Security Box Score — September 5, 2026

131 CVEs published, led by xmlsoft (8).

131 CVEs published September 5, 2026: 17 critical, 32 high, 45 medium, 3 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 34 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 106 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1839	36582	—	—
KEV catalog size	1695

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2369 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	188	4149	420	2015	694	1	12	3	0.1	7.8	.0016	+166 ▲
google	38	2202	280	856	978	88	78	7	0.3	7.5	.0026	+36 ▲
microsoft	9	1908	148	1290	455	15	287	28	1.5	7.8	.0044	-7 ▼
red hat	33	659	40	273	311	35	2	0	0.0	6.6	.0028	-1 ▼
apple	0	316	59	85	165	7	88	8	2.5	6.5	.0029	0
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0020	0
suse	9	37	5	21	10	1	0	0	0.0	7.5	.0036	+4 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	11	95	24	45	26	0	56	13	13.7	7.5	.0042	-12 ▼
ubiquiti	0	59	36	22	1	0	3	3	5.1	9.1	.0049	0
palo alto networks	0	37	1	3	21	12	13	2	5.4	4.7	.0020	0
netgear	0	32	0	0	27	5	0	0	0.0	4.3	.0025	0
fortinet	0	30	7	8	14	1	28	6	20.0	7.0	.0050	0
f5	7	24	6	14	3	1	4	1	4.2	8.7	.0047	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	+4 ▲
vmware	0	19	4	10	3	2	7	2	10.5	8.3	.0040	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	8	514	103	217	176	13	33	2	0.4	7.5	.0049	-31 ▼
mozilla	34	221	80	79	62	0	9	0	0.0	8.1	.0029	+33 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	0	76	3	17	47	9	4	2	2.6	5.3	.0029	0
github	3	20	1	10	9	0	0	0	0.0	7.3	.0044	+1 ▲
docker	0	9	0	6	3	0	0	0	0.0	7.2	.0016	0
wordpress	0	5	1	3	1	0	2	2	40.0	8.8	.3120	0
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2269	484	1170	519	96	28	4	0.2	7.8	.0034	0
ibm	70	689	150	301	228	9	6	1	0.1	7.5	.0029	+38 ▲
adobe	2	608	50	302	247	9	19	3	0.5	7.8	.0021	-5 ▼
progress	2	63	14	39	10	0	6	1	1.6	8.1	.0036	-8 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
zohocorp	1	11	3	6	2	0	0	0	0.0	8.8	.0144	+1 ▲
atlassian	0	6	1	5	0	0	13	0	0.0	8.1	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	3	48	15	16	9	8	3	8.5	.0160	+3 ▲
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+18 ▲
siemens	1	38	2	25	8	3	0	7.3	.0016	+1 ▲
synology	0	27	3	6	15	3	0	5.6	.0025	-1 ▼
schneider electric	4	13	1	8	4	0	0	8.2	.0032	+4 ▲
hitachi energy	4	7	0	3	4	0	0	6.9	.0017	+4 ▲
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	19	190	13	103	69	5	2	1	0.5	7.3	.0021	+16 ▲
sourcecodester	1	170	0	0	93	77	0	0	0.0	5.5	.0029	+1 ▲
spring	0	170	12	59	84	15	0	0	0.0	6.5	.0024	0
nvidia	30	164	20	115	29	0	0	0	0.0	7.8	.0028	+14 ▲
elastic	42	129	1	27	98	3	1	0	0.0	6.5	.0028	+42 ▲
splunk	0	128	6	47	70	5	1	1	0.8	6.5	.0025	0
itsourcecode	6	122	0	0	35	87	0	0	0.0	2.1	.0026	+6 ▲
siyuan-note	13	116	44	34	37	1	0	0	0.0	8.6	.0028	+5 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-8037	.9957	99.9	9.8
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-72898	.8232	99.6	10.0
CVE-2026-73570	.3238	98.3	8.9
CVE-2026-64638	.3120	98.2	8.9
CVE-2026-71362	.2514	97.8	9.1
CVE-2026-64849	.1641	96.8	9.3
CVE-2026-48376	.1548	96.6	5.4
CVE-2026-19681	.0780	94.4	9.4
CVE-2026-82329	.0767	94.3	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.8232	KEV
CVE-2026-48362	10.0	.0431
CVE-2026-19188	10.0	.0193
CVE-2026-58231	10.0	.0171
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-69836	10.0	.0155
CVE-2026-73299	10.0	.0121
CVE-2026-73678	10.0	.0114
CVE-2026-77554	10.0	.0099

