Security Box Score — September 7, 2026

252 CVEs published, led by Dell (36).

252 CVEs published September 7, 2026: 13 critical, 74 high, 119 medium, 42 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 4 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 227 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	2183	37055	—	—
KEV catalog size	1695

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2392 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	188	4270	420	2015	695	1	12	3	0.1	7.8	.0016	+144 ▲
google	38	2202	280	856	978	88	78	7	0.3	7.5	.0026	-5 ▼
microsoft	9	1908	148	1290	455	15	287	28	1.5	7.8	.0044	-24 ▼
red hat	43	669	42	279	313	35	2	0	0.0	6.7	.0028	+2 ▲
apple	0	316	59	85	165	7	88	8	2.5	6.5	.0029	-1 ▼
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0020	0
suse	9	37	5	21	10	1	0	0	0.0	7.5	.0036	+4 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	11	95	24	45	26	0	56	13	13.7	7.5	.0042	-19 ▼
ubiquiti	0	59	36	22	1	0	3	3	5.1	9.1	.0049	0
palo alto networks	0	37	1	3	21	12	13	2	5.4	4.7	.0020	0
netgear	0	32	0	0	27	5	0	0	0.0	4.3	.0025	0
fortinet	0	30	7	8	14	1	28	6	20.0	7.0	.0050	0
f5	7	24	6	14	3	1	4	1	4.2	8.7	.0047	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	+3 ▲
vmware	0	19	4	10	3	2	7	2	10.5	8.3	.0040	0

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	9	515	103	217	176	13	33	2	0.4	7.5	.0049	-51 ▼
mozilla	34	221	80	79	62	0	9	0	0.0	8.1	.0029	+33 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	0	76	3	17	47	9	4	2	2.6	5.3	.0029	0
github	3	20	1	10	9	0	0	0	0.0	7.3	.0044	+1 ▲
docker	0	9	0	6	3	0	0	0	0.0	7.2	.0016	0
wordpress	0	5	1	3	1	0	2	2	40.0	8.8	.3120	-1 ▼
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2269	484	1170	519	96	28	4	0.2	7.8	.0034	0
ibm	70	689	150	301	228	9	6	1	0.1	7.5	.0029	+38 ▲
adobe	3	609	51	302	247	9	19	3	0.5	7.8	.0021	-5 ▼
progress	2	63	14	39	10	0	6	1	1.6	8.1	.0035	-9 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
zohocorp	5	15	3	6	6	0	0	0	0.0	8.4	.0144	+5 ▲
atlassian	0	6	1	5	0	0	13	0	0.0	8.1	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	6	51	16	17	10	8	3	8.5	.0160	+6 ▲
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+18 ▲
siemens	1	38	2	25	8	3	0	7.3	.0016	+1 ▲
synology	0	27	3	6	15	3	0	5.6	.0025	-1 ▼
schneider electric	4	13	1	8	4	0	0	8.2	.0032	+4 ▲
hitachi energy	4	7	0	3	4	0	0	6.9	.0017	+4 ▲
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	55	226	15	119	87	5	2	1	0.4	7.2	.0021	+47 ▲
sourcecodester	26	195	0	0	114	81	0	0	0.0	5.5	.0028	+15 ▲
spring	0	170	12	59	84	15	0	0	0.0	6.5	.0024	0
nvidia	30	164	20	115	29	0	0	0	0.0	7.8	.0028	+14 ▲
itsourcecode	22	138	0	0	36	102	0	0	0.0	2.1	.0026	+16 ▲
elastic	42	129	1	27	98	3	1	0	0.0	6.5	.0028	+42 ▲
splunk	0	128	6	47	70	5	1	1	0.8	6.5	.0025	0
siyuan-note	13	116	44	34	37	1	0	0	0.0	8.6	.0027	+5 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-72898	.9422	99.8	10.0
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-73570	.3238	98.2	8.9
CVE-2026-71362	.2514	97.8	9.1
CVE-2026-64849	.1641	96.8	9.3
CVE-2026-48376	.1548	96.6	5.4
CVE-2026-19681	.0780	94.3	9.4
CVE-2026-82329	.0767	94.2	9.8
CVE-2026-71386	.0694	93.7	8.8
CVE-2026-68820	.0618	93.0	7.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.9422	KEV
CVE-2026-48362	10.0	.0431
CVE-2026-19188	10.0	.0193
CVE-2026-86152	10.0	.0186
CVE-2026-58231	10.0	.0171
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-69836	10.0	.0155
CVE-2026-73299	10.0	.0121
CVE-2026-73678	10.0	.0114

Most disclosures (vendor)
Vendor	CVEs
linux	1787
oracle	890
microsoft	453
ibm	428
google	397
red hat	229
dell	119
apache	117
splunk	110
adobe	96

Most KEV additions (YTD)
Vendor	KEV
microsoft	28
cisco	13
apple	8
google	7
fortinet	6
ivanti	5
berriai	4
oracle	4
solarwinds	4
sonicwall	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	33
Packagist	32
npm	13
PyPI	11
Go	1
RubyGems	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-20349	Cisco	0
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0
CVE-2026-72898	Metabase	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-64849	mlflow	1
CVE-2026-81578	PaperCut	3
CVE-2026-82078	PaperCut	3

