Security Box Score — September 8, 2026

CISA adds 4 to KEV; 1564 CVEs published, led by Microsoft (966).

1564 CVEs published September 8, 2026: 87 critical, 867 high, 473 medium, 26 low; 2 in the KEV catalog at press time; 0 with a public exploit reference; 111 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 1164 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	3747	38625	—	—
KEV catalog size	1699

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2436 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	188	4271	420	2018	706	1	12	3	0.1	7.8	.0016	+142 ▲
microsoft	975	2874	189	1972	696	17	289	30	1.0	7.8	.0044	+942 ▲
google	129	2295	284	870	980	88	78	7	0.3	7.5	.0026	+86 ▲
red hat	51	676	43	282	315	36	2	0	0.0	6.8	.0028	+9 ▲
apple	0	316	59	85	165	7	88	8	2.5	6.5	.0029	-1 ▼
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0020	0
suse	9	37	5	21	10	1	0	0	0.0	7.5	.0036	+4 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	12	96	24	46	26	0	56	13	13.5	7.5	.0042	-18 ▼
ubiquiti	0	59	36	22	1	0	3	3	5.1	9.1	.0049	0
fortinet	9	39	8	11	17	3	28	6	15.4	6.7	.0050	+9 ▲
palo alto networks	0	37	1	3	21	12	13	2	5.4	4.7	.0020	0
netgear	2	34	0	0	27	7	0	0	0.0	4.3	.0025	+2 ▲
ivanti	10	24	10	12	2	0	25	5	20.8	8.8	.0754	+10 ▲
f5	7	24	6	14	3	1	4	1	4.2	8.7	.0047	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	+3 ▲

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	10	516	105	219	178	13	33	2	0.4	7.5	.0049	-50 ▼
mozilla	35	222	80	79	63	0	9	0	0.0	8.1	.0029	+34 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	0	76	3	17	47	9	4	2	2.6	5.3	.0029	0
github	3	20	1	10	9	0	0	0	0.0	7.3	.0044	+1 ▲
docker	0	9	0	6	3	0	0	0	0.0	7.2	.0016	0
wordpress	0	5	1	3	1	0	2	2	40.0	8.8	.3120	-1 ▼
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2269	484	1170	519	96	28	4	0.2	7.8	.0034	0
adobe	170	776	57	344	365	10	20	4	0.5	7.5	.0021	+162 ▲
ibm	72	691	153	305	225	8	6	1	0.1	7.5	.0029	+40 ▲
progress	2	63	14	39	10	0	6	1	1.6	8.1	.0035	-9 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
zohocorp	5	15	3	6	6	0	0	0	0.0	8.4	.0099	+5 ▲
atlassian	0	6	1	5	0	0	13	0	0.0	8.1	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	8	53	16	19	10	8	3	8.5	.0157	-7 ▼
siemens	14	51	6	33	9	3	0	7.3	.0018	+14 ▲
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+18 ▲
synology	0	27	3	6	15	3	0	5.6	.0025	-1 ▼
schneider electric	4	13	1	8	4	0	0	8.2	.0032	+4 ▲
hitachi energy	4	7	0	3	4	0	0	6.9	.0017	+4 ▲
abb	0	7	0	4	3	0	0	7.2	.0018	0
hikvision	0	6	0	4	2	0	0	7.2	.0040	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	55	226	15	119	87	5	2	1	0.4	7.2	.0021	+47 ▲
sourcecodester	26	195	0	0	114	81	0	0	0.0	5.5	.0028	+15 ▲
spring	0	170	12	59	84	15	0	0	0.0	6.5	.0024	0
nvidia	32	166	20	117	29	0	0	0	0.0	7.8	.0028	+16 ▲
itsourcecode	24	140	0	0	36	104	0	0	0.0	2.1	.0026	+18 ▲
mongodb	34	132	4	81	43	4	1	0	0.0	7.1	.0024	+34 ▲
elastic	42	129	1	27	98	3	1	0	0.0	6.5	.0028	+42 ▲
splunk	0	128	6	47	70	5	1	1	0.8	6.5	.0025	0

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-72898	.9422	99.8	10.0
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-73570	.3238	98.2	8.9
CVE-2026-71362	.2514	97.8	9.1
CVE-2026-64849	.1641	96.8	9.3
CVE-2026-48376	.1548	96.6	5.4
CVE-2026-19681	.0780	94.3	9.4
CVE-2026-82329	.0767	94.2	9.8
CVE-2026-71386	.0694	93.7	8.8
CVE-2026-68820	.0618	93.0	7.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-72898	10.0	.9422	KEV
CVE-2026-48362	10.0	.0431
CVE-2026-19188	10.0	.0193
CVE-2026-86152	10.0	.0186
CVE-2026-58231	10.0	.0171
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-69836	10.0	.0155
CVE-2026-73299	10.0	.0121
CVE-2026-73678	10.0	.0114

Most disclosures (vendor)
Vendor	CVEs
linux	1787
microsoft	1419
oracle	890
google	488
ibm	430
adobe	263
red hat	237
dell	119
apache	118
splunk	110

Most KEV additions (YTD)
Vendor	KEV
microsoft	30
cisco	13
apple	8
google	7
fortinet	6
ivanti	5
adobe	4
berriai	4
oracle	4
solarwinds	4

Most-affected ecosystems
Ecosystem	Advisories
Packagist	34
Maven	33
npm	13
PyPI	11
Go	1
RubyGems	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-20349	Cisco	0
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0
CVE-2026-72898	Metabase	0
CVE-2026-75650	Adobe	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-64849	mlflow	1
CVE-2026-86218	N-able	2

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1756
CVE-2021-27102	n/a	2021-11-17	1756
CVE-2021-27101	n/a	2021-11-17	1756
CVE-2021-27103	n/a	2021-11-17	1756
CVE-2021-21017	Adobe	2021-11-17	1756
CVE-2021-28550	Adobe	2021-11-17	1756
CVE-2021-42013	Apache Software Foundation	2021-11-17	1756
CVE-2021-41773	Apache Software Foundation	2021-11-17	1756
CVE-2021-30858	Apple	2021-11-17	1756
CVE-2021-30860	Apple	2021-11-17	1756

Transactions

ADDED TO KEV — CVE-2026-75650 (Adobe Commerce). Remediation due September 11, 2026.

ADDED TO KEV — CVE-2026-81963 (Microsoft Windows 11 version 23H2). Remediation due September 22, 2026.

ADDED TO KEV — CVE-2026-85880 (Microsoft Windows 10 Version 1607). Remediation due September 22, 2026.

ADDED TO KEV — CVE-2026-86218 (N-able N-central). Remediation due September 11, 2026.

EXPLOIT PUBLISHED — itsourcecode Sales and Inventory System: 10 CVEs (CVE-2026-86163, CVE-2026-86164, CVE-2026-86232, CVE-2026-86233, CVE-2026-86235, CVE-2026-86245, CVE-2026-86269, CVE-2026-86270, CVE-2026-86291, CVE-2026-86309). Public exploit references added.

EXPLOIT PUBLISHED — FreeRDP: 6 CVEs (CVE-2026-67299, CVE-2026-67301, CVE-2026-67302, CVE-2026-67304, CVE-2026-67305, CVE-2026-67306). Public exploit references added.

EXPLOIT PUBLISHED — Mikrotik RouterOS: 6 CVEs (CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-86060). Public exploit references added.

EXPLOIT PUBLISHED — SourceCodester Class and Exam Timetabling System: 6 CVEs (CVE-2026-86209, CVE-2026-86220, CVE-2026-86221, CVE-2026-86223, CVE-2026-86225, CVE-2026-86298). Public exploit references added.

EXPLOIT PUBLISHED — SourceCodester Online Voting System: 4 CVEs (CVE-2026-86159, CVE-2026-86160, CVE-2026-86162, CVE-2026-86290). Public exploit references added.

