Security Box Score — September 6, 2026

92 CVEs published, led by SourceCodester (13).

92 CVEs published September 6, 2026: 6 critical, 19 high, 41 medium, 15 low; 0 in the KEV catalog at press time; 3 with a public exploit reference; 11 awaiting enrichment. 25 rendered as box scores below; the remaining 67 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	1931	36675	—	—
KEV catalog size	1695

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2384 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	188	4149	420	2015	694	1	12	3	0.1	7.8	.0016	+144 ▲
google	38	2202	280	856	978	88	78	7	0.3	7.5	.0026	-5 ▼
microsoft	9	1908	148	1290	455	15	287	28	1.5	7.8	.0044	-24 ▼
red hat	33	659	40	273	311	35	2	0	0.0	6.6	.0028	-4 ▼
apple	0	316	59	85	165	7	88	8	2.5	6.5	.0029	-1 ▼
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0020	0
suse	9	37	5	21	10	1	0	0	0.0	7.5	.0036	+4 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	11	95	24	45	26	0	56	13	13.7	7.5	.0042	-12 ▼
ubiquiti	0	59	36	22	1	0	3	3	5.1	9.1	.0049	0
palo alto networks	0	37	1	3	21	12	13	2	5.4	4.7	.0020	0
netgear	0	32	0	0	27	5	0	0	0.0	4.3	.0025	0
fortinet	0	30	7	8	14	1	28	6	20.0	7.0	.0050	0
f5	7	24	6	14	3	1	4	1	4.2	8.7	.0047	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	+4 ▲
vmware	0	19	4	10	3	2	7	2	10.5	8.3	.0040	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	8	514	103	217	176	13	33	2	0.4	7.5	.0049	-49 ▼
mozilla	34	221	80	79	62	0	9	0	0.0	8.1	.0029	+33 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	0	76	3	17	47	9	4	2	2.6	5.3	.0029	0
github	3	20	1	10	9	0	0	0	0.0	7.3	.0044	+1 ▲
docker	0	9	0	6	3	0	0	0	0.0	7.2	.0016	0
wordpress	0	5	1	3	1	0	2	2	40.0	8.8	.3120	0
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2269	484	1170	519	96	28	4	0.2	7.8	.0034	0
ibm	70	689	150	301	228	9	6	1	0.1	7.5	.0029	+38 ▲
adobe	2	608	50	302	247	9	19	3	0.5	7.8	.0021	-5 ▼
progress	2	63	14	39	10	0	6	1	1.6	8.1	.0036	-8 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
zohocorp	1	11	3	6	2	0	0	0	0.0	8.8	.0144	+1 ▲
atlassian	0	6	1	5	0	0	13	0	0.0	8.1	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	3	48	15	16	9	8	3	8.5	.0160	+3 ▲
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+18 ▲
siemens	1	38	2	25	8	3	0	7.3	.0016	+1 ▲
synology	0	27	3	6	15	3	0	5.6	.0025	-1 ▼
schneider electric	4	13	1	8	4	0	0	8.2	.0032	+4 ▲
hitachi energy	4	7	0	3	4	0	0	6.9	.0017	+4 ▲
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	19	190	13	103	69	5	2	1	0.5	7.3	.0021	+13 ▲
sourcecodester	14	183	0	0	106	77	0	0	0.0	5.5	.0029	+10 ▲
spring	0	170	12	59	84	15	0	0	0.0	6.5	.0024	0
nvidia	30	164	20	115	29	0	0	0	0.0	7.8	.0028	+14 ▲
elastic	42	129	1	27	98	3	1	0	0.0	6.5	.0028	+42 ▲
itsourcecode	12	128	0	0	38	90	0	0	0.0	2.1	.0026	+6 ▲
splunk	0	128	6	47	70	5	1	1	0.8	6.5	.0025	0
siyuan-note	13	116	44	34	37	1	0	0	0.0	8.6	.0027	+5 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-72898	.9422	99.8	10.0
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-73570	.3238	98.2	8.9
CVE-2026-71362	.2514	97.8	9.1
CVE-2026-64849	.1641	96.8	9.3
CVE-2026-48376	.1548	96.6	5.4
CVE-2026-19681	.0780	94.3	9.4
CVE-2026-82329	.0767	94.2	9.8
CVE-2026-71386	.0694	93.7	8.8
CVE-2026-68820	.0618	93.0	7.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.9422	KEV
CVE-2026-48362	10.0	.0431
CVE-2026-19188	10.0	.0193
CVE-2026-86152	10.0	.0186
CVE-2026-58231	10.0	.0171
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-69836	10.0	.0155
CVE-2026-73299	10.0	.0121
CVE-2026-73678	10.0	.0114

