Security Box Score — September 22, 2026

CISA adds 4 to KEV; 455 CVEs published, led by Adobe (53).

455 CVEs published September 22, 2026: 81 critical, 170 high, 162 medium, 22 low; 3 in the KEV catalog at press time; 2 with a public exploit reference; 20 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 55 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	11281	46235	—	—
KEV catalog size	1721

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2944 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	1507	5598	526	2513	713	1	15	6	0.1	7.8	.0017	+91 ▲
microsoft	1000	2899	205	1986	692	16	289	30	1.0	7.8	.0044	+531 ▲
google	517	2684	332	1049	1182	121	80	9	0.3	7.5	.0025	+446 ▲
red hat	175	804	47	337	378	42	2	0	0.0	6.7	.0028	-13 ▼
apple	246	563	67	165	317	14	88	8	1.4	6.5	.0020	+206 ▲
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	-23 ▼
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0021	-14 ▼
suse	13	41	7	21	12	1	0	0	0.0	7.5	.0036	+8 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	97	181	53	72	55	1	59	16	8.8	7.7	.0039	+51 ▲
ubiquiti	6	65	36	28	1	0	3	3	4.6	9.1	.0049	+6 ▲
palo alto networks	9	46	1	4	26	15	13	2	4.3	4.7	.0022	-3 ▼
fortinet	11	41	11	10	17	3	29	7	17.1	7.2	.0038	+4 ▲
netgear	2	34	0	0	27	7	0	0	0.0	4.3	.0025	-7 ▼
f5	9	26	7	14	4	1	5	2	7.7	8.7	.0045	+9 ▲
ivanti	10	24	6	16	2	0	25	5	20.8	8.8	.0147	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	-5 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	104	616	142	260	198	15	33	2	0.3	7.5	.0049	-27 ▼
mozilla	113	301	102	126	73	0	9	0	0.0	8.8	.0028	+54 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	17	93	5	23	55	10	5	3	3.2	5.3	.0032	+2 ▲
github	6	23	2	11	10	0	0	0	0.0	7.4	.0044	+1 ▲
docker	3	12	1	8	3	0	0	0	0.0	8.4	.0016	+1 ▲
wordpress	1	6	1	4	1	0	2	2	33.3	8.7	.3120	-1 ▼
go	4	4	0	2	1	1	0	0	0.0	5.9	.0029	+4 ▲

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	634	2905	581	1660	563	101	28	4	0.1	7.8	.0034	-255 ▼
ibm	341	960	190	437	319	14	6	1	0.1	7.5	.0030	-33 ▼
adobe	224	830	82	362	376	10	20	4	0.5	7.5	.0023	+164 ▲
progress	3	64	15	39	10	0	6	1	1.6	8.1	.0035	-16 ▼
solarwinds	3	26	18	5	3	0	10	4	15.4	9.1	.0058	+3 ▲
zohocorp	9	19	4	9	6	0	0	0	0.0	8.4	.0106	+5 ▲
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
atlassian	3	9	1	8	0	0	13	0	0.0	7.6	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	26	71	21	26	12	12	3	8.5	.0154	+10 ▲
siemens	15	52	6	33	10	3	0	7.3	.0018	-4 ▼
synology	19	46	5	10	25	6	0	5.6	.0027	+18 ▲
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+17 ▲
advantech	17	20	2	17	1	0	0	8.6	.0068	+17 ▲
schneider electric	9	18	2	11	5	0	0	8.5	.0040	+9 ▲
hikvision	3	9	0	5	4	0	0	7.1	.0036	+3 ▲
abb	1	8	1	4	3	0	0	7.2	.0018	+1 ▲

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	182	353	31	164	137	21	2	1	0.3	7.2	.0020	+126 ▲
sourcecodester	58	227	0	0	134	93	0	0	0.0	5.5	.0027	+21 ▲
nvidia	51	185	21	127	37	0	0	0	0.0	7.8	.0029	+27 ▲
spring	0	170	13	60	82	15	0	0	0.0	6.5	.0024	-5 ▼
mongodb	64	162	6	94	58	4	1	0	0.0	7.1	.0026	+32 ▲
itsourcecode	37	153	0	0	38	115	0	0	0.0	2.1	.0026	+18 ▲
hewlett packard enterprise (hpe)	139	148	17	77	48	6	1	1	0.7	7.2	.0029	+136 ▲
wwbn	106	146	23	49	74	0	0	0	0.0	6.9	.0024	+97 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-85706	.0929	95.1	10.0
CVE-2026-83549	.0851	94.8	7.8
CVE-2026-82329	.0767	94.3	9.8
CVE-2026-86218	.0749	94.2	10.0
CVE-2026-79756	.0515	92.0	8.7
CVE-2026-83548	.0467	91.3	10.0
CVE-2026-76698	.0411	90.3	6.5
CVE-2026-47864	.0408	90.2	9.8
CVE-2026-17176	.0359	88.9	7.7

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-85706	10.0	.0929	KEV
CVE-2026-86218	10.0	.0749	KEV
CVE-2026-83548	10.0	.0467	KEV
CVE-2026-75650	10.0	.0215	KEV
CVE-2026-86152	10.0	.0186
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-82222	10.0	.0155
CVE-2026-82004	10.0	.0144
CVE-2026-82456	10.0	.0139

Most disclosures (vendor)
Vendor	CVEs
linux	1735
microsoft	1008
google	848
oracle	635
ibm	357
adobe	265
apple	250
red hat	215
dell	198
apache	141

Most KEV additions (YTD)
Vendor	KEV
microsoft	30
cisco	16
google	9
apple	8
fortinet	7
linux	6
ivanti	5
adobe	4
berriai	4
checkpoint	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	100
Packagist	41
npm	20
PyPI	14
crates.io	5
RubyGems	2
Go	1
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-58704	Google	0
CVE-2026-75650	Adobe	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-87491	Google	0
CVE-2026-93952	Arista Networks	0
CVE-2026-84869	ConnectWise	2
CVE-2026-86218	N-able	2
CVE-2026-81578	PaperCut	3

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1770
CVE-2021-27102	n/a	2021-11-17	1770
CVE-2021-27101	n/a	2021-11-17	1770
CVE-2021-27103	n/a	2021-11-17	1770
CVE-2021-21017	Adobe	2021-11-17	1770
CVE-2021-28550	Adobe	2021-11-17	1770
CVE-2021-42013	Apache Software Foundation	2021-11-17	1770
CVE-2021-41773	Apache Software Foundation	2021-11-17	1770
CVE-2021-30858	Apple	2021-11-17	1770
CVE-2021-30860	Apple	2021-11-17	1770

Transactions

ADDED TO KEV — CVE-2026-85102 (checkpoint Quantum Security Gateway). Remediation due September 25, 2026.

ADDED TO KEV — CVE-2026-93616 (checkpoint Quantum Security Management). Remediation due September 25, 2026.

ADDED TO KEV — CVE-2026-93952 (Arista Networks VeloCloud Orchestrator (VCO) On-Prem). Remediation due September 25, 2026.

ADDED TO KEV — CVE-2026-94127 (F5 BIG-IP). Remediation due September 25, 2026.

EXPLOIT PUBLISHED — FreeRDP: 4 CVEs (CVE-2026-55191, CVE-2026-55192, CVE-2026-55564, CVE-2026-63652). Public exploit references added.