EXPLOIT PUBLISHED — SourceCodester Syllabus-Aligned Learning Management & Examination System: 4 CVEs (CVE-2026-86275, CVE-2026-86277, CVE-2026-86278, CVE-2026-86280). Public exploit references added.

EXPLOIT PUBLISHED — light0011 cms: 3 CVEs (CVE-2026-85381, CVE-2026-86306, CVE-2026-86307). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2023-52251. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70141. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70146. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70147. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70148. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70149. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70150. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70151. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-70152. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-32146 (Gleam). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4740 (Red Hat multicluster engine for Kubernetes 2.1). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-69414 (Microsoft Malware Protection Engine). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71624. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-71626. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-79697 (Advantech WISE-6610-NB). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-80116 (PassMark Software PerformanceTest). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82547 (Linux Foundation Magma). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85046 (Google Chrome). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85399 (code-projects Hospital Information System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85406 (Eleveo Quality Management). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85513 (StackStorm st2). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85636 (jofpin trape). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85643 (code-projects Online Shopping System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85701 (ramon-victor freegpt-webui). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85702 (ramon-victor freegpt-webui). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86165 (Tenda HG10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86167 (Tenda HG10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86168 (code-projects Content Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86171 (DefaultFuction CRM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86175 (netbox-community netbox). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86177 (pterodactyl panel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86178 (pixelfed). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86179 (code-projects Daily Expense Manager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86180 (code-projects Task Management System In PHP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86182 (diem-project diem). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86211 (rabindralamsal inventory-management-system). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86214 (Mstfakts College-Management-System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86216 (code-projects Hotel and Tourism Reservation in PHP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86226 (Projectwolds Online Attendance System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86228 (JeecgBoot). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86237 (openagents-org openagents). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86238 (projectworlds Online Examination System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86240 (liufee FeehiCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86244 (FastAdmin). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86261 (sfturing hosp_order). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86263 (sfturing hosp_order). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86264 (sfturing ssm_pro). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86267 (itsourcecode Information System Society Membership System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86272 (Beijing Meite Software Technology U+Smart Enjoyment WebSite). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86274 (projeto-siga siga). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86282 (jaychouchannel Tourism-Management-System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86284 (jaychouchannel Tourism-Management-System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86288 (ModelCloud GPTQModel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86293 (SourceCodester Simple Traffic Offense System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86295 (D-Link DIR-895L). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86296 (D-Link DIR-822A). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86300 (Tenda AC9). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86301 (code-projects Hospital Information System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86318 (java-json-tools json-patch). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-86321 (java-json-tools jackson-coreutils). Public exploit reference added.

REJECTED — CVE-2021-47996 (sparklemotion nokogiri). Record withdrawn by the CNA.

REJECTED — CVE-2022-50998 (sparklemotion nokogiri). Record withdrawn by the CNA.

REJECTED — CVE-2022-50999 (sparklemotion nokogiri). Record withdrawn by the CNA.

REJECTED — CVE-2022-51000 (sparklemotion nokogiri). Record withdrawn by the CNA.

REJECTED — CVE-2023-54354 (sparklemotion nokogiri). Record withdrawn by the CNA.

RESCORED — IBM i: 13 CVEs (CVE-2026-16693, CVE-2026-16826, CVE-2026-17057, CVE-2026-17207, CVE-2026-17255, CVE-2026-17259, CVE-2026-17270, CVE-2026-18076, CVE-2026-18078, CVE-2026-18175, CVE-2026-18221, CVE-2026-18341, CVE-2026-18858). CVSS rescored — before/after on each CVE page.

RESCORED — Cesanta Mongoose Web Server: 4 CVEs (CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392). CVSS rescored — before/after on each CVE page.

RESCORED — Adobe Experience Manager as a Cloud Service: 3 CVEs (CVE-2026-27222, CVE-2026-27238, CVE-2026-27258). CVSS rescored — before/after on each CVE page.

RESCORED — torproject Tor: 3 CVEs (CVE-2026-77640, CVE-2026-77641, CVE-2026-77642). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2025-48651 (Google Android). CVSS 4 → 5.5 (NVD).

RESCORED — CVE-2026-16689 (IBM App Connect Enterprise). CVSS 6.2 → 5.5 (NVD).

RESCORED — CVE-2026-18567 (IBM Db2 Mirror for i). CVSS 4.4 → 4.7 (NVD).

RESCORED — CVE-2026-19301 (IBM Langflow OSS). CVSS 5 → 6.5 (NVD).

RESCORED — CVE-2026-19305 (IBM Langflow OSS). CVSS 8.6 → 7.5 (NVD).

RESCORED — CVE-2026-62916 (Microsoft Entra). CVSS 9.1 → 9.8 (NVD).

RESCORED — CVE-2026-65818 (Microsoft Power Platform). CVSS 8.5 → 9.9 (NVD).

RESCORED — CVE-2026-69855 (Microsoft Copilot in Azure). CVSS 7.7 → 6.5 (NVD).

RESCORED — CVE-2026-70178 (Microsoft Fabric). CVSS 8.5 → 8.8 (NVD).

RESCORED — CVE-2026-70429 (Jenkins Project Jenkins). CVSS 8.1 → 6.5 (NVD).

RESCORED — CVE-2026-71407 (Fortinet FortiOS). CVSS 5.6 → 8.1 (NVD).

RESCORED — CVE-2026-75007 (Roundcube Webmail). CVSS 5.4 → 8.8 (NVD).

RESCORED — CVE-2026-75010 (Roundcube Webmail). CVSS 6.4 → 4.3 (NVD).

RESCORED — CVE-2026-76956 (libexpat project libexpat). CVSS 5.9 → 7.5 (NVD).

RESCORED — CVE-2026-76957 (libexpat project libexpat). CVSS 4.9 → 7.8 (NVD).

RESCORED — CVE-2026-80098 (Microsoft Copilot Studio). CVSS 9.3 → 10 (NVD).

PATCH SHIPPED — pmmp PocketMine-MP: 3 CVEs (CVE-2022-51016, CVE-2022-51017, CVE-2022-51018). Fix versions published.

PATCH SHIPPED — CVE-2026-18743 (rpm-software-management popt). Fixed in Red Hat Hardened Images 1.19-11.1.hum1.

ENRICHED — Linux: 13 CVEs (CVE-2026-23255, CVE-2026-23399, CVE-2026-31681, CVE-2026-43085, CVE-2026-43089, CVE-2026-43492, CVE-2026-64369, CVE-2026-64370, CVE-2026-64371, CVE-2026-64373, CVE-2026-64376, CVE-2026-64377, CVE-2026-64381). Received CVSS/CPE analysis.

Yesterday's Results

How to read these box scores · glossary

1564 CVEs published. 25 box scores and 375 table rows below; the remaining 1164 continue on page 2 · page 3 — every CVE is listed, nothing truncated.