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1755
CVE-2021-27102	n/a	2021-11-17	1755
CVE-2021-27101	n/a	2021-11-17	1755
CVE-2021-27103	n/a	2021-11-17	1755
CVE-2021-21017	Adobe	2021-11-17	1755
CVE-2021-28550	Adobe	2021-11-17	1755
CVE-2021-42013	Apache Software Foundation	2021-11-17	1755
CVE-2021-41773	Apache Software Foundation	2021-11-17	1755
CVE-2021-30858	Apple	2021-11-17	1755
CVE-2021-30860	Apple	2021-11-17	1755

Transactions

EXPLOIT PUBLISHED — axios: 16 CVEs (CVE-2025-62718, CVE-2026-25639, CVE-2026-40175, CVE-2026-42033, CVE-2026-42039, CVE-2026-42041, CVE-2026-42043, CVE-2026-42044, CVE-2026-42264, CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44492, CVE-2026-44494, CVE-2026-44495, CVE-2026-44496). Public exploit references added.

EXPLOIT PUBLISHED — patriksimek vm2: 7 CVEs (CVE-2026-43997, CVE-2026-43998, CVE-2026-43999, CVE-2026-44005, CVE-2026-44007, CVE-2026-44009, CVE-2026-45411). Public exploit references added.

EXPLOIT PUBLISHED — netty: 5 CVEs (CVE-2026-42578, CVE-2026-42579, CVE-2026-42581, CVE-2026-42584, CVE-2026-42587). Public exploit references added.

EXPLOIT PUBLISHED — Mikrotik RouterOS: 3 CVEs (CVE-2026-67276, CVE-2026-67278, CVE-2026-67281). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-69534. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-2332 (Eclipse Foundation Eclipse Jetty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-23745 (isaacs node-tar). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-24049 (pypa wheel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-24842 (isaacs node-tar). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-25896 (NaturalIntelligence fast-xml-parser). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-26278 (NaturalIntelligence fast-xml-parser). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-29063 (immutable-js). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-30922 (pyasn1). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-32286 (github.com/jackc/pgproto3/v2). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-33487 (russellhaering goxmldsig). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-41242 (protobufjs protobuf.js). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42338 (beaugunderson ip-address). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42880 (argoproj argo-cd). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-42945 (F5 NGINX Plus). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-45736 (websockets ws). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-46625 (js-cookie). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-48779 (websockets ws). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.

RESCORED — itsourcecode Sales and Inventory System: 3 CVEs (CVE-2026-86233, CVE-2026-86234, CVE-2026-86235). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2026-2670 (Advantech WISE-6610-NB). CVSS 8.6 → 7.3 (NVD).

PATCH SHIPPED — CVE-2026-16118 (xdgmime). Fixed in Red Hat Enterprise Linux 10 0:2.80.4-12.el10_2.22.

PATCH SHIPPED — CVE-2026-63622 (Red Hat Enterprise Linux 10.0 Extended Update Support). Fixed in Red Hat Enterprise Linux 10.0 Extended Update Support 0:10.10.0-8.11.el10_0.

PATCH SHIPPED — CVE-2026-78701 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:3.2.0-10.el10_2.

ENRICHED — Linux: 5 CVEs (CVE-2025-21817, CVE-2025-22127, CVE-2025-38205, CVE-2025-38621, CVE-2026-43344). Received CVSS/CPE analysis.

Yesterday's Results

How to read these box scores · glossary

252 CVEs published. 25 box scores, 227 table rows — nothing truncated.

CVE-2026-79697HIGH

Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0335   87.9     —

AFFECTED
  Product          Versions          Fixed
  WISE-6610-NB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-TB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-JB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-CB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-NB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-EB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-TB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-JB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-CB  1.2.1_20251110 –  1.2.4_20260821
  + 3 more

TIMELINE
  Aug 25  Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Received

CVE-2026-79698HIGH

Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0170   75.7     —

AFFECTED
  Product          Versions          Fixed
  WISE-6610-NB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-TB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-JB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-CB     1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-NB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-EB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-TB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-JB  1.2.1_20251110 –  1.2.4_20260821
  WISE-6610-EL-CB  1.2.1_20251110 –  1.2.4_20260821
  + 3 more

TIMELINE
  Aug 25  Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-74, CWE-77 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Received

CVE-2026-84732HIGH

OpenVPN OpenVPN — Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0054   43.7     —

AFFECTED
  Product  Versions     Fixed
  OpenVPN  unspecified  —

TIMELINE
  Sep 2   Reserved by CNA
  Sep 7   Published (CNA: OpenVPN)

CWE-190 · CNA: OpenVPN · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-86237MEDIUM

openagents-org openagents http.py test_default_model server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0051   41.9     —

AFFECTED
  Product     Versions  Fixed
  openagents  0.8.0 –   —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Received