EXPLOIT PUBLISHED — dromara lamp-cloud: 3 CVEs (CVE-2026-94533, CVE-2026-94534, CVE-2026-94535). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2019-25776 (Weaver Network Co., Ltd. E-cology). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-6851. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-6134 (Red Hat build of Keycloak 22). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-6563 (Red Hat Single Sign-On 7.6 for RHEL 7). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44253 (wazuh). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-5704 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-7273 (Zyxel GS1900-48HPv2 firmware). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-91854 (code-projects Record Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-92221 (gedelumbung HospitalManagement). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-92385 (SourceCodester Online Food Ordering System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-92475 (GPAC). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-92526 (itsourcecode Leave Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-92993 (Dromara mayfly-go). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93311 (Freedesktop Poppler). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93312 (Freedesktop Poppler). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93532 (gedelumbung HospitalManagement). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93738 (Totolink A3002MU). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93741 (Totolink A3002MU). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93954 (grimmory-tools grimmory). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93957 (olivier-ls PHP-FTS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93959 (SourceCodester Online Reviewer Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93960 (Pixelfed). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93962 (Kamailio). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93964 (NginxProxyManager nginx-proxy-manager). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93974 (SourceCodester Online Reviewer Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93979 (code-projects Internship Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93984 (Openpanel-dev openpanel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94015 (SourceCodester Drug Recommendation System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94016 (SourceCodester Drug Recommendation System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94032 (itsourcecode Leave Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94037 (00Kisumi00 mcp-file-analyzer). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94042 (AdithyaYelloju Restaurant Management System). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94047 (samanhappy MCPHub). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94089 (D-Link DIR-868L). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94094 (OpenClaw). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94099 (Netcore NBR200V2). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94110 (QCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94139 (Chengdu Feiyuxing Technology Feiyu Star Router). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94152 (Omega Solution FBP Fulfillment by People). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94413 (jishenghua jshERP). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94497 (jishenghua jshERP). Public exploit reference added.

DUE DATE PASSED — CVE-2025-39682 (Linux). CISA remediation deadline was September 21, 2026; still in catalog.

DUE DATE PASSED — CVE-2025-39964 (Linux). CISA remediation deadline was September 21, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-53266 (Linux). CISA remediation deadline was September 21, 2026; still in catalog.

REJECTED — CVE-2026-95511 (Red Hat Enterprise Linux 10). Record withdrawn by the CNA.

RESCORED — Microsoft Windows 10 Version 1607: 8 CVEs (CVE-2026-69681, CVE-2026-69688, CVE-2026-69706, CVE-2026-69714, CVE-2026-69717, CVE-2026-69761, CVE-2026-72931, CVE-2026-72978). CVSS rescored — before/after on each CVE page.

RESCORED — Microsoft Windows 10 Version 1809: 3 CVEs (CVE-2026-69689, CVE-2026-69757, CVE-2026-69762). CVSS rescored — before/after on each CVE page.

RESCORED — Okta Access Gateway: 3 CVEs (CVE-2026-78620, CVE-2026-78623, CVE-2026-78626). CVSS rescored — before/after on each CVE page.

RESCORED — Qualcomm, Inc. Snapdragon: 3 CVEs (CVE-2026-24075, CVE-2026-25261, CVE-2026-25278). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2023-4547 (SPA-Cart eCommerce CMS). CVSS 5.1 → 2 (NVD).

RESCORED — CVE-2023-4548 (SPA-Cart eCommerce CMS). CVSS 5.3 → 2.1 (NVD).

RESCORED — CVE-2023-6134 (Red Hat build of Keycloak 22). CVSS 4.6 → 5.4 (NVD).

RESCORED — CVE-2023-6927 (Red Hat build of Keycloak 22). CVSS 4.6 → 6.1 (NVD).

RESCORED — CVE-2026-55564 (FreeRDP). CVSS 5.4 → 7.1 (NVD).

RESCORED — CVE-2026-55748 (OpenStack Horizon). CVSS 6 → 6.8 (NVD).

RESCORED — CVE-2026-58381 (Red Hat Enterprise Linux 6). CVSS 6.1 → 7.3 (NVD).

RESCORED — CVE-2026-69775 (Microsoft Windows 11 version 23H2). CVSS 7.1 → 7.5 (NVD).

RESCORED — CVE-2026-71222 (Red Hat Enterprise Linux 7). CVSS 5.3 → 6.3 (NVD).

RESCORED — CVE-2026-78627 (Okta Hyperdrive Integration Plugin). CVSS 7.3 → 5.5 (NVD).

RESCORED — CVE-2026-78629 (Okta Hyperdrive Agent). CVSS 5.6 → 5.5 (NVD).

RESCORED — CVE-2026-78631 (Okta Hyperdrive Agent). CVSS 5.3 → 5.5 (NVD).

RESCORED — CVE-2026-93295 (misp). CVSS 5.1 → 8.7 (NVD).

RESCORED — CVE-2026-93296 (misp). CVSS 5.1 → 8.5 (NVD).

RESCORED — CVE-2026-94109 (openEQUELLA). CVSS 8.7 → 8.6 (NVD).

RESCORED — CVE-2026-94489 (OctoPrint). CVSS 5.3 → 2.1 (NVD).

PATCH SHIPPED — Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: 4 CVEs (CVE-2026-5680, CVE-2026-10832, CVE-2026-14180, CVE-2026-85511). Fix versions published.

PATCH SHIPPED — CVE-2026-19730 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 7:5.8.2-9.el10_2.

PATCH SHIPPED — CVE-2026-84217 (Mamunur Rashid Classified Listing). Fixed in Classified Listing 6.1.5.

ENRICHED — CVE-2020-6851. Received CVSS 7.5 and CPE data from NVD.

Yesterday's Results

How to read these box scores · glossary

455 CVEs published. 25 box scores and 375 table rows below; the remaining 55 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-93952CRITICAL

Arista Networks VeloCloud Orchestrator (VCO) On-Prem — Security Advisory 0183

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   H   N   N   N   H   H   H    9.5   .0042   36.3   YES

AFFECTED
  Product                               Versions  Fixed
  VeloCloud Orchestrator (VCO) On-Prem  5.2.0 –   —

TIMELINE
  Sep 19  Reserved by CNA
  Sep 22  Added to CISA KEV, due Sep 25
  Sep 22  Published (CNA: Arista)

CWE-20 · CNA: Arista · CVSS v4.0 · 2 references · NVD status: Awaiting Analysis · KEV due September 25, 2026

CVE-2026-93616CRITICAL

checkpoint Quantum Security Management — Directory Traversal and File upload allows execution of arbitrary script on the Management Server

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —   YES

AFFECTED
  Product                      Versions                       Fixed
  Quantum Security Management  R82.20 with no Jumbo Hotfix –  —

TIMELINE
  Sep 18  Reserved by CNA
  Sep 22  Added to CISA KEV, due Sep 25
  Sep 22  Published (CNA: checkpoint)

CWE-22 · CNA: checkpoint · CVSS v3.1 · 3 references · NVD status: Awaiting Analysis · KEV due September 25, 2026

CVE-2026-94127CRITICAL

F5 BIG-IP — BIG-IP APM OAuth vulnerability

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3      —      —   YES

AFFECTED
  Product  Versions  Fixed
  BIG-IP   21.1.0 –  —

TIMELINE
  Sep 20  Reserved by CNA
  Sep 22  Added to CISA KEV, due Sep 25
  Sep 22  Published (CNA: f5)

CWE-122 · CNA: f5 · CVSS v4.0 · 2 references · NVD status: Awaiting Analysis · KEV due September 25, 2026

CVE-2026-94490LOW

n/a OctoPrint — OctoPrint Command API system.py executeSystemCommand os command injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   H   N   L   L   L    2.0   .0210   80.9     —

AFFECTED
  Product    Versions  Fixed
  OctoPrint  1.0.0 –   —

TIMELINE
  Sep 21  Reserved by CNA
  Sep 22  Published (CNA: VulDB)

CWE-77, CWE-78 · CNA: VulDB · CVSS v4.0 · 4 references · NVD status: Deferred

CVE-2026-15095MEDIUM

wahid0003 Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels — Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  N  N    4.9   .0117   66.1     —

AFFECTED
  Product                                                                                        Versions     Fixed
  Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels  unspecified  —

TIMELINE
  Jul 8   Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-94493CRITICAL

Gigatech PDV5701 WebSocket Service index.html missing authentication

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0073   52.8     —

AFFECTED
  Product  Versions                Fixed
  PDV5701  1.0.31_240305_112640 –  —

TIMELINE
  Sep 21  Reserved by CNA
  Sep 22  Published (CNA: VulDB)

CWE-287, CWE-306 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-92969HIGH

realmag777 HUSKY – Products Filter for WooCommerce Professional — HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .0065   49.8     —

