Security Box Score — August 23, 2026

43 CVEs published, led by EmilStenstrom (11).

43 CVEs published August 23, 2026: 4 critical, 5 high, 15 medium, 15 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 4 awaiting enrichment. 25 rendered as box scores below; the remaining 18 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	9354	31518	—	—
KEV catalog size	1675

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

1748 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	1417	3732	363	1781	637	1	11	2	0.1	7.8	.0017	+937 ▲
microsoft	469	1891	145	1281	451	14	286	27	1.4	7.8	.0044	-181 ▼
google	71	1832	224	765	786	57	77	6	0.3	7.5	.0025	-48 ▼
red hat	189	575	43	237	264	31	2	0	0.0	6.8	.0029	+82 ▲
apple	40	311	58	82	163	6	88	8	2.6	6.5	.0029	+37 ▲
canonical	14	41	12	11	13	5	0	0	0.0	7.8	.0020	+7 ▲
freebsd	23	39	0	23	4	0	0	0	0.0	7.8	.0015	+23 ▲
suse	5	26	5	14	6	1	0	0	0.0	8.1	.0039	-3 ▼

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	46	84	21	39	24	0	56	13	15.5	7.5	.0044	+31 ▲
palo alto networks	12	37	1	3	21	12	13	2	5.4	4.7	.0020	-2 ▼
ubiquiti	0	36	14	21	1	0	3	3	8.3	8.8	.0049	-25 ▼
netgear	9	32	0	0	27	5	0	0	0.0	4.3	.0025	+3 ▲
fortinet	7	30	7	8	14	1	28	6	20.0	7.0	.0050	-6 ▼
vmware	2	19	4	9	4	2	7	2	10.5	8.1	.0040	-6 ▼
f5	0	16	5	8	3	0	4	1	6.3	8.6	.0057	-8 ▼
ivanti	3	14	4	8	2	0	25	5	35.7	8.3	.0754	+1 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	132	468	90	198	157	13	33	2	0.4	7.5	.0048	+40 ▲
mozilla	59	186	68	68	50	0	9	0	0.0	8.1	.0031	-12 ▼
gitlab	16	67	2	15	42	8	4	2	3.0	5.3	.0029	+9 ▲
drupal	0	51	6	5	35	5	4	1	2.0	5.9	.0026	-46 ▼
github	5	17	1	7	9	0	0	0	0.0	6.6	.0043	0
docker	2	9	0	6	3	0	0	0	0.0	7.2	.0016	+2 ▲
wordpress	2	5	1	3	1	0	2	2	40.0	8.8	.3120	0
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	-1 ▼

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	889	2268	487	1172	513	96	27	3	0.1	7.8	.0034	-220 ▼
ibm	374	603	133	285	176	9	6	1	0.2	7.5	.0029	+337 ▲
adobe	60	312	39	145	123	5	19	3	1.0	7.8	.0026	-35 ▼
progress	19	61	14	37	10	0	6	1	1.6	8.1	.0037	-9 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	-15 ▼
veeam	10	16	5	9	2	0	1	0	0.0	8.6	.0034	+9 ▲
zohocorp	4	10	3	5	2	0	0	0	0.0	8.7	.0140	+1 ▲
atlassian	3	6	1	5	0	0	13	0	0.0	8.1	.0034	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	16	36	15	5	9	7	3	7.4	.0157	+8 ▲
siemens	19	35	2	23	8	2	0	7.3	.0016	+12 ▲
rockwell automation	1	25	4	18	3	0	0	8.7	.0029	-16 ▼
synology	1	24	2	6	13	3	0	5.6	.0025	+1 ▲
schneider electric	0	9	1	6	2	0	0	8.6	.0037	0
abb	0	7	0	4	3	0	0	7.2	.0018	-1 ▼
hikvision	0	6	0	4	2	0	0	7.2	.0040	-5 ▼
moxa	0	5	0	3	2	0	0	7.0	.0029	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
sourcecodester	42	162	0	0	86	76	0	0	0.0	5.3	.0030	-7 ▼
dell	56	155	10	83	57	5	2	1	0.6	7.2	.0019	+13 ▲
splunk	110	128	6	47	70	5	1	1	0.8	6.5	.0025	+107 ▲
openclaw	0	111	0	58	39	14	0	0	0.0	7.0	.0026	-44 ▼
nvidia	24	106	14	71	21	0	0	0	0.0	7.5	.0034	-17 ▼
siyuan-note	73	95	42	20	31	1	0	0	0.0	8.7	.0027	+64 ▲
zephyrproject	38	91	2	32	48	9	0	0	0.0	6.5	.0022	+17 ▲
itsourcecode	20	91	0	0	19	72	0	0	0.0	2.1	.0032	+2 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-34486	.9862	99.9	7.5
CVE-2026-63077	.8473	99.7	9.8
CVE-2026-72898	.7922	99.6	10.0
CVE-2026-59310	.4588	98.7	9.8
CVE-2026-61511	.3399	98.3	9.3
CVE-2026-64638	.3120	98.1	8.9
CVE-2025-68686	.2915	98.0	5.9
CVE-2026-71362	.2514	97.8	9.1
CVE-2026-66066	.1895	97.1	9.5