CVE-2026-86239MEDIUM

liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0051   41.6     —

AFFECTED
  Product   Versions  Fixed
  FeehiCMS  2.1.0 –   —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-284, CWE-434 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86241LOW

liufee FeehiCMS Cookie Validation main-local.php hard-coded key

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   N   N    2.1   .0046   38.4     —

AFFECTED
  Product   Versions  Fixed
  FeehiCMS  2.1.0 –   —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-320, CWE-321 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86260MEDIUM

sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   L    5.5   .0043   36.0     —

AFFECTED
  Product     Versions                                    Fixed
  hosp_order  627f426331da8086ce8fff2017d65b1ddef384f8 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-620, CWE-640 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86274MEDIUM

projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0043   36.0     —

AFFECTED
  Product  Versions    Fixed
  siga     11.0.2.0 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-862, CWE-863 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86238LOW

projectworlds Online Examination System Feedback Form feedback.php cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0042   35.4     —

AFFECTED
  Product                    Versions  Fixed
  Online Examination System  1.0 –     —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-86261MEDIUM

sfturing hosp_order Order Controller OrderController.java authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.0     —

AFFECTED
  Product     Versions                                    Fixed
  hosp_order  627f426331da8086ce8fff2017d65b1ddef384f8 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86262MEDIUM

sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.0     —

AFFECTED
  Product     Versions                                    Fixed
  hosp_order  627f426331da8086ce8fff2017d65b1ddef384f8 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86263MEDIUM

sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0041   34.0     —

AFFECTED
  Product     Versions                                    Fixed
  hosp_order  627f426331da8086ce8fff2017d65b1ddef384f8 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86289LOW

n/a Ollama — Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   N   L    2.1   .0040   33.2     —

AFFECTED
  Product  Versions  Fixed
  Ollama   0.31.0 –  0.31.2-rc1

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-189, CWE-190 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Received

CVE-2026-84256HIGH

OpenVPN OpenVPN — An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   L   N   H   H   H    7.7   .0038   31.5     —

AFFECTED
  Product  Versions    Fixed
  OpenVPN  2.1_rc10 –  —

TIMELINE
  Sep 1   Reserved by CNA
  Sep 7   Published (CNA: OpenVPN)

CWE-78, CWE-88 · CNA: OpenVPN · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-86272MEDIUM

Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0038   31.4     —

AFFECTED
  Product                    Versions             Fixed
  U+Smart Enjoyment WebSite  18.6001.1096.1000 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-284, CWE-434 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-86240LOW

liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    2.0   .0038   31.1     —

AFFECTED
  Product   Versions  Fixed
  FeehiCMS  2.1.0 –   —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-84186MEDIUM

PrestaShop PrestaShop — Incorrect access control in PrestaShop

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    6.9   .0035   27.9     —

AFFECTED
  Product     Versions     Fixed
  PrestaShop  unspecified  —

TIMELINE
  Sep 1   Reserved by CNA
  Sep 7   Published (CNA: INCIBE)

CWE-290 · CNA: INCIBE · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-16876CRITICAL

NEC Corporation UNIVERGE IX-R/IX-V — An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypa…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   L    9.3   .0033   25.9     —

AFFECTED
  Product             Versions                                                                                                Fixed
  UNIVERGE IX-R/IX-V  All versions from Ver1.1 through Ver1.3, All versions from Ver1.4.21 through Ver1.4.28 and Ver1.5.23 –  —

TIMELINE
  Jul 24  Reserved by CNA
  Sep 7   Published (CNA: NEC)

CWE-306 · CNA: NEC · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-81738LOW

OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   P   N   P   N   L   L    2.3   .0033   25.8     —

AFFECTED
  Product  Versions  Fixed
  OpenVPN  2.5.0 –   —

TIMELINE
  Aug 27  Reserved by CNA
  Sep 7   Published (CNA: OpenVPN)

CWE-121, CWE-193, CWE-787 · CNA: OpenVPN · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-86284MEDIUM

jaychouchannel Tourism-Management-System CommonController.java getOption information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0032   24.8     —

AFFECTED
  Product                    Versions                                    Fixed
  Tourism-Management-System  8122bf020d91199eddfff3ee02d1632a70a9a132 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Received

CVE-2026-86277MEDIUM

SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0030   22.6     —

AFFECTED
  Product                                                    Versions  Fixed
  Syllabus-Aligned Learning Management & Examination System  1.0 –     —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-285, CWE-639 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86288LOW

ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   L   L   L    2.1   .0029   21.5     —

AFFECTED
  Product    Versions  Fixed
  GPTQModel  7.0 –     7.3.0

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-119, CWE-125 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Received

CVE-2026-86273MEDIUM

projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0029   21.1     —

AFFECTED
  Product  Versions  Fixed
  siga     11.1.0 –  —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86276MEDIUM

SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentials

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0029   21.1     —

AFFECTED
  Product                                                    Versions  Fixed
  Syllabus-Aligned Learning Management & Examination System  1.0 –     —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-259, CWE-798 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-86275MEDIUM

SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   L   N    5.5   .0029   20.8     —

AFFECTED
  Product                                                    Versions  Fixed
  Syllabus-Aligned Learning Management & Examination System  1.0 –     —