AFFECTED
  Product                                               Versions     Fixed
  HUSKY – Products Filter for WooCommerce Professional  unspecified  —

TIMELINE
  Sep 17  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-98 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-9231HIGH

wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software — WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   N  U  H  H  H    7.5   .0058   46.3     —

AFFECTED
  Product                                                          Versions     Fixed
  WP Travel Engine – Tour Booking Plugin – Tour Operator Software  unspecified  —

TIMELINE
  May 21  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-98 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2025-1281HIGH

SeaTheme BM Content Builder — BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0057   45.7     —

AFFECTED
  Product             Versions     Fixed
  BM Content Builder  unspecified  —

TIMELINE
  Feb 13  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2025-1280MEDIUM

SeaTheme BM Content Builder — BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0053   43.9     —

AFFECTED
  Product             Versions     Fixed
  BM Content Builder  unspecified  —

TIMELINE
  Feb 13  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-22 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-68956HIGH

Erlang OTP — SSH daemon allocates unbounded idle session channels, bypassing max_channels

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   N   H    7.1   .0047   40.3     —

AFFECTED
  Product  Versions                                    Fixed
  OTP      18.1.2 –                                    27.3.4.18
  OTP      4.1.1 –                                     5.2.11.13
  OTP      84df3d4d0278e21a36a453bfee94799f0df67c2a –  79c2d2be17d902c5f53969b5806b725efda831be

TIMELINE
  Aug 17  Reserved by CNA
  Sep 22  Published (CNA: EEF)

CWE-770 · CNA: EEF · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-95508HIGH

Red Hat Red Hat Enterprise Linux 10 — Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  N  H  H    7.4   .0042   36.3     —

AFFECTED
  Product                                 Versions     Fixed
  Red Hat Enterprise Linux 10             unspecified  —
  Red Hat Enterprise Linux 8              unspecified  —
  Red Hat Enterprise Linux 9              unspecified  —
  Red Hat OpenShift Container Platform 4  unspecified  —
  Red Hat OpenShift Container Platform 4  unspecified  —
  Red Hat OpenShift Container Platform 4  unspecified  —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 22  Published (CNA: redhat)

CWE-787 · CNA: redhat · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-19658CRITICAL

LiquidWeb Give Tributes — Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0041   34.9     —

AFFECTED
  Product        Versions     Fixed
  Give Tributes  unspecified  —

TIMELINE
  Aug 12  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-502 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-89422CRITICAL

Erlang OTP — TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   N    9.3   .0037   30.7     —

AFFECTED
  Product  Versions                                    Fixed
  OTP      22.2 –                                      27.3.4.18
  OTP      9.5 –                                       11.2.12.13
  OTP      21b8a1b0ad0adf200682b3854bc50114ab2b8c62 –  afec5156361bb50d3607c7c1a453c19b9149b324

TIMELINE
  Sep 11  Reserved by CNA
  Sep 22  Published (CNA: EEF)

CWE-322 · CNA: EEF · CVSS v4.0 · 8 references · NVD status: Deferred

CVE-2026-92235HIGH

roxnor WP Ultimate Review — WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  N    8.1   .0036   29.9     —

AFFECTED
  Product             Versions     Fixed
  WP Ultimate Review  unspecified  —

TIMELINE
  Sep 15  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-94 · CNA: Wordfence · CVSS v3.1 · 8 references · NVD status: Deferred

CVE-2026-92438HIGH

Unknown Ninja Forms — Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0035   28.4     —

AFFECTED
  Product      Versions  Fixed
  Ninja Forms  3.15.3 –  —

TIMELINE
  Sep 16  Reserved by CNA
  Sep 22  Published (CNA: WPScan)

CWE-79 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-13355CRITICAL

Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0034   28.1     —

AFFECTED
  Product                       Versions     Fixed
  Meta Box Frontend Submission  unspecified  —

TIMELINE
  Jun 25  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 3 references · NVD status: Deferred

CVE-2026-12470HIGH

niteo CMP – Coming Soon & Maintenance Plugin by NiteoThemes — CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0033   26.6     —

AFFECTED
  Product                                                Versions     Fixed
  CMP – Coming Soon & Maintenance Plugin by NiteoThemes  unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 4 references · NVD status: Deferred

CVE-2026-6922HIGH

wptb WP Table Builder – Drag & Drop Table Builder — WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  L  H    7.1   .0031   23.5     —

AFFECTED
  Product                                       Versions     Fixed
  WP Table Builder – Drag & Drop Table Builder  unspecified  —

TIMELINE
  Apr 23  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-863 · CNA: Wordfence · CVSS v3.1 · 12 references · NVD status: Deferred

CVE-2026-93556CRITICAL

Kompini Tankuam Places — Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0031   23.4     —

AFFECTED
  Product         Versions     Fixed
  Tankuam Places  unspecified  —

TIMELINE
  Sep 18  Reserved by CNA
  Sep 22  Published (CNA: INCIBE)

CWE-639 · CNA: INCIBE · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-91827HIGH

Unknown Ninja Forms — Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  U  H  H  H    7.5   .0030   23.4     —

AFFECTED
  Product      Versions  Fixed
  Ninja Forms  3.15.3 –  —

TIMELINE
  Sep 15  Reserved by CNA
  Sep 22  Published (CNA: WPScan)

CWE-502 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-89412HIGH

cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation — TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0030   23.3     —

AFFECTED
  Product                                                            Versions     Fixed
  TranslatePress – Translate Multilingual sites with AI Translation  unspecified  —

TIMELINE
  Sep 11  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 13 references · NVD status: Deferred

CVE-2026-94504HIGH

kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder — Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  L  L  N    7.2   .0029   22.1     —

AFFECTED
  Product                                                                                     Versions     Fixed
  Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder  unspecified  —

TIMELINE
  Sep 21  Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2026-93928HIGH

Magepeople inc. Taxi Booking Manager for WooCommerce — WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  L    7.3   .0028   21.2     —

AFFECTED
  Product                               Versions  Fixed
  Taxi Booking Manager for WooCommerce  n/a –     2.0.8

TIMELINE
  Sep 19  Reserved by CNA
  Sep 22  Published (CNA: Patchstack)

CWE-288 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-85653MEDIUM

ajay Contextual Related Posts — Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0026   17.4     —

AFFECTED
  Product                   Versions     Fixed
  Contextual Related Posts  unspecified  —