Most disclosures (vendor)
Vendor	CVEs
linux	1789
oracle	890
microsoft	453
ibm	428
google	397
red hat	224
apache	119
splunk	110
adobe	96
mozilla	93

Most KEV additions (YTD)
Vendor	KEV
microsoft	28
cisco	13
apple	8
google	7
fortinet	6
ivanti	5
berriai	4
oracle	4
solarwinds	4
sonicwall	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	33
Packagist	32
npm	13
PyPI	11
Go	1
RubyGems	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-20349	Cisco	0
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0
CVE-2026-72898	Metabase	0
CVE-2026-8037	Progress Software	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-64849	mlflow	1
CVE-2026-81578	PaperCut	3

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1753
CVE-2021-27102	n/a	2021-11-17	1753
CVE-2021-27101	n/a	2021-11-17	1753
CVE-2021-27103	n/a	2021-11-17	1753
CVE-2021-21017	Adobe	2021-11-17	1753
CVE-2021-28550	Adobe	2021-11-17	1753
CVE-2021-42013	Apache Software Foundation	2021-11-17	1753
CVE-2021-41773	Apache Software Foundation	2021-11-17	1753
CVE-2021-30858	Apple	2021-11-17	1753
CVE-2021-30860	Apple	2021-11-17	1753

Transactions

EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.

Yesterday's Results

How to read these box scores · glossary

131 CVEs published. 25 box scores, 106 table rows — nothing truncated.

CVE-2026-83627CRITICAL

wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN — Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0082   54.6     —

AFFECTED
  Product                                                                                                                                 Versions     Fixed
  Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN  unspecified  —

TIMELINE
  Aug 31  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-14975MEDIUM

JoomUnited WP File Download — WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0068   49.7     —

AFFECTED
  Product           Versions     Fixed
  WP File Download  unspecified  —

TIMELINE
  Jul 7   Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-19887HIGH

uscnanbu Welcart e-Commerce — Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0057   45.0     —

AFFECTED
  Product             Versions     Fixed
  Welcart e-Commerce  unspecified  —

TIMELINE
  Aug 14  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Received

CVE-2024-11080CRITICAL

pickplugins Post Grid — Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0044   36.8     —

AFFECTED
  Product    Versions  Fixed
  Post Grid  2.2.85 –  —

TIMELINE
  Nov 11  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · CVSS v3.1 · 4 references · NVD status: Received

CVE-2026-13447CRITICAL

inspireui MStore API – Create Native Android & iOS Apps On The Cloud — MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0038   31.0     —

AFFECTED
  Product                                                     Versions     Fixed
  MStore API – Create Native Android & iOS Apps On The Cloud  unspecified  —

TIMELINE
  Jun 26  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-287 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-83625HIGH

supsysticcom Contact Form by Supsystic — Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0033   25.6     —

AFFECTED
  Product                    Versions     Fixed
  Contact Form by Supsystic  unspecified  —

TIMELINE
  Aug 31  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Received

CVE-2026-86145HIGH

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  L    8.2   .0032   24.0     —

AFFECTED
  Product  Versions  Fixed
  PCRE2    10.32 –   —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 5   Published (CNA: mitre)

CWE-424 · CNA: mitre · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-75018MEDIUM

outlawgt Custom Contact Forms — Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0030   22.1     —

AFFECTED
  Product               Versions     Fixed
  Custom Contact Forms  unspecified  —

TIMELINE
  Aug 17  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 14 references · NVD status: Received