CVE-2026-81963HIGH

Microsoft Windows 11 version 23H2 — Windows Update Stack Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8      —      —   YES

AFFECTED
  Product                                         Versions        Fixed
  Windows 11 version 23H2                         10.0.22631.0 –  —
  Windows 11 Version 23H2                         10.0.22631.0 –  —
  Windows 11 Version 24H2                         10.0.26100.0 –  —
  Windows 11 Version 25H2                         10.0.26200.0 –  —
  Windows 11 version 26H1                         10.0.28000.0 –  —
  Windows Server 2025                             10.0.26100.0 –  —
  Windows Server 2025 (Server Core installation)  10.0.26100.0 –  —

TIMELINE
  Aug 27  Reserved by CNA
  Sep 8   Added to CISA KEV, due Sep 22
  Sep 8   Published (CNA: microsoft)

CWE-59, CWE-284 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due September 22, 2026

CVE-2026-85880HIGH

Microsoft Windows 10 Version 1607 — Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8      —      —   YES

AFFECTED
  Product                                            Versions        Fixed
  Windows 10 Version 1607                            10.0.14393.0 –  —
  Windows 10 Version 1809                            10.0.17763.0 –  —
  Windows 10 Version 21H2                            10.0.19044.0 –  —
  Windows 10 Version 22H2                            10.0.19045.0 –  —
  Windows Server 2012                                6.2.9200.0 –    —
  Windows Server 2012 (Server Core installation)     6.2.9200.0 –    —
  Windows Server 2012 R2                             6.3.9600.0 –    —
  Windows Server 2012 R2 (Server Core installation)  6.3.9600.0 –    —
  Windows Server 2016                                10.0.14393.0 –  —
  Windows Server 2016 (Server Core installation)     10.0.14393.0 –  —
  + 3 more

TIMELINE
  Sep 4   Reserved by CNA
  Sep 8   Added to CISA KEV, due Sep 22
  Sep 8   Published (CNA: microsoft)

CWE-122, CWE-908 · CNA: microsoft · CVSS v3.1 · 2 references · NVD status: Analyzed · KEV due September 22, 2026

CVE-2026-71376CRITICAL

Hitachi Cosminexus Component Container — OS Command Injection Vulnerability in Cosminexus Component Container

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0098   60.1     —

AFFECTED
  Product                         Versions    Fixed
  Cosminexus Component Container  11-70-01 –  11-70-03

TIMELINE
  Aug 6   Reserved by CNA
  Sep 8   Published (CNA: Hitachi)

CWE-78 · CNA: Hitachi · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-67367CRITICAL

Siemens SIMOVE Fleetmanager V3.1 — A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanag…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    9.2   .0081   54.6     —

AFFECTED
  Product                   Versions     Fixed
  SIMOVE Fleetmanager V3.1  unspecified  —
  SIMOVE Fleetmanager V3.2  unspecified  —
  SIMOVE Fleetmanager V3.3  unspecified  —
  SIMOVE Fleetmanager V4.0  unspecified  —
  SIPLANT V1.7              unspecified  —
  SIPLANT V2.2              unspecified  —
  SIPLANT V3.0              unspecified  —
  SIPLANT V3.1              unspecified  —

TIMELINE
  Jul 29  Reserved by CNA
  Sep 8   Published (CNA: siemens)

CWE-23 · CNA: siemens · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-76561HIGH

Red Hat Red Hat Certificate System 9 — Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0059   46.2     —

AFFECTED
  Product                       Versions     Fixed
  Red Hat Certificate System 9  unspecified  —
  Red Hat Enterprise Linux 10   unspecified  —
  Red Hat Enterprise Linux 6    unspecified  —
  Red Hat Enterprise Linux 7    unspecified  —
  Red Hat Enterprise Linux 8    unspecified  —
  Red Hat Enterprise Linux 8    unspecified  —
  Red Hat Enterprise Linux 9    unspecified  —

TIMELINE
  Aug 19  Reserved by CNA
  Sep 8   Published (CNA: redhat)

CWE-78 · CNA: redhat · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-86510HIGH

D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.6   .0046   38.6     —

AFFECTED
  Product   Versions  Fixed
  DIR-822A  A_101 –   —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: VulDB)

CWE-119, CWE-787 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-85400HIGH

TYPO3 CMS - Missing Authorization in lowlevel commands

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   H   N   H   H   H    7.5   .0044   36.8     —

AFFECTED
  Product    Versions  Fixed
  TYPO3 CMS  14.2.0 –  —

TIMELINE
  Sep 3   Reserved by CNA
  Sep 8   Published (CNA: TYPO3)

CWE-266, CWE-862 · CNA: TYPO3 · CVSS v4.0 · 3 references · NVD status: Deferred

CVE-2026-86509HIGH

D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    8.6   .0043   36.4     —

AFFECTED
  Product   Versions     Fixed
  DIR-895L  A1_102b07 –  —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-77132MEDIUM

TYPO3 CMS - Information Disclosure via Backend Localization Wizard

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    5.3   .0041   34.2     —

AFFECTED
  Product    Versions  Fixed
  TYPO3 CMS  10.0.0 –  —

TIMELINE
  Aug 20  Reserved by CNA
  Sep 8   Published (CNA: TYPO3)

CWE-200, CWE-862 · CNA: TYPO3 · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-86511MEDIUM

java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    5.5   .0040   33.8     —

AFFECTED
  Product            Versions  Fixed
  jackson-coreutils  2.0 –     —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: VulDB)

CWE-400, CWE-404 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-86513MEDIUM

java-json-tools jackson-coreutils JSON Pointer parser TreePointer.java TreePointer.tokensFromInput allocation of resources

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    5.5   .0040   33.8     —

AFFECTED
  Product            Versions  Fixed
  jackson-coreutils  2.0 –     —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: VulDB)

CWE-400, CWE-770 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-82710LOW

ash-project usage_rules — Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   P   N   L   N    2.3   .0040   33.7     —

AFFECTED
  Product      Versions                                    Fixed
  usage_rules  0.1.18 –                                    —
  usage_rules  2da7a99536041d63ec1f391d019565789a59595f –  —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: EEF)

CWE-150 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-86590MEDIUM

Eclipse Foundation Eclipse Che — In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver e…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   N    6.3   .0037   30.2     —

AFFECTED
  Product      Versions  Fixed
  Eclipse Che  7.79.0 –  —

TIMELINE
  Sep 8   Reserved by CNA
  Sep 8   Published (CNA: eclipse)

CWE-918 · CNA: eclipse · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-12962MEDIUM

ASUS Armoury Crate — A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to o…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   N   N    5.3   .0036   29.2     —

AFFECTED
  Product        Versions     Fixed
  Armoury Crate  unspecified  —

TIMELINE
  Jun 23  Reserved by CNA
  Sep 8   Published (CNA: ASUS)

CWE-942 · CNA: ASUS · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-9331HIGH

PixelYourSite EDD Product Catalog Feed by PixelYourSite — EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  L    7.1   .0035   28.2     —

AFFECTED
  Product                                    Versions     Fixed
  EDD Product Catalog Feed by PixelYourSite  unspecified  —

TIMELINE
  May 22  Reserved by CNA
  Sep 8   Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-62645CRITICAL

Siemens Reyrolle 7SR5 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0035   27.8     —

AFFECTED
  Product        Versions     Fixed
  Reyrolle 7SR5  unspecified  —

TIMELINE
  Jul 14  Reserved by CNA
  Sep 8   Published (CNA: siemens)

CWE-306 · CNA: siemens · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-58240CRITICAL

SAP_SE SAP NetWeaver (Message Server) — Missing Authentication check in SAP NetWeaver (Message Server)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0034   27.2     —

AFFECTED
  Product                         Versions       Fixed
  SAP NetWeaver (Message Server)  KERNEL 9.16 –  —

TIMELINE
  Jun 29  Reserved by CNA
  Sep 8   Published (CNA: sap)

CWE-308 · CNA: sap · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-62647CRITICAL

Siemens Reyrolle 7SR5 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is u…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   N    9.3   .0034   26.5     —

AFFECTED
  Product        Versions     Fixed
  Reyrolle 7SR5  unspecified  —

TIMELINE
  Jul 14  Reserved by CNA
  Sep 8   Published (CNA: siemens)

CWE-20 · CNA: siemens · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-86515LOW

n/a vgmstream — vgmstream txtp txtp_parser.c add_entry resource consumption

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   N   L    2.1   .0034   26.6     —

AFFECTED
  Product    Versions  Fixed
  vgmstream  r2117 –   —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: VulDB)

CWE-400, CWE-404 · CNA: VulDB · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-62648HIGH

Siemens Reyrolle 7SR5 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL componen…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0033   25.4     —

AFFECTED
  Product        Versions     Fixed
  Reyrolle 7SR5  unspecified  —

TIMELINE
  Jul 14  Reserved by CNA
  Sep 8   Published (CNA: siemens)