TIMELINE
  Sep 4   Reserved by CNA
  Sep 22  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 10 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-94491	5.5	17.2	Yonyou	KSOA	CWE-74	Yonyou KSOA search_list.jsp sql injection
CVE-2026-65634	8.2	16.7	Erlang	OTP	CWE-407	Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
CVE-2026-18439	4.3	16.7	themeum	Tutor LMS – eLearning and online course solution	CWE-639	Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference…
CVE-2026-93778	7.2	16.3	jgwhite33	WP Yelp Review Slider	CWE-79	WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting vi…
CVE-2026-91092	4.3	15.4	tomdever	wpForo Forum	CWE-862	wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) …
CVE-2026-93836	7.2	14.0	wpclever	WPC Product Bundles for WooCommerce	CWE-79	WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-S…
CVE-2025-14484	5.3	14.0	kamleshyadav	Image Buzz	CWE-862	Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API …
CVE-2025-14486	5.3	14.0	kamleshyadav	PixelPlay	CWE-862	PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API K…
CVE-2025-14487	5.3	14.0	kamleshyadav	Handily	CWE-862	Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe …
CVE-2026-16778	6.4	12.9	livecomposer	Live Composer – Free WordPress Website Builder	CWE-79	Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scri…
CVE-2026-9004	4.3	12.4	nofearinc	WP-CRM System – Manage Clients and Projects	CWE-200	WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive I…
CVE-2026-93655	6.1	12.2	wpdevelop	Booking Calendar	CWE-79	Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fi…
CVE-2026-76974	5.3	12.1	SAP_SE	SAP Fiori Launchpad	CWE-95	Information Disclosure vulnerability in SAP Fiori Launchpad
CVE-2026-12995	4.3	11.9	hiroaki-miyashita	Custom Field Template	CWE-639	Custom Field Template <= 2.7.8 - Authenticated (Contributor+) Insecure Direct…
CVE-2026-4123	4.3	10.6	rwelephant01	RW Elephant Rental Inventory	CWE-862	RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticat…
CVE-2026-7622	4.3	10.6	codexpert	ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More	CWE-862	ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Pl…
CVE-2026-18345	4.3	9.6	wpusermanager	WP User Manager – User Profile Builder & Membership	CWE-862	WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscribe…
CVE-2026-1645	4.4	9.5	prasunsen	Hostel	CWE-79	Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting …
CVE-2026-88788	6.8	9.4	Unknown	Text Styler	CWE-79	Text Styler <= 1.1.1 - Contributor+ Stored XSS
CVE-2026-94492	2.1	9.2	Yonyou	U8cloud	CWE-74	Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
CVE-2026-93711	6.5	8.7	—	Dancer2	CWE-113	Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response h…
CVE-2026-93712	7.5	8.5	—	Dancer2	CWE-22	Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside pu…
CVE-2026-93709	await	8.5	—	Dancer2	CWE-41	Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equiv…
CVE-2026-93710	7.5	6.9	—	Dancer2	CWE-460	Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dyi…
CVE-2016-15059	9.8	6.8	—	Net-IDN-Encode	CWE-122	Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflo…
CVE-2026-87082	7.5	5.6	—	Net-IDN-Encode	CWE-835	Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wro…
CVE-2026-74765	6.5	5.3	—	Net-IDN-Encode	CWE-125	Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read…
CVE-2026-74766	8.4	5.2	—	Net-IDN-Encode	CWE-416	Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use…
CVE-2026-87079	7.5	5.0	—	Net-IDN-Encode	CWE-407	Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via qu…
CVE-2026-87081	7.5	5.0	—	Net-IDN-Encode	CWE-407	Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadr…
CVE-2026-87078	9.1	5.0	—	Net-IDN-Encode	CWE-401	Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output …
CVE-2026-87080	9.1	4.4	—	Net-IDN-Encode	CWE-1286	Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated labe…
CVE-2026-95503	6.8	3.0	Red Hat	Red Hat Build of Keycloak	CWE-347	Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerb…
CVE-2026-7866	10.0	—	RTI	Connext Professional	CWE-121	Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core L…
CVE-2026-73369	10.0	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-75699	10.0	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-75703	10.0	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-75721	10.0	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-75723	10.0	—	Adobe	Adobe Campaign Classic	CWE-863	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)
CVE-2026-75745	10.0	—	Adobe	AEM 6.5 Forms JEE	CWE-863	Adobe Experience Manager Forms JEE \| Incorrect Authorization (CWE-863)
CVE-2026-77244	10.0	—	sooperset	mcp-atlassian	CWE-287	[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueToken…
CVE-2026-80155	10.0	—	LANTRONIX	SLC8000	CWE-22	Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypas…
CVE-2026-84412	10.0	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-89275	10.0	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-16346	9.9	—	IBM	DataStage on Cloud Pak for Data	CWE-285	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-18169	9.9	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-22	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-57149	9.9	—	plone	plone.app.portlets	CWE-95	plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
CVE-2026-75682	9.9	—	Adobe	Adobe Connect	CWE-89	Adobe Connect \| Improper Neutralization of Special Elements used in an SQL Co…
CVE-2026-82008	9.9	—	Adobe	Adobe Campaign Classic	CWE-20	Adobe Campaign Classic (ACC) \| Improper Input Validation (CWE-20)
CVE-2026-82010	9.9	—	Adobe	Adobe Campaign Classic	CWE-89	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements us…
CVE-2026-82013	9.9	—	Adobe	Adobe Campaign Classic	CWE-918	Adobe Campaign Classic (ACC) \| Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-83660	9.9	—	Adobe	Adobe Campaign Classic	CWE-918	Adobe Campaign Classic (ACC) \| Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-89276	9.9	—	Adobe	Adobe Campaign Classic	CWE-94	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code …
CVE-2026-12718	9.8	—	Karel Electronic Industry and Trade Inc.	KarelIPS	CWE-89	SQLi in Karel Electronics' KarelIPS
CVE-2026-18162	9.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-94	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18163	9.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-502	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-25254	9.8	—	Qualcomm, Inc.	Snapdragon	CWE-285	Improper authorization in Qualcomm Software Center
CVE-2026-28324	9.8	—	SolarWinds	Observability Self-Hosted	CWE-345	SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability
CVE-2026-65113	9.8	—	NVIDIA	Infrastructure Controller	CWE-798	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-74849	9.8	—	Zohocorp	ManageEngine ADSelfService Plus	CWE-78	Remote code execution vulnerability
CVE-2026-76708	9.8	—	Hewlett Packard Enterprise (HPE)	ALE	—	Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking An…
CVE-2026-76709	9.8	—	Hewlett Packard Enterprise (HPE)	ALE	—	Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking A…
CVE-2026-79313	9.8	—	n/a	n/a	CWE-613	webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The appli…
CVE-2026-93088	9.8	—	SGLang	SGLang	CWE-502	CVE-2026-93088
CVE-2026-17472	9.6	—	IBM	Concert	CWE-269	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-82000	9.6	—	Adobe	AEM 6.5 Forms JEE	CWE-918	Adobe Experience Manager Forms JEE \| Server-Side Request Forgery (SSRF) (CWE-…
CVE-2026-82443	9.6	—	Adobe	Adobe Campaign Classic	CWE-918	Adobe Campaign Classic (ACC) \| Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-84388	9.6	—	Fortinet	FortiPAM Chrome Extension	CWE-1021	A improper restriction of rendered ui layers or frames vulnerability in Forti…
CVE-2026-86059	9.6	—	Dokploy	dokploy	CWE-200	Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and …
CVE-2026-80143	9.4	—	LANTRONIX	SLC8000	CWE-78	Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom…
CVE-2026-80144	9.4	—	LANTRONIX	SLC8000	CWE-78	Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom…
CVE-2026-80145	9.4	—	LANTRONIX	SLC8000	CWE-78	Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs p…
CVE-2026-80146	9.4	—	LANTRONIX	SLC8000	CWE-121	Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc …
CVE-2026-80147	9.4	—	LANTRONIX	SLC8000	CWE-121	Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc …
CVE-2026-80151	9.4	—	LANTRONIX	SLC8000	CWE-78	Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs dow…