CVE-2026-77233HIGH

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0029   21.4     —

AFFECTED
  Product                                                                Versions     Fixed
  iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more  unspecified  —

TIMELINE
  Aug 20  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Received

CVE-2026-78438HIGH

boldgrid W3 Total Cache — W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0029   20.9     —

AFFECTED
  Product         Versions     Fixed
  W3 Total Cache  unspecified  —

TIMELINE
  Aug 24  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-18406HIGH

brainstormforce SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz — SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0029   20.7     —

AFFECTED
  Product                                                                  Versions     Fixed
  SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz  unspecified  —

TIMELINE
  Jul 30  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 9 references · NVD status: Received

CVE-2026-4361MEDIUM

Elegant Themes Divi — Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  N  N    5.0   .0027   19.6     —

AFFECTED
  Product  Versions     Fixed
  Divi     unspecified  —

TIMELINE
  Mar 17  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-918 · CNA: Wordfence · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-77830HIGH

cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk — Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0027   19.3     —

AFFECTED
  Product                                            Versions     Fixed
  Spam protection, Honeypot, Anti-Spam by CleanTalk  unspecified  —

TIMELINE
  Aug 21  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Received

CVE-2026-19769HIGH

kstover Ninja Forms – The Contact Form Builder That Grows With You — Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0025   15.9     —

AFFECTED
  Product                                                     Versions     Fixed
  Ninja Forms – The Contact Form Builder That Grows With You  unspecified  —

TIMELINE
  Aug 13  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-77263HIGH

iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0025   15.9     —

AFFECTED
  Product                                                                Versions     Fixed
  iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more  unspecified  —

TIMELINE
  Aug 20  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-81543HIGH

Tyche Softwares Abandoned Cart Pro for WooCommerce — Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0025   15.7     —

AFFECTED
  Product                             Versions     Fixed
  Abandoned Cart Pro for WooCommerce  unspecified  —

TIMELINE
  Aug 27  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-85414MEDIUM

fooplugins Gallery : FooGallery — Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0024   15.2     —

AFFECTED
  Product               Versions     Fixed
  Gallery : FooGallery  unspecified  —

TIMELINE
  Sep 3   Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Received

CVE-2026-83628MEDIUM

jfarthing84 Theme My Login — Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  N    4.3   .0024   15.0     —

AFFECTED
  Product         Versions     Fixed
  Theme My Login  unspecified  —

TIMELINE
  Aug 31  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2025-14945MEDIUM

netweblogic Events Manager – Calendar, Bookings, Tickets, and more! — Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  C  L  L  N    5.4   .0022   12.0     —

AFFECTED
  Product                                                  Versions     Fixed
  Events Manager – Calendar, Bookings, Tickets, and more!  unspecified  —

TIMELINE
  Dec 19  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 4 references · NVD status: Received

CVE-2026-75586MEDIUM

unitecms Unlimited Elements For Elementor — Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  L  N    6.1   .0022   11.8     —

AFFECTED
  Product                           Versions     Fixed
  Unlimited Elements For Elementor  unspecified  —

TIMELINE
  Aug 17  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-8623MEDIUM

dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer — Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0021   11.5     —

AFFECTED
  Product                                                      Versions     Fixed
  DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer  unspecified  —

TIMELINE
  May 14  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-8625MEDIUM

dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer — Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0021   10.6     —

AFFECTED
  Product                                                      Versions     Fixed
  DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer  unspecified  —

TIMELINE
  May 14  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-18404MEDIUM

quadlayers Social Chat – Click To Chat App Button — Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0020   10.0     —

AFFECTED
  Product                                 Versions     Fixed
  Social Chat – Click To Chat App Button  unspecified  —

TIMELINE
  Jul 30  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-76573MEDIUM

sc0ttkclark Pods – Custom Content Types and Fields — Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0020   10.0     —

AFFECTED
  Product                                 Versions     Fixed
  Pods – Custom Content Types and Fields  unspecified  —

TIMELINE
  Aug 19  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-15984HIGH

Themovation QuickCal — QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0019    8.7     —