TIMELINE
  Sep 6   Reserved by CNA
  Sep 7   Published (CNA: VulDB)

CWE-266, CWE-269 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-86244	2.1	19.4	n/a	FastAdmin	CWE-79	FastAdmin User Controller User.php login cross site scripting
CVE-2026-86278	2.1	19.4	SourceCodester	Syllabus-Aligned Learning Management & Examination System	CWE-79	SourceCodester Syllabus-Aligned Learning Management & Examination System mana…
CVE-2026-86282	5.5	19.3	jaychouchannel	Tourism-Management-System	CWE-74	jaychouchannel Tourism-Management-System CommonDao CommonController.java sql …
CVE-2026-86268	5.5	18.8	itsourcecode	School Management System	CWE-74	itsourcecode School Management System User_Login.php sql injection
CVE-2026-86290	5.5	18.8	SourceCodester	Online Voting System	CWE-74	SourceCodester Online Voting System ajax.php save_category sql injection
CVE-2026-86342	5.3	18.8	MISP	MISP	CWE-862	MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event an…
CVE-2026-86264	2.1	18.0	sfturing	ssm_pro	CWE-79	sfturing ssm_pro Order Endpoint OrderController.java cross site scripting
CVE-2026-86271	2.0	13.9	n/a	FluentCMS	CWE-862	FluentCMS PermissionManager.cs GetAccessible authorization
CVE-2026-86279	2.1	13.3	SourceCodester	Syllabus-Aligned Learning Management & Examination System	CWE-384	SourceCodester Syllabus-Aligned Learning Management & Examination System Logi…
CVE-2026-86285	2.1	12.7	n/a	BookStack	CWE-266	BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm acc…
CVE-2026-86280	5.5	11.9	SourceCodester	Syllabus-Aligned Learning Management & Examination System	CWE-310	SourceCodester Syllabus-Aligned Learning Management & Examination System cict…
CVE-2026-86332	6.5	11.5	Red Hat	Red Hat OpenShift AI (RHOAI)	CWE-862	Odh-dashboard: odh-dashboard: nim credential secret readable by any authentic…
CVE-2026-86269	2.1	10.4	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System emp_edit1.php sql injection
CVE-2026-20503	5.3	10.2	MediaTek, Inc.	MediaTek chipset	CWE-617	In Modem, there is a possible system crash due to a missing bounds check. Thi…
CVE-2026-20504	5.3	10.2	MediaTek, Inc.	MediaTek chipset	CWE-617	In Modem, there is a possible system crash due to a missing bounds check. Thi…
CVE-2026-20513	4.4	9.8	MediaTek, Inc.	MediaTek chipset	CWE-35	In Audio HAL, there is a possible information disclosure due to improper inpu…
CVE-2026-86236	2.1	9.9	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System pro_transac.php add sql injection
CVE-2026-86245	2.1	9.9	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System sup_transac.php sql injection
CVE-2026-86265	2.1	9.9	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System us_transac.php sql injection
CVE-2026-86267	2.1	9.9	itsourcecode	Information System Society Membership System	CWE-74	itsourcecode Information System Society Membership System check_student.php s…
CVE-2026-86270	2.1	9.9	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System settings_edit.php sql injection
CVE-2026-78254	await	8.7	Apache Software Foundation	Apache Ant	CWE-23	Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
CVE-2026-78043	5.6	6.7	OpenVPN	OpenVPN	CWE-22	The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows lo…
CVE-2026-86281	2.1	5.3	SourceCodester	Syllabus-Aligned Learning Management & Examination System	CWE-352	SourceCodester Syllabus-Aligned Learning Management & Examination System cros…
CVE-2026-14297	8.7	5.0	Nordic Semiconductor ASA	nRF Connect SDK	CWE-787	The Continuous Glucose Monitoring Service's Record Access Control Point (RACP…
CVE-2026-20501	8.4	4.5	MediaTek, Inc.	MediaTek chipset	CWE-122	In vdec, there is a possible out of bounds write due to a heap buffer overflo…
CVE-2026-20502	8.4	4.3	MediaTek, Inc.	MediaTek chipset	CWE-122	In vdec, there is a possible out of bounds write due to a missing bounds chec…
CVE-2026-20515	5.5	4.3	MediaTek, Inc.	MediaTek chipset	CWE-416	In gpu, there is a possible system crash due to use after free. This could le…
CVE-2026-84226	8.5	3.8	OpenVPN	OpenVPN	CWE-426	OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows …
CVE-2026-20500	5.5	3.7	MediaTek, Inc.	MediaTek chipset	CWE-295	In Modem, there is a possible system crash due to improper input validation. …
CVE-2026-20516	5.5	3.7	MediaTek, Inc.	MediaTek chipset	CWE-926	In MiracastService, there is a possible escalation of privilege due to a conf…
CVE-2026-20509	6.7	3.6	MediaTek, Inc.	MediaTek chipset	CWE-121	In Power HAL, there is a possible out of bounds write due to a missing bounds…
CVE-2026-20510	6.7	3.6	MediaTek, Inc.	MediaTek chipset	CWE-415	In camera middleware, there is a possible escalation of privilege due to doub…
CVE-2026-20518	4.4	3.6	MediaTek, Inc.	MediaTek chipset	CWE-125	In geniezone, there is a possible information disclosure due to a missing bou…
CVE-2026-20506	6.7	3.1	MediaTek, Inc.	MediaTek chipset	CWE-416	In Audio HAL, there is a possible escalation of privilege due to use after fr…
CVE-2026-20507	6.7	3.1	MediaTek, Inc.	MediaTek chipset	CWE-416	In Audio HAL, there is a possible escalation of privilege due to use after fr…
CVE-2026-20508	6.7	3.1	MediaTek, Inc.	MediaTek chipset	CWE-843	In Power HAL, there is a possible escalation of privilege due to type confusi…
CVE-2026-20511	6.7	3.2	MediaTek, Inc.	MediaTek chipset	CWE-416	In SurfaceFlinger, there is a possible memory corruption due to use after fre…
CVE-2026-20517	6.7	3.1	MediaTek, Inc.	MediaTek chipset	CWE-416	In geniezone, there is a possible escalation of privilege due to use after fr…