CVE-2026-80152	9.4	—	LANTRONIX	SLC8000	CWE-78	Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script …
CVE-2026-80156	9.4	—	LANTRONIX	SLC8000	CWE-22	Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload File…
CVE-2026-43641	9.3	—	Softaculous	Virtualizor	CWE-78	Softaculous Virtualizor OS Command Injection via Billing Module Handler
CVE-2026-47116	9.3	—	LTSecurity	LTK3500SF	CWE-798	LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH
CVE-2026-63374	9.3	—	agronholm	anyio	CWE-295	AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certifica…
CVE-2026-75684	9.3	—	Adobe	Adobe Connect	CWE-79	Adobe Connect \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75686	9.3	—	Adobe	Adobe Connect	CWE-20	Adobe Connect \| Improper Input Validation (CWE-20)
CVE-2026-75689	9.3	—	Adobe	Adobe Connect	CWE-79	Adobe Connect \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75697	9.3	—	Adobe	Adobe Connect	CWE-79	Adobe Connect \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-75698	9.3	—	Adobe	Adobe Connect	CWE-79	Adobe Connect \| Cross-site Scripting (Reflected XSS) (CWE-79)
CVE-2026-77621	9.3	—	vectordotdev	vector	CWE-22	Vector: Arbitrary file write in the file sink via templated path (path traver…
CVE-2026-77987	9.3	—	GitHub	Enterprise Server	CWE-208	GitHub Enterprise Server notebook viewer vulnerable to Server-side request fo…
CVE-2026-87121	9.3	—	lwIP	TCP/IP Stack MQTT	CWE-787	Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application
CVE-2026-91130	9.3	—	home-assistant	core	CWE-80	Home Assistant: XSS in Statistics Graph Card
CVE-2026-95675	9.3	—	D-LINK	DAP-1360	CWE-78	D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
CVE-2026-18461	9.2	—	RTI	Connext Professional	CWE-134	Use of Externally-Controlled Format String vulnerability in RTI Connext Profe…
CVE-2026-43642	9.2	—	Softaculous	Virtualizor	CWE-502	Softaculous Virtualizor PHP Object Injection via Billing Module Handler
CVE-2026-17635	9.1	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-306	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-17645	9.1	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-269	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-19202	9.1	—	Google	mcp-toolbox-sdk-python	CWE-524	Token Cache Reuse in mcp-toolbox-sdk-python
CVE-2026-75728	9.1	—	Adobe	Adobe Campaign Classic	CWE-863	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)
CVE-2026-77254	9.1	—	sooperset	mcp-atlassian	CWE-306	MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured …
CVE-2026-81995	9.1	—	Adobe	AEM 6.5 Forms JEE	CWE-20	Adobe Experience Manager Forms JEE \| Improper Input Validation (CWE-20)
CVE-2026-82009	9.1	—	Adobe	Adobe Campaign Classic	CWE-89	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements us…
CVE-2026-82011	9.1	—	Adobe	Adobe Campaign Classic	CWE-89	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements us…
CVE-2026-85734	9.1	—	HKUDS	LightRAG	CWE-307	LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
CVE-2026-94456	9.1	—	GitroomHQ	postiz-app	CWE-330	Unauthenticated recovery of the Math.random() state behind OAuth tokens, auth…
CVE-2026-95654	9.1	—	David-Crty	Databasement	CWE-863	Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token
CVE-2026-80154	8.9	—	LANTRONIX	SLC8000	CWE-330	Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Valid…
CVE-2026-13087	8.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-787	Kernel: heap out-of-bounds write in the linux kernel rpc-over-rdma server rep…
CVE-2026-16468	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-16469	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-16672	8.8	—	IBM	DataStage on Cloud Pak for Data	—	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-17102	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-17636	8.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-787	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-17637	8.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-502	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-17643	8.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-522	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-17644	8.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-798	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-17647	8.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-829	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-25255	8.8	—	Qualcomm, Inc.	Snapdragon	CWE-749	Exposed function in Qualcomm Package Manager and Qualcomm Software Center.
CVE-2026-25264	8.8	—	Qualcomm, Inc.	Snapdragon	CWE-427	Uncontrolled Search Path Element in Qualcomm Software Center
CVE-2026-25265	8.8	—	Qualcomm, Inc.	Snapdragon	CWE-378	Creation of Temporary File with Insecure Permissions in Qualcomm Software Center
CVE-2026-28325	8.8	—	SolarWinds	Observability Self-Hosted	CWE-502	SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vu…
CVE-2026-65128	8.8	—	NVIDIA	Infrastructure Controller	CWE-89	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-65179	8.8	—	NVIDIA	NeMo Speech	CWE-502	NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it d…
CVE-2026-70410	8.8	—	Apache Software Foundation	Apache Calcite Avatica	CWE-470	Apache Calcite Avatica: Unrestricted class initialization when instantiating …
CVE-2026-77243	8.8	—	sooperset	mcp-atlassian	CWE-862	MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
CVE-2026-77274	8.8	—	sooperset	mcp-atlassian	CWE-918	MCP Atlassian: SSRF Protection Bypass
CVE-2026-88419	8.8	—	n/a	n/a	CWE-434	An unrestricted upload of files with a dangerous type in the thumbnail-upload…
CVE-2026-18459	8.7	—	RTI	Connext Professional	CWE-682	Incorrect Calculation vulnerability in RTI Connext Professional (Core Librari…
CVE-2026-43643	8.7	—	Softaculous	Virtualizor	CWE-862	Softaculous Virtualizor Authorization Bypass via Billing Module Handler
CVE-2026-67615	8.7	—	Apereo Foundation	openEQUELLA	CWE-184	openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Inv…
CVE-2026-77619	8.7	—	vectordotdev	vector	CWE-130	Vector: Unauthenticated denial of service in the `logstash` source via unboun…
CVE-2026-77620	8.7	—	vectordotdev	vector	CWE-409	Vector: Unauthenticated denial of service in the `logstash` source via nested…
CVE-2026-81999	8.7	—	Adobe	AEM 6.5 Forms JEE	CWE-918	Adobe Experience Manager Forms JEE \| Server-Side Request Forgery (SSRF) (CWE-…
CVE-2026-90882	8.7	—	Eclipse Foundation	open-vsx.org	CWE-942	Reflected arbitrary origins with credentials, allowing cross-origin reads of …
CVE-2026-91018	8.7	—	lwIP	lwIP API	CWE-415	Double Free in lwIP (lightweight IP)
CVE-2026-93345	8.7	—	MikroTik	RouterOS	CWE-1284	MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-…
CVE-2026-94450	8.7	—	AWS	s2n-quic	CWE-1284	Potential denial of service when configured to send Retry packets in s2n-quic
CVE-2026-95653	8.7	—	concretecms-community-store	community_store	CWE-340	Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
CVE-2026-34689	8.6	—	Adobe	Adobe Connect	CWE-22	Adobe Connect \| Improper Limitation of a Pathname to a Restricted Directory (…
CVE-2026-75791	8.6	—	Zohocorp	ManageEngine ADSelfService Plus	CWE-306	Authentication bypass vulnerability
CVE-2026-77248	8.6	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachmen…
CVE-2026-77255	8.6	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA u…
CVE-2026-77262	8.6	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_atta…
CVE-2026-85279	8.6	—	notepad-plus-plus	notepad-plus-plus	CWE-121	Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLex…
CVE-2026-95655	8.6	—	aureuserp	aureuserp	CWE-639	Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
CVE-2026-95814	8.6	—	dani-garcia	vaultwarden	CWE-863	Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
CVE-2026-17646	8.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-611	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18095	8.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-787	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-82003	8.5	—	Adobe	Adobe Campaign Classic	CWE-20	Adobe Campaign Classic (ACC) \| Improper Input Validation (CWE-20)
CVE-2026-83603	8.4	—	netdata	netdata	CWE-73	Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle…
CVE-2026-18457	8.3	—	RTI	Connext Professional	CWE-122	Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Li…
CVE-2026-65114	8.3	—	NVIDIA	Infrastructure Controller	CWE-306	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-77247	8.3	—	sooperset	mcp-atlassian	CWE-73	MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachme…