AFFECTED
  Product   Versions     Fixed
  QuickCal  unspecified  —

TIMELINE
  Jul 16  Reserved by CNA
  Sep 5   Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-16649	7.2	8.7	Gravity Forms	Gravity Forms	CWE-79	Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Pos…
CVE-2026-82304	await	8.7	Unknown	Music Store	—	Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-d…
CVE-2026-19861	await	8.1	Unknown	JetFormBuilder — Dynamic Blocks Form Builder	—	JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in No…
CVE-2026-81404	await	8.1	Unknown	IPGP Visitors Origin	—	IPGP Visitors Origin < 1.6 - Reflected XSS
CVE-2025-15694	await	7.4	Unknown	Joli Table Of Contents	—	Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS
CVE-2026-18843	6.1	6.4	The Beaver Builder Team	Beaver Builder Plugin (Starter Version)	CWE-79	Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Script…
CVE-2026-3853	6.4	6.0	Elegant Themes	Divi	CWE-79	Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scr…
CVE-2026-86144	5.6	5.6	xmlsoft	libxml2	CWE-669	In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProce…
CVE-2025-15693	await	5.5	Unknown	JCH Optimize	—	JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal
CVE-2026-81423	await	5.4	Unknown	Accept Stripe Payments	—	Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler
CVE-2026-84934	await	5.3	Unknown	JCH Optimize	—	JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override
CVE-2026-84898	await	5.2	Unknown	Eventin	—	Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
CVE-2026-19858	await	5.1	Unknown	JetFormBuilder — Dynamic Blocks Form Builder	—	JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metada…
CVE-2026-78149	await	5.1	Unknown	Smart Post	—	Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content…
CVE-2026-81348	await	5.1	Unknown	My Private Site	—	My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via …
CVE-2026-84937	await	5.1	Unknown	Video Player for YouTube	—	YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax
CVE-2026-82846	await	4.7	Unknown	Masteriyo LMS	—	Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields
CVE-2026-83544	await	4.7	Unknown	Greenshift	—	Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps…
CVE-2026-84021	await	4.7	Unknown	Bold Page Builder	—	Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_he…
CVE-2026-84022	await	4.7	Unknown	Bold Page Builder	—	Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode El…
CVE-2026-84221	await	4.7	Unknown	Kirki	—	Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
CVE-2026-84896	await	4.7	Unknown	King Addons for Elementor	—	King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Gr…
CVE-2026-84899	await	4.7	Unknown	VikWidgetsLoader	—	VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class…
CVE-2026-84930	await	4.7	Unknown	CatFolders Document Gallery & PDF Library	—	CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block A…
CVE-2026-84931	await	4.7	Unknown	Joli Table Of Contents	—	Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Th…
CVE-2026-84935	await	4.7	Unknown	HT Menu	—	HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings
CVE-2026-77826	await	4.2	Unknown	RegistrationMagic	—	RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass v…
CVE-2026-78362	await	4.2	Unknown	SEO Flow by LupsOnline	—	SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation v…
CVE-2026-81424	await	4.2	Unknown	Accept Stripe Payments	—	Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR
CVE-2026-15247	await	3.8	Unknown	Search Atlas SEO	—	Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Ove…
CVE-2026-78150	await	3.8	Unknown	Smart Post	—	Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content…
CVE-2026-84745	await	3.6	Unknown	The Events Calendar	—	The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and …
CVE-2026-84926	await	3.6	Unknown	EmbedPress	—	EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Go…