Most disclosures (vendor)
Vendor	CVEs
linux	1789
oracle	890
microsoft	453
ibm	428
google	397
red hat	220
apache	116
splunk	110
adobe	95
mozilla	93

Most KEV additions (YTD)
Vendor	KEV
microsoft	28
cisco	13
apple	8
google	7
fortinet	6
ivanti	5
berriai	4
oracle	4
solarwinds	4
sonicwall	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	32
Packagist	32
npm	13
PyPI	11
Go	1
RubyGems	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-20349	Cisco	0
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0
CVE-2026-72898	Metabase	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-64849	mlflow	1
CVE-2026-81578	PaperCut	3
CVE-2026-82078	PaperCut	3

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1754
CVE-2021-27102	n/a	2021-11-17	1754
CVE-2021-27101	n/a	2021-11-17	1754
CVE-2021-27103	n/a	2021-11-17	1754
CVE-2021-21017	Adobe	2021-11-17	1754
CVE-2021-28550	Adobe	2021-11-17	1754
CVE-2021-42013	Apache Software Foundation	2021-11-17	1754
CVE-2021-41773	Apache Software Foundation	2021-11-17	1754
CVE-2021-30858	Apple	2021-11-17	1754
CVE-2021-30860	Apple	2021-11-17	1754

Transactions

EXPLOIT PUBLISHED — Unknown EmbedPress: 3 CVEs (CVE-2026-84926, CVE-2026-84927, CVE-2026-84936). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-15693 (Unknown JCH Optimize). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-15694 (Unknown Joli Table Of Contents). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-15247 (Unknown Search Atlas SEO). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19858 (Unknown JetFormBuilder — Dynamic Blocks Form Builder). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-19861 (Unknown JetFormBuilder — Dynamic Blocks Form Builder). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-77826 (Unknown RegistrationMagic). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-78149 (Unknown Smart Post). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-78150 (Unknown Smart Post). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-78362 (Unknown SEO Flow by LupsOnline). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-81348 (Unknown My Private Site). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-81404 (Unknown IPGP Visitors Origin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-81423 (Unknown Accept Stripe Payments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-81424 (Unknown Accept Stripe Payments). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82304 (Unknown Music Store). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82846 (Unknown Masteriyo LMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-83543 (Unknown Greenshift). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-83544 (Unknown Greenshift). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84021 (Unknown Bold Page Builder). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84022 (Unknown Bold Page Builder). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84221 (Unknown Kirki). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84225 (Unknown Kirki). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84745 (Unknown The Events Calendar). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84896 (Unknown King Addons for Elementor). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84898 (Unknown Eventin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84899 (Unknown VikWidgetsLoader). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84901 (Unknown Eventin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84930 (Unknown CatFolders Document Gallery & PDF Library). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84931 (Unknown Joli Table Of Contents). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84934 (Unknown JCH Optimize). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84935 (Unknown HT Menu). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-84937 (Unknown Video Player for YouTube). Public exploit reference added.