CVE-2026-77251	8.3	—	sooperset	mcp-atlassian	CWE-1276	MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidde…
CVE-2026-77256	8.3	—	sooperset	mcp-atlassian	CWE-732	MCP Atlassian: OAuth refresh-token backup file is world-readable under defaul…
CVE-2026-77257	8.3	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths
CVE-2026-77260	8.3	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Arbitrary local file READ via unconstrained file_path in uploa…
CVE-2026-77267	8.3	—	sooperset	mcp-atlassian	CWE-918	mcp-atlassian has an incomplete SSRF remediation
CVE-2026-77271	8.3	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrit…
CVE-2026-18074	8.2	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-287	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18131	8.2	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-79	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-65121	8.2	—	NVIDIA	Infrastructure Controller	CWE-287	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-87119	8.2	—	ZenHive	mpp	CWE-294	mpp Tempo subscription key authorization is not bound to the issuing challeng…
CVE-2026-18137	8.1	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-89	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-75607	8.1	—	blakeblackshear	frigate	CWE-862	Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Oper…
CVE-2026-75744	8.1	—	Adobe	AEM 6.5 Forms JEE	CWE-79	Adobe Experience Manager Forms JEE \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-87902	8.1	—	WordPress	WordPress	CWE-98	An unauthenticated attacker can make `get_page_template()` page-template reso…
CVE-2026-18154	8.0	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-321	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-65130	8.0	—	NVIDIA	Infrastructure Controller	CWE-78	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-18066	7.9	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-918	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-24239	7.8	—	NVIDIA	NeMo Speech	CWE-502	NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious…
CVE-2026-24267	7.8	—	NVIDIA	NeMo Speech	CWE-502	NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech d…
CVE-2026-65111	7.8	—	NVIDIA	NeMo Speech	CWE-77	NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious…
CVE-2026-65178	7.8	—	NVIDIA	NeMo Speech	CWE-502	NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a …
CVE-2026-75649	7.8	—	Adobe	Adobe Bridge	CWE-122	Bridge \| Heap-based Buffer Overflow (CWE-122)
CVE-2026-75655	7.8	—	Adobe	Adobe Bridge	CWE-674	Bridge \| Uncontrolled Recursion (CWE-674)
CVE-2026-75658	7.8	—	Adobe	Adobe Bridge	CWE-787	Bridge \| Out-of-bounds Write (CWE-787)
CVE-2026-75663	7.8	—	Adobe	Adobe Bridge	CWE-787	Bridge \| Out-of-bounds Write (CWE-787)
CVE-2026-75665	7.8	—	Adobe	Adobe Bridge	CWE-122	Bridge \| Heap-based Buffer Overflow (CWE-122)
CVE-2026-75676	7.8	—	Adobe	Adobe Bridge	CWE-121	Bridge \| Stack-based Buffer Overflow (CWE-121)
CVE-2026-77605	7.8	—	notepad-plus-plus	notepad-plus-plus	CWE-20	Notepad++ “Run by system” executes .txt.cmd when user selected .txt (target…
CVE-2026-79906	7.8	—	Adobe	Substance3D - Modeler	CWE-787	Substance3D - Modeler \| Out-of-bounds Write (CWE-787)
CVE-2026-81998	7.8	—	Adobe	Substance3D - Modeler	CWE-787	Substance3D - Modeler \| Out-of-bounds Write (CWE-787)
CVE-2026-83598	7.8	—	netdata	netdata	CWE-269	Netdata: Local Privilege Escalation in Netdata Agent Windows installer via Po…
CVE-2026-83962	7.8	—	Adobe	Substance3D - Modeler	CWE-121	Substance3D - Modeler \| Stack-based Buffer Overflow (CWE-121)
CVE-2026-83963	7.8	—	Adobe	Substance3D - Modeler	CWE-787	Substance3D - Modeler \| Out-of-bounds Write (CWE-787)
CVE-2026-86054	7.8	—	notepad-plus-plus	notepad-plus-plus	CWE-121	Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlon…
CVE-2026-95831	7.8	—	—	Crypt-SelfCertificate	CWE-506	Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malw…
CVE-2026-8849	7.7	—	RTI	Connext Professional	CWE-416	Use After Free vulnerability in RTI Connext Professional (Security Plugins) a…
CVE-2026-75608	7.7	—	blakeblackshear	frigate	CWE-863	Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive …
CVE-2026-77258	7.7	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing…
CVE-2026-77259	7.7	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows ex…
CVE-2026-80148	7.7	—	LANTRONIX	SLC8000	CWE-918	Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
CVE-2026-80149	7.7	—	LANTRONIX	SLC8000	CWE-918	Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
CVE-2026-80150	7.7	—	LANTRONIX	SLC8000	CWE-918	Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
CVE-2026-83803	7.7	—	getsentry	sentry	CWE-502	Sentry: Unsafe pickle deserialization in Relocation Feature
CVE-2026-95619	7.7	—	Red Hat	Red Hat Hardened Images	CWE-190	Gcc: libstdc++ integer overflow in `new` operator
CVE-2026-95806	7.7	—	MISP	MISP	CWE-74	MISP: PHP phar stream wrapper enables deserialization and code execution via …
CVE-2026-18123	7.6	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-470	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-94117	7.6	—	DevItems	HashBar – WordPress Notification Bar	CWE-89	WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injectio…
CVE-2026-18134	7.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-319	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-19480	7.5	—	Adobe	Content Credentials Rust SDK	CWE-20	CAI Content Credentials \| Improper Input Validation (CWE-20)
CVE-2026-58268	7.5	—	emiago	sipgo	CWE-789	SIPGO: DoS via unvalidated Content-Length in the stream parser
CVE-2026-59991	7.5	—	psd-tools	psd-tools	CWE-789	psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via cr…
CVE-2026-61570	7.5	—	joniles	mpxj	CWE-611	MPXJ: XXE Vulnerability in MerlinReader
CVE-2026-61685	7.5	—	fecommunity	reactpress	CWE-89	ReactPress has SQL injection via dynamic column names in TypeORM query builders
CVE-2026-62985	7.5	—	azu	request-filtering-agent	CWE-248	request-filtering-agent: Synchronous throw from createConnection() for litera…
CVE-2026-65118	7.5	—	NVIDIA	Infrastructure Controller	CWE-295	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-75632	7.5	—	Adobe	Content Credentials Rust SDK	CWE-400	CAI Content Credentials \| Uncontrolled Resource Consumption (CWE-400)
CVE-2026-76710	7.5	—	Hewlett Packard Enterprise (HPE)	ALE	—	Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE …
CVE-2026-76711	7.5	—	Hewlett Packard Enterprise (HPE)	ALE	—	Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analyti…
CVE-2026-77242	7.5	—	sooperset	mcp-atlassian	CWE-367	MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF…
CVE-2026-77322	7.5	—	emiago	sipgo	CWE-789	SIPGO: DoS via unvalidated WebSocket frame length
CVE-2026-77544	7.5	—	Ubiquiti Inc	Dream Machines	CWE-787	A malicious actor with access to the network could exploit an Out-of-bounds W…
CVE-2026-77555	7.5	—	Ubiquiti Inc	Dream Machines	CWE-787	A malicious actor with access to the network could exploit an Out-of-bounds W…
CVE-2026-77556	7.5	—	Ubiquiti Inc	Dream Machines	CWE-125	A malicious actor with access to the network could exploit an Out-of-bounds R…
CVE-2026-77558	7.5	—	Ubiquiti Inc	Dream Machines	CWE-125	A malicious actor with access to the network could exploit an Out-of-bounds R…
CVE-2026-83599	7.5	—	netdata	netdata	CWE-409	Netdata: WebSocket Decompression Bomb
CVE-2026-89407	7.5	—	FasterXML	jackson-core	CWE-400	jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLi…
CVE-2026-94640	7.5	—	Red Hat	Red Hat Enterprise Linux 10	CWE-400	Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows un…
CVE-2026-95861	7.5	—	Ubiquiti Inc	Dream Machines	CWE-674	A malicious actor with access to the network could exploit an Uncontrolled Re…
CVE-2026-95862	7.5	—	Ubiquiti Inc	Dream Machines	CWE-787	A malicious actor with access to the network could exploit an Out-of-bounds W…
CVE-2026-96269	7.5	—	GNU	Emacs	CWE-829	GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a fi…
CVE-2026-18152	7.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-347	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18172	7.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-611	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18176	7.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-319	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-77246	7.4	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated…
CVE-2026-77912	7.4	—	GitHub	Enterprise Server	CWE-79	Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed…
CVE-2026-17618	7.3	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-862	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18462	7.3	—	RTI	Connext Professional	CWE-190	Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI …
CVE-2026-19915	7.3	—	HP Inc	HP Support Assistant	CWE-269	HP Support Assistant - Local Escalation of Privilege
CVE-2026-56681	7.3	—	decolua	9router	CWE-807	9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip H…
CVE-2026-76712	7.3	—	Hewlett Packard Enterprise (HPE)	ALE	CWE-200	Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denia…
CVE-2026-85995	7.3	—	notepad-plus-plus	notepad-plus-plus	CWE-347	Notepad++: Authenticode verification bypass allows modified updater execution
CVE-2026-63104	7.2	—	usekaneo	kaneo	CWE-862	Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint
CVE-2026-76713	7.2	—	Hewlett Packard Enterprise (HPE)	ALE	CWE-269	Authenticated Remote File System Access Vulnerability in HPE Networking Analy…
CVE-2026-76714	7.2	—	Hewlett Packard Enterprise (HPE)	ALE	CWE-78	Authenticated Remote Code Execution with Elevated Privileges Vulnerability in…
CVE-2026-94367	7.2	—	OpenEye	Apex Network Video Recorder (NVR)	CWE-78	OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS c…
CVE-2026-95815	7.2	—	OpenClaw	OpenClaw iOS	CWE-532	OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging
CVE-2026-75743	7.1	—	Adobe	AEM 6.5 Forms JEE	CWE-352	Adobe Experience Manager Forms JEE \| Cross-Site Request Forgery (CSRF) (CWE-352)
CVE-2026-76715	7.1	—	Hewlett Packard Enterprise (HPE)	ALE	CWE-300	Unauthenticated Man-in-the-Middle Attach Leads to Remote Code Execution Vulne…
CVE-2026-77253	7.1	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary…
CVE-2026-77261	7.1	—	sooperset	mcp-atlassian	CWE-918	MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth auth…
CVE-2026-77426	7.1	—	Unleash	unleash	CWE-639	Unleash: Missing await on permission check + cross-project IDOR in admin API
CVE-2026-77633	7.1	—	cloudreve	cloudreve	CWE-362	Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based de…
CVE-2026-84395	7.1	—	Adobe	Premiere	CWE-918	Premiere Pro \| Server-Side Request Forgery (SSRF) (CWE-918)
CVE-2026-85055	7.1	—	twentyhq	twenty	CWE-200	Twenty: Field-level read bypass
CVE-2026-85740	7.1	—	HKUDS	LightRAG	CWE-918	LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6t…
CVE-2026-89420	7.1	—	ZenHive	mpp	CWE-1284	Session voucher adding no new funds is accepted without a charge in mpp, serv…
CVE-2026-93343	7.1	—	WebWizards	MarketKing	CWE-862	MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax
CVE-2026-93344	7.1	—	WebWizards	MarketKing	CWE-862	MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX
CVE-2026-94455	7.1	—	GitroomHQ	postiz-app	CWE-306	Unauthenticated /enterprise/create-user mints lifetime top-tier organizations…
CVE-2026-94462	7.1	—	spree	spree	CWE-639	Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
CVE-2026-83597	7.0	—	netdata	netdata	CWE-269	Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MS…
CVE-2026-11388	6.9	—	RTI	Connext Professional	CWE-415	Double Free vulnerability in RTI Connext Professional (Core Libraries) allows…
CVE-2026-18460	6.9	—	RTI	Connext Professional	CWE-193	Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Profession…
CVE-2026-25262	6.9	—	Qualcomm, Inc.	Snapdragon	CWE-123	Write-what-where Condition in Primary Bootloader
CVE-2026-63627	6.9	—	wevm	mppx	CWE-20	mppx: Gas Draining with padding
CVE-2026-63628	6.9	—	wevm	mppx	CWE-20	mppx: Gas Draining with access list
CVE-2026-95499	6.9	—	JosephChuks	php-file-manager-with-code-editor	CWE-284	JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_f…
CVE-2026-95658	6.9	—	MISP	MISP	CWE-352	MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-sit…
CVE-2026-95667	6.9	—	MISP	MISP	CWE-22	MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Creden…
CVE-2026-95679	6.9	—	MISP	MISP	CWE-20	MISP Unauthenticated Blind SSRF via XML Body Processing
CVE-2026-95754	6.9	—	MISP	MISP	CWE-285	MISP: Disabled-user check ineffective in pre-authentication TOTP login branch
CVE-2026-11389	6.8	—	RTI	Connext Professional	CWE-125	Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access …
CVE-2026-18458	6.8	—	RTI	Connext Professional	CWE-125	Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access …
CVE-2026-18626	6.8	—	RTI	Connext Professional	CWE-125	Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries)…
CVE-2026-79312	6.8	—	n/a	n/a	CWE-384	webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._l…
CVE-2026-95624	6.8	—	Tauri	tauri-plugin-updater	CWE-284	Tauri framework v2 malicious downgrade via allow_downgrades from frontend code
CVE-2026-63278	6.7	—	The Document Foundation	LibreOffice	CWE-200	Package URLs can be used to exfiltrate arbitrary INI file values and environm…
CVE-2026-65129	6.7	—	NVIDIA	Infrastructure Controller	CWE-295	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-85288	6.7	—	notepad-plus-plus	notepad-plus-plus	CWE-78	Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Mac…
CVE-2026-65125	6.6	—	NVIDIA	Infrastructure Controller	CWE-73	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-16426	6.5	—	IBM	Concert	CWE-918	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-17465	6.5	—	IBM	Concert	CWE-400	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-18114	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-22	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18124	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-522	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18132	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-862	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18156	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-862	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18170	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-770	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-57576	6.5	—	plone	plone.app.dexterity	CWE-400	plone.app.dexterity and plone.app.contenttypes have a Denial of Service due t…
CVE-2026-65112	6.5	—	NVIDIA	Infrastructure Controller	CWE-400	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-65115	6.5	—	NVIDIA	Infrastructure Controller	CWE-400	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-75517	6.5	—	novuhq	novu	CWE-639	Novu: Cross-Environment Integration Manipulation (IDOR)
CVE-2026-75638	6.5	—	Adobe	Content Credentials Rust SDK	CWE-20	CAI Content Credentials \| Improper Input Validation (CWE-20)
CVE-2026-77252	6.5	—	sooperset	mcp-atlassian	CWE-284	MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypas…
CVE-2026-77266	6.5	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read…
CVE-2026-77269	6.5	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read…
CVE-2026-77270	6.5	—	sooperset	mcp-atlassian	CWE-22	MCP Atlassian: Arbitrary File Read via Upload Attachment Tools
CVE-2026-77399	6.5	—	collective	icalendar	CWE-400	icalendar: Denial of service via unbounded VALARM REPEAT expansion
CVE-2026-79913	6.5	—	cloudreve	cloudreve	CWE-697	Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrapper…
CVE-2026-83600	6.5	—	netdata	netdata	CWE-193	Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB alloca…
CVE-2026-83601	6.5	—	netdata	netdata	CWE-190	Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing…
CVE-2026-83602	6.5	—	netdata	netdata	CWE-284	Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist…
CVE-2026-92928	6.5	—	OpenEye	Apex Network Video Recorder (NVR)	CWE-798	OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardc…
CVE-2026-96260	6.5	—	Mattermost	Mattermost	CWE-789	Mattermost server missing request body size limit on plugin routes allows den…
CVE-2026-83805	6.4	—	nautobot	nautobot	CWE-285	Nautobot: Authorization bypass in approval workflow REST API allows self-appr…
CVE-2026-94384	6.4	—	Amazon	amazon-connect-salesforce-lambda	CWE-862	Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Conn…
CVE-2026-84301	6.3	—	labring	FastGPT	CWE-918	FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected …
CVE-2026-86805	6.3	—	The GNU C Library	glibc	CWE-367	AT_SECURE programs may load attacker-controlled code via $ORIGIN
CVE-2026-88010	6.3	—	traefik	traefik	CWE-208	Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated us…
CVE-2026-15915	6.2	—	IBM	Concert	CWE-552	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-83964	6.2	—	Adobe	Adobe Connect	CWE-295	Adobe Connect \| Improper Certificate Validation (CWE-295)
CVE-2026-92930	6.2	—	OpenEye	Apex Network Video Recorder (NVR)	CWE-330	OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administ…
