323, "cve_id": "CVE-2026-63044", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00208, "epss_percentile": 0.10827, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-918", "title": "Apache InLong: Authenticated SSRF via POST /api/node/testConnection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63044" }, { "rank": 324, "cve_id": "CVE-2026-17006", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00207, "epss_percentile": 0.10705, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17006" }, { "rank": 325, "cve_id": "CVE-2026-18299", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00207, "epss_percentile": 0.1068, "kev": false, "kev_due_at": null, "vendor": "GStreamer", "product": "GStreamer", "cwe": "CWE-416", "title": "GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18299" }, { "rank": 326, "cve_id": "CVE-2026-7485", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00207, "epss_percentile": 0.1071, "kev": false, "kev_due_at": null, "vendor": "Checkmk GmbH", "product": "Checkmk", "cwe": "CWE-863", "title": "Frozen BI aggregations leak host and service names to unauthorized users", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7485" }, { "rank": 327, "cve_id": "CVE-2026-69242", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00206, "epss_percentile": 0.10528, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-122", "title": "libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69242" }, { "rank": 328, "cve_id": "CVE-2026-63038", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00205, "epss_percentile": 0.10367, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-89", "title": "Apache InLong: SQL Injection via String Concatenation Vulnerability Report", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63038" }, { "rank": 329, "cve_id": "CVE-2026-77074", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00204, "epss_percentile": 0.10288, "kev": false, "kev_due_at": null, "vendor": "n8n-io", "product": "n8n", "cwe": "CWE-94", "title": "n8n before 1.123.69 SSRF via Edit Image Node", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77074" }, { "rank": 330, "cve_id": "CVE-2026-18288", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10112, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "OriginPro", "cwe": "CWE-787", "title": "OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18288" }, { "rank": 331, "cve_id": "CVE-2026-18289", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10113, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "OriginPro", "cwe": "CWE-787", "title": "OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18289" }, { "rank": 332, "cve_id": "CVE-2026-18290", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10111, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "OriginPro", "cwe": "CWE-787", "title": "OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18290" }, { "rank": 333, "cve_id": "CVE-2026-18291", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10112, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "OriginPro", "cwe": "CWE-119", "title": "OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18291" }, { "rank": 334, "cve_id": "CVE-2026-18292", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10112, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "OriginPro", "cwe": "CWE-119", "title": "OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18292" }, { "rank": 335, "cve_id": "CVE-2026-18293", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00203, "epss_percentile": 0.10112, "kev": false, "kev_due_at": null, "vendor": "OriginLab", "product": "Origin Viewer", "cwe": "CWE-787", "title": "OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18293" }, { "rank": 336, "cve_id": "CVE-2026-16958", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00202, "epss_percentile": 0.10065, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16958" }, { "rank": 337, "cve_id": "CVE-2026-76800", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.00201, "epss_percentile": 0.09942, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "DeDeCMS", "cwe": "CWE-284", "title": "DeDeCMS select_media_post.php unrestricted upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76800" }, { "rank": 338, "cve_id": "CVE-2026-11861", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.002, "epss_percentile": 0.09826, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-266", "title": "Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11861" }, { "rank": 339, "cve_id": "CVE-2026-72861", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.09726, "kev": false, "kev_due_at": null, "vendor": "appwrite", "product": "templates", "cwe": "CWE-347", "title": "Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72861" }, { "rank": 340, "cve_id": "CVE-2026-18828", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.09815, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18828" }, { "rank": 341, "cve_id": "CVE-2026-49245", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.002, "epss_percentile": 0.09816, "kev": false, "kev_due_at": null, "vendor": "drakkan", "product": "sftpgo", "cwe": "CWE-79", "title": "SFTPGo: Stored XSS via inline parameter on public shares and user file download", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49245" }, { "rank": 342, "cve_id": "CVE-2026-76785", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.002, "epss_percentile": 0.09809, "kev": false, "kev_due_at": null, "vendor": "amirsanni", "product": "Mini-Inventory-and-Sales-Management-System", "cwe": "CWE-74", "title": "amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76785" }, { "rank": 343, "cve_id": "CVE-2026-76991", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.002, "epss_percentile": 0.09807, "kev": false, "kev_due_at": null, "vendor": "itsourcecode", "product": "Hospital Management System", "cwe": "CWE-89", "title": "itsourcecode Hospital Management System viewappointmentapproved.