{ "day": "2026-09-10", "boundary": "UTC calendar day", "published_count": 384, "by_severity": { "CRITICAL": 59, "HIGH": 170, "MEDIUM": 135, "LOW": 7 }, "kev_count": 0, "exploit_reference_count": 0, "awaiting_enrichment_count": 13, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-0302", "cvss_base": 1.1, "cvss_severity": "LOW", "epss_score": 0.00824, "epss_percentile": 0.55217, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Checkov by Prisma Cloud", "cwe": "CWE-78", "title": "Checkov by Prisma Cloud: OS Command Injection Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0302" }, { "rank": 2, "cve_id": "CVE-2026-18351", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00768, "epss_percentile": 0.53444, "kev": false, "kev_due_at": null, "vendor": "addonsorg", "product": "Drag and Drop File Upload for Elementor Forms", "cwe": "CWE-434", "title": "Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18351" }, { "rank": 3, "cve_id": "CVE-2026-18386", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00746, "epss_percentile": 0.52707, "kev": false, "kev_due_at": null, "vendor": "cssimmon", "product": "WP BackItUp Community Edition", "cwe": "CWE-22", "title": "WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18386" }, { "rank": 4, "cve_id": "CVE-2026-15019", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00676, "epss_percentile": 0.5016, "kev": false, "kev_due_at": null, "vendor": "kamalyon", "product": "Direct Download for WooCommerce", "cwe": "CWE-22", "title": "Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15019" }, { "rank": 5, "cve_id": "CVE-2026-19583", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": 0.006, "epss_percentile": 0.46786, "kev": false, "kev_due_at": null, "vendor": "Rapid7", "product": "Velociraptor", "cwe": "CWE-732", "title": "Velociraptor Required Permissions bypass by using client monitoring queries", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19583" }, { "rank": 6, "cve_id": "CVE-2026-78374", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00538, "epss_percentile": 0.43597, "kev": false, "kev_due_at": null, "vendor": "joomlart.com", "product": "T4 Page Builder extension for Joomla", "cwe": "CWE-201", "title": "Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78374" }, { "rank": 7, "cve_id": "CVE-2026-78082", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.0049, "epss_percentile": 0.40578, "kev": false, "kev_due_at": null, "vendor": "joomshaper.com", "product": "SP Property extension for Joomla", "cwe": "CWE-89", "title": "Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78082" }, { "rank": 8, "cve_id": "CVE-2026-0309", "cvss_base": 4, "cvss_severity": "MEDIUM", "epss_score": 0.00447, "epss_percentile": 0.37701, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-78", "title": "PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0309" }, { "rank": 9, "cve_id": "CVE-2026-44950", "cvss_base": 9.5, "cvss_severity": "CRITICAL", "epss_score": 0.00438, "epss_percentile": 0.36929, "kev": false, "kev_due_at": null, "vendor": "SUSE", "product": "Container suse/kiosk/tigervnc-x11vnc:1.14-63.8", "cwe": "CWE-122", "title": "fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44950" }, { "rank": 10, "cve_id": "CVE-2026-78302", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00436, "epss_percentile": 0.36831, "kev": false, "kev_due_at": null, "vendor": "joomshaper.com", "product": "SP Property extension for Joomla", "cwe": "CWE-79", "title": "Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78302" }, { "rank": 11, "cve_id": "CVE-2026-84063", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": 0.00435, "epss_percentile": 0.36677, "kev": false, "kev_due_at": null, "vendor": "D-ZERO CO.,LTD.", "product": "BurgerEditor", "cwe": "CWE-434", "title": "BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowing arbitrary PHP code to be executed may be caused.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84063" }, { "rank": 12, "cve_id": "CVE-2026-78303", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00428, "epss_percentile": 0.36075, "kev": false, "kev_due_at": null, "vendor": "joomshaper.com", "product": "SP Property extension for Joomla", "cwe": "CWE-201", "title": "Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78303" }, { "rank": 13, "cve_id": "CVE-2026-59679", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00411, "epss_percentile": 0.34569, "kev": false, "kev_due_at": null, "vendor": "SUSE", "product": "Container suse/kiosk/tigervnc-x11vnc:1.14-63.8", "cwe": "CWE-787", "title": "fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59679" }, { "rank": 14, "cve_id": "CVE-2026-88273", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00371, "epss_percentile": 0.30477, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-78", "title": "GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88273" }, { "rank": 15, "cve_id": "CVE-2026-88274", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00371, "epss_percentile": 0.30477, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-78", "title": "GV-LPC2011/LPC2211 - Wireless SSID Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88274" }, { "rank": 16, "cve_id": "CVE-2026-88275", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00371, "epss_percentile": 0.30477, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-78", "title": "GV-LPC2011/LPC2211 - Wireless WPA-PSK Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88275" }, { "rank": 17, "cve_id": "CVE-2026-88276", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00371, "epss_percentile": 0.30478, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "cwe": "CWE-78", "title": "GV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88276" }, { "rank": 18, "cve_id": "CVE-2026-88288", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00366, "epss_percentile": 0.29892, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-36", "title": "GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88288" }, { "rank": 19, "cve_id": "CVE-2026-88277", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00343, "epss_percentile": 0.27403, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "cwe": "CWE-78", "title": "GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88277" }, { "rank": 20, "cve_id": "CVE-2026-0310", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00337, "epss_percentile": 0.2676, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-787", "title": "PAN-OS: Buffer Overflow Vulnerability via XML Processing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0310" }, { "rank": 21, "cve_id": "CVE-2026-5399", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00334, "epss_percentile": 