CVE-2026-48361	6.1	—	Adobe	Adobe Connect	CWE-79	Adobe Connect \| Cross-site Scripting (Stored XSS) (CWE-79)
CVE-2026-77250	6.1	—	sooperset	mcp-atlassian	CWE-312	MCP Atlassian: OAuth fallback token storage writes plaintext access and refre…
CVE-2026-86062	6.1	—	HKUDS	LightRAG	CWE-79	LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer…
CVE-2026-75101	6.0	—	GitHub	Enterprise Server	CWE-639	Authorization bypass vulnerability in GitHub Enterprise Server allowed readin…
CVE-2025-36084	5.9	—	IBM	Concert	CWE-327	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-65124	5.9	—	NVIDIA	Infrastructure Controller	CWE-91	NVIDIA Infrastructure Controller for Linux contains a vulnerability where an …
CVE-2026-77265	5.9	—	sooperset	mcp-atlassian	CWE-918	MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
CVE-2026-85725	5.9	—	HKUDS	LightRAG	CWE-208	LightRAG: Plaintext Passwords Compared Without Constant-Time Function
CVE-2026-94570	5.9	—	SGLang	SGLang	CWE-1287	CVE-2026-94570
CVE-2026-95623	5.6	—	Tauri	tauri-plugin-http	CWE-918	Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
CVE-2026-75633	5.5	—	Adobe	Content Credentials Rust SDK	CWE-20	CAI Content Credentials \| Improper Input Validation (CWE-20)
CVE-2026-75656	5.5	—	Adobe	Adobe Bridge	CWE-125	Bridge \| Out-of-bounds Read (CWE-125)
CVE-2026-76192	5.5	—	Adobe	InDesign Desktop	CWE-476	InDesign Desktop \| NULL Pointer Dereference (CWE-476)
CVE-2026-76804	5.5	—	projectdiscovery	nuclei	CWE-284	Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
CVE-2026-77268	5.5	—	sooperset	mcp-atlassian	CWE-732	MCP Atlassian: Insecure File Permissions on OAuth Token Storage
CVE-2026-79767	5.5	—	gardener	gardener	CWE-863	Gardener: Authorization Bypass via Group Subject Injection
CVE-2026-81878	5.5	—	radareorg	radare2	CWE-190	radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser
CVE-2026-81879	5.5	—	radareorg	radare2	CWE-125	radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling
CVE-2026-81880	5.5	—	radareorg	radare2	CWE-400	radare2: Uncontrolled resource consumption in radare2 PEF loader
CVE-2026-81885	5.5	—	radareorg	radare2	CWE-770	radare2: Infinite relocation-chain loop causes denial of service in radare2 N…
CVE-2026-81886	5.5	—	radareorg	radare2	CWE-770	radare2: Uncontrolled memory allocation in radare2 dmp64 parser
CVE-2026-84396	5.5	—	Adobe	InDesign Desktop	CWE-476	InDesign Desktop \| NULL Pointer Dereference (CWE-476)
CVE-2026-86056	5.5	—	notepad-plus-plus	notepad-plus-plus	CWE-476	Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler cause…
CVE-2026-89277	5.5	—	Adobe	Content Credentials Rust SDK	CWE-190	CAI Content Credentials \| Integer Overflow or Wraparound (CWE-190)
CVE-2026-95271	5.5	—	dgtlmoon	changedetection.io	CWE-287	dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentica…
CVE-2026-95500	5.5	—	JosephChuks	php-file-manager-with-code-editor	CWE-284	JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_co…
CVE-2026-95656	5.5	—	dgtlmoon	changedetection.io	CWE-918	dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapsho…
CVE-2026-95819	5.5	—	anirbandutta9	College-Notes-Gallery	CWE-74	anirbandutta9 College-Notes-Gallery login.php sql injection
CVE-2026-96259	5.5	—	Mattermost	Mattermost	CWE-918	Mattermost server-side request forgery via OAuth endpoints configurable by a …
CVE-2026-18133	5.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-22	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18153	5.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-327	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-63272	5.4	—	The Document Foundation	LibreOffice	CWE-125	Heap buffer overflow in WMF text record import
CVE-2026-63273	5.4	—	The Document Foundation	LibreOffice	CWE-787	Heap buffer overflow in PDF import encryption handling
CVE-2026-63274	5.4	—	The Document Foundation	LibreOffice	CWE-125	Heap buffer overflow in PDF import stream handling
CVE-2026-63275	5.4	—	The Document Foundation	LibreOffice	CWE-787	Stack buffer overflow in CFF font hint handling
CVE-2026-63276	5.4	—	The Document Foundation	LibreOffice	CWE-787	Stack buffer overflow in CFF to Type 1 font conversion
CVE-2026-63279	5.4	—	The Document Foundation	LibreOffice	CWE-125	Out of bounds read in PICT image import
CVE-2026-77272	5.4	—	sooperset	mcp-atlassian	CWE-79	MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
CVE-2026-83801	5.4	—	nautobot	nautobot	CWE-79	Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
CVE-2026-90462	5.4	—	Red Hat	Red Hat Enterprise Linux 10	CWE-280	Sssd: sssd: fail-open in ldap ppolicy access check allows continued authoriza…
CVE-2026-91129	5.4	—	home-assistant	core	CWE-918	Home Assistant: mDNS Server-Side Request Forgery
CVE-2025-12767	5.3	—	IBM	Concert	CWE-770	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-17620	5.3	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-523	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-56682	5.3	—	decolua	9router	CWE-307	9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
CVE-2026-63386	5.3	—	sunnyadn	js-toml	CWE-674	js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaus…
CVE-2026-65829	5.3	—	joniles	mpxj	CWE-22	MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak…
CVE-2026-75511	5.3	—	novuhq	novu	CWE-918	Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs
CVE-2026-76716	5.3	—	Hewlett Packard Enterprise (HPE)	ALE	CWE-770	Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilit…
CVE-2026-76717	5.3	—	Hewlett Packard Enterprise (HPE)	ALE	CWE-200	Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE …
CVE-2026-76803	5.3	—	projectdiscovery	nuclei	CWE-284	Nuclei: Local File Read via MySQL Client Sandbox Bypass
CVE-2026-76805	5.3	—	projectdiscovery	nuclei	CWE-200	Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuz…
CVE-2026-76910	5.3	—	Unleash	unleash	CWE-639	Unleash: Clone-feature lets a user copy a feature from a project they cannot …
CVE-2026-77249	5.3	—	sooperset	mcp-atlassian	CWE-918	MCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unh…
CVE-2026-85709	5.3	—	HKUDS	LightRAG	CWE-209	LightRAG: Sensitive Information Exposure Through Raw Exception Messages in AP…
CVE-2026-88020	5.3	—	Autonomy Logic	OpenPLC Runtime	CWE-79	Improper Neutralization of Input During Web Page Generation in OpenPLC Runtim…
CVE-2026-90990	5.3	—	Checkmk GmbH	Checkmk	CWE-93	Livestatus injection via monitoring filter values
CVE-2026-92882	5.3	—	Checkmk GmbH	Checkmk	CWE-522	Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config …
CVE-2026-92929	5.3	—	OpenEye	Apex Network Video Recorder (NVR)	CWE-290	OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forw…
CVE-2026-93341	5.3	—	WebWizards	MarketKing	CWE-862	MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX
CVE-2026-93342	5.3	—	WebWizards	MarketKing	CWE-862	MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX
CVE-2026-95671	5.3	—	MISP	MISP	CWE-285	MISP Collections: Missing Authorization Check for Sharing Group on PUT Reques…
CVE-2026-95674	5.3	—	MISP	MISP	CWE-20	MISP EventsController queryEnrichment allows querying unavailable or legacy m…
CVE-2026-95683	5.3	—	MISP	MISP	CWE-639	MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
CVE-2026-95685	5.3	—	MISP	MISP	CWE-862	MISP Missing Authorization on replaceSuggestionInReport Event Report Action
CVE-2026-95693	5.3	—	MISP	MISP	CWE-22	MISP Information Disclosure via Forged Upload Path
CVE-2026-95697	5.3	—	MISP	MISP	CWE-862	MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Or…
CVE-2026-95698	5.3	—	MISP	MISP	CWE-22	MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
CVE-2026-95805	5.3	—	MISP	MISP	CWE-285	MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended a…
CVE-2026-95812	5.3	—	MacWarrior	clipbucket-v5	CWE-79	ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
CVE-2026-95813	5.3	—	e621ng	e621ng	CWE-601	e621ng before 26.09.16 Open Redirect via URL Parameters
CVE-2026-95829	5.3	—	TDuckCloud	tduck-platform	CWE-89	TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java…
CVE-2026-95830	5.3	—	theRealSain	Pixtream	CWE-434	theRealSain Pixtream post_upload.php unrestricted upload
CVE-2026-95833	5.3	—	itsourcecode	Leave Management System	CWE-89	itsourcecode Leave Management System index.php sql injection
CVE-2026-75510	5.1	—	novuhq	novu	CWE-79	Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: sc…

Results continue: ranks 401–455.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-22 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.