DUE DATE PASSED — CVE-2026-49869 (kestra-io kestra). CISA remediation deadline was September 5, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-82329 (jfrog artifactory). CISA remediation deadline was September 5, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-83548 (SonicWall SMA1000). CISA remediation deadline was September 5, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-83549 (SonicWall SMA1000). CISA remediation deadline was September 5, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-9586 (Sangoma Switchvox SMB Edition). CISA remediation deadline was September 5, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

92 CVEs published. 25 box scores, 67 table rows — nothing truncated.

CVE-2026-86152CRITICAL

Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0   .0186   77.8     —

AFFECTED
  Product  Versions       Fixed
  CP3      27.5.57.101 –  —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-86167HIGH

Tenda HG10 Boa formgponConf os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0163   74.6     —

AFFECTED
  Product  Versions     Fixed
  HG10     300001138 –  —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86165HIGH

Tenda HG10 formURL buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    8.9   .0064   48.5     —

AFFECTED
  Product  Versions     Fixed
  HG10     300001138 –  —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Received

CVE-2026-75816CRITICAL

shabti Frontend Admin by DynamiApps — Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0050   41.0     —

AFFECTED
  Product                       Versions     Fixed
  Frontend Admin by DynamiApps  unspecified  —

TIMELINE
  Aug 18  Reserved by CNA
  Sep 6   Published (CNA: Wordfence)

CWE-287 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-86166HIGH

Tenda HG10 Boa Web Server formWanRedirect buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    7.4   .0048   39.5     —

AFFECTED
  Product  Versions     Fixed
  HG10     300001138 –  —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-119, CWE-120 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86218CRITICAL

N-able N-central — pre-authentication remote code execution

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0   .0041   34.3     —

AFFECTED
  Product    Versions     Fixed
  N-central  unspecified  —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: N-able)

CWE-96 · CNA: N-able · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-86153CRITICAL

Tenda CP3 Redirect.cpp SetRedirectEnable privileges management

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    9.4   .0039   32.0     —

AFFECTED
  Product  Versions       Fixed
  CP3      27.5.57.101 –  —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-266, CWE-269 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-18056HIGH

HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  U  H  H  H    7.5   .0034   27.1     —

AFFECTED
  Product                   Versions     Fixed
  HivePress Authentication  unspecified  —

TIMELINE
  Jul 28  Reserved by CNA
  Sep 6   Published (CNA: Wordfence)

CWE-287 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-86168MEDIUM

code-projects Content Management System login.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0034   26.5     —

AFFECTED
  Product                    Versions  Fixed
  Content Management System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86180MEDIUM

code-projects Task Management System In PHP Login index.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0034   26.5     —

AFFECTED
  Product                        Versions  Fixed
  Task Management System In PHP  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86183MEDIUM

diem-project diem dmWidget BasedmWidgetActions.class.php authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0033   26.2     —

AFFECTED
  Product  Versions  Fixed
  diem     5.1.0 –   —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86179MEDIUM

code-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0032   24.3     —

AFFECTED
  Product                Versions  Fixed
  Daily Expense Manager  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-16310CRITICAL

LearnDash MemberDash — MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0030   22.5     —

AFFECTED
  Product     Versions     Fixed
  MemberDash  unspecified  —

TIMELINE
  Jul 20  Reserved by CNA
  Sep 6   Published (CNA: Wordfence)

CWE-639 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-86159MEDIUM

SourceCodester Online Voting System ajax.php save_user sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   18.0     —

AFFECTED
  Product               Versions  Fixed
  Online Voting System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86160MEDIUM

SourceCodester Online Voting System ajax.php delete_voting sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   18.0     —

AFFECTED
  Product               Versions  Fixed
  Online Voting System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86161MEDIUM

SourceCodester Online Voting System ajax.php delete_category sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   18.0     —

AFFECTED
  Product               Versions  Fixed
  Online Voting System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86162MEDIUM

SourceCodester Online Voting System ajax.php login sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0026   18.0     —

AFFECTED
  Product               Versions  Fixed
  Online Voting System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86181LOW

code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   P   N   L   N    2.0   .0021   10.9     —

AFFECTED
  Product                 Versions  Fixed
  Task Management System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Received

CVE-2026-86164LOW

itsourcecode Sales and Inventory System trans_view.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0020   10.4     —

AFFECTED
  Product                     Versions  Fixed
  Sales and Inventory System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86163LOW

itsourcecode Sales and Inventory System pro_del.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0020    9.9     —

AFFECTED
  Product                     Versions  Fixed
  Sales and Inventory System  1.0 –     —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86172LOW