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76991" }, { "rank": 344, "cve_id": "CVE-2026-76997", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.002, "epss_percentile": 0.09809, "kev": false, "kev_due_at": null, "vendor": "SourceCodester", "product": "Simple Online Food Ordering System", "cwe": "CWE-89", "title": "SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76997" }, { "rank": 345, "cve_id": "CVE-2026-77025", "cvss_base": 2.1, "cvss_severity": "LOW", "epss_score": 0.002, "epss_percentile": 0.09807, "kev": false, "kev_due_at": null, "vendor": "itsourcecode", "product": "Hospital Management System", "cwe": "CWE-74", "title": "itsourcecode Hospital Management System viewappointmentpending.php sql injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77025" }, { "rank": 346, "cve_id": "CVE-2026-77066", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00199, "epss_percentile": 0.09711, "kev": false, "kev_due_at": null, "vendor": "omnivore-app", "product": "omnivore", "cwe": "CWE-918", "title": "Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77066" }, { "rank": 347, "cve_id": "CVE-2026-61663", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00199, "epss_percentile": 0.09711, "kev": false, "kev_due_at": null, "vendor": "django-cms", "product": "django-cms", "cwe": "CWE-639", "title": "django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61663" }, { "rank": 348, "cve_id": "CVE-2026-14953", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00197, "epss_percentile": 0.09413, "kev": false, "kev_due_at": null, "vendor": "Frauscher Sensortechnik", "product": "FDS 102", "cwe": "CWE-425", "title": "Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14953" }, { "rank": 349, "cve_id": "CVE-2026-18280", "cvss_base": 3.9, "cvss_severity": "LOW", "epss_score": 0.00197, "epss_percentile": 0.0946, "kev": false, "kev_due_at": null, "vendor": "Sony", "product": "XAV-9500ES", "cwe": "CWE-120", "title": "Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18280" }, { "rank": 350, "cve_id": "CVE-2026-73251", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00195, "epss_percentile": 0.0925, "kev": false, "kev_due_at": null, "vendor": "cesanta", "product": "mongoose", "cwe": "CWE-295", "title": "Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73251" }, { "rank": 351, "cve_id": "CVE-2026-77642", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00194, "epss_percentile": 0.09088, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-787", "title": "tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77642" }, { "rank": 352, "cve_id": "CVE-2026-77641", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00194, "epss_percentile": 0.09088, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-252", "title": "tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77641" }, { "rank": 353, "cve_id": "CVE-2026-55489", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00193, "epss_percentile": 0.08951, "kev": false, "kev_due_at": null, "vendor": "bigbluebutton", "product": "bigbluebutton", "cwe": "CWE-639", "title": "BigBlueButton: IDOR on BBB through /api/graphql via POST parameter \"presentationId\" leads to Authentication Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55489" }, { "rank": 354, "cve_id": "CVE-2026-53583", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00192, "epss_percentile": 0.08818, "kev": false, "kev_due_at": null, "vendor": "libgit2", "product": "libgit2", "cwe": "CWE-295", "title": "libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53583" }, { "rank": 355, "cve_id": "CVE-2026-77648", "cvss_base": 2.2, "cvss_severity": "LOW", "epss_score": 0.00192, "epss_percentile": 0.08821, "kev": false, "kev_due_at": null, "vendor": "OpenStack", "product": "Glance", "cwe": "CWE-918", "title": "In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77648" }, { "rank": 356, "cve_id": "CVE-2026-63039", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00191, "epss_percentile": 0.08752, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-89", "title": "Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63039" }, { "rank": 357, "cve_id": "CVE-2026-73254", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00191, "epss_percentile": 0.08753, "kev": false, "kev_due_at": null, "vendor": "cesanta", "product": "mongoose", "cwe": "CWE-79", "title": "Mongoose: Stored XSS via unescaped filenames in directory listing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73254" }, { "rank": 358, "cve_id": "CVE-2026-63040", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00189, "epss_percentile": 0.08542, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-552", "title": "Apache InLong: Missing authorization in StreamSource forceDelete", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63040" }, { "rank": 359, "cve_id": "CVE-2026-9033", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00185, "epss_percentile": 0.08078, "kev": false, "kev_due_at": null, "vendor": "TP-Link Systems Inc.", "product": "ER7212PC v2", "cwe": "CWE-306", "title": "Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9033" }, { "rank": 360, "cve_id": "CVE-2026-15743", "cvss_base": null, "cvss_severity": null, "epss_score": 0.00184, "epss_percentile": 0.07995, "kev": false, "kev_due_at": null, "vendor": null, "product": "Catalyst-Plugin-Static-Simple", "cwe": "CWE-524", "title": "Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15743" }, { "rank": 361, "cve_id": "CVE-2026-72844", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00183, "epss_percentile": 0.07913, "kev": false, "kev_due_at": null, "vendor": "leanprover", "product": "lean4", "cwe": "CWE-843", "title": "Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72844" }, { "rank": 362, "cve_id": "CVE-2025-62307", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00183, "epss_percentile": 0.07847, "kev": false, "kev_due_at": null, "vendor": "HCL Software", "product": "IEM", "cwe": "CWE-778", "title": "HCL IntelliOps Event Management is affected by multiple security vulnerabilities.