CWE-787 · CNA: siemens · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-62649HIGH

Siemens Reyrolle 7SR5 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not proper…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7   .0033   25.4     —

AFFECTED
  Product        Versions     Fixed
  Reyrolle 7SR5  unspecified  —

TIMELINE
  Jul 14  Reserved by CNA
  Sep 8   Published (CNA: siemens)

CWE-770 · CNA: siemens · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-44756CRITICAL

SAP_SE SAP Extended Passport (EPP) Processing — Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .0032   24.7     —

AFFECTED
  Product                                 Versions          Fixed
  SAP Extended Passport (EPP) Processing  KRNL64NUC 7.22 –  —

TIMELINE
  May 7   Reserved by CNA
  Sep 8   Published (CNA: sap)

CWE-120 · CNA: sap · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-62650HIGH

Siemens Reyrolle 7SR5 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization chec…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7   .0032   24.5     —

AFFECTED
  Product        Versions     Fixed
  Reyrolle 7SR5  unspecified  —

TIMELINE
  Jul 14  Reserved by CNA
  Sep 8   Published (CNA: siemens)

CWE-288 · CNA: siemens · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-66768CRITICAL

SAP_SE SAP NetWeaver (SAP GUI for Java) — Improper Access Control in SAP NetWeaver (SAP GUI for Java)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   R  C  H  H  H    9.0   .0032   24.3     —

AFFECTED
  Product                           Versions           Fixed
  SAP NetWeaver (SAP GUI for Java)  BC-FES-JAV 8.10 –  —

TIMELINE
  Jul 27  Reserved by CNA
  Sep 8   Published (CNA: sap)

CWE-807 · CNA: sap · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-86519MEDIUM

code-projects Student Crud Operation Backup File card_activation.sql information disclosure

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   N   N    5.5   .0032   24.3     —

AFFECTED
  Product                 Versions  Fixed
  Student Crud Operation  1.0 –     —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 8   Published (CNA: VulDB)