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.7922	KEV
CVE-2026-48362	10.0	.0431
CVE-2026-19188	10.0	.0193
CVE-2026-58231	10.0	.0171
CVE-2026-69836	10.0	.0159
CVE-2026-16812	10.0	.0157	KEV
CVE-2026-73299	10.0	.0121
CVE-2026-73678	10.0	.0114
CVE-2026-45618	10.0	.0092
CVE-2026-48168	10.0	.0091

Most disclosures (vendor)
Vendor	CVEs
linux	1724
oracle	889
microsoft	474
google	448
ibm	442
red hat	236
apache	210
apple	204
splunk	110
siyuan-note	77

Most KEV additions (YTD)
Vendor	KEV
microsoft	27
cisco	13
apple	8
fortinet	6
google	6
ivanti	5
solarwinds	4
adobe	3
berriai	3
oracle	3

Most-affected ecosystems
Ecosystem	Advisories
Maven	51
PyPI	10
npm	5
Go	4
Packagist	2
NuGet	1
crates.io	1

Fastest to KEV
CVE	Vendor	Days
CVE-2025-68686	Fortinet	0
CVE-2026-16812	Arista Networks	0
CVE-2026-18556	N-able	0
CVE-2026-18577	N-able	0
CVE-2026-20316	Cisco	0
CVE-2026-20349	Cisco	0
CVE-2026-34486	Apache Software Foundation	0
CVE-2026-63077	JetBrains	0
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1740
CVE-2021-27102	n/a	2021-11-17	1740
CVE-2021-27101	n/a	2021-11-17	1740
CVE-2021-27103	n/a	2021-11-17	1740
CVE-2021-21017	Adobe	2021-11-17	1740
CVE-2021-28550	Adobe	2021-11-17	1740
CVE-2021-42013	Apache Software Foundation	2021-11-17	1740
CVE-2021-41773	Apache Software Foundation	2021-11-17	1740
CVE-2021-30858	Apple	2021-11-17	1740
CVE-2021-30860	Apple	2021-11-17	1740

Transactions

EXPLOIT PUBLISHED — guardian language-system: 6 CVEs (CVE-2026-34100, CVE-2026-34101, CVE-2026-34102, CVE-2026-34103, CVE-2026-34104, CVE-2026-34105). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-14187 (Unknown Tutor LMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16260 (Unknown Post Grid, Slider & Carousel Ultimate). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16612 (Unknown FiboSearch). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-16738 (Unknown Conekta Payment Gateway). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-18052 (Unknown ManageWP Worker). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19093 (Unknown Tutor LMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19221 (Unknown Forminator Forms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19222 (Unknown Forminator Forms). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-46243 (Linux). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-46331 (Linux). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-50656 (Microsoft Malware Protection Engine). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-76789 (Unknown Slider Hero with Video Background, Animation). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-76793 (Unknown Firebase Authentication). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-77000 (Unknown WP Social Media Login). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-77001 (Unknown Social Login & Sharing buttons with Analytics By SoClever). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-77002 (Unknown SmilePass Selfie Login). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-77988 (TRENDnet TEW-823DRU). Public exploit reference added.

RESCORED — CVE-2026-78050 (Comfast CF-N1-S). CVSS 9.4 → 8.6 (NVD).

RESCORED — CVE-2026-78051 (alexta69 MeTube). CVSS 6.9 → 5.5 (NVD).

PATCH SHIPPED — CVE-2026-10805 (Red Hat Enterprise Linux 8). Fixed in Red Hat Enterprise Linux 8 1:1.40.16-21.el8_10.

PATCH SHIPPED — CVE-2026-52902 (Red Hat Ansible Automation Platform 2.7 for RHEL 10). Fixed in Red Hat Ansible Automation Platform 2.7 for RHEL 10 0:4.8.6-1.el10ap.