CVE-2026-20514	4.4	2.6	MediaTek, Inc.	MediaTek chipset	CWE-307	In Audio HAL, there is a possible information disclosure due to a missing per…
CVE-2026-20512	await	2.6	MediaTek, Inc.	MediaTek chipset	CWE-307	In Audio HAL, there is a possible escalation of privilege due to improper inp…
CVE-2026-86314	6.2	2.5	Samsung Opensource	Walrus	CWE-190	Integer overflow in the source-bounds check in Memory::init() (src/runtime/Me…
CVE-2026-86315	6.2	2.4	Samsung Opensource	Escargot	CWE-197	An out-of-bounds write caused by numeric truncation Samsung Open Source Escar…
CVE-2026-86313	7.8	1.8	Samsung Opensource	Walrus	CWE-787	Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflo…
CVE-2026-78221	5.9	1.8	OpenVPN	OpenVPN	CWE-131	An incorrect buffer size calculation in the Windows Interactive Service in Op…
CVE-2026-14296	7.5	1.4	Nordic Semiconductor ASA	nRF54H20	CWE-347	nRF54H20: MCUBoot can be tricked to executing unauthenticated code
CVE-2026-81830	5.6	1.2	OpenVPN	OpenVPN	CWE-73	The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local …
CVE-2026-82312	1.8	1.0	OpenVPN	OpenVPN	CWE-412	OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows l…
CVE-2026-18796	6.8	0.1	Nordic Semiconductor ASA	nRF5340	CWE-1342	QSPI flash encryption side-channel leakage
CVE-2026-75650	10.0	—	Adobe	Adobe Commerce	CWE-1336	Adobe Commerce \| Improper Neutralization of Special Elements Used in a Templa…
CVE-2026-7861	9.8	—	Next4Biz Information Technologies Inc.	CSM (Customer Service Management)	CWE-502	Code Injection in Next4Biz's CSM (Customer Service Management)
CVE-2026-18922	9.8	—	Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	CWE-287	389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalati…
CVE-2026-76578	9.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-306	Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator c…
CVE-2026-86478	9.8	—	JetBrains	YouTrack	CWE-290	In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authenticat…
CVE-2026-86480	9.8	—	JetBrains	Hub	CWE-306	In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could regist…
CVE-2026-6223	9.4	—	Bahçelievler Muncipality	BiHayat App	CWE-307	OTP Bypass in Bahçelievler Muncipality's BiHayat App
CVE-2026-61410	9.4	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-862	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80238	9.3	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-250	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86296	9.3	—	D-Link	DIR-822A	CWE-119	D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
CVE-2026-86543	9.3	—	knowns-dev	knowns	CWE-306	knowns before 0.30.0 Unauthenticated Management API Exposure
CVE-2026-86426	9.2	—	librenms	librenms	CWE-287	LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion
CVE-2026-86404	8.8	—	Red Hat	Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7	CWE-502	Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildf…
CVE-2026-86482	8.8	—	JetBrains	YouTrack	CWE-266	In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes …
CVE-2026-86542	8.8	—	knowns-dev	knowns	CWE-22	knowns before 0.30.0 Path Traversal via Import Name
CVE-2022-51017	8.7	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data
CVE-2026-19204	8.7	—	Eclipse Foundation	Eclipse Jetty	CWE-770	A client may send a WebSocket frame with an unknown opcode and a very large d…
CVE-2026-86427	8.7	—	librenms	librenms	CWE-77	LibreNMS before 26.8.0 Argument Injection via graph_title
CVE-2026-86428	8.7	—	thephpleague	commonmark	CWE-407	commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes
CVE-2026-86429	8.7	—	thephpleague	commonmark	CWE-407	commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
CVE-2026-86430	8.7	—	thephpleague	commonmark	CWE-407	league/commonmark before 2.9.1 Denial of Service via parsing
CVE-2026-86433	8.7	—	thephpleague	commonmark	CWE-407	commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes
CVE-2026-86434	8.7	—	thephpleague	commonmark	CWE-407	commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision
CVE-2026-86435	8.7	—	thephpleague	commonmark	CWE-407	commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote
CVE-2026-86439	8.7	—	knowns-dev	knowns	CWE-22	knowns before 0.30.0 Path Traversal via MCP doc and memory tools
CVE-2026-86452	8.7	—	MISP	MISP	CWE-400	MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and R…
CVE-2026-86538	8.7	—	knowns-dev	knowns	CWE-22	knowns before 0.30.0 Path Traversal via templateFile parameter
CVE-2026-86299	8.6	—	Linksys	RE7000	CWE-77	Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
CVE-2026-86437	8.6	—	laradashboard	laradashboard	CWE-863	Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive U…
CVE-2026-86438	8.6	—	laradashboard	laradashboard	CWE-862	Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Insta…
CVE-2026-86492	8.5	—	JetBrains	YouTrack	CWE-488	In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-…
CVE-2026-86540	8.5	—	knowns-dev	knowns	CWE-78	knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
CVE-2026-19843	8.4	—	Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	CWE-78	389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit …
CVE-2026-86502	8.4	—	JetBrains	IntelliJ IDEA	CWE-306	In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on …
CVE-2026-84173	8.3	—	Eclipse Foundation	Eclipse Ankaios	CWE-863	In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Int…