CWE-200, CWE-284 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-62646	9.1	24.0	Siemens	Reyrolle 7SR5	CWE-331	A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). …
CVE-2026-71377	9.8	23.9	Hitachi	Cosminexus Component Container	CWE-88	Command Argument Injection Vulnerability in Cosminexus Component Container
CVE-2026-71374	9.8	23.9	Hitachi	Cosminexus Component Container	CWE-502	Deserialization of Untrusted Data Vulnerability in Cosminexus Component Conta…
CVE-2026-76969	9.4	21.7	SAP_SE	SAP Cloud Application Programming Model (CAP)	CWE-522	Credential disclosure in multitenant applications using SAP Cloud Application…
CVE-2026-86514	2.1	19.4	n/a	vgmstream	CWE-119	vgmstream txth-txtp txth.c sscanf stack-based overflow
CVE-2026-86550	6.5	18.6	ZTE	NebulaOS	CWE-79	UXSS vulnerability in ZTE browser products
CVE-2026-81790	7.5	18.3	Viszt Péter	Csomagpontok és szállítási címkék WooCommerce-hez	CWE-862	WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - …
CVE-2026-48888	7.5	17.9	Automattic	WooCommerce	CWE-770	WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
CVE-2026-66767	7.7	17.6	SAP_SE	SAP NetWeaver Application Server for ABAP and ABAP Platform	CWE-191	Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP …
CVE-2026-71375	7.4	15.8	Hitachi	Cosminexus Component Container	CWE-611	XXE Vulnerability in Cosminexus Component Container
CVE-2026-86516	5.1	13.9	elenavanengelenmaslova	mocknest-serverless	CWE-266	elenavanengelenmaslova mocknest-serverless AWS GitHub OIDC Deployment Helper …
CVE-2026-76968	6.5	13.9	SAP_SE	SAP Web Dispatcher, Internet Communication Manager and SAP Content Server	CWE-497	Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communic…
CVE-2026-44766	6.5	13.4	SAP_SE	SAP S/4HANA (Intercompany Matching and Reconciliation)	CWE-89	SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconci…
CVE-2026-76958	8.5	12.9	SAP_SE	SAP Integration Suite	CWE-611	XML External Entity (XXE) Vulnerability in SAP Integration Suite
CVE-2026-76977	4.3	12.8	SAP_SE	SAPUI5(Frame Options Allowlist)	CWE-1289	Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)
CVE-2026-58113	8.5	12.1	Siemens	Teamcenter V2412	CWE-79	A vulnerability has been identified in Teamcenter V2412 (All versions < V2412…
CVE-2026-76967	7.8	12.1	SAP_SE	SAP NetWeaver Business Client	CWE-502	Insecure Deserialization in SAP NetWeaver Business Client
CVE-2026-58234	2.2	11.4	SAP_SE	SAP Process Integration (SOAP Adapter)	CWE-776	Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
CVE-2026-86512	2.1	11.1	java-json-tools	json-patch	CWE-266	java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperat…
CVE-2026-62652	6.9	10.7	Siemens	Reyrolle 7SR5	CWE-215	A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). …
CVE-2026-19397	7.7	10.5	ASUS	Control Center Express Agent	CWE-306	Missing authentication for a critical function in ASUS Control Center Express…
CVE-2026-86517	2.1	10.4	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql inj…
CVE-2026-86518	2.1	10.4	code-projects	Student Crud Operation	CWE-74	code-projects Student Crud Operation edit.php sql injection
CVE-2026-76962	4.3	10.2	SAP_SE	SAP S/4HANA (Manage Bank Chains app)	CWE-862	Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)
CVE-2026-81792	6.5	9.4	MultiVendorX	Product Catalog Enquiry for WooCommerce by MultiVendorX	CWE-266	WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6…
CVE-2026-81802	6.5	9.4	Magepeople inc.	WpEvently	CWE-639	WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR…
CVE-2026-50093	8.9	8.8	Siemens	Siveillance Control Pro V3.0	CWE-434	A vulnerability has been identified in Siveillance Control Pro V3.0 (All vers…
CVE-2026-81781	7.1	8.0	Unbounce	Unbounce Landing Pages	CWE-862	WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vuln…
CVE-2026-62653	7.0	7.9	Siemens	Reyrolle 7SR5	CWE-787	A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). …
CVE-2026-76963	4.3	6.3	SAP_SE	SAP NetWeaver and ABAP Platform	CWE-862	Missing Authorization Check in Application Server ABAP of SAP NetWeaver and A…
CVE-2026-81806	7.2	5.4	John Darrel	Hide My WP Ghost	CWE-918	WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SS…
CVE-2026-76971	6.5	4.3	SAP_SE	SAP Manufacturing Integration and Intelligence	CWE-918	Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
CVE-2026-81798	7.1	4.2	Easy Appointments	Easy Appointments	CWE-79	WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vu…
CVE-2026-84817	7.1	4.2	Crocoblock	JetFormBuilder	CWE-79	WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulne…
CVE-2026-84818	7.1	4.2	100plugins	Open User Map	CWE-79	WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnera…
CVE-2026-84820	7.1	4.2	Unlimited Elements	Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	CWE-79	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) …
CVE-2026-34223	8.6	3.1	Siemens	Desigo CC ClickOnce Client V6	CWE-94	A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All ver…
CVE-2026-74859	6.8	2.6	Red Hat	Red Hat Enterprise Linux 8	CWE-22	Gnome-tweaks: path traversal in theme installer
CVE-2026-62654	7.0	1.4	Siemens	Reyrolle 7SR5	CWE-494	A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). …
CVE-2026-75809	5.9	1.3	ASUS	Armoury Crate	CWE-782	Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a…
CVE-2026-75808	5.7	1.3	ASUS	Armoury Crate	CWE-770	Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate al…
CVE-2026-75810	5.7	1.3	ASUS	Armoury Crate	CWE-749	Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user…
CVE-2026-75811	5.8	1.2	ASUS	Armoury Crate	CWE-1256	Improper Restriction of Software Interfaces to Hardware Features in ASUS Armo…
CVE-2026-76960	3.5	0.7	SAP_SE	SAP S/4HANA (Finance for Advanced Payment Management)	CWE-352	Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for A…
CVE-2026-76961	3.5	0.7	SAP_SE	SAP S/4HANA (Finance for Advanced Payment Management)	CWE-352	Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for A…
CVE-2026-16004	5.9	0.5	ASUS	Armoury Crate	CWE-782	Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows…
CVE-2026-16005	5.8	0.5	ASUS	Armoury Crate	CWE-763	Release of Invalid Pointer or Reference in Armoury Crate driver allows a loca…
CVE-2026-16006	5.7	0.5	ASUS	Armoury Crate	CWE-497	Exposure of Sensitive System Information to an Unauthorized Control Sphere in…
CVE-2026-18023	5.7	0.5	ASUS	Armoury Crate	CWE-226	Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Cr…
CVE-2026-16003	2.0	0.5	ASUS	Armoury Crate	CWE-782	Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows…
CVE-2026-76959	4.6	0.4	SAP_SE	SAP S/4HANA (Finance for Advanced Payment Management)	CWE-352	Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for A…
CVE-2026-86597	6.5	0.4	Snowflake	Snowflake Connector for Python	CWE-532	Sensitive information written to logs by Snowflake drivers
CVE-2026-28659	10.0	—	Google	Android XR	—	In MicroXR Blobstore, there is a possible way to access other app's files due…
CVE-2026-49883	10.0	—	Google	Android Wear	—	In checkReadPermission of PermissionsManager.java, there is a possible way to…
CVE-2026-82004	10.0	—	Adobe	Adobe Campaign Classic	CWE-78	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements us…
CVE-2026-12645	9.9	—	Ivanti	Ivanti Neurons for ITSM	CWE-862	A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.…
CVE-2026-12646	9.9	—	Ivanti	Ivanti Neurons for ITSM	CWE-862	A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.…
CVE-2026-12647	9.9	—	Ivanti	Ivanti Neurons for ITSM	CWE-862	A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.…
CVE-2026-12650	9.9	—	Ivanti	Neurons for ITSM	CWE-502	A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM …
CVE-2026-19232	9.9	—	Adobe	Adobe Experience Manager as a Cloud Service	CWE-863	Adobe Experience Manager \| Incorrect Authorization (CWE-863)
CVE-2026-26084	9.9	—	Fortinet	FortiSandbox PaaS	CWE-284	A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 throug…
CVE-2026-48273	9.9	—	Adobe	ColdFusion 2025	CWE-95	ColdFusion \| Improper Neutralization of Directives in Dynamically Evaluated C…
CVE-2026-78234	9.9	—	Red Hat	Red Hat build of Apache Camel - HawtIO 4	CWE-295	Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-…
CVE-2026-83941	9.9	—	Microsoft	Microsoft Entra	CWE-862	Entra ID Elevation of Privilege Vulnerability
CVE-2026-84869	9.9	—	ConnectWise	ScreenConnect	CWE-269	ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
CVE-2026-86464	9.9	—	Eclipse Foundation	Eclipse aeriOS	CWE-200	In the current development version of Eclipse aeriOS, for which no official r…
CVE-2026-12744	9.8	—	Ivanti	Neurons for ITSM	CWE-502	A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM …
CVE-2026-12745	9.8	—	Ivanti	Neurons for ITSM	CWE-502	A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM …
CVE-2026-49921	9.8	—	Google	Android	CWE-122	In multiple locations, there is a possible memory safety issue due to a heap …
CVE-2026-58822	9.8	—	Google	Android	CWE-704	In multiple functions of ftsmooth.c, there is a possible memory safety issue …
CVE-2026-66302	9.8	—	Microsoft	Skype for Business Server 2015 CU13	CWE-73	Skype for Business Remote Code Execution Vulnerability
CVE-2026-68839	9.8	—	Microsoft	Windows 10 Version 1607	CWE-20	Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability
CVE-2026-69276	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability
CVE-2026-69408	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-69431	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Telnet Client Remote Code Execution Vulnerability
CVE-2026-69463	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows NTFS Remote Code Execution Vulnerability
CVE-2026-69491	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft DirectMusic Remote Code Execution Vulnerability
CVE-2026-69493	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Event Logging Service Remote Code Execution Vulnerability
CVE-2026-69496	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Compressed Folder Remote Code Execution Vulnerability
CVE-2026-69525	9.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Remote Desktop Services Remote Code Execution Vulnerability
CVE-2026-69579	9.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows Message Queuing Remote Code Execution Vulnerability
CVE-2026-69586	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft Windows PDF Remote Code Execution Vulnerability