DefaultFuction CRM delete.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0020    9.5     —

AFFECTED
  Product  Versions  Fixed
  CRM      1.0.0 –   —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-86170LOW

DefaultFuction CRM edit.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0019    9.0     —

AFFECTED
  Product  Versions  Fixed
  CRM      1.0.0 –   —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-86171LOW

DefaultFuction CRM delete.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    2.1   .0019    9.0     —

AFFECTED
  Product  Versions  Fixed
  CRM      1.0.0 –   —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-84219HIGH

Unknown Kirki — Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  U  H  H  H    7.5   .0017    6.8     —

AFFECTED
  Product  Versions  Fixed
  Kirki    6.2.1 –   —

TIMELINE
  Sep 1   Reserved by CNA
  Sep 6   Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-86182LOW

diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0016    5.3     —

AFFECTED
  Product  Versions  Fixed
  diem     5.1.0 –   —

TIMELINE
  Sep 5   Reserved by CNA
  Sep 6   Published (CNA: VulDB)

CWE-352, CWE-862 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-84028	6.8	4.7	Unknown	Bold Page Builder	CWE-79	Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' addi…
CVE-2026-75793	6.5	3.4	Unknown	SureCart	CWE-284	SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login
CVE-2026-85038	5.3	3.4	Unknown	B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More	CWE-862	B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass v…
CVE-2026-18480	8.8	3.1	Unknown	SureCart	CWE-269	SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
CVE-2026-13159	4.3	0.8	Unknown	Real Estate Papi	CWE-862	Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
CVE-2026-86259	9.0	—	THU-MAIC	OpenMAIC	CWE-306	OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
CVE-2026-19633	8.8	—	DALIBO	PostgreSQL Anonymizer	CWE-89	PostgreSQL Anonymizer: unprivileged masked users can execute code via operato…
CVE-2022-51009	8.7	—	pmmp	PocketMine-MP	CWE-248	PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
CVE-2026-86250	8.7	—	h3js	h3	CWE-400	h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
CVE-2026-82750	8.3	—	ZenHive	mpp	CWE-1284	Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship infl…
CVE-2026-82751	8.3	—	ZenHive	mpp	CWE-1284	Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas c…
CVE-2026-86251	8.2	—	h3js	h3	CWE-22	h3 before 1.15.9 Path Traversal via Double Decoding
CVE-2026-86253	8.2	—	h3js	h3	CWE-22	h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
CVE-2026-86258	8.2	—	jupyter	nbviewer	CWE-22	nbviewer through 1.0.1 Path Traversal via LocalFileHandler
CVE-2026-86242	8.1	—	maximhq	Bifrost	CWE-94	Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
CVE-2020-37277	7.1	—	pmmp	PocketMine-MP	CWE-400	PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction
CVE-2021-48007	7.1	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
CVE-2026-86255	7.1	—	wger-project	wger	CWE-400	wger before 2.5 Uncontrolled Resource Consumption via date_sequence
CVE-2026-86283	7.1	—	MISP	MISP	CWE-285	MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
CVE-2022-51008	6.9	—	pmmp	PocketMine-MP	CWE-770	PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions
CVE-2026-86252	6.9	—	h3js	h3	CWE-74	h3 before 1.15.9 SSE Event Injection via Carriage Return
CVE-2026-19859	6.5	—	Unknown	JetFormBuilder	CWE-74	JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via …
CVE-2026-19634	6.4	—	DALIBO	PostgreSQL Anonymizer	CWE-89	PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_ro…
CVE-2026-83534	6.4	—	DALIBO	PostgreSQL Anonymizer	CWE-250	PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_d…
CVE-2026-86254	6.1	—	wger-project	wger	CWE-862	wger Incomplete Authorization Fix Cross-Tenant Account Deletion
CVE-2026-86208	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System delete_teacher.php sql injec…
CVE-2026-86209	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System delete_user.php sql injection