CVE-2026-86140	8.0	3.3	xmlsoft	libxml2	CWE-121	In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-b…
CVE-2026-84936	await	3.4	Unknown	EmbedPress	—	EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumpti…
CVE-2026-86142	6.9	3.0	xmlsoft	libxml2	CWE-122	In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEva…
CVE-2026-83543	await	3.1	Unknown	Greenshift	—	Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint
CVE-2026-84225	await	3.1	Unknown	Kirki	—	Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification…
CVE-2026-84901	await	3.1	Unknown	Eventin	—	Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manip…
CVE-2026-84927	await	3.1	Unknown	EmbedPress	—	EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
CVE-2026-86138	6.9	2.0	xmlsoft	libxml2	CWE-190	In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow…
CVE-2026-86143	6.9	2.0	xmlsoft	libxml2	CWE-192	In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback…
CVE-2026-86137	2.9	1.8	xmlsoft	libxml2	CWE-125	In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, a…
CVE-2026-86141	2.9	1.8	xmlsoft	libxml2	CWE-252	xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNe…
CVE-2026-86139	6.9	1.3	xmlsoft	libxml2	CWE-190	In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
CVE-2026-10196	9.8	—	getwpfunnels	Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails	CWE-502	Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form …
CVE-2026-86123	9.4	—	sqlchat	sqlchat	CWE-918	SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection End…
CVE-2026-86148	9.4	—	Tenda	CP3	CWE-77	Tenda CP3 Kylin system.c SystemAsh os command injection
CVE-2026-86149	9.4	—	Tenda	CP3	CWE-77	Tenda CP3 NetCheckPing.cpp os command injection
CVE-2026-86151	9.4	—	Tenda	CP3	CWE-78	Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command inj…
CVE-2026-86121	9.3	—	trycua	cua-computer-server	CWE-306	Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
CVE-2026-86124	9.3	—	HKUDS	AutoAgent	CWE-306	AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command S…
CVE-2026-86184	9.3	—	laradashboard	laradashboard	CWE-306	Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
CVE-2026-86189	9.3	—	WWBN	AVideo	CWE-73	WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
CVE-2026-86190	9.3	—	WWBN	AVideo	CWE-200	WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
CVE-2026-67276	9.2	—	Mikrotik	RouterOS	CWE-347	SSH user impersonation possible in Mikrotik RouterOS
CVE-2026-86060	9.2	—	Mikrotik	RouterOS	CWE-88	SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
CVE-2026-86117	9.2	—	coollabsio	coolify	CWE-287	Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
CVE-2026-86119	9.2	—	webstudio-is	webstudio	CWE-918	Webstudio through 0.296.0 SSRF via /cgi proxy routes
CVE-2025-9049	8.8	—	scriptsbundle	Nokri – Job Board WordPress Theme	CWE-862	Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authent…
CVE-2026-67277	8.8	—	Mikrotik	RouterOS	CWE-306	Kernel memory disclosure and denial of service in MikroTik RouterOS btest ser…
CVE-2026-0799	8.7	—	The Tcpdump Group	libpcap	CWE-125	OOBR and OOBW in libpcap before 1.10.7
CVE-2026-67281	8.7	—	Mikrotik	RouterOS	CWE-22	Unauthenticated file read in Mikrotik RouterOS
CVE-2026-86169	8.7	—	axolotl-ai-cloud	axolotl	CWE-829	Axolotl through 0.18.0 Remote Code Execution via Multipack Patching
CVE-2026-86173	8.7	—	mindsdb	mindsdb	CWE-918	MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
CVE-2026-86177	8.7	—	pterodactyl	panel	CWE-862	Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
CVE-2026-86193	8.7	—	getgrav	grav-plugin-api	CWE-863	Grav API Plugin Authentication Bypass via Group-Inherited Super
CVE-2026-86195	8.7	—	getgrav	grav-plugin-api	CWE-269	grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super…
CVE-2026-86196	8.7	—	getgrav	grav-plugin-api	CWE-290	Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
CVE-2026-86185	8.6	—	Bilibili	Bilibili Desktop	CWE-295	Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification By…