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62307" }, { "rank": 363, "cve_id": "CVE-2026-66581", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.0755, "kev": false, "kev_due_at": null, "vendor": "Crocoblock. Jetimpex Inc.", "product": "JetEngine", "cwe": "CWE-79", "title": "WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66581" }, { "rank": 364, "cve_id": "CVE-2026-66582", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07541, "kev": false, "kev_due_at": null, "vendor": "Cozmoslabs", "product": "TranslatePress", "cwe": "CWE-79", "title": "WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66582" }, { "rank": 365, "cve_id": "CVE-2026-66590", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07541, "kev": false, "kev_due_at": null, "vendor": "Tagembed", "product": "Tagembed", "cwe": "CWE-79", "title": "WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66590" }, { "rank": 366, "cve_id": "CVE-2026-66597", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07541, "kev": false, "kev_due_at": null, "vendor": "Melograno Venture Studio", "product": "wpDataTables", "cwe": "CWE-79", "title": "WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66597" }, { "rank": 367, "cve_id": "CVE-2026-66598", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07537, "kev": false, "kev_due_at": null, "vendor": "Kingtech LLC.", "product": "B2BKing Premium", "cwe": "CWE-79", "title": "WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66598" }, { "rank": 368, "cve_id": "CVE-2026-66604", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07536, "kev": false, "kev_due_at": null, "vendor": "Paolo", "product": "GeoDirectory", "cwe": "CWE-79", "title": "WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66604" }, { "rank": 369, "cve_id": "CVE-2026-66605", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.0754, "kev": false, "kev_due_at": null, "vendor": "HasThemes", "product": "Swatchly – WooCommerce Variation Swatches for Products", "cwe": "CWE-79", "title": "WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66605" }, { "rank": 370, "cve_id": "CVE-2026-66606", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07538, "kev": false, "kev_due_at": null, "vendor": "ThemeGrill", "product": "SmartSMTP", "cwe": "CWE-79", "title": "WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66606" }, { "rank": 371, "cve_id": "CVE-2026-66607", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07538, "kev": false, "kev_due_at": null, "vendor": "ThemeHunk", "product": "Advance Product Search", "cwe": "CWE-79", "title": "WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66607" }, { "rank": 372, "cve_id": "CVE-2026-66611", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07539, "kev": false, "kev_due_at": null, "vendor": "Paymob", "product": "Paymob for WooCommerce", "cwe": "CWE-79", "title": "WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66611" }, { "rank": 373, "cve_id": "CVE-2026-66612", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07539, "kev": false, "kev_due_at": null, "vendor": "thembay", "product": "Aora", "cwe": "CWE-79", "title": "WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66612" }, { "rank": 374, "cve_id": "CVE-2026-66614", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07538, "kev": false, "kev_due_at": null, "vendor": "SEO Squirrly", "product": "SEO Plugin by Squirrly SEO", "cwe": "CWE-79", "title": "WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66614" }, { "rank": 375, "cve_id": "CVE-2026-66615", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07536, "kev": false, "kev_due_at": null, "vendor": "Eric Teubert", "product": "Podlove Podcast Publisher", "cwe": "CWE-79", "title": "WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66615" }, { "rank": 376, "cve_id": "CVE-2026-66616", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07547, "kev": false, "kev_due_at": null, "vendor": "10Web", "product": "Form Maker by 10Web", "cwe": "CWE-79", "title": "WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66616" }, { "rank": 377, "cve_id": "CVE-2026-66673", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07542, "kev": false, "kev_due_at": null, "vendor": "Monkeysan", "product": "Flatastic", "cwe": "CWE-79", "title": "WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66673" }, { "rank": 378, "cve_id": "CVE-2026-68564", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.0018, "epss_percentile": 0.07532, "kev": false, "kev_due_at": null, "vendor": "NotificationX", "product": "NotificationX Pro", "cwe": "CWE-79", "title": "WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68564" }, { "rank": 379, "cve_id": "CVE-2026-53425", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00178, "epss_percentile": 0.07319, "kev": false, "kev_due_at": null, "vendor": "dropbox", "product": "samly", "cwe": "CWE-345", "title": "Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53425" }, { "rank": 380, "cve_id": "CVE-2026-77584", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00176, "epss_percentile": 0.07117, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-821", "title": "Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77584" }, { "rank": 381, "cve_id": "CVE-2026-28163", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.07119, "kev": false, "kev_due_at": null, "vendor": "myCred", "product": "New User Approve", "cwe": "CWE-862", "title": "WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28163" }, { "rank": 382, "cve_id": "CVE-2026-63654", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00175, "epss_percentile": 0.07031, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "frappe", "cwe": "CWE-352", "title": "Frappe: Unauthenticated Workflow approval via confirm_action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63654" }, { "rank": 383, "cve_id": "CVE-2026-64962", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00175, "epss_percentile": 0.06999, "kev": false, "kev_due_at": null, "vendor": "ATutor", "product": "ATutor", "cwe": "CWE-352", "title": "Cross-Site Request Forgery (CSRF) in ATutor", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64962" }, { "rank": 