CVE-2026-69590	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-69595	9.8	—	Microsoft	Windows Server 2012	CWE-416	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
CVE-2026-69715	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Direct Show Remote Code Execution Vulnerability
CVE-2026-69730	9.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-69768	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows RNDIS Remote Code Execution Vulnerability
CVE-2026-69769	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows HTTP Print Provider Remote Code Execution Vulnerability
CVE-2026-69819	9.8	—	Microsoft	Windows 10 Version 1607	CWE-787	RPC Runtime Library Remote Code Execution Vulnerability
CVE-2026-69824	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft Standard XPS Remote Code Execution Vulnerability
CVE-2026-69829	9.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Shell Remote Code Execution Vulnerability
CVE-2026-69845	9.8	—	Microsoft	Windows 10 Version 1607	CWE-20	Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-69910	9.8	—	Microsoft	Windows 10 Version 1607	CWE-121	Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-70296	9.8	—	Microsoft	Windows 10 Version 1607	CWE-787	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-72979	9.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-72982	9.8	—	Microsoft	Windows 10 Version 1607	CWE-121	Windows Netlogon Remote Code Execution Vulnerability
CVE-2026-72983	9.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
CVE-2026-73009	9.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnera…
CVE-2026-73010	9.8	—	Microsoft	Windows 10 Version 1809	CWE-416	Microsoft Failover Cluster Remote Code Execution Vulnerability
CVE-2026-73025	9.8	—	Microsoft	Windows 10 Version 1607	CWE-1390	Windows iSCSI Security Feature Bypass Vulnerability
CVE-2026-77493	9.8	—	Microsoft	Windows 10 Version 1607	CWE-415	Windows Graphics Component Remote Code Execution Vulnerability
CVE-2026-78445	9.8	—	Microsoft	Windows Server 2012	CWE-416	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
CVE-2026-78509	9.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-78510	9.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Word Remote Code Execution Vulnerability
CVE-2026-79569	9.8	—	n/a	n/a	CWE-89	Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerabilit…
CVE-2026-79576	9.8	—	n/a	n/a	CWE-287	An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6…
CVE-2026-65669	9.6	—	Microsoft	SQL Server Management Studio 22	CWE-74	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-81376	9.6	—	Microsoft	Visual Studio Code	CWE-693	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-82533	9.4	—	DeepSeek	DeepSeek Harness	CWE-807	DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
CVE-2026-61516	9.3	—	Netis Systems	NX10	CWE-522	Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
CVE-2026-69356	9.3	—	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-79	Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-76200	9.3	—	Adobe	Adobe Commerce	CWE-79	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-76201	9.3	—	Adobe	Adobe Commerce	CWE-79	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-77089	9.3	—	Commvault	Commvault Cloud	—	Command Center API Authentication Bypass
CVE-2026-86738	9.3	—	grokability	snipe-it	CWE-79	Snipe-IT before 8.7.0 CSS Injection via Custom CSS
CVE-2026-82067	9.2	—	MongoDB	MongoDB Server	CWE-178	Improper Case Sensitivity Handling in MongoDB Server Configuration Validation…
CVE-2026-84197	9.2	—	Eclipse Foundation	Eclipse Ditto	CWE-295	In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclip…
CVE-2026-53939	9.1	—	OpenIDC	cjose	CWE-321	OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encry…
CVE-2026-69641	9.1	—	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-862	Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-73309	9.1	—	XenForo	XenForo	CWE-697	XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint
CVE-2026-73311	9.1	—	XenForo	XenForo	CWE-294	XenForo < 2.3.13 OAuth2 Authorization Code Reuse
CVE-2026-73312	9.1	—	XenForo	XenForo	CWE-294	XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
CVE-2026-75156	9.1	—	Apache Software Foundation	Apache Airflow FAB provider	CWE-346	Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not…
CVE-2026-75746	9.1	—	Adobe	ColdFusion 2025	CWE-89	ColdFusion \| Improper Neutralization of Special Elements used in an SQL Comma…
CVE-2026-86729	9.1	—	WWBN	AVideo	CWE-307	WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize
CVE-2026-53581	9.0	—	opnsense	core	CWE-22	ntp: write path traversal
CVE-2026-69854	9.0	—	Microsoft	Spring Cloud Azure	CWE-287	Spring Cloud Azure Elevation of Privilege Vulnerability
CVE-2026-85982	9.0	—	Auth0	Auth0 AD/LDAP Connector	CWE-79	Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
CVE-2026-12648	8.8	—	Ivanti	Neurons for ITSM	CWE-502	A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM …
CVE-2026-12651	8.8	—	Ivanti	Neurons for ITSM	CWE-502	A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM …
CVE-2026-16502	8.8	—	livecomposer	Live Composer – Free WordPress Website Builder	CWE-502	Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection v…
CVE-2026-18851	8.8	—	Ivanti	Endpoint Manager Mobile	CWE-862	Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.…
CVE-2026-62706	8.8	—	Microsoft	Windows 10 Version 1607	CWE-121	Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-62744	8.8	—	Microsoft	Windows 11 Version 24H2	CWE-122	Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-62895	8.8	—	Microsoft	Azure Arc SQL Server Extension	CWE-89	Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
CVE-2026-65772	8.8	—	Microsoft	Microsoft Dynamics 365 (on-premises) version 9.1	CWE-502	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2026-66814	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-1220	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-66818	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-269	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-66819	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-89	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-66820	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-89	SQL Server Elevation of Privilege Vulnerability
CVE-2026-67368	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-59	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-67370	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-89	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-67373	8.8	—	Microsoft	Microsoft SQL Server 2025 (CU8)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67380	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67381	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Elevation of Privilege Vulnerability
CVE-2026-67384	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67385	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-416	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67388	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67631	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67638	8.8	—	Microsoft	Microsoft SQL Server 2025 (CU8)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67639	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67642	8.8	—	Microsoft	Microsoft SQL Server 2025 (CU8)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67643	8.8	—	Microsoft	Microsoft SQL Server 2022 (CU 26)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-68775	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-68786	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-68828	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-69266	8.8	—	Microsoft	Windows 10 Version 1607	CWE-190	Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-69268	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-284	Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-69273	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-284	Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-69282	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-284	Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-69285	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-69291	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
CVE-2026-69334	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
CVE-2026-69355	8.8	—	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-73	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2026-69360	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69386	8.8	—	Microsoft	Windows 10 Version 1809	CWE-122	Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-69434	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows URL Moniker Remote Code Execution Vulnerability
CVE-2026-69439	8.8	—	Microsoft	.NET 10.0	CWE-122	.NET and Visual Studio Elevation of Privilege Vulnerability
CVE-2026-69442	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-69461	8.8	—	Microsoft	Windows 10 Version 1607	CWE-121	Windows NTFS Remote Code Execution Vulnerability
CVE-2026-69464	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-250	Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-69465	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-862	Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-69485	8.8	—	Microsoft	Windows 10 Version 1607	CWE-908	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-69494	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Event Logging Service Remote Code Execution Vulnerability
CVE-2026-69495	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Event Logging Service Remote Code Execution Vulnerability
CVE-2026-69499	8.8	—	Microsoft	Windows 10 Version 1607	CWE-190	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-69511	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-69518	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Remote Desktop Remote Code Execution Vulnerability
CVE-2026-69522	8.8	—	Microsoft	.NET 10.0	CWE-122	.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2026-69529	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Access Remote Code Execution Vulnerability
CVE-2026-69547	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-69551	8.8	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-69556	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69598	8.8	—	Microsoft	Windows 10 Version 1607	CWE-131	Windows iSCSI Remote Code Execution Vulnerability