CVE-2026-86207	7.7	—	N-able	N-central	CWE-305	Authentication bypass leads to unauthorised access to N-central
CVE-2026-86187	7.4	—	WWBN	AVideo	CWE-330	WWBN AVideo Weak PRNG Password Generation via External Login
CVE-2026-86111	7.1	—	bookwyrm-social	bookwyrm	CWE-639	BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes…
CVE-2026-86113	7.1	—	bookwyrm-social	bookwyrm	CWE-639	BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough A…
CVE-2026-86114	7.1	—	getarcaneapp	arcane	CWE-862	Arcane before 2.0.0 Missing Administrator Authorization on the Compose Templa…
CVE-2026-86116	7.1	—	metabase	metabase	CWE-862	Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary M…
CVE-2026-86175	7.1	—	netbox-community	netbox	CWE-522	NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
CVE-2026-86192	7.1	—	siyuan-note	siyuan	CWE-639	SiYuan before v3.8.2 Information Disclosure via Attribute-View
CVE-2026-67279	6.9	—	Mikrotik	RouterOS	CWE-841	SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
CVE-2026-86188	6.9	—	WWBN	AVideo	CWE-79	AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
CVE-2026-86194	6.9	—	getgrav	grav-plugin-form	CWE-862	Grav Form Plugin before 9.1.22 Cross-Page Form Execution
CVE-2026-86206	6.9	—	N-able	N-central	CWE-791	Access control filter bypass allows unauthorised access to APIs
CVE-2025-15647	6.8	—	artem-ogre	CDT	CWE-125	CDT before 1.4.5 Out-of-Bounds Read via opposedVertexInd
CVE-2026-67278	6.3	—	Mikrotik	RouterOS	CWE-347	TLS server impersonation possible in Mikrotik RouterOS
CVE-2026-86186	6.3	—	WWBN	AVideo	CWE-307	AVideo API Rate Limit Bypass via Bot User-Agent Header
CVE-2026-82752	5.9	—	ash-project	ash	CWE-1284	Ash string length constraints count graphemes, so a combining-mark string of …
CVE-2026-6244	5.5	—	The Tcpdump Group	libpcap	CWE-369	division by zero in libpcap before 1.10.7
CVE-2026-6554	5.5	—	The Tcpdump Group	libpcap	CWE-835	infinte loop in libpcap before 1.10.7
CVE-2026-31911	5.5	—	The Tcpdump Group	libpcap	CWE-617	abort() in libpcap before 1.10.7 on an invalid BPF opcode
CVE-2026-31912	5.5	—	The Tcpdump Group	libpcap	CWE-125	OOBR in libpcap before 1.10.7
CVE-2026-12843	5.4	—	StellarWP	LearnDash LMS	CWE-862	LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment vi…
CVE-2026-86112	5.3	—	bookwyrm-social	bookwyrm	CWE-639	BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite E…
CVE-2026-86115	5.3	—	simstudioai	sim	CWE-441	Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token…
CVE-2026-86118	5.3	—	sentriz	gonic	CWE-862	gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan End…
CVE-2026-86120	5.3	—	apitable	apitable	CWE-636	APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node…
CVE-2026-86122	5.3	—	rowboatlabs	rowboat	CWE-918	Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
CVE-2026-86174	5.3	—	makeplane	plane	CWE-639	Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board
CVE-2026-86176	5.3	—	netbox-community	netbox	CWE-639	NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
CVE-2026-86178	5.3	—	pixelfed	pixelfed	CWE-862	Pixelfed through 0.12.9 Unauthorized Story Access via API
CVE-2026-86191	5.3	—	siyuan-note	siyuan	CWE-639	SiYuan before v3.8.2 Private Attribute View Key Enumeration
CVE-2026-86197	5.1	—	getgrav	grav	CWE-79	Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
CVE-2026-18238	5.0	—	The Tcpdump Group	libpcap	CWE-126	OOBR in rpcap client in libpcap before 1.10.7
CVE-2025-15614	4.8	—	Genivia	ugrep	CWE-125	ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
CVE-2026-15550	4.3	—	Saturday Drive	Ninja Forms - Save Progress	CWE-862	Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticate…
CVE-2026-18313	4.3	—	The Tcpdump Group	libpcap	CWE-401	rpcapd memory leak in libpcap before 1.10.7
CVE-2026-86150	2.0	—	Tenda	CP3	CWE-259	Tenda CP3 hostapd hard-coded credentials

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-05 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.