CVE-2026-79645	8.2	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-306	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-82586	8.2	—	ash-project	ash_lua	CWE-424	AshLua read operation aggregate bypasses the exposed-field allow-list, exposi…
CVE-2026-82753	8.2	—	ash-project	ash_authentication_oauth2_server	CWE-770	Unauthenticated authorize requests create unbounded, never-expiring CIMD clie…
CVE-2026-86297	8.2	—	D-Link	DIR-605	CWE-189	D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one
CVE-2026-79678	8.1	—	Red Hat	Red Hat Enterprise Linux 10	CWE-95	Freeipa: idm: freeipa: idp-add eval() reachable before authorization check al…
CVE-2026-80132	8.1	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-306	ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicati…
CVE-2026-86479	8.1	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missin…
CVE-2026-80166	7.8	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-269	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86504	7.8	—	JetBrains	IntelliJ IDEA	CWE-829	In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation…
CVE-2026-80134	7.7	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-798	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86494	7.7	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauth…
CVE-2026-86498	7.7	—	JetBrains	YouTrack	CWE-863	In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link…
CVE-2026-79639	7.6	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-6377	7.5	—	Next4Biz Information Technologies Inc.	CSM (Customer Service Management)	CWE-22	Path Traversal in Next4Biz's CSM (Customer Service Management)
CVE-2026-14444	7.5	—	Very Good Plugins	WP Fusion (Pro)	CWE-269	WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation…
CVE-2026-18355	7.5	—	Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	CWE-191	389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length…
CVE-2026-18453	7.5	—	Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	CWE-476	389-ds-base: 389-ds-base: pre-authentication null pointer dereference via pag…
CVE-2026-76560	7.5	—	Red Hat	Red Hat Directory Server 11.7 E4S for RHEL 8	CWE-863	389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule ch…
CVE-2026-78480	7.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-306	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80135	7.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-703	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-79644	7.4	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80131	7.4	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-22	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80133	7.4	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-23	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80164	7.4	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-61409	7.3	—	Dell	Secure Connect Gateway (SCG) 5.0 Application	CWE-78	Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.…
CVE-2026-79643	7.3	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-480	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-79691	7.3	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-6431	7.2	—	cozmoslabs	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor	CWE-79	User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting …
CVE-2026-80127	7.2	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-78	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86541	7.2	—	knowns-dev	knowns	CWE-22	knowns before 0.30.0 Path Traversal via code.replace MCP action
CVE-2026-86544	7.2	—	knowns-dev	knowns	CWE-863	knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions
CVE-2022-51010	7.1	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 4.4.2 Server Crash via Item ID
CVE-2022-51012	7.1	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization
CVE-2022-51013	7.1	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata
CVE-2022-51014	7.1	—	pmmp	PocketMine-MP	CWE-248	PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
CVE-2022-51015	7.1	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket
CVE-2022-51018	7.1	—	pmmp	PocketMine-MP	CWE-400	PocketMine-MP before 3.26.5 Input Validation via Book Pages
CVE-2026-80130	7.1	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-23	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86347	7.1	—	MISP	MISP	CWE-400	MISP Missing Authorization on Template File Upload Allows Authenticated Disk …
CVE-2026-86408	7.1	—	MISP	MISP	CWE-639	MISP Missing Authorization in Cryptographic Key View Exposes Signing Keys fro…
CVE-2026-86419	7.0	—	MISP	MISP	CWE-200	MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosu…
CVE-2026-78325	6.9	—	Standard Notes	Standard Notes	CWE-79	XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML …
CVE-2026-86303	6.9	—	92181	markdown	CWE-119	92181 markdown md.c lds out-of-bounds
CVE-2026-86317	6.9	—	ggml-org	llama.cpp	CWE-617	ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
CVE-2026-86431	6.9	—	thephpleague	commonmark	CWE-79	commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
CVE-2026-86432	6.9	—	thephpleague	commonmark	CWE-405	commonmark 2.0.0 before 2.8.4 Denial of Service via XML
CVE-2026-86539	6.9	—	knowns-dev	knowns	CWE-918	knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
CVE-2026-82325	6.8	—	OpenVPN	ovpn-dco-win	CWE-415	A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5…
CVE-2026-85201	6.8	—	Eclipse Foundation	Eclipse Ankaios	CWE-789	In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the…