CVE-2026-86210	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System delete_user_account.php sql …
CVE-2026-86211	5.5	—	rabindralamsal	inventory-management-system	CWE-74	rabindralamsal inventory-management-system Login index.php sql injection
CVE-2026-86213	5.5	—	Mstfakts	College-Management-System	CWE-74	Mstfakts College-Management-System Search university.php mysqli_query sql inj…
CVE-2026-86214	5.5	—	n/a	Mstfakts College-Management-System	CWE-287	Mstfakts College-Management-System login.php improper authentication
CVE-2026-86217	5.5	—	code-projects	Hotel and Tourism Reservation in PHP	CWE-200	code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%2…
CVE-2026-86220	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_…
CVE-2026-86221	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli…
CVE-2026-86222	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli…
CVE-2026-86223	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli…
CVE-2026-86224	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli…
CVE-2026-86225	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_qu…
CVE-2026-86205	5.3	—	h3js	h3	CWE-601	h3 before 2.0.1-rc.18 Open Redirect via redirectBack()
CVE-2026-86233	5.3	—	itsourcecode	Sales and Inventory System	CWE-89	itsourcecode Sales and Inventory System us_del.php sql injection
CVE-2026-86234	5.3	—	itsourcecode	Sales and Inventory System	CWE-89	itsourcecode Sales and Inventory System cust_transac.php add sql injection
CVE-2026-86235	5.3	—	itsourcecode	Sales and Inventory System	CWE-89	itsourcecode Sales and Inventory System pos_transac.php add sql injection
CVE-2026-86256	5.1	—	wger-project	wger	CWE-601	wger before 2.6 Open Redirect via trainer-login next parameter
CVE-2021-48006	4.8	—	pmmp	PocketMine-MP	CWE-178	PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity
CVE-2026-19862	4.8	—	Unknown	JetFormBuilder	CWE-93	JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Em…
CVE-2026-80437	4.8	—	Unknown	Ninja Forms	CWE-74	Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution …
CVE-2026-80439	4.8	—	Unknown	Redirection for Contact Form 7	CWE-74	Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Sho…
CVE-2026-86257	4.8	—	wger-project	wger	CWE-1236	wger before 2.6 CSV Formula Injection via member export
CVE-2026-86231	2.9	—	mwiede	jsch	CWE-298	mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate rev…
CVE-2026-86212	2.1	—	n/a	Open5GS	CWE-266	Open5GS AMF/MME improper authorization
CVE-2026-86215	2.1	—	Mstfakts	College-Management-System	CWE-613	Mstfakts College-Management-System Logout server.php session expiration
CVE-2026-86216	2.1	—	code-projects	Hotel and Tourism Reservation in PHP	CWE-79	code-projects Hotel and Tourism Reservation in PHP details.php cross site scr…
CVE-2026-86228	2.1	—	n/a	JeecgBoot	CWE-266	JeecgBoot AiragModelController.java exportXls access control
CVE-2026-86232	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System sup_del.php sql injection
CVE-2026-86226	2.0	—	Projectwolds	Online Attendance System	CWE-79	Projectwolds Online Attendance System profile.php cross site scripting
CVE-2026-86227	1.3	—	valkey-io	valkey	CWE-119	valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds
CVE-2026-13608	await	—	curl	curl	—	OpenLDAP SASL authentication bypass
CVE-2026-18924	await	—	curl	curl	—	HTTP/2 server push UAF
CVE-2026-19931	await	—	curl	curl	—	Negotiate ambient user conn reuse
CVE-2026-80229	await	—	curl	curl	—	OpenSSL provider use-after-free
CVE-2026-80230	await	—	curl	curl	—	OpenSSL pinning bypass
CVE-2026-80231	await	—	curl	curl	—	native CA store conn reuse
CVE-2026-80255	await	—	curl	curl	—	secure cookie attribute bypass with tab
CVE-2026-82208	await	—	curl	curl	—	wolfSSL CA-cache hit overrides callback
CVE-2026-82209	await	—	curl	curl	—	domain-scoped PSL domain cookie
CVE-2026-86219	await	—	—	Authen-SASL	CWE-294	Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replaye…
CVE-2026-86304	await	—	—	MojoX-Authentication	CWE-347	MojoX::Authentication versions before 0.006 for Perl allow SAML authenticatio…

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-06 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.