384, "cve_id": "CVE-2026-77638", "cvss_base": 8.9, "cvss_severity": "HIGH", "epss_score": 0.00174, "epss_percentile": 0.06887, "kev": false, "kev_due_at": null, "vendor": "torproject", "product": "Tor", "cwe": "CWE-362", "title": "Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77638" }, { "rank": 385, "cve_id": "CVE-2026-66787", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00172, "epss_percentile": 0.06632, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2", "cwe": "CWE-345", "title": "Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice and serviceimport ips", "url": "https://www.cve.org/CVERecord?id=CVE-2026-66787" }, { "rank": 386, "cve_id": "CVE-2026-19582", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00171, "epss_percentile": 0.06584, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Migration Toolkit for Containers", "cwe": "CWE-787", "title": "Binutils: stack buffer overflow in gnu binutils in rsrc_print_name from an untrusted pe file", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19582" }, { "rank": 387, "cve_id": "CVE-2026-63042", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.0017, "epss_percentile": 0.06496, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache InLong", "cwe": "CWE-552", "title": "Apache InLong: Missing authorization on DataNode management endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63042" }, { "rank": 388, "cve_id": "CVE-2026-15679", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0017, "epss_percentile": 0.06418, "kev": false, "kev_due_at": null, "vendor": "Hugging Face", "product": "PyTorch Image Models", "cwe": "CWE-502", "title": "Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15679" }, { "rank": 389, "cve_id": "CVE-2025-62306", "cvss_base": 5, "cvss_severity": "MEDIUM", "epss_score": 0.00166, "epss_percentile": 0.05991, "kev": false, "kev_due_at": null, "vendor": "HCL Software", "product": "IEM", "cwe": "CWE-221", "title": "HCL IntelliOps Event Management is affected by multiple security vulnerabilities.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62306" }, { "rank": 390, "cve_id": "CVE-2026-18278", "cvss_base": 3.5, "cvss_severity": "LOW", "epss_score": 0.00166, "epss_percentile": 0.05997, "kev": false, "kev_due_at": null, "vendor": "Sony", "product": "XAV-9500ES", "cwe": "CWE-125", "title": "Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18278" }, { "rank": 391, "cve_id": "CVE-2025-52182", "cvss_base": null, "cvss_severity": null, "epss_score": 0.00166, "epss_percentile": 0.05996, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52182" }, { "rank": 392, "cve_id": "CVE-2026-14951", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00165, "epss_percentile": 0.05928, "kev": false, "kev_due_at": null, "vendor": "Frauscher Sensortechnik", "product": "FDS 102", "cwe": "CWE-352", "title": "Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14951" }, { "rank": 393, "cve_id": "CVE-2026-55491", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00165, "epss_percentile": 0.05947, "kev": false, "kev_due_at": null, "vendor": "bigbluebutton", "product": "bigbluebutton", "cwe": "CWE-79", "title": "BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55491" }, { "rank": 394, "cve_id": "CVE-2026-75526", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00165, "epss_percentile": 0.05861, "kev": false, "kev_due_at": null, "vendor": "django-cms", "product": "django-cms", "cwe": "CWE-79", "title": "django CMS: Stored XSS in edit-mode plugin exception rendering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75526" }, { "rank": 395, "cve_id": "CVE-2026-71368", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00163, "epss_percentile": 0.05667, "kev": false, "kev_due_at": null, "vendor": "Thinkingreed Inc.", "product": "F-RevoCRM", "cwe": "CWE-79", "title": "F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-71368" }, { "rank": 396, "cve_id": "CVE-2025-62299", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.00161, "epss_percentile": 0.05416, "kev": false, "kev_due_at": null, "vendor": "HCL Software", "product": "IEM", "cwe": "CWE-272", "title": "HCL IntelliOps Event Management is affected by multiple security vulnerabilities.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62299" }, { "rank": 397, "cve_id": "CVE-2026-17423", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.00157, "epss_percentile": 0.05068, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-125", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17423" }, { "rank": 398, "cve_id": "CVE-2026-76610", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00156, "epss_percentile": 0.04919, "kev": false, "kev_due_at": null, "vendor": "yootheme.com", "product": "Zoo extension for Joomla", "cwe": "CWE-352", "title": "Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76610" }, { "rank": 399, "cve_id": "CVE-2026-77643", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00156, "epss_percentile": 0.04983, "kev": false, "kev_due_at": null, "vendor": "Xapian", "product": "xapian-core", "cwe": "CWE-79", "title": "A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77643" }, { "rank": 400, "cve_id": "CVE-2026-18273", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.00155, "epss_percentile": 0.04896, "kev": false, "kev_due_at": null, "vendor": "Kenwood", "product": "DNR1007XR", "cwe": "CWE-276", "title": "Kenwood DNR1007XR USB Incorrect Default Permissions Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18273" }, { "rank": 401, "cve_id": "CVE-2026-70383", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00153, "epss_percentile": 0.04643, "kev": false, "kev_due_at": null, "vendor": "Estonian Information System Authority (RIA)", "product": "DigiDoc4", "cwe": "CWE-22", "title": "Arbitrary file overwrite vulnerability in DigiDoc4 client", "url": "https://www.cve.org/CVERecord?id=CVE-2026-70383" }, { "rank": 402, "cve_id": "CVE-2026-76833", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00151, "epss_percentile": 0.04509, "kev": false, "kev_due_at": null, "vendor": "cgauge", "product": "@cgauge/yaml", "cwe": "CWE-95", "title": "@cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76833" }, { "rank": 403, "cve_id": "CVE-2025-62300", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00149, "epss_percentile": 0.04285, "kev": false, "kev_due_at": null, "vendor": "HCL Software", "product": "IEM", "cwe": "CWE-362", "title": "HCL IntelliOps Event Management is affected by multiple security vulnerabilities.