CVE-2026-86497	6.8	—	JetBrains	YouTrack	CWE-201	In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-…
CVE-2026-12757	6.5	—	icegram	Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress	CWE-94	Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortco…
CVE-2026-78488	6.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-78	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80126	6.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-667	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80129	6.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-22	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80170	6.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-798	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86488	6.5	—	JetBrains	YouTrack	CWE-639	In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueLi…
CVE-2026-86489	6.5	—	JetBrains	YouTrack	CWE-639	In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API dis…
CVE-2026-86490	6.5	—	JetBrains	YouTrack	CWE-863	In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed …
CVE-2026-86493	6.5	—	JetBrains	YouTrack	CWE-863	In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed …
CVE-2026-86495	6.5	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed c…
CVE-2026-2390	6.4	—	codesupplyco	Powerkit – Supercharge your WordPress Site	CWE-79	Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting …
CVE-2026-80128	6.4	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-287	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-77697	6.3	—	Zohocorp	ManageEngine Endpoint Central	CWE-269	Privilege Escalation
CVE-2026-82754	6.3	—	ash-project	ash_authentication_oauth2_server	CWE-424	ash_authentication_oauth2_server aliases every protocol endpoint under /.well…
CVE-2026-82755	6.3	—	ash-project	ash_authentication_oauth2_server	CWE-524	ash_authentication_oauth2_server serves tenant-specific OAuth metadata as pub…
CVE-2026-82756	6.3	—	ash-project	ash_authentication_oauth2_server	CWE-116	ash_authentication_oauth2_server interpolates a tenant-derived value into the…
CVE-2026-82757	6.3	—	ash-project	ash_authentication_oauth2_server	CWE-918	ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and sit…
CVE-2026-82758	6.3	—	ash-project	ash_authentication_oauth2_server	CWE-287	ash_authentication_oauth2_server treats an empty resolved secret as valid, op…
CVE-2026-85640	6.3	—	Zohocorp	ManageEngine Endpoint Central	CWE-269	Privilege Escalation
CVE-2026-86420	6.3	—	ImageMagick	ImageMagick	CWE-400	ImageMagick before 7.1.2-30 Denial of Service Memory Budget
CVE-2026-86421	6.3	—	ImageMagick	ImageMagick	CWE-400	ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
CVE-2026-79734	5.9	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80125	5.9	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86506	5.9	—	JetBrains	GoLand	CWE-306	In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand pr…
CVE-2026-77698	5.7	—	Zohocorp	ManageEngine Endpoint Central	CWE-269	Privilege Escalation
CVE-2026-79642	5.6	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-78487	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-321	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-79975	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-295	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80054	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-732	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80056	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-532	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80057	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-321	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80058	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-312	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80167	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-321	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-80178	5.5	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-269	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86292	5.5	—	SourceCodester	Simple Traffic Offense System	CWE-287	SourceCodester Simple Traffic Offense System User Creation saveuser.php missi…
CVE-2026-86293	5.5	—	SourceCodester	Simple Traffic Offense System	CWE-287	SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.ph…
CVE-2026-86295	5.5	—	D-Link	DIR-895L	CWE-74	D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection
CVE-2026-86298	5.5	—	SourceCodester	Class and Exam Timetabling System	CWE-74	SourceCodester Class and Exam Timetabling System delete_subject.php sql injec…
CVE-2026-86300	5.5	—	Tenda	AC9	CWE-287	Tenda AC9 Web Management R7WebsSecurityHandler improper authentication
CVE-2026-86302	5.5	—	code-projects	Hospital Information System	CWE-200	code-projects Hospital Information System SQL Database Backup File his.sql in…
CVE-2026-86305	5.5	—	light0011	cms	CWE-284	light0011 cms Upload.class.php upload unrestricted upload
CVE-2026-86306	5.5	—	light0011	cms	CWE-287	light0011 cms Cookie Helper UserModel.class.php improper authentication
CVE-2026-86308	5.5	—	light0011	cms	CWE-200	light0011 cms Debug Mode config.php information disclosure
CVE-2026-86318	5.5	—	java-json-tools	json-patch	CWE-119	java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fro…
CVE-2026-86319	5.5	—	java-json-tools	json-patch	CWE-400	java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply res…
