Security Box Score — September 12, 2026

94 CVEs published, led by WWBN (17).

94 CVEs published September 12, 2026: 13 critical, 26 high, 51 medium, 4 low; 1 in the KEV catalog at press time; 3 with a public exploit reference; 0 awaiting enrichment. 25 rendered as box scores below; the remaining 69 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	5582	40467	—	—
KEV catalog size	1709

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2586 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	631	4714	491	2228	706	1	12	3	0.1	7.8	.0017	+219 ▲
microsoft	977	2876	189	1978	693	16	289	30	1.0	7.8	.0044	+538 ▲
google	361	2527	318	973	1110	120	79	8	0.3	7.5	.0025	+312 ▲
red hat	73	698	43	289	329	37	2	0	0.0	6.7	.0028	-52 ▼
apple	0	316	59	85	165	7	88	8	2.5	6.5	.0029	-2 ▼
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0021	-11 ▼
suse	12	40	7	21	11	1	0	0	0.0	7.6	.0037	+7 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	12	96	24	46	26	0	57	14	14.6	7.5	.0041	-19 ▼
ubiquiti	0	59	36	22	1	0	3	3	5.1	9.1	.0049	0
palo alto networks	9	46	1	4	26	15	13	2	4.3	4.7	.0022	+9 ▲
fortinet	10	40	10	10	17	3	29	7	17.5	7.0	.0038	+3 ▲
netgear	2	34	0	0	27	7	0	0	0.0	4.3	.0025	-7 ▼
ivanti	10	24	10	12	2	0	25	5	20.8	8.8	.0146	+7 ▲
f5	7	24	6	14	3	1	4	1	4.2	8.7	.0047	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	-5 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	32	541	117	228	181	13	33	2	0.4	7.5	.0049	-62 ▼
mozilla	35	222	80	79	63	0	9	0	0.0	8.1	.0029	+34 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	2	78	5	17	47	9	5	3	3.8	5.3	.0029	-11 ▼
github	3	20	1	10	9	0	0	0	0.0	7.3	.0044	-1 ▼
docker	0	9	0	6	3	0	0	0	0.0	7.2	.0016	-1 ▼
wordpress	0	5	1	3	1	0	2	2	40.0	8.8	.3120	-1 ▼
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2269	484	1170	519	96	28	4	0.2	7.8	.0034	0
adobe	170	776	57	343	366	10	20	4	0.5	7.5	.0023	+110 ▲
ibm	121	740	161	341	229	9	6	1	0.1	7.5	.0030	+21 ▲
progress	3	64	15	39	10	0	6	1	1.6	8.1	.0035	-13 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
zohocorp	5	15	3	6	6	0	0	0	0.0	8.4	.0099	+3 ▲
atlassian	0	6	1	5	0	0	13	0	0.0	8.1	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	8	53	16	19	10	8	3	8.5	.0157	-7 ▼
siemens	14	51	6	33	9	3	0	7.3	.0018	-3 ▼
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+18 ▲
synology	0	27	3	6	15	3	0	5.6	.0025	-1 ▼
schneider electric	9	18	2	11	5	0	0	8.5	.0040	+9 ▲
hikvision	3	9	0	5	4	0	0	7.1	.0036	+3 ▲
hitachi energy	4	7	0	3	4	0	0	6.9	.0017	+4 ▲
abb	0	7	0	4	3	0	0	7.2	.0018	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	134	305	25	140	122	18	2	1	0.3	7.2	.0020	+122 ▲
sourcecodester	26	195	0	0	114	81	0	0	0.0	5.5	.0028	+14 ▲
spring	0	170	12	60	83	15	0	0	0.0	6.5	.0024	0
nvidia	32	166	20	117	29	0	0	0	0.0	7.8	.0029	+16 ▲
mongodb	50	148	4	87	53	4	1	0	0.0	7.1	.0026	+18 ▲
itsourcecode	24	140	0	0	36	104	0	0	0.0	2.1	.0026	+16 ▲
wwbn	89	129	21	43	65	0	0	0	0.0	6.9	.0026	+87 ▲
elastic	42	129	1	27	98	3	1	0	0.0	6.5	.0028	+42 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-64849	.1641	96.8	9.3
CVE-2026-83549	.0851	94.7	7.8
CVE-2026-19681	.0780	94.3	9.4
CVE-2026-82329	.0767	94.2	9.8
CVE-2026-19478	.0581	92.7	9.1
CVE-2026-19586	.0570	92.6	9.3
CVE-2026-19490	.0560	92.5	9.3
CVE-2026-79756	.0515	91.9	8.7
CVE-2026-83548	.0467	91.2	10.0