ENRICHED — CVE-2024-40973 (Linux). Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2025-23160 (Linux). Received CVSS 5.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

43 CVEs published. 25 box scores, 18 table rows — nothing truncated.

CVE-2026-78063LOW

Tenda CH22 editFileName formeditFileName command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.2     —

AFFECTED
  Product  Versions   Fixed
  CH22     1.0.0.1 –  —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-78141LOW

Tenda CH22 exeCommand formexeCommand command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0107   62.2     —

AFFECTED
  Product  Versions   Fixed
  CH22     1.0.0.1 –  —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-10053HIGH

GitLab GitLab — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  C  H  H  H    8.5   .0072   51.1     —

AFFECTED
  Product  Versions  Fixed
  GitLab   18.8 –    —

TIMELINE
  May 29  Reserved by CNA
  Aug 23  Published (CNA: GitLab)

CWE-22 · CNA: GitLab · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-78148MEDIUM

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    6.9   .0054   43.0     —

AFFECTED
  Product    Versions     Fixed
  llama.cpp  bec4772f6 –  —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-476, CWE-404 · CNA: VulDB · CVSS v4.0 · 7 references

CVE-2026-78147MEDIUM

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0043   35.8     —

AFFECTED
  Product    Versions     Fixed
  llama.cpp  bec4772f6 –  —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-20, CWE-502 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-78145LOW

n/a CTFd — CTFd __init__.py _is_safe_url redirect

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0042   34.7     —

AFFECTED
  Product  Versions  Fixed
  CTFd     3.8.0 –   —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-601 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-78154MEDIUM

the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    6.9   .0040   33.4     —

AFFECTED
  Product         Versions  Fixed
  open-wearables  0.6.0 –   —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-306, CWE-287 · CNA: VulDB · CVSS v4.0 · 6 references

CVE-2026-8445CRITICAL

EmilStenstrom justhtml — justhtml before 1.12.0 Sanitizer Bypass via Markdown

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0038   30.8     —

AFFECTED
  Product   Versions     Fixed
  justhtml  unspecified  1.12.0

TIMELINE
  May 12  Reserved by CNA
  Aug 23  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-4671HIGH

EmilStenstrom justhtml — justhtml before 1.18.0 Denial of Service via CSS Selector

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0037   29.9     —

AFFECTED
  Product   Versions     Fixed
  justhtml  unspecified  1.18.0

TIMELINE
  Mar 23  Reserved by CNA
  Aug 23  Published (CNA: VulnCheck)

CWE-400 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-78059LOW

SourceCodester Stock Management System printOrder.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0035   28.1     —

AFFECTED
  Product                  Versions  Fixed
  Stock Management System  1.0 –     —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-78060LOW

SourceCodester Stock Management System getOrderReport.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0035   28.1     —

AFFECTED
  Product                  Versions  Fixed
  Stock Management System  1.0 –     —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-7808CRITICAL

EmilStenstrom justhtml — justhtml before 1.16.0 Multiple Security Issues via Sanitization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0035   27.8     —

AFFECTED
  Product   Versions     Fixed
  justhtml  unspecified  1.16.0

TIMELINE
  May 4   Reserved by CNA
  Aug 23  Published (CNA: VulnCheck)

CWE-20 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-78055LOW

SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0035   27.3     —

AFFECTED
  Product                            Versions  Fixed
  Class and Exam Timetabling System  1.0 –     —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-5388CRITICAL

EmilStenstrom justhtml — justhtml before 1.15.0 Multiple Security Issues

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0034   27.0     —

AFFECTED
  Product   Versions     Fixed
  justhtml  unspecified  1.15.0

TIMELINE
  Apr 1   Reserved by CNA
  Aug 23  Published (CNA: VulnCheck)

CWE-20 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-78156MEDIUM

n/a Open5GS — Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0033   25.7     —

AFFECTED
  Product  Versions  Fixed
  Open5GS  2.8.0 –   —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-122, CWE-119 · CNA: VulDB · CVSS v4.0 · 7 references

CVE-2026-78115LOW

SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   L   L    2.1   .0030   21.6     —

AFFECTED
  Product                            Versions  Fixed
  Class and Exam Timetabling System  1.0 –     —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-266, CWE-285 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-78144LOW

code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0029   20.9     —

AFFECTED
  Product                                        Versions  Fixed
  Barangay Resident Profiling Management System  1.0 –     —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-78062MEDIUM

vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0029   20.8     —

AFFECTED
  Product    Versions  Fixed
  TaxHacker  0.8.0 –   —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-259, CWE-798 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-19565AWAITING ENRICHMENT