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-62300" }, { "rank": 404, "cve_id": "CVE-2026-54625", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00147, "epss_percentile": 0.04189, "kev": false, "kev_due_at": null, "vendor": "django-cms", "product": "django-cms", "cwe": "CWE-349", "title": "django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54625" }, { "rank": 405, "cve_id": "CVE-2026-28164", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": 0.00146, "epss_percentile": 0.04079, "kev": false, "kev_due_at": null, "vendor": "HashThemes", "product": "Easy Elementor Addons", "cwe": "CWE-352", "title": "WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-28164" }, { "rank": 406, "cve_id": "CVE-2026-18716", "cvss_base": 7.9, "cvss_severity": "HIGH", "epss_score": 0.00146, "epss_percentile": 0.04131, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-125", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18716" }, { "rank": 407, "cve_id": "CVE-2026-67448", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.04134, "kev": false, "kev_due_at": null, "vendor": "axllent", "product": "mailpit", "cwe": "CWE-177", "title": "Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67448" }, { "rank": 408, "cve_id": "CVE-2026-43798", "cvss_base": null, "cvss_severity": null, "epss_score": 0.00145, "epss_percentile": 0.04049, "kev": false, "kev_due_at": null, "vendor": "Apple", "product": "swift-nio-ssh", "cwe": null, "title": "A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43798" }, { "rank": 409, "cve_id": "CVE-2026-64773", "cvss_base": null, "cvss_severity": null, "epss_score": 0.00145, "epss_percentile": 0.0405, "kev": false, "kev_due_at": null, "vendor": "Apple", "product": "container", "cwe": null, "title": "An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64773" }, { "rank": 410, "cve_id": "CVE-2026-63388", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00142, "epss_percentile": 0.03701, "kev": false, "kev_due_at": null, "vendor": "libevent", "product": "libevent", "cwe": "CWE-617", "title": "Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63388" }, { "rank": 411, "cve_id": "CVE-2026-21784", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.03758, "kev": false, "kev_due_at": null, "vendor": "HCL Software", "product": "IEM", "cwe": "CWE-200", "title": "HCL IntelliOps Event Management is affected by multiple security vulnerabilities.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-21784" }, { "rank": 412, "cve_id": "CVE-2026-72852", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00141, "epss_percentile": 0.03625, "kev": false, "kev_due_at": null, "vendor": "hank-ai", "product": "darknet", "cwe": "CWE-190", "title": "darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72852" }, { "rank": 413, "cve_id": "CVE-2026-55893", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.0014, "epss_percentile": 0.03605, "kev": false, "kev_due_at": null, "vendor": "capstone-engine", "product": "capstone", "cwe": "CWE-122", "title": "Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55893" }, { "rank": 414, "cve_id": "CVE-2026-17422", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00135, "epss_percentile": 0.03191, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17422" }, { "rank": 415, "cve_id": "CVE-2026-54389", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00135, "epss_percentile": 0.03202, "kev": false, "kev_due_at": null, "vendor": "NationalSecurityAgency", "product": "ghidra", "cwe": "CWE-770", "title": "Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54389" }, { "rank": 416, "cve_id": "CVE-2026-55894", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00134, "epss_percentile": 0.03131, "kev": false, "kev_due_at": null, "vendor": "capstone-engine", "product": "capstone", "cwe": "CWE-125", "title": "Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55894" }, { "rank": 417, "cve_id": "CVE-2026-18263", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00132, "epss_percentile": 0.03007, "kev": false, "kev_due_at": null, "vendor": "Parallels", "product": "RAS Client", "cwe": "CWE-749", "title": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18263" }, { "rank": 418, "cve_id": "CVE-2026-77118", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00131, "epss_percentile": 0.02901, "kev": false, "kev_due_at": null, "vendor": "GraphicsMagick Group", "product": "GraphicsMagick", "cwe": "CWE-787", "title": "Out-of-bounds write in GraphicsMagick PCD decoder", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77118" }, { "rank": 419, "cve_id": "CVE-2026-13121", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0013, "epss_percentile": 0.02822, "kev": false, "kev_due_at": null, "vendor": "Parallels", "product": "RAS Client", "cwe": "CWE-749", "title": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13121" }, { "rank": 420, "cve_id": "CVE-2026-18262", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0013, "epss_percentile": 0.02821, "kev": false, "kev_due_at": null, "vendor": "Parallels", "product": "RAS Client", "cwe": "CWE-749", "title": "Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18262" }, { "rank": 421, "cve_id": "CVE-2026-18917", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0013, "epss_percentile": 0.02833, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-190", "title": "Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18917" }, { "rank": 422, "cve_id": "CVE-2026-61898", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0013, "epss_percentile": 0.02869, "kev": false, "kev_due_at": null, "vendor": "Canonical", "product": "accountsservice", "cwe": "CWE-78", "title": "accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61898" }, { "rank": 