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-83548	10.0	.0467	KEV
CVE-2026-75650	10.0	.0215	KEV
CVE-2026-19188	10.0	.0193
CVE-2026-86152	10.0	.0186
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-69836	10.0	.0155
CVE-2026-82222	10.0	.0155
CVE-2026-82004	10.0	.0144
CVE-2026-85706	10.0	.0115	KEV

Most disclosures (vendor)
Vendor	CVEs
linux	1860
microsoft	1015
oracle	890
google	714
ibm	337
adobe	211
dell	194
red hat	170
splunk	110
apache	105

Most KEV additions (YTD)
Vendor	KEV
microsoft	30
cisco	14
apple	8
google	8
fortinet	7
ivanti	5
adobe	4
berriai	4
jfrog	4
oracle	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	47
Packagist	38
npm	19
PyPI	15
RubyGems	2
Go	1
NuGet	1
crates.io	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0
CVE-2026-75650	Adobe	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-87491	Google	0
CVE-2026-64849	mlflow	1
CVE-2026-84869	ConnectWise	2
CVE-2026-86218	N-able	2

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1760
CVE-2021-27102	n/a	2021-11-17	1760
CVE-2021-27101	n/a	2021-11-17	1760
CVE-2021-27103	n/a	2021-11-17	1760
CVE-2021-21017	Adobe	2021-11-17	1760
CVE-2021-28550	Adobe	2021-11-17	1760
CVE-2021-42013	Apache Software Foundation	2021-11-17	1760
CVE-2021-41773	Apache Software Foundation	2021-11-17	1760
CVE-2021-30858	Apple	2021-11-17	1760
CVE-2021-30860	Apple	2021-11-17	1760

Transactions

DUE DATE PASSED — CVE-2026-75650 (Adobe Commerce). CISA remediation deadline was September 11, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-86218 (N-able N-central). CISA remediation deadline was September 11, 2026; still in catalog.

Yesterday's Results

How to read these box scores · glossary

94 CVEs published. 25 box scores, 69 table rows — nothing truncated.

CVE-2026-85706CRITICAL

GitLab GitLab — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  N   10.0   .0115   65.0   YES

AFFECTED
  Product  Versions  Fixed
  GitLab   18.7 –    —

TIMELINE
  Sep 4   Reserved by CNA
  Sep 11  Added to CISA KEV, due Sep 14
  Sep 12  Published (CNA: GitLab)

CWE-22 · CNA: GitLab · CVSS v3.1 · 3 references · NVD status: Received · KEV due September 14, 2026

CVE-2026-78006CRITICAL

stellarwp The Events Calendar — The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0078   53.8     —

AFFECTED
  Product              Versions     Fixed
  The Events Calendar  unspecified  —

TIMELINE
  Aug 21  Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-78159CRITICAL

stellarwp The Events Calendar — The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0076   53.3     —

AFFECTED
  Product              Versions     Fixed
  The Events Calendar  unspecified  —

TIMELINE
  Aug 23  Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-85200HIGH

ninjew GEO my WP — GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0076   53.3     —

AFFECTED
  Product    Versions     Fixed
  GEO my WP  unspecified  —

TIMELINE
  Sep 3   Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-98 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Received

CVE-2026-87719CRITICAL

GitLab GitLab — Deserialization of Untrusted Data in GitLab

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0061   47.4     —

AFFECTED
  Product  Versions  Fixed
  GitLab   18.3 –    —

TIMELINE
  Sep 9   Reserved by CNA
  Sep 12  Published (CNA: GitLab)

CWE-502 · CNA: GitLab · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-78175HIGH

themeum Tutor LMS – eLearning and online course solution — Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0059   46.2     —

AFFECTED
  Product                                           Versions     Fixed
  Tutor LMS – eLearning and online course solution  unspecified  —

TIMELINE
  Aug 23  Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-16482HIGH

rtcamp rtMedia for WordPress, BuddyPress and bbPress — rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0034   27.5     —

AFFECTED
  Product                                        Versions     Fixed
  rtMedia for WordPress, BuddyPress and bbPress  unspecified  —