CVE-2026-69601	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft Windows Media Foundation Remote Code Execution Vulnerability
CVE-2026-69603	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-69614	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-20	Microsoft Office Access Remote Code Execution Vulnerability
CVE-2026-69628	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows iSCSI Remote Code Execution Vulnerability
CVE-2026-69629	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-69632	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-69649	8.8	—	Microsoft	Raw Image Extension	CWE-122	Raw Image Extension Remote Code Execution Vulnerability
CVE-2026-69669	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Kernel Remote Code Execution Vulnerability
CVE-2026-69671	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69676	8.8	—	Microsoft	Windows 10 Version 1607	CWE-294	Windows Kerberos Remote Code Execution Vulnerability
CVE-2026-69678	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-69686	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-121	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69712	8.8	—	Microsoft	Windows Server 2012	CWE-416	Windows Key Distribution Center Remote Code Execution Vulnerability
CVE-2026-69716	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-89	Microsoft Office SharePoint Elevation of Privilege Vulnerability
CVE-2026-69722	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-121	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69724	8.8	—	Microsoft	Microsoft SharePoint Server Subscription Edition	CWE-862	Microsoft Office SharePoint Remote Code Execution Vulnerability
CVE-2026-69729	8.8	—	Microsoft	Windows 11 Version 24H2	CWE-122	Windows Credential Providers Remote Code Execution Vulnerability
CVE-2026-69740	8.8	—	Microsoft	Windows 11 version 23H2	CWE-416	Windows Hello Elevation of Privilege Vulnerability
CVE-2026-69742	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-190	Microsoft Office Publisher Remote Code Execution Vulnerability
CVE-2026-69759	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-121	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69764	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-69767	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-69772	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Network File System Remote Code Execution Vulnerability
CVE-2026-69778	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Access Remote Code Execution Vulnerability
CVE-2026-69784	8.8	—	Microsoft	Windows 10 Version 21H2	CWE-416	Windows Hello Elevation of Privilege Vulnerability
CVE-2026-69797	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-69860	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-70203	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Media Player Remote Code Execution Vulnerability
CVE-2026-70351	8.8	—	Microsoft	WebP Image Extension	CWE-122	Microsoft WebP Image Extension Remote Code Execution Vulnerability
CVE-2026-70586	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Paint Remote Code Execution Vulnerability
CVE-2026-71328	8.8	—	Microsoft	.NET 10.0	CWE-122	.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2026-71336	8.8	—	Microsoft	Windows 10 Version 1607	CWE-190	Windows Work Folder Service Remote Code Execution Vulnerability
CVE-2026-71352	8.8	—	Microsoft	Windows 10 Version 1607	CWE-191	Windows Remote Access Connection Manager Remote Code Execution Vulnerability
CVE-2026-72933	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability
CVE-2026-72940	8.8	—	Microsoft	Windows 11 version 23H2	CWE-122	Windows Schannel Remote Code Execution Vulnerability
CVE-2026-72950	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-72959	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulner…
CVE-2026-72960	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Media Player Remote Code Execution Vulnerability
CVE-2026-72972	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-72973	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-72986	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Graphic Fonts Remote Code Execution Vulnerability
CVE-2026-73006	8.8	—	Microsoft	Windows 10 Version 1607	CWE-121	DirectWrite Remote Code Execution Vulnerability
CVE-2026-73012	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Management Services Elevation of Privilege Vulnerability
CVE-2026-73013	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-73016	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	DirectWrite Remote Code Execution Vulnerability
CVE-2026-73018	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Graphic Fonts Remote Code Execution Vulnerability
CVE-2026-73023	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-73028	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-284	SQL Server Elevation of Privilege Vulnerability
CVE-2026-77097	8.8	—	Commvault	Commvault Cloud	CWE-306	Private Metrics Server Denial of Service
CVE-2026-77098	8.8	—	Commvault	Commvault Cloud	CWE-89	Private Metrics Server SQL Injection
CVE-2026-77480	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-1220	SQL Server Elevation of Privilege Vulnerability
CVE-2026-77481	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-77482	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-77483	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-1390	SQL Server Elevation of Privilege Vulnerability
CVE-2026-77484	8.8	—	Microsoft	Microsoft SQL Server 2019 (CU 32)	CWE-502	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-77486	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-77487	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-284	SQL Server Elevation of Privilege Vulnerability
CVE-2026-77495	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-77504	8.8	—	Microsoft	Windows 10 Version 1607	CWE-415	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-77901	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-476	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-77906	8.8	—	Microsoft	Microsoft Visual Studio 2026 version 18.9	CWE-122	Visual Studio Remote Code Execution Vulnerability
CVE-2026-77907	8.8	—	Microsoft	Microsoft Visual Studio 2026 version 18.9	CWE-122	Visual Studio Remote Code Execution Vulnerability
CVE-2026-77908	8.8	—	Microsoft	Microsoft Dynamics 365 Customer Engagement V9.1	CWE-94	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVE-2026-78439	8.8	—	Microsoft	Microsoft Office 365 for Mac	CWE-121	Microsoft Office Graphics Component Remote Code Execution Vulnerability
CVE-2026-78442	8.8	—	Microsoft	Microsoft SQL Server 2017 (CU 31)	CWE-122	Windows OLE DB Remote Code Execution Vulnerability
CVE-2026-78456	8.8	—	Microsoft	Microsoft SQL Server 2022 (CU 26)	CWE-122	SQL Server Remote Code Execution Vulnerability
CVE-2026-78462	8.8	—	Microsoft	Visual Studio Code	CWE-639	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-78463	8.8	—	Microsoft	Remote Desktop client for Windows Desktop	CWE-94	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-78504	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-121	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78505	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-78507	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78511	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78512	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78514	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78517	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78518	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-20	Microsoft Office Excel Remote Code Execution Vulnerability
CVE-2026-78519	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-908	Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-78521	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-78524	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-787	Microsoft Office Remote Code Execution Vulnerability
CVE-2026-78525	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office Outlook Remote Code Execution Vulnerability
CVE-2026-78526	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-79376	8.8	—	n/a	n/a	CWE-20	An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 B…
CVE-2026-80074	8.8	—	Microsoft	Remote Desktop client for Windows Desktop	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-80077	8.8	—	Microsoft	Remote Desktop client for Windows Desktop	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-80080	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-415	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-80081	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-416	Microsoft Office PowerPoint Remote Code Execution Vulnerability
CVE-2026-80083	8.8	—	Microsoft	Windows 11 version 23H2	CWE-822	Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-80085	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Office Word Remote Code Execution Vulnerability
CVE-2026-80096	8.8	—	Microsoft	Windows 10 Version 1607	CWE-125	Windows Remote Desktop Services Elevation of Privilege Vulnerability
CVE-2026-81352	8.8	—	Microsoft	Web Media Extensions	CWE-122	Web Media Extensions Remote Code Execution Vulnerability
CVE-2026-81385	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-502	Microsoft Office Publisher Remote Code Execution Vulnerability
CVE-2026-81952	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Microsoft Word Remote Code Execution Vulnerability
CVE-2026-81955	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	CWE-122	Windows Graphics Component Remote Code Execution Vulnerability
CVE-2026-81996	8.8	—	Adobe	Adobe Acrobat	CWE-863	Acrobat Reader \| Incorrect Authorization (CWE-863)
CVE-2026-83992	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Imaging Component Remote Code Execution Vulnerability
CVE-2026-83996	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2026-83998	8.8	—	Microsoft	Windows 10 Version 1607	CWE-122	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2026-85877	8.8	—	Microsoft	Windows 11 Version 24H2	CWE-122	Windows Print Spooler Remote Code Execution Vulnerability
CVE-2026-12611	8.7	—	Eclipse Foundation	Eclipse Jetty	CWE-400	A client may issue HTTP/2 requests to a Jetty server that result in blocking …