423, "cve_id": "CVE-2026-17171", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00129, "epss_percentile": 0.02818, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-59", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17171" }, { "rank": 424, "cve_id": "CVE-2026-16951", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00129, "epss_percentile": 0.02774, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16951" }, { "rank": 425, "cve_id": "CVE-2026-18840", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00127, "epss_percentile": 0.02598, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-822", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18840" }, { "rank": 426, "cve_id": "CVE-2026-16989", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00127, "epss_percentile": 0.02595, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-59", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16989" }, { "rank": 427, "cve_id": "CVE-2026-55586", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": 0.00127, "epss_percentile": 0.02586, "kev": false, "kev_due_at": null, "vendor": "sumatrapdfreader", "product": "sumatrapdf", "cwe": "CWE-119", "title": "SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55586" }, { "rank": 428, "cve_id": "CVE-2026-19442", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": 0.00123, "epss_percentile": 0.02316, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-822", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19442" }, { "rank": 429, "cve_id": "CVE-2026-16997", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00123, "epss_percentile": 0.02313, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-269", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16997" }, { "rank": 430, "cve_id": "CVE-2026-70653", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00123, "epss_percentile": 0.02327, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-122", "title": "libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image", "url": "https://www.cve.org/CVERecord?id=CVE-2026-70653" }, { "rank": 431, "cve_id": "CVE-2026-18842", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00122, "epss_percentile": 0.02216, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18842" }, { "rank": 432, "cve_id": "CVE-2026-17124", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00122, "epss_percentile": 0.02206, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-125", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17124" }, { "rank": 433, "cve_id": "CVE-2026-70651", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00121, "epss_percentile": 0.02115, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-680", "title": "libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick", "url": "https://www.cve.org/CVERecord?id=CVE-2026-70651" }, { "rank": 434, "cve_id": "CVE-2026-63381", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00121, "epss_percentile": 0.02115, "kev": false, "kev_due_at": null, "vendor": "libevent", "product": "libevent", "cwe": "CWE-908", "title": "Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63381" }, { "rank": 435, "cve_id": "CVE-2026-16943", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0012, "epss_percentile": 0.02046, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16943" }, { "rank": 436, "cve_id": "CVE-2026-16944", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.0012, "epss_percentile": 0.02047, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16944" }, { "rank": 437, "cve_id": "CVE-2026-19783", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00117, "epss_percentile": 0.01836, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19783" }, { "rank": 438, "cve_id": "CVE-2026-16936", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00116, "epss_percentile": 0.0174, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16936" }, { "rank": 439, "cve_id": "CVE-2026-16945", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00116, "epss_percentile": 0.0174, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-121", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16945" }, { "rank": 440, "cve_id": "CVE-2026-18270", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00116, "epss_percentile": 0.01782, "kev": false, "kev_due_at": null, "vendor": "Kenwood", "product": "DNR1007XR", "cwe": "CWE-732", "title": "Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18270" }, { "rank": 441, "cve_id": "CVE-2026-16996", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00114, "epss_percentile": 0.01618, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16996" }, { "rank": 442, "cve_id": "CVE-2026-70654", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00114, "epss_percentile": 0.01629, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-122", "title": "libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-70654" }, { "rank": 443, "cve_id": "CVE-2026-70652", "cvss_base": 2, "cvss_severity": "LOW", "epss_score": 0.00114, "epss_percentile": 0.0163, "kev": false, "kev_due_at": null, "vendor": "libvips", "product": "libvips", "cwe": "CWE-126", "title": "libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map", "url": "https://www.cve.org/CVERecord?id=CVE-2026-70652" }, { "rank": 444, "cve_id": "CVE-2026-72854", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00113, "epss_percentile": 0.01538, "kev": false, "kev_due_at": null, "vendor": "msgpack", "product": "msgpack-c", "cwe": "CWE-190", "title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72854" }, { "rank": 445, "cve_id": "CVE-2026-63380", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": 0.00113, "epss_percentile": 0.01553, "kev": false, "kev_due_at": null, "vendor": "libevent", "product": "libevent", "cwe": "CWE-416", "title": "Libevent: Null Pointer Dereference in `evws_new_session`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63380" }, { "rank": 446, "cve_id": "CVE-2026-17007", "cvss_base": 