TIMELINE
  Jul 21  Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Received

CVE-2026-17585MEDIUM

wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor — Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  N  N    5.3   .0032   25.2     —

AFFECTED
  Product                                                              Versions     Fixed
  Royal Addons for Elementor – Addons and Templates Kit for Elementor  unspecified  —

TIMELINE
  Jul 27  Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-200 · CNA: Wordfence · CVSS v3.1 · 9 references · NVD status: Received

CVE-2026-85198MEDIUM

themeisle MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO — MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0029   21.2     —

AFFECTED
  Product                                                               Versions     Fixed
  MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO  unspecified  —

TIMELINE
  Sep 3   Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Received

CVE-2026-77161MEDIUM

egoi Smart Marketing SMS and Newsletters Forms — Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0027   19.0     —

AFFECTED
  Product                                    Versions     Fixed
  Smart Marketing SMS and Newsletters Forms  unspecified  —

TIMELINE
  Aug 20  Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Received

CVE-2026-11355MEDIUM

designthemes DT LMS – elearning, WordPress LMS Plugin — DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0024   15.8     —

AFFECTED
  Product                                    Versions     Fixed
  DT LMS – elearning,  WordPress LMS Plugin  unspecified  —

TIMELINE
  Jun 5   Reserved by CNA
  Sep 12  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 7 references · NVD status: Received

CVE-2026-90467MEDIUM

cole aiosmtplib — aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   N   L   N    6.3   .0023   13.8     —

AFFECTED
  Product     Versions     Fixed
  aiosmtplib  unspecified  5.1.3

TIMELINE
  Sep 11  Reserved by CNA
  Sep 12  Published (CNA: VulnCheck)

CWE-88 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-89172MEDIUM

Microchip AN1044 — Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   P   H   P   N   N   H   N   N    5.6   .0020   10.1     —

AFFECTED
  Product   Versions     Fixed
  AN1044    unspecified  —
  AN953     unspecified  —
  SW300052  unspecified  —

TIMELINE
  Sep 11  Reserved by CNA
  Sep 12  Published (CNA: Microchip)

CWE-1300 · CNA: Microchip · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-81402CRITICAL

Unknown DS Ad Rotator — DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0020    9.6     —

AFFECTED
  Product        Versions     Fixed
  DS Ad Rotator  unspecified  —

TIMELINE
  Aug 26  Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-434 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-89267MEDIUM

jowilf starlette-admin — starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   N   N    5.3   .0019    9.1     —

AFFECTED
  Product          Versions  Fixed
  starlette-admin  0.16.1 –  —

TIMELINE
  Sep 11  Reserved by CNA
  Sep 12  Published (CNA: VulnCheck)

CWE-863 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Received

CVE-2026-80491HIGH

Unknown SAMO Forms — SAMO Forms <= 1.0.0 - Unauthenticated SQLi

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  N    8.6   .0019    8.8     —

AFFECTED
  Product     Versions     Fixed
  SAMO Forms  unspecified  —

TIMELINE
  Aug 26  Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-89 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-75800CRITICAL

Unknown Frontegg SAML SSO — Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0019    8.4     —

AFFECTED
  Product            Versions     Fixed
  Frontegg SAML SSO  unspecified  —

TIMELINE
  Aug 18  Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-287 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-84047HIGH

Unknown Album Cover Finder — Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  N    8.6   .0018    7.4     —

AFFECTED
  Product             Versions     Fixed
  Album Cover Finder  unspecified  —

TIMELINE
  Sep 1   Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-89 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-87842HIGH

Unknown Zonify — Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0018    7.2     —

AFFECTED
  Product  Versions     Fixed
  Zonify   unspecified  —

TIMELINE
  Sep 9   Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-200 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-81742HIGH

Unknown BE REST Endpoints — BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0017    6.8     —

AFFECTED
  Product            Versions     Fixed
  BE REST Endpoints  unspecified  —

TIMELINE
  Aug 27  Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-89268MEDIUM

Webkul QloApps — QloApps through 1.7.0 Reflected XSS via List Filter Parameters

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   P   L   L   N    5.1   .0017    6.7     —

AFFECTED
  Product  Versions     Fixed
  QloApps  unspecified  —

TIMELINE
  Sep 11  Reserved by CNA
  Sep 12  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-82845CRITICAL

Unknown Masteriyo LMS — Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9   .0017    6.2     —