0.26403, "kev": false, "kev_due_at": null, "vendor": "davidanderson", "product": "Redux Framework", "cwe": "CWE-79", "title": "Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value", "url": "https://www.cve.org/CVERecord?id=CVE-2026-5399" }, { "rank": 22, "cve_id": "CVE-2026-88289", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00327, "epss_percentile": 0.25601, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - Multiple Pre-Authentication Stack Buffer Overflows in VLSVR Request Handlers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88289" }, { "rank": 23, "cve_id": "CVE-2026-78084", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00325, "epss_percentile": 0.25307, "kev": false, "kev_due_at": null, "vendor": "joomshaper.com", "product": "SP Property extension for Joomla", "cwe": "CWE-284", "title": "Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78084" }, { "rank": 24, "cve_id": "CVE-2026-7188", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00321, "epss_percentile": 0.24848, "kev": false, "kev_due_at": null, "vendor": "Armiya Information Technologies Ltd. Co.", "product": "Access Control System", "cwe": "CWE-89", "title": "SQLi in Armiya Information Technologies' Access Control System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-7188" }, { "rank": 25, "cve_id": "CVE-2026-88287", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00313, "epss_percentile": 0.23989, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 -ONVIF Discovery Probe Scopes Stack-Frame Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88287" }, { "rank": 26, "cve_id": "CVE-2026-87803", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00308, "epss_percentile": 0.23308, "kev": false, "kev_due_at": null, "vendor": "Countly", "product": "countly-server", "cwe": "CWE-863", "title": "An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87803" }, { "rank": 27, "cve_id": "CVE-2026-87933", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00307, "epss_percentile": 0.23214, "kev": false, "kev_due_at": null, "vendor": "DaveGamble", "product": "cJSON", "cwe": "CWE-119", "title": "DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87933" }, { "rank": 28, "cve_id": "CVE-2026-88272", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.003, "epss_percentile": 0.22454, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-78", "title": "GV-LPC2011/LPC2211 - Stored Administrator-Username Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88272" }, { "rank": 29, "cve_id": "CVE-2026-88282", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.003, "epss_percentile": 0.22453, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "cwe": "CWE-78", "title": "GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88282" }, { "rank": 30, "cve_id": "CVE-2026-13745", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": 0.00299, "epss_percentile": 0.22393, "kev": false, "kev_due_at": null, "vendor": "Google Cloud", "product": "Gemini CLI", "cwe": "CWE-20", "title": "Arbitrary Code Execution in Gemini CLI via Symlinked Environment Variables", "url": "https://www.cve.org/CVERecord?id=CVE-2026-13745" }, { "rank": 31, "cve_id": "CVE-2026-84062", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00297, "epss_percentile": 0.22139, "kev": false, "kev_due_at": null, "vendor": "D-ZERO CO.,LTD.", "product": "BurgerEditor", "cwe": "CWE-639", "title": "BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product may be caused.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84062" }, { "rank": 32, "cve_id": "CVE-2026-67593", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00288, "epss_percentile": 0.21223, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-306", "title": "Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-67593" }, { "rank": 33, "cve_id": "CVE-2026-82925", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00288, "epss_percentile": 0.2119, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Site Reviews", "cwe": "CWE-502", "title": "Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82925" }, { "rank": 34, "cve_id": "CVE-2026-49363", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00286, "epss_percentile": 0.20973, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-306", "title": "Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49363" }, { "rank": 35, "cve_id": "CVE-2026-57967", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00279, "epss_percentile": 0.2021, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-306", "title": "Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57967" }, { "rank": 36, "cve_id": "CVE-2026-88285", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": 0.00274, "epss_percentile": 0.19587, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-306", "title": "GV-LPC2011/LPC2211 - Unauthenticated PTZ Control Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88285" }, { "rank": 37, "cve_id": "CVE-2026-88278", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00268, "epss_percentile": 0.18858, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "cwe": "CWE-294", "title": "GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88278" }, { "rank": 38, "cve_id": "CVE-2026-0308", "cvss_base": 1.1, "cvss_severity": "LOW", "epss_score": 0.00265, "epss_percentile": 0.18356, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cloud NGFW", "cwe": "CWE-79", "title": "PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0308" }, { "rank": 39, "cve_id": "CVE-2026-88286", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00263, "epss_percentile": 0.18038, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-400", "title": "GV-LPC2011/LPC2211 - PTZ Connection-State Accept-Loop Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88286" }, { "rank": 40, "cve_id": "CVE-2026-88290", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00263, "epss_percentile": 0.18037, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-400", "title": "GV-LPC2011/LPC2211 - Unauthenticated VLSVR Slowloris and Memory Resource Exhaustion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88290" }, { "rank": 41, "cve_id": "CVE-2026-8323", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00254, "epss_percentile": 0.16868, "kev": false, "kev_due_at": null, "vendor": "Armiya Information Technologies Ltd. Co.", "product": "Access Control System", "cwe": "CWE-601", "title": "Open Redirect in Armiya Information Technologies' Access Control System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-8323" }, { "rank": 42, "cve_id": "CVE-2026-42804", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": 0.00254, "epss_percentile": 0.16863, "kev": false, "kev_due_at": null, "vendor": "Bosch