CVE-2026-86321	5.5	—	java-json-tools	jackson-coreutils	CWE-918	java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.f…
CVE-2026-86500	5.5	—	JetBrains	YouTrack	CWE-266	In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a us…
CVE-2026-12853	5.4	—	rocklobsterinc	Flamingo	CWE-862	Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Una…
CVE-2026-86483	5.4	—	JetBrains	YouTrack	CWE-79	In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Ag…
CVE-2022-51011	5.3	—	pmmp	PocketMine-MP	CWE-20	PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
CVE-2022-51016	5.3	—	pmmp	PocketMine-MP	CWE-294	PocketMine-MP before 4.0.0 Authentication Bypass via Login Replay
CVE-2026-4945	5.3	—	themeisle	Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE	CWE-639	Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Ver…
CVE-2026-8279	5.3	—	masteriyo	Masteriyo LMS – LMS Course Builder, Quizzes & Certificates	CWE-862	Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary C…
CVE-2026-86416	5.3	—	ILIAS-eLearning e.V.	ILIAS	CWE-862	ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Acti…
CVE-2026-86417	5.3	—	MISP	MISP	CWE-200	MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Un…
CVE-2026-86436	5.3	—	laradashboard	laradashboard	CWE-862	Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Uploa…
CVE-2026-86451	5.3	—	MISP	MISP	CWE-639	MISP Event Graph Object Reference Lookup Exposes References from Unauthorized…
CVE-2026-86469	5.3	—	Red Hat	Red Hat Enterprise Linux 10	CWE-59	Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path
CVE-2026-86351	5.1	—	MISP	MISP	CWE-20	MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol…
CVE-2026-86440	5.1	—	MISP	MISP	CWE-20	MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Bac…
CVE-2026-77699	5.0	—	Zohocorp	ManageEngine Endpoint Central	CWE-269	Privilege Escalation
CVE-2026-79943	4.8	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-297	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86423	4.8	—	ImageMagick	ImageMagick	CWE-416	ImageMagick before 7.1.2-30 Heap-use-after-free via GetList
CVE-2026-86425	4.8	—	ImageMagick	ImageMagick	CWE-416	ImageMagick before 7.1.2-30 Heap-use-after-free via Layer
CVE-2026-80176	4.7	—	Dell	Secure Connect Gateway 5.0 - Application	CWE-257	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat…
CVE-2026-86484	4.6	—	JetBrains	YouTrack	CWE-79	In JetBrains YouTrack before 2026.2.18634 angularJS template injection in ass…
CVE-2026-86481	4.3	—	JetBrains	YouTrack	CWE-639	In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure…
CVE-2026-86496	4.3	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk …
CVE-2026-86499	4.3	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all…
CVE-2026-86486	3.7	—	JetBrains	YouTrack	CWE-306	In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler fai…
CVE-2025-52651	3.5	—	HCL Software	MyXalytics	CWE-20	HCL MyXalytics is affected by multiple security vulnerabilities.
CVE-2025-52652	3.5	—	HCL Software	MyXalytics	CWE-451	HCL MyXalytics is affected by multiple security vulnerabilities.
CVE-2025-52657	3.5	—	HCL Software	MyXalytics	CWE-770	HCL MyXalytics is affected by multiple security vulnerabilities.
CVE-2026-86491	3.5	—	JetBrains	YouTrack	CWE-79	In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project…
CVE-2026-86485	3.3	—	JetBrains	YouTrack	CWE-291	In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowe…
CVE-2026-86503	3.3	—	JetBrains	IntelliJ IDEA	CWE-918	In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could…
CVE-2026-86505	3.3	—	JetBrains	IntelliJ IDEA	CWE-201	In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked…
CVE-2026-86487	3.1	—	JetBrains	YouTrack	CWE-863	In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed…
CVE-2026-86501	2.8	—	JetBrains	IntelliJ IDEA	CWE-532	In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be wr…
CVE-2026-82584	2.3	—	ash-project	igniter	CWE-150	Terminal escape sequence injection in the mix igniter.install confirmation pr…
CVE-2026-86418	2.3	—	MISP	MISP	CWE-200	MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Un…
CVE-2026-86441	2.3	—	MISP	MISP	CWE-200	MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions an…
CVE-2026-81638	2.1	—	ash-project	ash_double_entry	CWE-173	Non-canonical ULID spellings are accepted and alias to the same record in ash…
CVE-2026-86291	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System us_edit1.php sql injection
CVE-2026-86294	2.1	—	SourceCodester	Simple Traffic Offense System	CWE-79	SourceCodester Simple Traffic Offense System Settings Update Endpoint save-se…
CVE-2026-86307	2.1	—	light0011	cms	CWE-352	light0011 cms cross-site request forgery
CVE-2026-86309	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System pro_searchfrm.php sql injection
CVE-2026-86310	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System cust_edit1.php sql injection
CVE-2026-86301	2.0	—	code-projects	Hospital Information System	CWE-79	code-projects Hospital Information System Patient Management editPatient.php …
CVE-2026-86424	2.0	—	ImageMagick	ImageMagick	CWE-59	ImageMagick before 7.1.2-30 Path Traversal via TOCTOU Symlink Race
CVE-2026-86422	1.0	—	ImageMagick	ImageMagick	CWE-59	ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
CVE-2026-16028	await	—	—	Protocol-HTTP2	CWE-401	Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via clo…
CVE-2026-86287	await	—	—	Net-IP-LPM	CWE-1287	Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-07 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.