Apache-AppSamurai — Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey

  CVSS   EPSS    %ile   KEV
  —      .0028   20.2   —

AFFECTED
  Product            Versions     Fixed
  Apache-AppSamurai  unspecified  —

TIMELINE
  Aug 11  Reserved by CNA
  Aug 23  Published (CNA: CPANSec)

CWE-341 · CNA: CPANSec · 3 references · NVD status: Received

CVE-2026-9769HIGH

EmilStenstrom justhtml — justhtml before 1.10.0 Denial of Service via deeply nested HTML

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0028   19.7     —

AFFECTED
  Product   Versions     Fixed
  justhtml  unspecified  1.10.0

TIMELINE
  May 27  Reserved by CNA
  Aug 23  Published (CNA: VulnCheck)

CWE-674 · CNA: VulnCheck · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-78061MEDIUM

vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0028   19.4     —

AFFECTED
  Product    Versions  Fixed
  TaxHacker  0.8.0 –   —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

CVE-2026-78054LOW

SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0027   19.1     —

AFFECTED
  Product                            Versions  Fixed
  Class and Exam Timetabling System  1.0 –     —

TIMELINE
  Aug 22  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-78155CRITICAL

OnGres StackGres — Untrusted Search Path in StackGres

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0027   19.0     —

AFFECTED
  Product    Versions     Fixed
  StackGres  unspecified  —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: GitLab)

CWE-426 · CNA: GitLab · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-78143MEDIUM

code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   17.7     —

AFFECTED
  Product                                        Versions  Fixed
  Barangay Resident Profiling Management System  1.0 –     —

TIMELINE
  Aug 23  Reserved by CNA
  Aug 23  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-75922AWAITING ENRICHMENT

Reverse-Proxy — Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line

  CVSS   EPSS    %ile   KEV
  —      .0026   17.6   —

AFFECTED
  Product        Versions     Fixed
  Reverse-Proxy  unspecified  —

TIMELINE
  Aug 18  Reserved by CNA
  Aug 23  Published (CNA: CPANSec)

CWE-93, CWE-444 · CNA: CPANSec · 5 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-78057	2.1	16.7	sambitraj	Student-Management-System	CWE-74	sambitraj Student-Management-System Management Mutation sql injection
CVE-2026-78112	2.1	16.1	itsourcecode	Hospital Management System Project in PHP	CWE-74	itsourcecode Hospital Management System Project in PHP viewservicetype.php sq…
CVE-2026-78140	2.0	15.3	Dromara	UJCMS	CWE-791	Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java updat…
CVE-2026-78183	await	13.5	—	DBD-Pg	CWE-787	DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
CVE-2026-78142	2.1	12.3	code-projects	Barangay Resident Profiling Management System	CWE-285	code-projects Barangay Resident Profiling Management System Restore/Delete ar…
CVE-2026-74793	5.1	10.3	EmilStenstrom	justhtml	CWE-79	justhtml before 3.11.0 XSS via selectedcontent projection
CVE-2026-78056	2.1	10.3	sambitraj	Student-Management-System	CWE-74	sambitraj Student-Management-System Dashboard sql injection
CVE-2026-78136	7.8	8.4	chirpmyradio	CHIRP	CWE-95	chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data.…
CVE-2026-77088	5.3	8.4	EmilStenstrom	justhtml	CWE-79	justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
CVE-2026-5389	5.1	8.4	EmilStenstrom	justhtml	CWE-80	justhtml before 1.13.0 XSS via code fence breakout
CVE-2026-5751	5.1	8.4	EmilStenstrom	justhtml	CWE-79	justhtml before 1.14.0 Mutation XSS via custom sanitization policies
CVE-2026-8630	5.1	8.4	EmilStenstrom	justhtml	CWE-79	justhtml before 1.12.0 Mutation XSS via Raw Text Elements
CVE-2026-6827	5.1	8.3	EmilStenstrom	justhtml	CWE-79	justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnerabilities
CVE-2026-14853	4.3	6.4	Unknown	WooCommerce Bookings	CWE-862	WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation vi…
CVE-2026-77003	2.7	6.3	Unknown	Content Mask	CWE-269	Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via crea…
CVE-2026-77116	4.3	5.9	Unknown	Brave	CWE-639	Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Pr…
CVE-2026-13598	await	4.6	Unknown	RestrictMate	—	RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator
CVE-2026-77115	7.1	4.1	Unknown	Brave	CWE-79	Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-08-23 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.