CVE-2026-33197	8.7	—	AMI	AptioV	CWE-184	BDS Module Bypass Secure Boot Advisory
CVE-2026-55250	8.7	—	macropay-solutions	maravel-framework	CWE-294	Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Evic…
CVE-2026-73314	8.7	—	XenForo	XenForo	CWE-754	XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
CVE-2026-73316	8.7	—	XenForo	XenForo	CWE-345	XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
CVE-2026-77101	8.7	—	Commvault	Commvault Cloud	CWE-121	CommServe Stack-based Buffer Overflow
CVE-2026-77102	8.7	—	Commvault	Commvault Cloud	CWE-122	CommServe Denial of Service
CVE-2026-77103	8.7	—	Commvault	Commvault Cloud	CWE-288	CommServe Information Disclosure
CVE-2026-77105	8.7	—	Commvault	Commvault Cloud	CWE-347	CommServe Privilege Escalation
CVE-2026-77111	8.7	—	Adobe	Adobe Commerce	CWE-863	Adobe Commerce \| Incorrect Authorization (CWE-863)
CVE-2026-80219	8.7	—	Red Hat	Red Hat build of Apache Camel - HawtIO 4	CWE-1390	Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto a…
CVE-2026-82064	8.7	—	MongoDB	MongoDB Server	CWE-617	Unauthenticated Denial of Service in MongoDB Server via Assertion Failure in …
CVE-2026-82075	8.7	—	MongoDB	MongoDB Server	CWE-770	Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Un…
CVE-2026-86075	8.7	—	n8n-io	n8n	CWE-770	n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client R…
CVE-2026-86076	8.7	—	n8n-io	n8n	CWE-94	n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScr…
CVE-2026-86721	8.7	—	WWBN	AVideo	CWE-287	AVideo through c3edcc274c Authorization Bypass via Session Cookie
CVE-2026-86727	8.7	—	WWBN	AVideo	CWE-306	AVideo through 29.0 Information Disclosure via stats.json.php
CVE-2026-86728	8.7	—	WWBN	AVideo	CWE-306	AVideo through 29.0 Unauthenticated Disclosure via epg.json.php
CVE-2026-86730	8.7	—	craftcms	cms	CWE-94	Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE
CVE-2026-86732	8.7	—	craftcms	cms	CWE-94	Craft CMS before 5.10.12 Remote Code Execution via element-index
CVE-2026-61517	8.6	—	Netis Systems	NX10	CWE-78	Netis NX10 OS Command Injection via Ping Diagnostic Handler
CVE-2026-74239	8.6	—	XenForo	XenForo	CWE-22	XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows
CVE-2026-75990	8.6	—	Adobe	Illustrator Desktop 2026	CWE-863	Illustrator \| Incorrect Authorization (CWE-863)
CVE-2026-75991	8.6	—	Adobe	Illustrator Desktop 2026	CWE-20	Illustrator \| Improper Input Validation (CWE-20)
CVE-2026-76190	8.6	—	Adobe	ColdFusion 2025	CWE-95	ColdFusion \| Improper Neutralization of Directives in Dynamically Evaluated C…
CVE-2026-76199	8.6	—	Adobe	Photoshop 2026	CWE-427	Photoshop Desktop \| Uncontrolled Search Path Element (CWE-427)
CVE-2026-77109	8.6	—	Adobe	Adobe Commerce	CWE-863	Adobe Commerce \| Incorrect Authorization (CWE-863)
CVE-2026-77774	8.6	—	Adobe	Adobe Commerce	CWE-863	Adobe Commerce \| Incorrect Authorization (CWE-863)
CVE-2026-79721	8.6	—	mlflow	mlflow	CWE-829	Code execution can occur in versions of the MLflow platform running version 0…
CVE-2026-80097	8.6	—	Microsoft	Microsoft Authenticator for Android	CWE-287	Microsoft Authenticator Elevation of Privilege Vulnerability
CVE-2026-86712	8.6	—	siyuan-note	siyuan	CWE-79	SiYuan before 3.8.2 Remote Code Execution via Clipboard
CVE-2026-86720	8.6	—	WWBN	AVideo	CWE-639	WWBN AVideo Missing Authorization via resendRestreamer.json.php
CVE-2026-86722	8.6	—	WWBN	AVideo	CWE-287	AVideo Authentication Bypass via SQL Cache Invalidation
CVE-2026-86723	8.6	—	WWBN	AVideo	CWE-287	AVideo LoginControl PGP Authentication Bypass via verifyChallenge
CVE-2026-86733	8.6	—	grokability	snipe-it	CWE-78	Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore
CVE-2026-67378	8.5	—	Microsoft	Microsoft SQL Server 2019 (CU 32)	CWE-822	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67379	8.5	—	Microsoft	Microsoft SQL Server 2019 (CU 32)	CWE-121	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-67636	8.5	—	Microsoft	Microsoft SQL Server 2019 (CU 32)	CWE-125	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-74860	8.5	—	Red Hat	Red Hat Enterprise Linux 10	CWE-763	Libxml2: double-free/uaf in libxml2 python bindings
CVE-2026-75993	8.5	—	Adobe	ColdFusion 2025	CWE-79	ColdFusion \| Cross-site Scripting (Reflected XSS) (CWE-79)
CVE-2026-77091	8.5	—	Commvault	Commvault Cloud	CWE-22	DataCube Security Feature Bypass
CVE-2026-85384	8.5	—	TP-Link Systems Inc.	RE210 AC750	CWE-121	Authenticated Stack-Based Buffer Overflow in RE210 AC750 Configuration Import
CVE-2026-69479	8.4	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows NTFS Remote Code Execution Vulnerability
CVE-2026-69638	8.4	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows NTFS Remote Code Execution Vulnerability
CVE-2026-75999	8.4	—	Adobe	ColdFusion 2025	CWE-20	ColdFusion \| Improper Input Validation (CWE-20)
CVE-2026-77503	8.4	—	Microsoft	Windows 10 Version 1607	CWE-125	Windows NTFS Elevation of Privilege Vulnerability
CVE-2026-77827	8.4	—	Maono	Maono Link	CWE-428	Maono Link local privilege escalation
CVE-2026-86819	8.4	—	Waves Audio Ltd.	Waves Central	CWE-862	Waves Central local privilege escalation via Improper XPC Client Authenticati…
CVE-2026-19203	8.3	—	Eclipse Foundation	Eclipse Jetty	CWE-444	A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty ser…
CVE-2026-69646	8.3	—	Microsoft	Skype for Business Server 2015 CU13	CWE-347	Skype for Business Spoofing Vulnerability
CVE-2026-77104	8.3	—	Commvault	Commvault Cloud	CWE-22	CommServe Path Traversal
CVE-2026-81821	8.3	—	AVEVA	Pipeline Integrity Monitor	CWE-321	AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key
CVE-2026-81822	8.3	—	AVEVA	Pipeline Integrity Monitor	CWE-327	AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algor…
CVE-2026-53938	8.2	—	OpenIDC	cjose	CWE-122	OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A…
CVE-2026-69820	8.2	—	Microsoft	Windows 10 Version 21H2	CWE-122	Windows Hello Elevation of Privilege Vulnerability
CVE-2026-69846	8.2	—	Microsoft	Windows 10 Version 1607	CWE-190	Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVE-2026-69874	8.2	—	Microsoft	Windows 10 Version 1809	CWE-822	Windows ALPC Elevation of Privilege Vulnerability
CVE-2026-69906	8.2	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVE-2026-72958	8.2	—	Microsoft	Windows 11 Version 24H2	CWE-415	Windows Credential Guard Elevation of Privilege Vulnerability
CVE-2026-72961	8.2	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2026-72962	8.2	—	Microsoft	Windows 10 Version 1809	CWE-122	Windows USB Video Driver Elevation of Privilege Vulnerability
CVE-2026-73310	8.2	—	XenForo	XenForo	CWE-863	XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass
CVE-2026-76191	8.2	—	Adobe	Adobe Animate 2023	CWE-94	Animate \| Improper Control of Generation of Code ('Code Injection') (CWE-94)
CVE-2026-76202	8.2	—	Adobe	Adobe Commerce	CWE-863	Adobe Commerce \| Incorrect Authorization (CWE-863)
CVE-2026-77968	8.2	—	Red Hat	Red Hat build of Apache Camel - HawtIO 4	CWE-269	Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to …
CVE-2026-81354	8.2	—	Microsoft	Windows 10 Version 1809	CWE-122	Windows Hello Elevation of Privilege Vulnerability
CVE-2026-81356	8.2	—	Microsoft	Visual Studio Code	CWE-444	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81357	8.2	—	Microsoft	Visual Studio Code	CWE-918	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81378	8.2	—	Microsoft	Visual Studio Code	CWE-436	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81379	8.2	—	Microsoft	Visual Studio Code	CWE-636	Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81994	8.2	—	Adobe	Adobe Acrobat	CWE-1321	Acrobat Reader \| Improperly Controlled Modification of Object Prototype Attri…
CVE-2026-83939	8.2	—	Microsoft	Windows 11 version 26H1	CWE-822	Windows Secure Kernel Mode Elevation of Privilege Vulnerability
CVE-2026-86600	8.2	—	Snowflake	Snowflake Connector for Python	CWE-441	Workload identity attestation generated before login host validation in Snowf…
CVE-2026-47297	8.1	—	Microsoft	Microsoft SQL Server 2019 (CU 32)	CWE-502	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2026-55007	8.1	—	Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	CWE-415	Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2026-69325	8.1	—	Microsoft	Windows 10 Version 1607	CWE-122	Microsoft JScript Remote Code Execution Vulnerability
CVE-2026-69380	8.1	—	Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	CWE-862	Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-69438	8.1	—	Microsoft	Windows 10 Version 1607	CWE-681	Microsoft JScript Remote Code Execution Vulnerability
CVE-2026-69510	8.1	—	Microsoft	Windows 10 Version 1607	CWE-121	Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-69524	8.1	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows Active Directory Domain Services Remote Code Execution Vulnerability
CVE-2026-69530	8.1	—	Microsoft	Windows 10 Version 1809	CWE-416	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vu…
CVE-2026-69546	8.1	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows Active Directory Domain Services Remote Code Execution Vulnerability
CVE-2026-69620	8.1	—	Microsoft	Windows 10 Version 1607	CWE-121	Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-69680	8.1	—	Microsoft	Windows 10 Version 1607	CWE-346	Windows DNS Spoofing Vulnerability
CVE-2026-69732	8.1	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerab…
CVE-2026-69782	8.1	—	Microsoft	Windows 10 Version 1607	CWE-362	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-69786	8.1	—	Microsoft	Windows 10 Version 1607	CWE-122	Windows Text Shaping Remote Code Execution Vulnerability
CVE-2026-69813	8.1	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-69827	8.1	—	Microsoft	Windows 10 Version 1607	CWE-362	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-69858	8.1	—	Microsoft	Windows Server 2022	CWE-416	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-69989	8.1	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows DNS Server Remote Code Execution Vulnerability
CVE-2026-70342	8.1	—	Microsoft	Windows 10 Version 1607	CWE-416	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerab…
CVE-2026-70563	8.1	—	Microsoft	Windows 10 Version 1607	CWE-59	Windows Shell Spoofing Vulnerability

Results continue: ranks 401–1564.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-08 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.