Sensortec", "product": "BHI360_SensorAPI (C-Library)", "cwe": "CWE-121", "title": "A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875). The parser trusts the first payload byte of a debug frame as the message length (msg_length) and copies that many bytes into a fixed-size 17-byte stack buffer (debug_msg) via memcpy without performing any bounds checking. A locally or physically positioned attacker (e.g., via a malicious sensor, counterfeit hardware module, or a Man-in-the-Middle on the communication bus) can exploit this vulnerability by injecting a crafted debug frame with a length byte exceeding 16. This corrupts adjacent stack data, including the saved return address. Furthermore, because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (Denial of Service).", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42804" }, { "rank": 43, "cve_id": "CVE-2026-88279", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16565, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - ONVIF CreateUsers Username/Password Stack-Frame Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88279" }, { "rank": 44, "cve_id": "CVE-2026-88280", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16565, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88280" }, { "rank": 45, "cve_id": "CVE-2026-88281", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16565, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - ONVIF DeleteUsers Repeated-Element Stack Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88281" }, { "rank": 46, "cve_id": "CVE-2026-88283", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16566, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88283" }, { "rank": 47, "cve_id": "CVE-2026-88284", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00251, "epss_percentile": 0.16565, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211 -", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Frame Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88284" }, { "rank": 48, "cve_id": "CVE-2026-15889", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.0025, "epss_percentile": 0.16311, "kev": false, "kev_due_at": null, "vendor": "arubadev", "product": "Aruba HiSpeed Cache", "cwe": "CWE-79", "title": "Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15889" }, { "rank": 49, "cve_id": "CVE-2026-88763", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.0025, "epss_percentile": 0.16332, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Service Interconnect 2", "cwe": "CWE-674", "title": "Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88763" }, { "rank": 50, "cve_id": "CVE-2026-4657", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00241, "epss_percentile": 0.15225, "kev": false, "kev_due_at": null, "vendor": "sunny_johal", "product": "Easy Google Fonts", "cwe": "CWE-79", "title": "Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4657" }, { "rank": 51, "cve_id": "CVE-2026-88268", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00238, "epss_percentile": 0.14831, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPCLPC2011/2211", "cwe": "CWE-121", "title": "GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88268" }, { "rank": 52, "cve_id": "CVE-2026-76562", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00236, "epss_percentile": 0.14598, "kev": false, "kev_due_at": null, "vendor": "otwthemes", "product": "Sidebar Manager Light", "cwe": "CWE-79", "title": "Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76562" }, { "rank": 53, "cve_id": "CVE-2026-14873", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00235, "epss_percentile": 0.1447, "kev": false, "kev_due_at": null, "vendor": "rubenw", "product": "Bulk Password Reset", "cwe": "CWE-862", "title": "Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14873" }, { "rank": 54, "cve_id": "CVE-2026-88271", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00232, "epss_percentile": 0.14022, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-862", "title": "GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88271" }, { "rank": 55, "cve_id": "CVE-2026-49362", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00227, "epss_percentile": 0.13341, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-306", "title": "Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49362" }, { "rank": 56, "cve_id": "CVE-2026-0304", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00218, "epss_percentile": 0.12235, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Cortex XDR Broker VM", "cwe": "CWE-88", "title": "Cortex XDR Broker VM: Privilege Escalation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0304" }, { "rank": 57, "cve_id": "CVE-2026-85645", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00215, "epss_percentile": 0.11873, "kev": false, "kev_due_at": null, "vendor": "10web", "product": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder", "cwe": "CWE-79", "title": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85645" }, { "rank": 58, "cve_id": "CVE-2026-88770", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00213, "epss_percentile": 0.11584, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "cwe": "CWE-307", "title": "Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88770" }, { "rank": 59, "cve_id": "CVE-2026-18594", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00213, "epss_percentile": 0.11613, "kev": false, "kev_due_at": null, "vendor": "vsourz1td", "product": "Advanced Contact form 7 DB", "cwe": "CWE-862", "title": "Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18594" }, { "rank": 60, "cve_id": "CVE-2026-84939", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00212, "epss_percentile": 0.11457, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache FreeMarker", "cwe": "CWE-23", "title": "Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84939" }, { "rank": 61, "cve_id": "CVE-2026-88270", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0021, "epss_percentile": 0.11241, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-862", "title": "GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88270" }, { "rank": 62, "cve_id": "CVE-2026-87870", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00207, "epss_percentile": 0.10808, "kev": false, "kev_due_at": null, "vendor": "Saturday Drive", "product": "Ninja Forms - Scheduled Exports", "cwe": "CWE-79", "title": "Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87870" }, { "rank": 63, "cve_id": "CVE-2026-15823", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00207, "epss_percentile": 0.10884, "kev": false, "kev_due_at": null, "vendor": "builderall", "product": "Builderall for WordPress", "cwe": "CWE-862", "title": "Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15823" }, { "rank": 64, "cve_id": "CVE-2026-78083", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00205, "epss_percentile": 0.10623, "kev": false, "kev_due_at": null, "vendor": "joomshaper.com", "product": "SP Property extension for Joomla", "cwe": "CWE-352", "title": "Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78083" }, { "rank": 65, "cve_id": "CVE-2026-42807", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00204, "epss_percentile": 0.10404, "kev": false, "kev_due_at": null, "vendor": "Bosch Sensortec", "product": "COINES_SDK", "cwe": "CWE-122", "title": "A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The bridge decoder ({{bridge_decoder.c}}) trusts the packet length field provided by the external device and forwards it to the host response queue ({{mqueue_add_data}}) without validating the bounds of the destination buffer. A malicious or compromised USB or Bluetooth Low Energy (BLE) peripheral can advertise a payload size up to ~3 KB, which exceeds the default queue slot size of 255 bytes. This results in an unbounded heap overwrite ({{memcpy}}), corrupting adjacent heap metadata on the host system when processing the device's response.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42807" }, { "rank": 66, "cve_id": "CVE-2026-88269", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.1, "kev": false, "kev_due_at": null, "vendor": "GeoVision Inc.", "product": "GV-LPC2011/LPC2211", "cwe": "CWE-862", "title": "GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88269" }, { "rank": 67, "cve_id": "CVE-2026-15820", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.10027, "kev": false, "kev_due_at": null, "vendor": "builderall", "product": "Builderall for WordPress", "cwe": "CWE-79", "title": "Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15820" }, { "rank": 68, "cve_id": "CVE-2026-82582", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.002, "epss_percentile": 0.09964, "kev": false, "kev_due_at": null, "vendor": "SHIRASAGI Project", "product": "SHIRASAGI", "cwe": "CWE-639", "title": "An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82582" }, { "rank": 69, "cve_id": "CVE-2026-15796", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00193, "epss_percentile": 0.09089, "kev": false, "kev_due_at": null, "vendor": "builderall", "product": "Builderall for WordPress", "cwe": "CWE-79", "title": "Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15796" }, { "rank": 70, "cve_id": "CVE-2026-42808", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00191, "epss_percentile": 0.08792, "kev": false, "kev_due_at": null, "vendor": "Bosch Sensortec", "product": "COINES_SDK", "cwe": "CWE-120", "title": "An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the boundaries of the caller-provided destination buffer. Internally, the stream processing mechanism in {{comm_intf_process_stream_response()}} discards the requested {{number_of_samples}} argument and copies the entirety of the streaming ring buffer's accumulated data into {{coines_stream_rsp_buf}}. Subsequently, {{coines_read_stream_sensor_data()}} unconditionally executes a {{memcpy}} of the ring buffer size into the caller-provided buffer without verifying if the destination memory allocation is large enough. A malicious or compromised hardware board connected via USB or BLE can exploit this by streaming a high volume of sensor samples, causing a heap or stack-based buffer overflow on the host desktop environment. This can result in a Denial of Service (DoS) or potential arbitrary code execution on the host machine.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42808" }, { "rank": 71, "cve_id": "CVE-2026-19584", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": 0.0019, "epss_percentile": 0.0873, "kev": false, "kev_due_at": null, "vendor": "Rapid7", "product": "Velociraptor", "cwe": "CWE-94", "title": "Velociraptor VQL injection during notebook restore from backup", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19584" }, { "rank": 72, "cve_id": "CVE-2026-80351", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00182, "epss_percentile": 0.07872, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Camel K", "cwe": "CWE-95", "title": "Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80351" }, { "rank": 73, "cve_id": "CVE-2026-57822", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00171, "epss_percentile": 0.06699, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-502", "title": "Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57822" }, { "rank": 74, "cve_id": "CVE-2026-80352", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00164, "epss_percentile": 0.05875, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Camel K", "cwe": "CWE-94", "title": "Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80352" }, { "rank": 75, "cve_id": "CVE-2026-49364", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00162, "epss_percentile": 0.0575, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-306", "title": "Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49364" }, { "rank": 76, "cve_id": "CVE-2026-75880", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00159, "epss_percentile": 0.05362, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Artemis", "cwe": "CWE-1333", "title": "Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75880" }, { "rank": 77, "cve_id": "CVE-2026-82079", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00157, "epss_percentile": 0.0519, "kev": false, "kev_due_at": null, "vendor": "Nintendo", "product": "Nintendo Switch", "cwe": "CWE-121", "title": "Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82079" }, { "rank": 78, "cve_id": "CVE-2026-42806", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00154, "epss_percentile": 0.04801, "kev": false, "kev_due_at": null, "vendor": "Bosch Sensortec", "product": "BME690 SensorAPI (C)", "cwe": "CWE-125", "title": "An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in read_all_field_data (bme69x.c). The driver prefetches heater configuration registers into a contiguous 30-byte stack buffer (set_val) mapping IDAC, RES_HEAT, and GAS_WAIT tables. When parsing sensor field data, the gas_index is extracted using a 4-bit mask (0..15) but lacks boundary verification against the valid range (0..9). An attacker or a compromised peripheral mimicking a sensor on the I2C/SPI bus could return a payload with a gas index value of 10 or higher. This causes the driver to perform an out-of-bounds array access (set_val[20 + gas_index]), reading up to 6 bytes past the stack buffer. The leaked out-of-bounds byte is then written into the public gas_wait field, which may lead to measurement corruption or leak adjacent stack memory when telemetered or logged.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42806" }, { "rank": 79, "cve_id": "CVE-2026-81635", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.04638, "kev": false, "kev_due_at": null, "vendor": "SHIRASAGI Project", "product": "SHIRASAGI", "cwe": "CWE-79", "title": "A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81635" }, { "rank": 80, "cve_id": "CVE-2026-19439", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00145, "epss_percentile": 0.04141, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Ultimate Gift Cards for WooCommerce", "cwe": "CWE-200", "title": "Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19439" }, { "rank": 81, "cve_id": "CVE-2026-42805", "cvss_base": 8.4, "cvss_severity": "HIGH", "epss_score": 0.00142, "epss_percentile": 0.03821, "kev": false, "kev_due_at": null, "vendor": "Bosch Sensortec", "product": "BHI385 SensorAPI (C Library)", "cwe": "CWE-121", "title": "A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (located in bhi385_parse.c). The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without enforcing bounds checks or clamping the value. When copying the payload into a fixed-size stack buffer of 17 bytes (uint8_t debug_msg[17]) via memcpy, providing a length byte greater than 16 causes the function to write past the allocated stack boundary. This memory corruption can be triggered by a malicious or compromised sensor or bus participant, leading to a firmware crash, Denial of Service (DoS), or potentially the execution of arbitrary code via adjacent stack data corruption.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42805" }, { "rank": 82, "cve_id": "CVE-2026-80354", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.0014, "epss_percentile": 0.0369, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Camel K", "cwe": "CWE-639", "title": "Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80354" }, { "rank": 83, "cve_id": "CVE-2026-78361", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": 0.00136, "epss_percentile": 0.03381, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "zipMoney(Zip Co) Payments Plugin for WooCommerce", "cwe": "CWE-862", "title": "zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78361" }, { "rank": 84, "cve_id": "CVE-2026-19436", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00136, "epss_percentile": 0.03381, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Ultimate Gift Cards for WooCommerce", "cwe": "CWE-284", "title": "Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19436" }, { "rank": 85, "cve_id": "CVE-2026-77770", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00132, "epss_percentile": 0.03105, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "miniOrange 2FA", "cwe": "CWE-862", "title": "miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77770" }, { "rank": 86, "cve_id": "CVE-2026-77771", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00132, "epss_percentile": 0.03105, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "miniOrange 2FA", "cwe": "CWE-287", "title": "miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77771" }, { "rank": 87, "cve_id": "CVE-2026-81431", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00132, "epss_percentile": 0.03106, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Registration Form for WooCommerce", "cwe": "CWE-269", "title": "Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81431" }, { "rank": 88, "cve_id": "CVE-2026-19840", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00132, "epss_percentile": 0.03106, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Notiqoo", "cwe": "CWE-863", "title": "Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19840" }, { "rank": 89, "cve_id": "CVE-2026-0303", "cvss_base": 2.4, "cvss_severity": "LOW", "epss_score": 0.00128, "epss_percentile": 0.02812, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Checkov by Prisma Cloud", "cwe": "CWE-829", "title": "Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0303" }, { "rank": 90, "cve_id": "CVE-2026-88265", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.00119, "epss_percentile": 0.02007, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Hardened Images", "cwe": "CWE-59", "title": "Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88265" }, { "rank": 91, "cve_id": "CVE-2026-88264", "cvss_base": 5.6, "cvss_severity": "MEDIUM", "epss_score": 0.00117, "epss_percentile": 0.01883, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Hardened Images", "cwe": "CWE-59", "title": "Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88264" }, { "rank": 92, "cve_id": "CVE-2026-0307", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00105, "epss_percentile": 0.0116, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "GlobalProtect App", "cwe": "CWE-426", "title": "GlobalProtect App: Local Privilege Escalation Vulnerabilities", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0307" }, { "rank": 93, "cve_id": "CVE-2026-0306", "cvss_base": 5.8, "cvss_severity": "MEDIUM", "epss_score": 0.00105, "epss_percentile": 0.01175, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "cwe": "CWE-693", "title": "Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0306" }, { "rank": 94, "cve_id": "CVE-2026-84042", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.001, "epss_percentile": 0.00917, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Hardened Images", "cwe": "CWE-269", "title": "Crun: crun: rootful krun with passt executes container payload as host root", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84042" }, { "rank": 95, "cve_id": "CVE-2026-0305", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00099, "epss_percentile": 0.00887, "kev": false, "kev_due_at": null, "vendor": "Palo Alto Networks", "product": "Prisma Access Agent", "cwe": "CWE-200", "title": "Prisma Access Agent: Information Disclosure Vulnerability on Linux", "url": "https://www.cve.org/CVERecord?id=CVE-2026-0305" }, { "rank": 96, "cve_id": "CVE-2026-68487", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WebPros", "product": "Plesk", "cwe": "CWE-36", "title": "Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68487" }, { "rank": 97, "cve_id": "CVE-2026-68488", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WebPros", "product": "Plesk", "cwe": "CWE-367", "title": "A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68488" }, { "rank": 98, "cve_id": "CVE-2026-89094", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Forgejo", "product": "Forgejo", "cwe": "CWE-1336", "title": "Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89094" }, { "rank": 99, "cve_id": "CVE-2026-9163", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "GIS Informatics", "product": "GisLab Laboratory Management System", "cwe": "CWE-89", "title": "SQLi in GIS Informatics' GisLab Laboratory Management System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-9163" }, { "rank": 100, "cve_id": "CVE-2026-52098", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-94", "title": "An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52098" }, { "rank": 101, "cve_id": "CVE-2026-78573", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "ContextForge MCP Gateway", "cwe": "CWE-1392", "title": "IBM ContextForge MCP Gateway is affected by use of default credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78573" }, { "rank": 102, "cve_id": "CVE-2026-79724", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-78", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-79724" }, { "rank": 103, "cve_id": "CVE-2026-81204", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81204" }, { "rank": 104, "cve_id": "CVE-2026-81467", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "ThinOS 10", "cwe": "CWE-78", "title": "Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81467" }, { "rank": 105, "cve_id": "CVE-2026-85025", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-863", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85025" }, { "rank": 106, "cve_id": "CVE-2026-88018", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "rclone", "product": "rclone", "cwe": "CWE-287", "title": "rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88018" }, { "rank": 107, "cve_id": "CVE-2026-81048", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "ThinOS 10", "cwe": "CWE-77", "title": "Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81048" }, { "rank": 108, "cve_id": "CVE-2026-82100", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-22", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82100" }, { "rank": 109, "cve_id": "CVE-2026-82107", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-287", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82107" }, { "rank": 110, "cve_id": "CVE-2026-65639", "cvss_base": 9.5, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WebPros", "product": "ConfigServer Security & Firewall", "cwe": "CWE-78", "title": "OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65639" }, { "rank": 111, "cve_id": "CVE-2026-88062", "cvss_base": 9.5, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "diegosouzapw", "product": "OmniRoute", "cwe": "CWE-94", "title": "OmniRoute ACP Custom-Agent Remote Code Execution (RCE)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88062" }, { "rank": 112, "cve_id": "CVE-2026-81046", "cvss_base": 9.4, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "ThinOS 10", "cwe": "CWE-284", "title": "Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81046" }, { "rank": 113, "cve_id": "CVE-2026-75940", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Lenovo", "product": "Health Application", "cwe": "CWE-798", "title": "A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75940" }, { "rank": 114, "cve_id": "CVE-2026-81800", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Par avisverifies", "product": "Verified Reviews (Avis Vérifiés)", "cwe": "CWE-89", "title": "WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81800" }, { "rank": 115, "cve_id": "CVE-2026-88860", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Cap-go", "product": "capgo.app", "cwe": "CWE-863", "title": "Capgo Authorization Bypass via Stale Channel Permission Overrides", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88860" }, { "rank": 116, "cve_id": "CVE-2026-88864", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Cap-go", "product": "capgo.app", "cwe": "CWE-284", "title": "Capgo SSO Provider Authentication Bypass via PostgREST Direct Write", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88864" }, { "rank": 117, "cve_id": "CVE-2026-88866", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-79", "title": "WWBN AVideo LoginControl Stored XSS via User-Agent Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88866" }, { "rank": 118, "cve_id": "CVE-2026-88867", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-79", "title": "WWBN AVideo Stored XSS via Category Name and Icon Class", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88867" }, { "rank": 119, "cve_id": "CVE-2026-88868", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-79", "title": "AVideo LiveLinks Stored XSS via title and description fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88868" }, { "rank": 120, "cve_id": "CVE-2026-88869", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-79", "title": "AVideo AD_Server Stored XSS via log.php label parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88869" }, { "rank": 121, "cve_id": "CVE-2026-88877", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-639", "title": "Traefik v3.7.0 Authentication Bypass via from-to-www-redirect", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88877" }, { "rank": 122, "cve_id": "CVE-2026-88899", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "knowns-dev", "product": "knowns", "cwe": "CWE-73", "title": "knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88899" }, { "rank": 123, "cve_id": "CVE-2026-89042", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "krakenjs", "product": "passport-saml-encrypted", "cwe": "CWE-347", "title": "passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89042" }, { "rank": 124, "cve_id": "CVE-2026-65638", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WebPros", "product": "ConfigServer Security & Firewall", "cwe": "CWE-78", "title": "Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed the vulnerability in version 16.30. Other forks or independently maintained versions of ConfigServer Security & Firewall (CSF) may also be affected and should be evaluated independently.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65638" }, { "rank": 125, "cve_id": "CVE-2026-88880", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "renovatebot", "product": "renovate", "cwe": "CWE-601", "title": "Renovate before 44.11.3 Credential Exfiltration via Link Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88880" }, { "rank": 126, "cve_id": "CVE-2026-88881", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "renovatebot", "product": "renovate", "cwe": "CWE-601", "title": "Renovate before 44.11.3 Credential Exfiltration via Link Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88881" }, { "rank": 127, "cve_id": "CVE-2026-88882", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "renovatebot", "product": "renovate", "cwe": "CWE-601", "title": "Renovate before 44.11.2 Credential Exfiltration via Link Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88882" }, { "rank": 128, "cve_id": "CVE-2026-88887", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "renovatebot", "product": "renovate", "cwe": "CWE-601", "title": "Renovate before 44.11.2 Credential Exfiltration via Link Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88887" }, { "rank": 129, "cve_id": "CVE-2026-19646", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Common Licensing", "cwe": "CWE-1149", "title": "Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19646" }, { "rank": 130, "cve_id": "CVE-2026-45764", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "OISF", "product": "suricata", "cwe": "CWE-843", "title": "Suricata http2: protocol-change type confusion can lead to denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45764" }, { "rank": 131, "cve_id": "CVE-2026-80424", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-22", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80424" }, { "rank": 132, "cve_id": "CVE-2026-81468", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "ThinOS 10", "cwe": "CWE-78", "title": "Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81468" }, { "rank": 133, "cve_id": "CVE-2026-88007", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-287", "title": "Traefik HTTP/3 Backend NTLM Connection Reuse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88007" }, { "rank": 134, "cve_id": "CVE-2026-88044", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "rclone", "product": "rclone", "cwe": "CWE-863", "title": "rclone: RC per-server auth-proxy bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88044" }, { "rank": 135, "cve_id": "CVE-2026-89043", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "krakenjs", "product": "passport-saml-encrypted", "cwe": "CWE-347", "title": "passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89043" }, { "rank": 136, "cve_id": "CVE-2026-89086", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "OCaml", "product": "jose", "cwe": "CWE-347", "title": "In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89086" }, { "rank": 137, "cve_id": "CVE-2026-75624", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "App Connect Enterprise", "cwe": "CWE-863", "title": "IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75624" }, { "rank": 138, "cve_id": "CVE-2026-75777", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Aspera Enterprise WebApps", "cwe": "CWE-269", "title": "Multiple vulnerabilities in IBM Aspera Enterprise Webapps", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75777" }, { "rank": 139, "cve_id": "CVE-2026-76059", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-693", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-76059" }, { "rank": 140, "cve_id": "CVE-2026-78569", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-78", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78569" }, { "rank": 141, "cve_id": "CVE-2026-78571", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78571" }, { "rank": 142, "cve_id": "CVE-2026-78575", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-78", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-78575" }, { "rank": 143, "cve_id": "CVE-2026-79742", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-79742" }, { "rank": 144, "cve_id": "CVE-2026-81211", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-862", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81211" }, { "rank": 145, "cve_id": "CVE-2026-81550", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-78", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81550" }, { "rank": 146, "cve_id": "CVE-2026-81551", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-22", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81551" }, { "rank": 147, "cve_id": "CVE-2026-81554", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-22", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81554" }, { "rank": 148, "cve_id": "CVE-2026-81940", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-94", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81940" }, { "rank": 149, "cve_id": "CVE-2026-81941", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-284", "title": "Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81941" }, { "rank": 150, "cve_id": "CVE-2026-82092", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-36", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82092" }, { "rank": 151, "cve_id": "CVE-2026-82095", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-78", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82095" }, { "rank": 152, "cve_id": "CVE-2026-82097", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-918", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82097" }, { "rank": 153, "cve_id": "CVE-2026-82098", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-78", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82098" }, { "rank": 154, "cve_id": "CVE-2026-82099", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "DataStage on Cloud Pak for Data", "cwe": "CWE-78", "title": "DataStage on Cloud Pak for Data has several vulnerabilities due to open source software", "url": "https://www.cve.org/CVERecord?id=CVE-2026-82099" }, { "rank": 155, "cve_id": "CVE-2026-84889", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-22", "title": "A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem", "url": "https://www.cve.org/CVERecord?id=CVE-2026-84889" }, { "rank": 156, "cve_id": "CVE-2026-85228", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Amazon", "product": "Deep Java Library", "cwe": "CWE-190", "title": "Integer overflow in tensor buffer validation in Deep Java Library", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85228" }, { "rank": 157, "cve_id": "CVE-2026-88009", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "traefik", "product": "traefik", "cwe": "CWE-444", "title": "Traefik: Rootless HTTP/1 request-target routes as \"/\" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88009" }, { "rank": 158, "cve_id": "CVE-2026-89046", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "luben", "product": "zstd-jni", "cwe": "CWE-125", "title": "zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89046" }, { "rank": 159, "cve_id": "CVE-2026-16174", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Netskope", "product": "Endpoint DLP", "cwe": "CWE-190", "title": "Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16174" }, { "rank": 160, "cve_id": "CVE-2026-64836", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ICEcoder", "product": "ICEcoder", "cwe": "CWE-22", "title": "ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64836" }, { "rank": 161, "cve_id": "CVE-2026-64837", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ICEcoder", "product": "ICEcoder", "cwe": "CWE-78", "title": "ICEcoder through 8.1 OS Command Injection via lib/properties.php", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64837" }, { "rank": 162, "cve_id": "CVE-2026-64838", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ICEcoder", "product": "ICEcoder", "cwe": "CWE-22", "title": "ICEcoder through 8.1 Path Traversal via oldFileName Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64838" }, { "rank": 163, "cve_id": "CVE-2026-73693", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FileRun", "product": "FileRun", "cwe": "CWE-78", "title": "FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73693" }, { "rank": 164, "cve_id": "CVE-2026-75584", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "nasa-jpl", "product": "ION-DTN", "cwe": "CWE-617", "title": "ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75584" }, { "rank": 165, "cve_id": "CVE-2026-79987", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "craftcms", "product": "cms", "cwe": "CWE-470", "title": "Low-privilege RCE through element-search eager loading", "url": "https://www.cve.org/CVERecord?id=CVE-2026-79987" }, { "rank": 166, "cve_id": "CVE-2026-87962", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tdunning", "product": "t-digest", "cwe": "CWE-1284", "title": "t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87962" }, { "rank": 167, "cve_id": "CVE-2026-88861", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Cap-go", "product": "capgo.app", "cwe": "CWE-288", "title": "Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88861" }, { "rank": 168, "cve_id": "CVE-2026-88862", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Cap-go", "product": "capgo.app", "cwe": "CWE-863", "title": "Capgo API Key Manager Authentication Bypass via x-limited-key-id", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88862" }, { "rank": 169, "cve_id": "CVE-2026-88874", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-200", "title": "AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88874" }, { "rank": 170, "cve_id": "CVE-2026-88876", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WWBN", "product": "AVideo", "cwe": "CWE-200", "title": "AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88876" }, { "rank": 171, "cve_id": "CVE-2026-88893", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Openpanel-dev", "product": "openpanel", "cwe": "CWE-200", "title": "OpenPanel Unauthenticated Share Lookup Information Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88893" }, { "rank": 172, "cve_id": "CVE-2026-88939", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "knowns-dev", "product": "knowns", "cwe": "CWE-863", "title": "knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88939" }, { "rank": 173, "cve_id": "CVE-2026-88959", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "anchorcms", "product": "Anchor CMS", "cwe": "CWE-862", "title": "Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88959" }, { "rank": 174, "cve_id": "CVE-2026-4129", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "NI", "product": "SystemLink", "cwe": "CWE-862", "title": "Improper Access Controls in NI SystemLink", "url": "https://www.cve.org/CVERecord?id=CVE-2026-4129" }, { "rank": 175, "cve_id": "CVE-2026-73694", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FileRun", "product": "FileRun", "cwe": "CWE-78", "title": "FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73694" }, { "rank": 176, "cve_id": "CVE-2026-73698", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FileRun", "product": "FileRun", "cwe": "CWE-89", "title": "FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73698" }, { "rank": 177, "cve_id": "CVE-2026-73699", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FileRun", "product": "FileRun", "cwe": "CWE-502", "title": "FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-73699" }, { "rank": 178, "cve_id": "CVE-2026-81213", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Langflow OSS", "cwe": "CWE-918", "title": "Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81213" }, { "rank": 179, "cve_id": "CVE-2026-81789", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Maarten B", "product": "Advanced Product Fields Extended for WooCommerce", "cwe": "CWE-22", "title": "WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81789" }, { "rank": 180, "cve_id": "CVE-2026-85217", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Autodesk", "product": "Fusion", "cwe": "CWE-15", "title": "Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85217" }, { "rank": 181, "cve_id": "CVE-2026-88047", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tesseract-ocr", "product": "tesseract", "cwe": "CWE-121", "title": "Tesseract: ReadNormProtos stack buffer overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88047" }, { "rank": 182, "cve_id": "CVE-2026-88048", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tesseract-ocr", "product": "tesseract", "cwe": "CWE-125", "title": "Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88048" }, { "rank": 183, "cve_id": "CVE-2026-88049", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tesseract-ocr", "product": "tesseract", "cwe": "CWE-787", "title": "Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88049" }, { "rank": 184, "cve_id": "CVE-2026-88051", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tesseract-ocr", "product": "tesseract", "cwe": "CWE-787", "title": "Tesseract: Heap out-of-bounds write in GenericVector::read due to independent reserved/size_used_ fields", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88051" }, { "rank": 185, "cve_id": "CVE-2026-88053", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tesseract-ocr", "product": "tesseract", "cwe": "CWE-787", "title": "Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88053" }, { "rank": 186, "cve_id": "CVE-2026-88056", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "angular", "product": "angular", "cwe": "CWE-918", "title": "Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88056" }, { "rank": 187, "cve_id": "CVE-2026-88058", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "angular", "product": "angular", "cwe": "CWE-79", "title": "Angular: SSR XSS via Unescaped Processing Instruction () Nodes in Fallback Raw-Content Elements", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88058" }, { "rank": 188, "cve_id": "CVE-2026-88060", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "angular", "product": "angular", "cwe": "CWE-79", "title": "Angular: SSR XSS via Unescaped