AFFECTED
  Product        Versions     Fixed
  Masteriyo LMS  unspecified  —

TIMELINE
  Aug 31  Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-502 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-84171CRITICAL

Unknown WP images upload on piclect — WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0016    5.7     —

AFFECTED
  Product                      Versions     Fixed
  WP images upload on piclect  unspecified  —

TIMELINE
  Sep 1   Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-434 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-84099HIGH

Unknown wpstorecart — IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0016    5.2     —

AFFECTED
  Product      Versions     Fixed
  wpstorecart  unspecified  —

TIMELINE
  Sep 1   Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-502 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-80494HIGH

Unknown Yogeta WP Cloud — Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  N  N    8.6   .0016    5.1     —

AFFECTED
  Product          Versions     Fixed
  Yogeta WP Cloud  unspecified  —

TIMELINE
  Aug 26  Reserved by CNA
  Sep 12  Published (CNA: WPScan)

CWE-552 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-86790	6.8	4.7	Unknown	WP Highlight Box	CWE-79	WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode
CVE-2026-87888	8.0	4.7	Unknown	YayPricing	CWE-79	YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
CVE-2026-82847	6.8	4.7	Unknown	Masteriyo LMS	CWE-79	Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
CVE-2026-83532	6.8	4.7	Unknown	Custom Menu Wizard Widget	CWE-79	Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes
CVE-2026-77005	9.6	4.4	Unknown	CODE MONKEYS PROPOSALS	CWE-73	Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Pat…
CVE-2026-78152	5.3	4.4	Unknown	SureRank SEO	CWE-200	SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person …
CVE-2026-77689	5.3	4.2	Unknown	Booking for Appointments and Events Calendar	CWE-284	Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
CVE-2026-87892	5.3	4.1	Unknown	Rox Appointment Booking	CWE-284	Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Paym…
CVE-2026-87916	5.3	4.1	Unknown	WPBot	CWE-200	WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
CVE-2026-81090	7.2	3.9	Unknown	Gpx2Graphics	CWE-352	Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
CVE-2026-77705	7.2	3.8	Unknown	Booking for Appointments and Events Calendar	CWE-639	Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
CVE-2026-77752	7.2	3.8	Unknown	Temporary Login Without Password	CWE-269	Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Netwo…
CVE-2026-77753	5.5	3.8	Unknown	Temporary Login Without Password	CWE-284	Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Rev…
CVE-2026-85681	9.8	3.4	Unknown	WP Component	CWE-269	WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Bl…
CVE-2026-87891	6.5	3.4	Unknown	Rox Appointment Booking	CWE-284	Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modificati…
CVE-2026-87894	5.3	3.4	Unknown	Rox Appointment Booking	CWE-639	Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosu…
CVE-2026-87918	5.3	3.4	Unknown	WPBot	CWE-284	WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
CVE-2026-87759	8.8	3.1	Unknown	Add User Autocomplete	CWE-269	Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
CVE-2026-87919	4.9	3.1	Unknown	Product XML Feed Manager for WooCommerce	CWE-862	Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Pro…
CVE-2026-87797	4.3	3.1	Unknown	Sprout Invoices	CWE-862	Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Over…
CVE-2026-82851	2.7	3.1	Unknown	Masteriyo LMS	CWE-639	Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
CVE-2026-84025	2.2	3.1	Unknown	BEAR	CWE-639	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 …
CVE-2026-77006	9.6	1.8	Unknown	WebTotem Backups	CWE-73	WebTotem Backups <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Trav…
CVE-2026-81429	7.1	1.2	Unknown	Export & Import WPBakery Page Builder	CWE-79	Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
CVE-2026-84023	6.5	0.8	Unknown	BEAR	CWE-352	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 …
CVE-2026-84024	4.3	0.8	Unknown	BEAR	CWE-352	BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 …
CVE-2026-90558	9.3	—	irontec	sngrep	CWE-121	sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers
CVE-2026-90647	9.1	—	Kalkitech	ASE2000 V2 Communication Test Set	CWE-295	ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows …
CVE-2026-15451	8.8	—	MemberPress	MemberPress Corporate Accounts	CWE-269	MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privil…
CVE-2026-90537	8.8	—	WWBN	AVideo	CWE-862	WWBN AVideo Scheduler sendEmail Missing Authorization via Token
CVE-2026-90560	8.8	—	luben	zstd-jni	CWE-125	zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
CVE-2026-90559	8.7	—	xerial	snappy-java	CWE-787	snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
CVE-2026-90553	8.5	—	vllm-project	vLLM	CWE-94	vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor
CVE-2026-90556	8.5	—	freeciv	freeciv	CWE-122	Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load
CVE-2026-90651	8.1	—	Socket	Socket Firewall	CWE-295	Socket Firewall (socketdev/socket-registry-firewall) in registry mode before …
CVE-2026-90474	7.6	—	samanhappy	mcphub	CWE-287	MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
CVE-2026-90616	7.4	—	Flatpak	Flatpak	CWE-61	In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read…
CVE-2026-90555	7.1	—	vllm-project	vLLM	CWE-409	vLLM before 0.28.0 Denial of Service via Audio Header
CVE-2026-90648	7.1	—	WebAssembly	wabt	CWE-252	wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situa…
CVE-2026-90472	6.9	—	msgpack	msgpack-java	CWE-674	msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
CVE-2026-90473	6.9	—	msgpack	msgpack-java	CWE-190	msgpack-java through 0.9.12 Integer Overflow via MAP32
CVE-2026-90536	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Missing Authorization via adsInfo API Endpoint
CVE-2026-90538	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Missing Authorization via playlistsFromUser.json.php
CVE-2026-90539	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Missing Authentication via menuItems.json.php
CVE-2026-90541	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Unauthenticated Information Disclosure via menus.json.php
CVE-2026-90543	6.9	—	WWBN	AVideo	CWE-306	WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
CVE-2026-90547	6.9	—	WWBN	AVideo	CWE-862	WWBN AVideo Missing Authorization via getBookmarks.json.php
CVE-2026-90548	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Missing Authorization in ImageGallery list.json.php
CVE-2026-90549	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint
CVE-2026-90550	6.9	—	WWBN	AVideo	CWE-200	WWBN AVideo Missing Authorization via mediaSession.json.php
CVE-2026-90551	6.9	—	WWBN	AVideo	CWE-862	WWBN AVideo Missing Authorization via video_from_program API
CVE-2026-90554	6.9	—	vllm-project	vLLM	CWE-400	vLLM before 0.28.0 Denial of Service via audio extraction
CVE-2026-90557	6.9	—	freeciv	freeciv	CWE-125	Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame
CVE-2026-10148	6.4	—	melograno	Booking for Appointments and Events Calendar – Amelia	CWE-79	Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticate…
CVE-2026-90535	6.3	—	FlowiseAI	Flowise	CWE-862	Flowise before 3.1.4 Denial of Service via text-to-speech/abort
CVE-2026-90534	6.1	—	FlowiseAI	Flowise	CWE-639	Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
CVE-2026-90533	6.0	—	FlowiseAI	Flowise	CWE-862	Flowise before 3.1.4 Broken Access Control via organizationuser
CVE-2026-90485	5.4	—	IOBit	Uninstaller	CWE-404	IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer …
CVE-2026-90486	5.3	—	openstatusHQ	openstatus	CWE-918	openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request …
CVE-2026-90488	5.3	—	Xuxueli	xxl-job	CWE-94	Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection
CVE-2026-90540	5.3	—	WWBN	AVideo	CWE-862	WWBN AVideo Missing Authorization via playListAddVideo.json.php
CVE-2026-90542	5.3	—	WWBN	AVideo	CWE-639	WWBN AVideo Missing Authorization via remindMe.json.php
CVE-2026-90544	5.3	—	WWBN	AVideo	CWE-862	WWBN AVideo Missing Authorization via videoAddViewCount.json.php
CVE-2026-90545	5.3	—	WWBN	AVideo	CWE-862	WWBN AVideo Missing Authorization via commentAddNew.json.php
CVE-2026-90546	5.3	—	WWBN	AVideo	CWE-862	WWBN AVideo Missing Authorization via like.json.php
CVE-2026-90552	5.3	—	WWBN	AVideo	CWE-639	WWBN AVideo Missing Authorization via Playlists_schedules list.json.php
CVE-2026-90489	5.1	—	Xuxueli	xxl-job	CWE-79	Xuxueli xxl-job insert cross site scripting
CVE-2026-79300	3.5	—	SEP	sesam	CWE-180	SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authe…
CVE-2026-90487	2.1	—	Xuxueli	xxl-job	CWE-266	Xuxueli xxl-job JobGroupController.java privileges management

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-12 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.