6.7, "cvss_severity": "MEDIUM", "epss_score": 0.00111, "epss_percentile": 0.01445, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-125", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17007" }, { "rank": 447, "cve_id": "CVE-2026-73542", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.0011, "epss_percentile": 0.01418, "kev": false, "kev_due_at": null, "vendor": "SEIKO EPSON CORPORATION", "product": "Multiple SEIKO EPSON printers and scanners", "cwe": "CWE-296", "title": "Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73542" }, { "rank": 448, "cve_id": "CVE-2026-16973", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00108, "epss_percentile": 0.01299, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-200", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16973" }, { "rank": 449, "cve_id": "CVE-2026-18822", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00107, "epss_percentile": 0.01259, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-400", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18822" }, { "rank": 450, "cve_id": "CVE-2026-16934", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00106, "epss_percentile": 0.0122, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16934" }, { "rank": 451, "cve_id": "CVE-2026-16946", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00106, "epss_percentile": 0.0122, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16946" }, { "rank": 452, "cve_id": "CVE-2026-19755", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00105, "epss_percentile": 0.01149, "kev": false, "kev_due_at": null, "vendor": "NoSleep", "product": "NoSleep", "cwe": "CWE-862", "title": "NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19755" }, { "rank": 453, "cve_id": "CVE-2026-72847", "cvss_base": 2.4, "cvss_severity": "LOW", "epss_score": 0.00103, "epss_percentile": 0.01057, "kev": false, "kev_due_at": null, "vendor": "Canop", "product": "broot", "cwe": "CWE-150", "title": "broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72847" }, { "rank": 454, "cve_id": "CVE-2026-76957", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00102, "epss_percentile": 0.01049, "kev": false, "kev_due_at": null, "vendor": "libexpat project", "product": "libexpat", "cwe": "CWE-416", "title": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76957" }, { "rank": 455, "cve_id": "CVE-2026-19449", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.001, "epss_percentile": 0.00949, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-269", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19449" }, { "rank": 456, "cve_id": "CVE-2026-16991", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.001, "epss_percentile": 0.00948, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-269", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16991" }, { "rank": 457, "cve_id": "CVE-2026-17195", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.001, "epss_percentile": 0.00944, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-787", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17195" }, { "rank": 458, "cve_id": "CVE-2026-16952", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.001, "epss_percentile": 0.00932, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-400", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16952" }, { "rank": 459, "cve_id": "CVE-2026-16980", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00099, "epss_percentile": 0.00883, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-59", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16980" }, { "rank": 460, "cve_id": "CVE-2026-61897", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00097, "epss_percentile": 0.00814, "kev": false, "kev_due_at": null, "vendor": "Canonical", "product": "accountsservice", "cwe": "CWE-273", "title": "accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61897" }, { "rank": 461, "cve_id": "CVE-2026-16937", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00093, "epss_percentile": 0.00648, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-269", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16937" }, { "rank": 462, "cve_id": "CVE-2026-17009", "cvss_base": 4.7, "cvss_severity": "MEDIUM", "epss_score": 0.00088, "epss_percentile": 0.00435, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-476", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17009" }, { "rank": 463, "cve_id": "CVE-2026-64846", "cvss_base": 2.8, "cvss_severity": "LOW", "epss_score": 0.00088, "epss_percentile": 0.00421, "kev": false, "kev_due_at": null, "vendor": "NixOS", "product": "nix", "cwe": "CWE-61", "title": "Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64846" }, { "rank": 464, "cve_id": "CVE-2026-16925", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00086, "epss_percentile": 0.00367, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-285", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16925" }, { "rank": 465, "cve_id": "CVE-2026-16935", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00084, "epss_percentile": 0.00293, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-367", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16935" }, { "rank": 466, "cve_id": "CVE-2026-16927", "cvss_base": 7.3, "cvss_severity": "HIGH", "epss_score": 0.00082, "epss_percentile": 0.00259, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-367", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16927" }, { "rank": 467, "cve_id": "CVE-2026-16923", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.0008, "epss_percentile": 0.00187, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-269", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16923" }, { "rank": 468, "cve_id": "CVE-2026-16922", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00077, "epss_percentile": 0.00121, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "AIX", "cwe": "CWE-367", "title": "Vulnerabilities in IBM AIX and PowerVM VIOS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16922" } ], "transactions": [ { "type": "KEV_ADDED", "cve_id": "CVE-2026-72529", "detail": "ADDED TO KEV — CVE-2026-72529 (TrueConf Server). Remediation due August 23, 2026." }, { "type": "KEV_ADDED", "cve_id": "CVE-2026-72530", "detail": "ADDED TO KEV — CVE-2026-72530 (TrueConf Server). Remediation due September 3, 2026." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2022-2586", "detail": "EXPLOIT PUBLISHED — CVE-2022-2586 (The Linux Kernel Organization linux). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-29181", "detail": "EXPLOIT PUBLISHED — CVE-2026-29181 (open-telemetry opentelemetry-go). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-59939", "detail": "EXPLOIT PUBLISHED — CVE-2026-59939 (httplib2). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-61518", "detail": "EXPLOIT PUBLISHED — CVE-2026-61518 (ispconfig3). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-64849", "detail": "EXPLOIT PUBLISHED — CVE-2026-64849 (mlflow). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-75978", "detail": "EXPLOIT PUBLISHED — CVE-2026-75978 (xianrendzw EasyReport). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-75979", "detail": "EXPLOIT PUBLISHED — CVE-2026-75979 (xianrendzw EasyReport). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76003", "detail": "EXPLOIT PUBLISHED — CVE-2026-76003 (UTT HiPER 1200GW). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76048", "detail": "EXPLOIT PUBLISHED — CVE-2026-76048 (SourceCodester Simple Online Food Ordering System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76049", "detail": "EXPLOIT PUBLISHED — CVE-2026-76049 (SourceCodester Simple Online Food Ordering System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76576", "detail": "EXPLOIT PUBLISHED — CVE-2026-76576 (yangzongzhuan RuoYi-Vue). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76582", "detail": "EXPLOIT PUBLISHED — CVE-2026-76582 (TRENDnet TEW-821DAP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76583", "detail": "EXPLOIT PUBLISHED — CVE-2026-76583 (TRENDnet TV-IP751WIC). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76584", "detail": "EXPLOIT PUBLISHED — CVE-2026-76584 (TRENDnet TV-IP751WIC). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76590", "detail": "EXPLOIT PUBLISHED — CVE-2026-76590 (TRENDnet TEW-755AP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76591", "detail": "EXPLOIT PUBLISHED — CVE-2026-76591 (TRENDnet TEW-755AP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76760", "detail": "EXPLOIT PUBLISHED — CVE-2026-76760 (chenhg5 cc-connect). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76761", "detail": "EXPLOIT PUBLISHED — CVE-2026-76761 (chenhg5 cc-connect). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-76886", "detail": "EXPLOIT PUBLISHED — CVE-2026-76886 (Wireshark Foundation Wireshark). Public exploit reference added." }, { "type": "RESCORED", "cve_id": "CVE-2022-4996", "detail": "RESCORED — CVE-2022-4996 (mruby). CVSS 6.9 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-16905", "detail": "RESCORED — CVE-2026-16905 (IBM Db2 Mirror for i). CVSS 5.3 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-17079", "detail": "RESCORED — CVE-2026-17079 (IBM Db2 Mirror for i). CVSS 6.3 → 4.3 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-17081", "detail": "RESCORED — CVE-2026-17081 (IBM Db2 Mirror for i). CVSS 8.2 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-17175", "detail": "RESCORED — CVE-2026-17175 (IBM Db2 Mirror for i). CVSS 7.5 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-17179", "detail": "RESCORED — CVE-2026-17179 (IBM Db2 Mirror for i). CVSS 8.5 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-17181", "detail": "RESCORED — CVE-2026-17181 (IBM Db2 Mirror for i). CVSS 9.3 → 8.6 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-19550", "detail": "RESCORED — CVE-2026-19550 (Red Hat Enterprise Linux 10). CVSS 4.3 → 8.2 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-42510", "detail": "RESCORED — CVE-2026-42510 (OpenStack Ironic). CVSS 6.6 → 7.2 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-47867", "detail": "RESCORED — CVE-2026-47867 (VMware Avi Load Balancer). CVSS 8.7 → 8.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-47869", "detail": "RESCORED — CVE-2026-47869 (VMware Avi Load Balancer). CVSS 8.7 → 8.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-47870", "detail": "RESCORED — CVE-2026-47870 (VMware Avi Load Balancer). CVSS 7.1 → 8.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-54117", "detail": "RESCORED — CVE-2026-54117 (Microsoft SQL Server 2025 (CU 6)). CVSS 8.8 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-54118", "detail": "RESCORED — CVE-2026-54118 (Microsoft SQL Server 2016 Service Pack 3 (GDR)). CVSS 8.8 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-74241", "detail": "RESCORED — CVE-2026-74241 (Red Hat OpenShift Update Service). CVSS 4.8 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-74242", "detail": "RESCORED — CVE-2026-74242 (Red Hat OpenShift Update Service). CVSS 5.3 → 4.4 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-74243", "detail": "RESCORED — CVE-2026-74243 (Red Hat OpenShift Update Service). CVSS 6.5 → 8.2 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-74244", "detail": "RESCORED — CVE-2026-74244 (Red Hat OpenShift Update Service). CVSS 5.9 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-74245", "detail": "RESCORED — CVE-2026-74245 (Red Hat OpenShift Update Service). CVSS 5.9 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-74247", "detail": "RESCORED — CVE-2026-74247 (Red Hat OpenShift Update Service). CVSS 4.2 → 7.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-76762", "detail": "RESCORED — CVE-2026-76762 (code-projects Assessment Management). CVSS 6.9 → 5.5 (NVD)." }, { "type": "REJECTED", "cve_id": "CVE-2026-69159", "detail": "REJECTED — CVE-2026-69159 (FreeRDP). Record withdrawn by the CNA." }, { "type": "DISPUTED", "cve_id": "CVE-2026-74234", "detail": "DISPUTED — CVE-2026-74234 (Legora). Record marked disputed." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }