Security Box Score — September 23, 2026

472 CVEs published, led by Red Hat (47).

472 CVEs published September 23, 2026: 42 critical, 188 high, 196 medium, 40 low; 0 in the KEV catalog at press time; 4 with a public exploit reference; 6 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 72 on continuation pages.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	11753	46709	—	—
KEV catalog size	1721

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3010 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	1507	5598	526	2513	713	1	15	6	0.1	7.8	.0017	+91 ▲
microsoft	1001	2900	206	1987	691	16	289	30	1.0	7.8	.0044	+532 ▲
google	517	2684	332	1049	1182	121	80	9	0.3	7.5	.0025	+446 ▲
red hat	222	851	52	354	399	46	2	0	0.0	6.7	.0028	+34 ▲
apple	246	563	67	165	317	14	88	8	1.4	6.5	.0020	+206 ▲
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	-23 ▼
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0021	-14 ▼
suse	13	41	7	21	12	1	0	0	0.0	7.5	.0036	+8 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	97	181	53	72	55	1	59	16	8.8	7.7	.0039	+51 ▲
ubiquiti	6	65	36	28	1	0	3	3	4.6	9.1	.0049	+6 ▲
palo alto networks	9	46	1	4	26	15	13	2	4.3	4.7	.0022	-3 ▼
fortinet	11	41	11	10	17	3	29	7	17.1	7.2	.0038	+4 ▲
netgear	2	34	0	0	27	7	0	0	0.0	4.3	.0025	-7 ▼
f5	9	26	7	14	4	1	5	2	7.7	8.7	.0047	+9 ▲
ivanti	10	24	6	16	2	0	25	5	20.8	8.8	.0147	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	-5 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	129	641	147	271	206	16	33	2	0.3	7.5	.0049	-2 ▼
mozilla	113	301	102	126	73	0	9	0	0.0	8.8	.0028	+54 ▲
gitlab	24	100	7	24	58	11	5	3	3.0	5.3	.0032	+8 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
github	6	23	2	11	10	0	0	0	0.0	7.4	.0045	+1 ▲
docker	3	12	1	8	3	0	0	0	0.0	8.4	.0016	+1 ▲
wordpress	1	6	1	4	1	0	2	2	33.3	8.7	.1658	-1 ▼
go	4	4	0	2	1	1	0	0	0.0	5.9	.0029	+4 ▲

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	634	2905	581	1660	563	101	28	4	0.1	7.8	.0034	-255 ▼
ibm	371	990	195	452	328	15	6	1	0.1	7.5	.0030	-3 ▼
adobe	224	830	82	362	376	10	20	4	0.5	7.5	.0025	+164 ▲
progress	3	64	15	39	10	0	6	1	1.6	8.1	.0035	-16 ▼
zohocorp	26	36	6	24	6	0	0	0	0.0	8.1	.0121	+22 ▲
solarwinds	3	26	18	5	3	0	10	4	15.4	9.1	.0060	+3 ▲
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
atlassian	3	9	1	8	0	0	13	0	0.0	7.6	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	26	71	21	26	12	12	3	8.5	.0154	+10 ▲
siemens	15	52	6	33	10	3	0	7.3	.0018	-4 ▼
synology	19	46	5	10	25	6	0	5.6	.0027	+18 ▲
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+17 ▲
advantech	17	20	2	17	1	0	0	8.6	.0068	+17 ▲
schneider electric	9	18	2	11	5	0	0	8.5	.0040	+9 ▲
hikvision	3	9	0	5	4	0	0	7.1	.0036	+3 ▲
abb	2	9	1	5	3	0	0	7.2	.0018	+2 ▲

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	190	361	31	166	142	22	2	1	0.3	7.2	.0020	+134 ▲
sourcecodester	63	232	0	0	138	94	0	0	0.0	5.5	.0028	+21 ▲
nvidia	51	185	21	127	37	0	0	0	0.0	7.8	.0031	+27 ▲
spring	0	170	13	60	83	14	0	0	0.0	6.5	.0024	-5 ▼
mongodb	64	162	6	94	58	4	1	0	0.0	7.1	.0026	+32 ▲
itsourcecode	37	153	0	0	37	116	0	0	0.0	2.1	.0026	+17 ▲
hewlett packard enterprise (hpe)	139	148	17	77	48	6	1	1	0.7	7.2	.0030	+136 ▲
wwbn	106	146	23	49	74	0	0	0	0.0	6.9	.0024	+97 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-85706	.0929	95.1	10.0
CVE-2026-83549	.0851	94.8	7.8
CVE-2026-82329	.0767	94.3	9.8
CVE-2026-86218	.0749	94.2	10.0
CVE-2026-79756	.0515	92.1	8.7
CVE-2026-83548	.0467	91.4	10.0
CVE-2026-74849	.0446	91.0	9.8
CVE-2026-76698	.0444	91.0	6.5
CVE-2026-19632	.0412	90.4	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-85706	10.0	.0929	KEV
CVE-2026-86218	10.0	.0749	KEV
CVE-2026-83548	10.0	.0467	KEV
CVE-2026-75650	10.0	.0215	KEV
CVE-2026-86152	10.0	.0186
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-80155	10.0	.0158
CVE-2026-82222	10.0	.0155
CVE-2026-82004	10.0	.0144

Most disclosures (vendor)
Vendor	CVEs
linux	1735
microsoft	1009
google	846
oracle	635
ibm	387
adobe	265
red hat	253
apple	250
dell	204
apache	157

Most KEV additions (YTD)
Vendor	KEV
microsoft	30
cisco	16
google	9
apple	8
fortinet	7
linux	6
ivanti	5
adobe	4
berriai	4
checkpoint	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	92
Packagist	40
npm	14
PyPI	12
crates.io	8
RubyGems	2
Go	1
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-58704	Google	0
CVE-2026-75650	Adobe	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-87491	Google	0
CVE-2026-93952	Arista Networks	0
CVE-2026-84869	ConnectWise	2
CVE-2026-86218	N-able	2
CVE-2026-81578	PaperCut	3

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1771
CVE-2021-27102	n/a	2021-11-17	1771
CVE-2021-27101	n/a	2021-11-17	1771
CVE-2021-27103	n/a	2021-11-17	1771
CVE-2021-21017	Adobe	2021-11-17	1771
CVE-2021-28550	Adobe	2021-11-17	1771
CVE-2021-42013	Apache Software Foundation	2021-11-17	1771
CVE-2021-41773	Apache Software Foundation	2021-11-17	1771
CVE-2021-30858	Apple	2021-11-17	1771
CVE-2021-30860	Apple	2021-11-17	1771

Transactions

EXPLOIT PUBLISHED — MediaArea MediaInfoLib: 3 CVEs (CVE-2026-25104, CVE-2026-25713, CVE-2026-28764). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2026-26824. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-26825. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-43641 (Softaculous Virtualizor). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-47116 (LTSecurity LTK3500SF). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-55654 (Red Hat Enterprise Linux 10). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-56818 (netty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-67615 (Apereo Foundation openEQUELLA). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-77006 (Unknown WebTotem Backups). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-85706 (GitLab). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-87719 (GitLab). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-92764 (opencve). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93307 (O-RAN-SC SMO OAM). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93533 (spatie Scotty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93739 (Totolink A3002MU). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94109 (openEQUELLA). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-94536 (dromara lamp-cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-95812 (MacWarrior clipbucket-v5). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-95819 (anirbandutta9 College-Notes-Gallery). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-95820 (anirbandutta9 College-Notes-Gallery). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-95828 (Mstfakts College-Management-System). Public exploit reference added.

DUE DATE PASSED — CVE-2026-81963 (Microsoft Windows 11 version 23H2). CISA remediation deadline was September 22, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-85880 (Microsoft Windows 10 Version 1607). CISA remediation deadline was September 22, 2026; still in catalog.

RESCORED — Microsoft Windows 10 Version 1607: 3 CVEs (CVE-2026-69512, CVE-2026-72927, CVE-2026-81355). CVSS rescored — before/after on each CVE page.

RESCORED — Okta Access Gateway: 3 CVEs (CVE-2026-78552, CVE-2026-78560, CVE-2026-78579). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2026-10027 (IBM MQ). CVSS 8.1 → 9.8 (NVD).

RESCORED — CVE-2026-10853 (IBM MQ). CVSS 7.5 → 8.8 (NVD).

RESCORED — CVE-2026-12749 (IBM Cloud Pak for Business Automation). CVSS 6.4 → 5.4 (NVD).

RESCORED — CVE-2026-12750 (IBM Cloud Pak for Business Automation). CVSS 6.4 → 5.4 (NVD).

RESCORED — CVE-2026-13745 (Google Cloud Gemini CLI). CVSS 9.2 → 7.7 (NVD).

RESCORED — CVE-2026-47116 (LTSecurity LTK3500SF). CVSS 9.3 → 9.2 (NVD).

RESCORED — CVE-2026-59302 (Spring Cloud Stream). CVSS 3.1 → 4.9 (NVD).

RESCORED — CVE-2026-59903 (netty). CVSS 6.5 → 7.5 (NVD).

RESCORED — CVE-2026-73508 (netty). CVSS 5.3 → 7.5 (NVD).

RESCORED — CVE-2026-78574 (Okta Hyperdrive Integration Plugin). CVSS 7.5 → 6.3 (NVD).

RESCORED — CVE-2026-80225 (NLnet Labs Unbound). CVSS 5.3 → 7.5 (NVD).

RESCORED — CVE-2026-81352 (Microsoft Web Media Extensions). CVSS 8.8 → 9.8 (NVD).

RESCORED — CVE-2026-81380 (Microsoft Visual Studio Code). CVSS 5.3 → 5.9 (NVD).

RESCORED — CVE-2026-82443 (Adobe Campaign Classic). CVSS 9.6 → 9.9 (NVD).

RESCORED — CVE-2026-83660 (Adobe Campaign Classic). CVSS 9.9 → 10 (NVD).

RESCORED — CVE-2026-85501 (NLnet Labs Unbound). CVSS 5.3 → 7.5 (NVD).

RESCORED — CVE-2026-88013 (rclone). CVSS 3.7 → 5.3 (NVD).

RESCORED — CVE-2026-95829 (TDuckCloud tduck-platform). CVSS 5.3 → 2.1 (NVD).

RESCORED — CVE-2026-95830 (theRealSain Pixtream). CVSS 5.3 → 2.1 (NVD).

RESCORED — CVE-2026-95833 (itsourcecode Leave Management System). CVSS 5.3 → 2.1 (NVD).

PATCH SHIPPED — Red Hat Enterprise Linux 9: 9 CVEs (CVE-2025-11395, CVE-2026-11861, CVE-2026-13097, CVE-2026-18147, CVE-2026-19550, CVE-2026-73197, CVE-2026-73198, CVE-2026-76578, CVE-2026-79678). Fix versions published.

PATCH SHIPPED — CVE-2026-28183 (PublishPress Capabilities). Fixed in PublishPress Capabilities 2.50.0.

PATCH SHIPPED — CVE-2026-84470 (Red Hat Ansible Automation Platform 2.5 for RHEL 8). Fixed in Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap.

PATCH SHIPPED — CVE-2026-93337 (nm-l2tp NetworkManager-l2tp). Fixed in NetworkManager-l2tp 1.52.6.

Yesterday's Results

How to read these box scores · glossary

472 CVEs published. 25 box scores and 375 table rows below; the remaining 72 continue on page 2 — every CVE is listed, nothing truncated.

CVE-2026-15027HIGH

Changing｜CGServiSign - OS Command Injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   A   H   H   H    8.6   .0217   81.5     —

AFFECTED
  Product      Versions       Fixed
  CGServiSign  1.0.23.1227 –  —

TIMELINE
  Jul 8   Reserved by CNA
  Sep 23  Published (CNA: twcert)

CWE-78 · CNA: twcert · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-96257CRITICAL

Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .0104   62.5     —

AFFECTED
  Product                   Versions  Fixed
  FAC1203R Gigabit Edition  2.0.4 –   —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-119, CWE-121 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-31377HIGH

Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0065   49.6     —

AFFECTED
  Product       Versions  Fixed
  Apache Doris  2.0.0 –   4.0.8

TIMELINE
  Mar 9   Reserved by CNA
  Sep 23  Published (CNA: apache)

CWE-287 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-96272HIGH

MacWarrior clipbucket-v5 — ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   N   N    8.7   .0054   44.4     —

AFFECTED
  Product        Versions     Fixed
  clipbucket-v5  unspecified  —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulnCheck)

CWE-89 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-89425HIGH

FasterXML jackson-core — jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growth

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0053   44.0     —

AFFECTED
  Product       Versions  Fixed
  jackson-core  2.8.0 –   —
  jackson-core  3.0.0 –   —

TIMELINE
  Sep 11  Reserved by CNA
  Sep 23  Published (CNA: HeroDevs)

CWE-400, CWE-770 · CNA: HeroDevs · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-93368HIGH

travispluse Rename wp-login.php to anything you want — Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .0050   42.2     —

AFFECTED
  Product                                   Versions     Fixed
  Rename wp-login.php to anything you want  unspecified  —

TIMELINE
  Sep 17  Reserved by CNA
  Sep 23  Published (CNA: Wordfence)

CWE-89 · CNA: Wordfence · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-91776HIGH

FasterXML jackson-databind — jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0049   41.1     —

AFFECTED
  Product           Versions  Fixed
  jackson-databind  2.0.0 –   —
  jackson-databind  3.0.0 –   —

TIMELINE
  Sep 15  Reserved by CNA
  Sep 23  Published (CNA: HeroDevs)

CWE-400 · CNA: HeroDevs · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-91777HIGH

FasterXML jackson-databind — jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0049   41.1     —

AFFECTED
  Product           Versions  Fixed
  jackson-databind  2.5.0 –   —
  jackson-databind  3.0.0 –   —

TIMELINE
  Sep 15  Reserved by CNA
  Sep 23  Published (CNA: HeroDevs)

CWE-400 · CNA: HeroDevs · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-96454HIGH

tw93 Pake — Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  C  L  H  N    8.2   .0048   40.8     —

AFFECTED
  Product  Versions     Fixed
  Pake     unspecified  —

TIMELINE
  Sep 23  Reserved by CNA
  Sep 23  Published (CNA: JFROG)

CWE-862, CWE-923 · CNA: JFROG · CVSS v3.1 · 5 references · NVD status: Deferred

CVE-2026-95626HIGH

Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  C  H  H  H    8.3   .0047   39.9     —

AFFECTED
  Product  Versions  Fixed
  tauri    2.0.0 –   —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: JFROG)

CWE-79 · CNA: JFROG · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-95957LOW

SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0047   39.9     —

AFFECTED
  Product                                       Versions  Fixed
  Smart Attendance System with QR Code Scanner  1.0 –     —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-96258LOW

onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   L   N    2.1   .0045   38.4     —

AFFECTED
  Product                      Versions    Fixed
  Auktion NG Auktionssoftware  20260722 –  —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-79, CWE-94 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Deferred

CVE-2026-95924MEDIUM

SourceCodester Online Reviewer Management System btn_functions.php add sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0043   36.9     —

AFFECTED
  Product                            Versions  Fixed
  Online Reviewer Management System  1.0 –     —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-95925MEDIUM

SourceCodester Online Reviewer Management System btn_functions.php update sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0043   36.9     —

AFFECTED
  Product                            Versions  Fixed
  Online Reviewer Management System  1.0 –     —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-95926MEDIUM

SourceCodester Online Reviewer Management System btn_functions.php update sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0043   36.9     —

AFFECTED
  Product                            Versions  Fixed
  Online Reviewer Management System  1.0 –     —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-95927MEDIUM

SourceCodester Online Reviewer Management System exam-delete.php sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   L   L   L    5.5   .0043   36.9     —

AFFECTED
  Product                            Versions  Fixed
  Online Reviewer Management System  1.0 –     —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

CVE-2026-95930MEDIUM

iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0043   36.6     —

AFFECTED
  Product       Versions  Fixed
  astron-agent  1.0.0 –   reward-1575

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-918 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-19438HIGH

ABB Mint Workbench I — Mint Workbench I Path traversal Vulnerability

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   N   N   N   H   N   N    8.2   .0041   35.1     —

AFFECTED
  Product           Versions     Fixed
  Mint Workbench I  unspecified  —

TIMELINE
  Aug 10  Reserved by CNA
  Sep 23  Published (CNA: ABB)

CWE-22 · CNA: ABB · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-95929MEDIUM

iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   L   L   L    5.3   .0039   32.9     —

AFFECTED
  Product       Versions  Fixed
  astron-agent  1.0.0 –   reward-1575

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-74, CWE-89 · CNA: VulDB · CVSS v4.0 · 9 references · NVD status: Deferred

CVE-2026-96271HIGH

Photoview through 2.4.0 Authorization Bypass via shareAlbum

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   H   L   N    7.1   .0039   32.7     —

AFFECTED
  Product    Versions     Fixed
  photoview  unspecified  —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulnCheck)

CWE-639 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-6831MEDIUM

vsourz1td Advanced Contact form 7 DB — Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  N  N    6.5   .0035   29.1     —

AFFECTED
  Product                     Versions     Fixed
  Advanced Contact form 7 DB  unspecified  —

TIMELINE
  Apr 21  Reserved by CNA
  Sep 23  Published (CNA: Wordfence)

CWE-862 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-5924MEDIUM

jetmonsters Getwid – Gutenberg Blocks — Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  L  L  N    6.4   .0035   28.6     —

AFFECTED
  Product                    Versions  Fixed
  Getwid – Gutenberg Blocks  2.1.3 –   —

TIMELINE
  Apr 8   Reserved by CNA
  Sep 23  Published (CNA: Wordfence)

CWE-79 · CNA: Wordfence · CVSS v3.1 · 6 references · NVD status: Deferred

CVE-2026-91797HIGH

Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   N   R  U  H  H  H    7.8   .0035   28.2     —

AFFECTED
  Product           Versions                       Fixed
  Foxit PDF Editor  Versions 2026.2 and earlier –  —
  Foxit PDF Reader  Versions 2026.2 and earlier –  —

TIMELINE
  Sep 15  Reserved by CNA
  Sep 23  Published (CNA: Foxit)

CWE-73 · CNA: Foxit · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-95627HIGH

Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   L   R  C  H  H  N    7.7   .0034   27.3     —

AFFECTED
  Product              Versions  Fixed
  tauri-plugin-dialog  2.0.0 –   —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: JFROG)

CWE-732 · CNA: JFROG · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-95897LOW

n/a Dask — Dask Loader core.py from_npy_stack deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   P   L   L   L    2.0   .0034   27.3     —

AFFECTED
  Product  Versions  Fixed
  Dask     2026.0 –  —

TIMELINE
  Sep 22  Reserved by CNA
  Sep 23  Published (CNA: VulDB)

CWE-20, CWE-502 · CNA: VulDB · CVSS v4.0 · 6 references · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-95928	2.0	27.3	recommenders-team	recommenders	CWE-20	recommenders-team recommenders Dict Loading mind_iterator.py pickle.load dese…
CVE-2026-95868	2.1	26.7	AdithyaYelloju	Restaurant-Management-System	CWE-74	AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysq…
CVE-2026-42801	7.4	21.1	ASR	Crane，Falcon	CWE-476	Deference after null check in as_rrc
CVE-2026-96443	6.5	18.7	Apache Software Foundation	Apache Doris	CWE-829	Apache Doris: JDBC driver URL validation bypass leads to remote code execution
CVE-2026-50227	6.1	18.4	Acer	NitroSense V5	CWE-78	MQTT WebSocket Command Execution Vulnerability in NitroSense
CVE-2026-75799	9.0	14.8	Unknown	YAHMAN Add-ons	CWE-94	YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card…
CVE-2022-4997	8.6	14.8	Unknown	jet-form-builder-stripe-gateway	CWE-89	JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Paymen…
CVE-2026-91789	7.8	13.3	Foxit Software Inc.	Foxit PDF Editor	CWE-787	Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Executi…
CVE-2026-91794	7.8	13.3	Foxit Software Inc.	Foxit PDF Editor	CWE-787	Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Ex…
CVE-2026-91024	6.8	13.0	Unknown	Booking Manager	CWE-89	Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
CVE-2026-95625	5.9	13.0	Tauri	tauri-plugin-updater	CWE-354	Tauri framework v2 missing updater signature version number validation can be…
CVE-2026-91073	6.8	12.3	Unknown	Subscribe Forms	CWE-79	Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form …
CVE-2026-91852	6.1	11.8	Apache Software Foundation	Apache Sling XSS	CWE-79	Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
CVE-2026-14321	8.2	11.7	Unknown	divi-dash	CWE-400	Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing
CVE-2025-15696	6.8	11.2	Unknown	Real3D Flipbook	CWE-79	Real3D Flipbook Lite < 5.4 - Author+ Stored XSS
CVE-2026-85006	6.8	11.2	Unknown	HappyAddons for Elementor	CWE-79	Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Bu…
CVE-2026-88997	6.8	11.2	Unknown	JSM Show Post Metadata	CWE-79	JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Met…
CVE-2026-91801	7.8	11.1	Foxit Software Inc.	Foxit PDF Editor	CWE-22	Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code …
CVE-2026-86842	6.8	10.8	Unknown	Real3D Flipbook	CWE-862	Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Glob…
CVE-2026-73192	6.1	10.7	Apache Software Foundation	Apache Sling XSS	CWE-79	Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
CVE-2026-91928	6.1	10.7	Apache Software Foundation	Apache Sling XSS	CWE-79	Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and fai…
CVE-2026-91999	6.1	10.7	Apache Software Foundation	Apache Sling XSS	CWE-79	Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
CVE-2026-87979	5.3	10.5	Unknown	Paymob for WooCommerce	CWE-862	Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to A…
CVE-2026-93511	5.3	10.5	Unknown	Premium Packages	CWE-290	Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verificat…
CVE-2026-86608	8.2	10.0	Unknown	WP Recipe Maker	CWE-400	WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta …
CVE-2026-84026	5.3	10.0	Unknown	Directorist: AI-Powered Business Directory, Listings & Classified Ads	CWE-200	Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST …
CVE-2026-84168	5.3	10.0	Unknown	Easy Hide Login	CWE-200	Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
CVE-2026-84741	5.3	10.0	Unknown	The Events Calendar	CWE-200	The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Org…
CVE-2026-86783	5.3	10.0	Unknown	Post Grid Gutenberg Blocks	CWE-200	PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API
CVE-2026-88929	5.3	10.0	Unknown	Product Badge, Label, Countdown Timer for WooCommerce	CWE-200	Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure
CVE-2026-89331	5.3	10.0	Unknown	FluentBoards	CWE-200	FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Discl…
CVE-2026-90985	5.3	10.0	Unknown	WPC Smart Compare for WooCommerce	CWE-200	WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protecte…
CVE-2026-93528	3.7	10.0	Unknown	NP Quote Request for WooCommerce	CWE-200	NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclo…
CVE-2026-82331	9.8	9.5	Apache Software Foundation	Apache BuildStream	CWE-59	Apache BuildStream: tar source extraction escape
CVE-2026-84742	2.7	9.1	Unknown	The Events Calendar	CWE-863	The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via …
CVE-2026-94251	6.5	8.9	Apache Software Foundation	Apache Sling Security Bundle	CWE-693	Apache Sling Security Bundle: ContentDispositionFilter mediates only one addr…
CVE-2026-18365	4.3	8.9	Unknown	zportals	CWE-200	Zportals < 6.4.2 - Subscriber+ User Email Disclosure
CVE-2026-86602	4.3	8.9	Unknown	WP Recipe Maker	CWE-200	WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Conten…
CVE-2026-86603	4.3	8.9	Unknown	WP Recipe Maker	CWE-200	WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via w…
CVE-2026-92001	6.1	8.6	Apache Software Foundation	Apache Sling XSS	CWE-776	Apache Sling XSS: Missing parser resource limits
CVE-2026-80342	6.5	8.5	Unknown	Payment Plugins for PayPal WooCommerce	CWE-639	Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hij…
CVE-2026-77765	5.3	8.5	Unknown	Better Payment	CWE-284	Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation
CVE-2026-83555	5.3	8.5	Unknown	Email Subscribers & Newsletters	CWE-862	Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription …
CVE-2026-86785	5.3	8.5	Unknown	Social Commerce for WooCommerce	CWE-862	Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and …
CVE-2026-91791	7.8	8.4	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne…
CVE-2026-91799	7.8	8.4	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability
CVE-2026-91815	7.8	8.4	Foxit Software Inc.	Foxit PDF Editor	CWE-787	Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execut…
CVE-2026-82843	9.0	7.9	Unknown	WP OAuth Server ( Login with WordPress )	CWE-287	WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID…
CVE-2026-93508	8.1	7.9	Unknown	WC Fields Factory	CWE-862	WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via…
CVE-2026-16264	6.5	7.9	Unknown	Newsletters	CWE-639	Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Di…
CVE-2026-84098	6.5	7.9	Unknown	Directorist: AI-Powered Business Directory, Listings & Classified Ads	CWE-863	Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove…
CVE-2026-84150	5.4	7.9	Unknown	Directorist: AI-Powered Business Directory, Listings & Classified Ads	CWE-639	Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via RES…
CVE-2026-84046	5.0	7.9	Unknown	Directorist: AI-Powered Business Directory, Listings & Classified Ads	CWE-918	Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
CVE-2026-87981	4.7	7.9	Unknown	Paymob for WooCommerce	CWE-862	Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration …
CVE-2026-18364	4.3	7.9	Unknown	zportals	CWE-862	Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update
CVE-2026-77766	4.3	7.9	Unknown	Directorist: AI-Powered Business Directory, Listings & Classified Ads	CWE-639	Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure v…
CVE-2026-81339	4.3	7.9	Unknown	MasterStudy LMS WordPress Plugin	CWE-639	MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR
CVE-2026-84027	4.3	7.9	Unknown	Directorist: AI-Powered Business Directory, Listings & Classified Ads	CWE-862	Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery…
CVE-2026-91025	4.3	7.9	Unknown	Booking Manager	CWE-639	Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modificatio…
CVE-2026-93510	4.3	7.9	Unknown	Points and Rewards for WooCommerce	CWE-862	Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points an…
CVE-2026-84743	3.8	7.9	Unknown	The Events Calendar	CWE-863	The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer…
CVE-2026-87074	3.7	7.9	Unknown	Forminator Forms	CWE-862	Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sendi…
CVE-2026-90951	3.7	7.9	Unknown	Paid Membership Subscriptions	CWE-863	Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State …
CVE-2026-93507	3.3	7.9	Unknown	WC Fields Factory	CWE-862	WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private …
CVE-2026-87069	3.1	7.9	Unknown	Forminator Forms	CWE-862	Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via mig…
CVE-2026-91077	2.7	7.9	Unknown	Event Booking Manager for WooCommerce	CWE-284	Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublishe…
CVE-2026-50228	6.1	7.7	Acer	NitroSense V5	CWE-489	Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
CVE-2026-92378	4.1	7.5	NT-ware	uniFLOW Online	CWE-613	uniFLOW Online Legacy UI Previous login session retained when entering Reduce…
CVE-2026-91796	6.1	7.2	Foxit Software Inc.	Foxit PDF Editor	CWE-693	Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulne…
CVE-2026-96273	6.8	6.9	NationalSecurityAgency	ghidra	CWE-460	Ghidra before 12.1.4 Denial of Service via Crafted Database
CVE-2026-91814	5.3	7.0	Foxit Software Inc.	Foxit PDF Editor	CWE-347	Security vulnerability: Foxit PDF Editor/Reader Fails to Detect Modifications…
CVE-2026-91790	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vuln…
CVE-2026-91792	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne…
CVE-2026-91793	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vuln…
CVE-2026-91802	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-787	Foxit PDF Editor/Reader — Heap Buffer Overflow in WebP Image Decoding via Bit…
CVE-2026-91804	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-787	Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Rendering
CVE-2026-91805	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling
CVE-2026-91806	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vuln…
CVE-2026-91809	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vuln…
CVE-2026-91811	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-787	Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Ex…
CVE-2026-91816	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnera…
CVE-2026-91818	7.8	6.8	Foxit Software Inc.	Foxit PDF Editor	CWE-416	Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulne…
CVE-2026-91803	8.8	6.4	Foxit Software Inc.	Foxit PDF Editor	CWE-427	Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Pa…
CVE-2026-95958	4.8	5.6	JusticeRage	Manalyze	CWE-189	JusticeRage Manalyze PE Parser pe.cpp _parse_relocations integer underflow
CVE-2026-91807	6.1	4.8	Foxit Software Inc.	Foxit PDF Editor	CWE-125	Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Discl…
CVE-2026-91808	6.1	4.8	Foxit Software Inc.	Foxit PDF Editor	CWE-125	Foxit PDF Editor/Reader JPEG File Parsing Out-Of-Bounds Read Information Disc…
CVE-2026-91810	6.1	4.8	Foxit Software Inc.	Foxit PDF Editor	CWE-125	Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure …
CVE-2026-91817	6.1	4.8	Foxit Software Inc.	Foxit PDF Editor	CWE-125	Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vul…
CVE-2026-91800	8.8	4.6	Foxit Software Inc.	Foxit PDF Editor	CWE-732	Foxit PDF Editor installer local privilege escalation
CVE-2026-79616	0.6	4.6	qt	qt	CWE-125	Out-of-bounds read vulnerability in Context2D.path and PathSvg.path propertie…
CVE-2026-91798	8.8	4.5	Foxit Software Inc.	Foxit PDF Editor	CWE-732	Foxit PDF Editor/Reader Updater Privilege Escalation
CVE-2026-81338	4.6	3.5	Unknown	MasterStudy LMS WordPress Plugin	CWE-345	MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discu…
CVE-2026-91788	4.7	3.1	Foxit Software Inc.	Foxit PDF Editor	CWE-668	Foxit PDF Editor/Reader Missing Authorization Information Disclosure Vulnerab…
CVE-2026-91813	8.8	2.9	Foxit Software Inc.	Foxit PDF Editor	CWE-367	Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalatio…
CVE-2026-94243	7.3	2.8	Apache Software Foundation	Apache Sling Security Bundle	CWE-346	Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence
CVE-2026-91812	7.9	2.7	Foxit Software Inc.	Foxit PDF Editor	CWE-295	Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Pr…
CVE-2026-91795	7.8	2.1	Foxit Software Inc.	Foxit PDF Editor	CWE-822	Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution…
CVE-2026-59167	10.0	—	JiHong88	suneditor	CWE-79	SunEditor: Critical XSS vulnerability - sanitizer bypass
CVE-2026-86708	10.0	—	Zohocorp	ManageEngine Applications Manager	CWE-321	Sensitive data exposure
CVE-2026-19599	9.9	—	Zohocorp	ManageEngine OpManager	CWE-78	Remote Code Execution vulnerability
CVE-2026-77602	9.9	—	OpenC3	cosmos	CWE-94	OpenC3 COSMOS: Authenticated remote code execution via the user-writable conf…
CVE-2026-84474	9.9	—	Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	CWE-807	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-84502	9.9	—	Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	CWE-88	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-84719	9.9	—	Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	CWE-862	Automation-controller: automation-controller: workflowjobtemplate /copy/ deep…
CVE-2026-89078	9.9	—	GitLab	GitLab	CWE-415	Double Free in GitLab
CVE-2026-93577	9.9	—	GitLab	GitLab	CWE-190	Integer Overflow or Wraparound in GitLab
CVE-2025-63564	9.8	—	n/a	n/a	CWE-89	SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 a…
CVE-2026-6721	9.8	—	IBM	Concert	CWE-78	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-6730	9.8	—	IBM	Concert	CWE-120	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-6928	9.8	—	IBM	Concert	CWE-416	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-76183	9.8	—	Apache Software Foundation	Apache Tomcat	CWE-289	Apache Tomcat: Bypass of security constraints for WebSocket endpoints
CVE-2026-86248	9.8	—	Apache Software Foundation	Apache Tomcat	CWE-287	Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes s…
CVE-2026-96276	9.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-22	Flatpak: flatpak: arbitrary write in host context via flatpak build-init
CVE-2026-85724	9.6	—	moquette-io	moquette	CWE-155	Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
CVE-2026-87898	9.4	—	WebPros	Plesk extension "Site Import"	CWE-78	OS command injection in Plesk allows remote authenticated users to execute ar…
CVE-2026-87899	9.4	—	WebPros	cPanel	CWE-250	Execution with unnecessary privileges in cPanel allows remote authenticated u…
CVE-2026-87900	9.4	—	WebPros	WP Toolkit for cPanel	CWE-88	Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows r…
CVE-2026-18872	9.3	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-79	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-93352	9.3	—	plank	laravel-mediable	CWE-434	Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload
CVE-2026-95601	9.3	—	WBW Plugins	Product Filter by WBW	CWE-89	WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability
CVE-2026-95848	9.3	—	moquette-io	moquette	CWE-636	Moquette fails open when configured authentication or authorization classes c…
CVE-2026-96560	9.3	—	ModelTC	LightLLM	CWE-502	LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC…
CVE-2026-96754	9.3	—	orval-labs	orval	CWE-94	orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
CVE-2026-96755	9.3	—	orval-labs	orval	CWE-94	orval @orval/effect 8.14.0 through 8.28.1 Code Injection
CVE-2026-96757	9.3	—	orval-labs	orval	CWE-94	orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
CVE-2026-96758	9.3	—	orval-labs	orval	CWE-94	orval @orval/core before 8.28.0 Code Injection via Form-Data
CVE-2026-96759	9.3	—	orval-labs	orval	CWE-94	orval before 8.29.0 Code Injection via operationId
CVE-2026-96770	9.3	—	Temporal Technologies, Inc.	s2s-proxy	CWE-296	s2s-proxy accepts untrusted client certificates
CVE-2026-63132	9.2	—	openbao	openbao	CWE-208	OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
CVE-2026-67404	9.2	—	rabbitmq	rabbitmq-server	CWE-295	RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
CVE-2026-96756	9.2	—	orval-labs	orval	CWE-94	orval before 8.30.0 Code Injection via Factory Generation
CVE-2026-67231	9.1	—	rabbitmq	rabbitmq-server	CWE-295	RabbitMQ: Trust-store whitelist by Issuer+Serial only
CVE-2026-75884	9.1	—	Red Hat	Red Hat Ansible Automation Platform 2.4 for RHEL 8	CWE-184	Awx: awx: privilege escalation to openshift namespace via pod_spec_override i…
CVE-2026-86246	9.1	—	Apache Software Foundation	Apache Tomcat Native	CWE-1188	Apache Tomcat Native: Insecure OpenSSL options enabled
CVE-2026-86350	9.1	—	Apache Software Foundation	Apache Tomcat	CWE-444	Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request heade…
CVE-2026-14913	8.8	—	Zohocorp	ManageEngine OpManager	CWE-89	SQL Injection vulnerability
CVE-2026-18490	8.8	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-502	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-70125	8.8	—	Microsoft	Microsoft 365 Apps for Enterprise	—	Microsoft Outlook Remote Code Execution Vulnerability
CVE-2026-75825	8.8	—	Zohocorp	ManageEngine OpManager	CWE-306	Authentication Bypass vulnerability
CVE-2026-76978	8.8	—	Zohocorp	ManageEngine OpManager	CWE-78	Command Injection vulnerability
CVE-2026-77601	8.8	—	OpenC3	cosmos	CWE-78	OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
CVE-2026-80379	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-80412	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-80423	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-200	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-80425	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-81537	8.8	—	IBM	DataStage on Cloud Pak for Data	CWE-78	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-86583	8.8	—	carazo	Import and export users and customers	CWE-266	Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+)…
CVE-2026-86677	8.8	—	Zohocorp	ManageEngine Applications Manager	CWE-89	Broken Authentication vulnerability
CVE-2026-86678	8.8	—	Zohocorp	ManageEngine Applications Manager	CWE-639	Broken Authentication vulnerability
CVE-2026-95847	8.8	—	moquette-io	moquette	CWE-99	Moquette client IDs can cause cross-session H2 durable-queue corruption
CVE-2026-96275	8.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-22	Flatpak: flatpak: arbitrary write access as root via extra-data extraction
CVE-2026-96455	8.8	—	Pollen Robotics	Reachy Mini	CWE-306	Reachy Mini daemon allows unauthenticated remote code execution through the a…
CVE-2026-96775	8.8	—	MLflow	MLflow	CWE-502	MLflow dspy bypasses pickle deserialization control
CVE-2026-96804	8.8	—	MLflow	MLflow	CWE-502	CVE-2026-96804
CVE-2026-55610	8.7	—	InvoiceShelf	InvoiceShelf	CWE-639	InvoiceShelf has cross-company user read/update IDOR that enables cross-tenan…
CVE-2026-68492	8.7	—	WebPros	Plesk	CWE-426	An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8…
CVE-2026-82368	8.7	—	Brocade	SANnav	CWE-284	Insecure access controls on internal service ports in Brocade SANnav versions…
CVE-2026-82405	8.7	—	klever-io	klever-go	CWE-863	Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on att…
CVE-2026-84683	8.7	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-79	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-84691	8.7	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-134	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-95842	8.7	—	moquette-io	moquette	CWE-248	Moquette uncaught MQTT command exceptions can terminate shared session event …
CVE-2026-95843	8.7	—	moquette-io	moquette	CWE-20	Moquette malformed shared subscriptions can crash command processing
CVE-2026-95844	8.7	—	moquette-io	moquette	CWE-674	Moquette deeply nested MQTT topics can cause stack exhaustion
CVE-2026-95845	8.7	—	moquette-io	moquette	CWE-770	Moquette unbounded per-session message queues allow memory exhaustion
CVE-2026-95846	8.7	—	moquette-io	moquette	CWE-862	Moquette publishes Last-Will messages without enforcing write authorization
CVE-2026-96673	8.7	—	Photoview	Photoview	CWE-89	Photoview through 2.4.0 SQL Injection via album download route
CVE-2026-82369	8.6	—	Brocade	SANnav	CWE-78	Insufficient input sanitization of shell metacharacters in Brocade SANnav bef…
CVE-2026-82370	8.6	—	Brocade	SANnav	CWE-77	Unauthenticated remote command injection in the Brocade SANnav orchestrator H…
CVE-2026-86064	8.6	—	klever-io	klever-go	CWE-200	Klever-Go: /log controls global node logging
CVE-2026-90901	8.6	—	joomshaper.com	Easy Store extension for Joomla	CWE-74	Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection i…
CVE-2026-90904	8.6	—	joomshaper.com	Easy Store extension for Joomla	CWE-284	Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in Api…
CVE-2026-93349	8.6	—	frictionlessdata	frictionless-py	CWE-78	Frictionless OS Command Injection via explore Console Command
CVE-2026-96656	8.6	—	Plex	Media Server	CWE-73	Plex Media Server arbitrary file write
CVE-2026-75131	8.5	—	nm-l2tp	NetworkManager-l2tp	CWE-88	NetworkManager-l2tp Privilege Escalation via pppd Username Injection
CVE-2026-76086	8.5	—	verbb	formie	CWE-862	Formie: Integration form-settings action allows SSRF and exfiltration of stor…
CVE-2026-76648	8.5	—	Red Hat	Red Hat Ansible Automation Platform 2.7	CWE-862	Automation-controller: automation-controller-container: aap controller: copya…
CVE-2026-79310	8.5	—	n/a	n/a	CWE-94	webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The…
CVE-2026-93527	8.5	—	bdthemes	Live Copy Paste for Elementor	CWE-89	WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vuln…
CVE-2026-93773	8.5	—	Nick van Wobbie	Mollie Forms	CWE-89	WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability
CVE-2026-94124	8.5	—	levelfourdevelopment	WP EasyCart	CWE-89	WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability
CVE-2026-5695	8.4	—	Microweber	Administration panel	CWE-434	Multiple vulnerabilities in the Microweber administration panel
CVE-2026-82409	8.4	—	klever-io	klever-go	CWE-116	Klever-Go: Elasticsearch bulk / painless injection via on-chain account name …
CVE-2026-19179	8.2	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-74	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-66079	8.2	—	rabbitmq	rabbitmq-server	CWE-770	RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
CVE-2026-67232	8.2	—	rabbitmq	rabbitmq-server	CWE-409	RabbitMQ: Web-MQTT decompression bomb
CVE-2026-68490	8.2	—	WebPros	cPanel	CWE-732	Incorrect permission assignment allows local users to obtain sensitive CalDAV…
CVE-2026-76087	8.2	—	verbb	formie	CWE-639	Formie: Unauthenticated users can overwrite incomplete submissions via submit…
CVE-2026-84486	8.2	—	Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	CWE-489	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-90899	8.2	—	joomshaper.com	Easy Store extension for Joomla	CWE-200	Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in …
CVE-2026-90902	8.2	—	joomshaper.com	Easy Store extension for Joomla	CWE-74	Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection i…
CVE-2026-96599	8.2	—	isotope	isotope-core	CWE-330	Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
CVE-2026-18181	8.1	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-321	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-19125	8.1	—	lynn999	EthPress – Web3 Login	CWE-287	EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
CVE-2026-77762	8.1	—	Apache Software Foundation	Apache Tomcat	CWE-362	Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
CVE-2026-84787	8.1	—	Zohocorp	ManageEngine OpManager	CWE-250	Privilege Escalation vulnerability
CVE-2026-86683	8.1	—	Zohocorp	ManageEngine Applications Manager	CWE-20	Broken Authentication Vulnerability
CVE-2026-94487	8.1	—	PublishPress	PublishPress Capabilities	CWE-352	WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request For…
CVE-2026-12974	7.9	—	Forcepoint	Forcepoint Security Engine (NGFW)	CWE-183	Security Policy Bypass in Forcepoint Security Engine (NGFW)
CVE-2026-6794	7.8	—	IBM	Concert	CWE-415	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-6935	7.8	—	IBM	Concert	CWE-427	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-96442	7.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-94	Emacs: emacs: arbitrary code execution, incomplete fix for cve-2024-53920
CVE-2026-96512	7.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-863	Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-…
CVE-2026-96889	7.8	—	Red Hat	Red Hat Enterprise Linux 10	CWE-416	Librsvg: use-after-free when xml includes have duplicated entities
CVE-2026-76089	7.7	—	verbb	formie	CWE-200	Formie: Missing authorization on sent notification resend modal exposes submi…
CVE-2026-76979	7.7	—	Zohocorp	ManageEngine OpManager	CWE-91	XML Injection vulnerability
CVE-2026-81208	7.7	—	IBM	DataStage on Cloud Pak for Data	CWE-522	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-81536	7.7	—	IBM	DataStage on Cloud Pak for Data	CWE-611	DataStage on Cloud Pak for Data has several vulnerabilities
CVE-2026-84499	7.7	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-209	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-92470	7.7	—	GitLab	GitLab	CWE-862	Missing Authorization in GitLab
CVE-2026-12370	7.6	—	Zohocorp	ManageEngine OpManager	CWE-1336	Remote Code Execution Vulnerability
CVE-2026-66070	7.6	—	rabbitmq	rabbitmq-server	CWE-942	RabbitMQ: CORS * reflects Origin with Allow-Credentials
CVE-2026-77394	7.6	—	OpenC3	cosmos	CWE-79	OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
CVE-2026-84706	7.6	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-184	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-86681	7.6	—	Zohocorp	ManageEngine Applications Manager	CWE-306	Broken Access Control vulnerability
CVE-2026-94174	7.6	—	WebFactory	Email Log	CWE-89	WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
CVE-2026-95522	7.6	—	Syed Balkhi	Easy Digital Downloads	CWE-89	WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
CVE-2026-95593	7.6	—	Ben Roberts	Ultimeter	CWE-89	WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability
CVE-2026-96826	7.6	—	Shazzad Hossain Khan	W4 Post List	CWE-89	WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
CVE-2026-6668	7.5	—	n/a	PgBouncer	CWE-190	Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
CVE-2026-15358	7.5	—	Zohocorp	ManageEngine OpManager	CWE-428	Path Traversal Vulnerability
CVE-2026-19888	7.5	—	n/a	PgBouncer	CWE-476	NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
CVE-2026-59990	7.5	—	typelevel	jawn	CWE-770	Jawn: Uncontrolled nesting depth in JSON parser
CVE-2026-61695	7.5	—	square	wire	CWE-129	Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes a…
CVE-2026-61814	7.5	—	typelevel	jawn	CWE-400	Jawn: Quadratic parsing effort in AsyncParser
CVE-2026-73591	7.5	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-540	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-75887	7.5	—	Red Hat	Red Hat OpenShift Container Platform 4	CWE-22	Openshift/console: openshift/console: unauthenticated path traversal in i18n …
CVE-2026-77422	7.5	—	jline	jline3	CWE-1333	JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
CVE-2026-77423	7.5	—	jline	jline3	CWE-1333	JLine: ReDoS in Built-in Less Viewer Search
CVE-2026-77791	7.5	—	Apache Software Foundation	Apache Tomcat	CWE-400	Apache Tomcat: DoS via busy wait during WebSocket close
CVE-2026-78383	7.5	—	Apache Software Foundation	Apache Tomcat	CWE-770	Apache Tomcat: AJP DoS via missing request body
CVE-2026-79677	7.5	—	Apache Software Foundation	Apache Tomcat	CWE-772	Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
CVE-2026-86065	7.5	—	klever-io	klever-go	CWE-770	Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no conne…
CVE-2026-86243	7.5	—	Apache Software Foundation	Apache Tomcat Native	CWE-126	Apache Tomcat Native: DoS via TLS handshake
CVE-2026-87022	7.5	—	Apache Software Foundation	Apache Tomcat	CWE-130	Apache Tomcat: WebSocket message smuggling with per-message-deflate
CVE-2026-88830	7.5	—	Red Hat	Red Hat Hardened Images	CWE-131	Busybox: busybox: tls montgomery reduction allocates bytes instead of digits,…
CVE-2026-95513	7.5	—	vcita	Online Booking & Scheduling Calendar for WordPress by vcita	CWE-862	WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin …
CVE-2026-95604	7.5	—	Tangible	Loops & Logic	CWE-862	WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability
CVE-2026-96541	7.5	—	Red Hat	Red Hat Enterprise Linux 10	CWE-400	Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack …
CVE-2026-18184	7.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-611	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-73588	7.4	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-306	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-76980	7.4	—	Zohocorp	ManageEngine OpManager	CWE-20	Data Exposure vulnerability
CVE-2026-86247	7.4	—	Apache Software Foundation	Apache Tomcat Native	CWE-366	Apache Tomcat Native: Client certificate requirements can be down-graded
CVE-2026-91775	7.4	—	LimeSurvey	LimeSurvey	CWE-79	LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS sur…
CVE-2026-92730	7.4	—	LimeSurvey	LimeSurvey	CWE-79	LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import…
CVE-2026-94181	7.4	—	The Browser Company of New York	Arc	CWE-451	Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
CVE-2026-94183	7.4	—	The Browser Company of New York	Arc Search	CWE-451	Address bar spoofing risk in affected Android versions of Arc Search
CVE-2026-95676	7.4	—	WatchGuard	AuthPoint Authentication Gateway	CWE-287	AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Au…
CVE-2026-96808	7.4	—	Flatpak	Flatpak	CWE-61	In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-hel…
CVE-2026-18185	7.3	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-306	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18875	7.3	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-74	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-66077	7.3	—	rabbitmq	rabbitmq-server	CWE-79	RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
CVE-2026-75973	7.3	—	Apache Software Foundation	Apache Tomcat	CWE-287	Apache Tomcat: Cross-context authentication mix-up with Jakarta Authenticatio…
CVE-2026-78437	7.3	—	Apache Software Foundation	Apache Tomcat	CWE-459	Apache Tomcat: HTTP/2 DoS via malformed request
CVE-2026-88832	7.3	—	Red Hat	Red Hat Hardened Images	CWE-787	Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixe…
CVE-2026-75886	7.2	—	Red Hat	Red Hat OpenShift Container Platform 4	CWE-441	Openshift/console: openshift/console: unauthenticated reverse proxy to in-clu…
CVE-2026-85475	7.2	—	Red Hat	Red Hat Ansible Automation Platform 2.7	CWE-96	Automation-controller: automation-controller-container: automation-controller…
CVE-2026-90903	7.2	—	joomshaper.com	Easy Store extension for Joomla	CWE-352	Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Ad…
CVE-2026-90905	7.2	—	joomshaper.com	Easy Store extension for Joomla	CWE-284	Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site C…
CVE-2026-93769	7.2	—	Humhub	Humhub	CWE-79	HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderFo…
CVE-2026-95603	7.2	—	Victor Rodriguez	Reycob Product Import Export	CWE-502	WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection…
CVE-2026-18177	7.1	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-862	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-67235	7.1	—	rabbitmq	rabbitmq-server	CWE-770	RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
CVE-2026-67238	7.1	—	rabbitmq	rabbitmq-server	CWE-400	RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
CVE-2026-82406	7.1	—	klever-io	klever-go	CWE-841	Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native mark…
CVE-2026-84714	7.1	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-184	Automation-controller: automation-controller: incomplete sanitize_jinja() reg…
CVE-2026-84789	7.1	—	Zohocorp	ManageEngine OpManager	CWE-639	Broken Access Control vulnerability
CVE-2026-84791	7.1	—	Zohocorp	ManageEngine OpManager	CWE-639	Broken Access Control vulnerability
CVE-2026-86679	7.1	—	Zohocorp	ManageEngine Applications Manager	CWE-20	Broken Access Control vulnerability
CVE-2026-93526	7.1	—	Nexcess	Event Tickets	CWE-79	WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnera…
CVE-2026-93622	7.1	—	NicolasKulka	WPS Limit Login	CWE-79	WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vuln…
CVE-2026-93774	7.1	—	Jacob N. Breetvelt	WP Photo Album Plus	CWE-79	WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XS…
CVE-2026-94176	7.1	—	Kitae Park	Mang Board WP	CWE-79	WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerab…
CVE-2026-94179	7.1	—	Razorpay	Razorpay Payment Button	CWE-79	WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS…
CVE-2026-95515	7.1	—	Kevin Stover	Ninja Forms	CWE-79	WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-95528	7.1	—	Mohammed Kaludi	Core Web Vitals & PageSpeed Booster	CWE-79	WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site S…
CVE-2026-95529	7.1	—	codepeople	Calculated Fields Form	CWE-79	WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XS…
CVE-2026-95590	7.1	—	tainacan	Tainacan	CWE-89	WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
CVE-2026-96609	7.1	—	Robur	Albatross	CWE-770	Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring…
CVE-2026-96651	7.1	—	Plex	Media Server	CWE-22	Plex Media Server path traversal
CVE-2026-82407	7.0	—	klever-io	klever-go	CWE-20	Klever-Go: Validator registration accepts an unvalidated BLS public key → con…
CVE-2026-96600	7.0	—	isotope	isotope-core	CWE-89	Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
CVE-2026-67228	6.9	—	rabbitmq	rabbitmq-server	CWE-400	RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
CVE-2026-67229	6.9	—	rabbitmq	rabbitmq-server	CWE-400	RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
CVE-2026-92284	6.9	—	caddyserver	caddy	CWE-770	Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exh…
CVE-2026-92692	6.9	—	sulu	sulu	CWE-89	Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
CVE-2026-96611	6.9	—	FFmpeg	FFmpeg	CWE-190	FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_…
CVE-2026-96654	6.9	—	Plex	Media Server	CWE-84	Plex Media Server URL injection
CVE-2026-96751	6.9	—	pmTicket	Project-Management-Software	CWE-89	pmTicket Project-Management-Software add_project.php setSync sql injection
CVE-2026-96762	6.9	—	kvcache-ai	mooncake	CWE-639	kvcache-ai mooncake RPC Path UnmountSegment authorization
CVE-2026-61413	6.8	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-269	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-73587	6.8	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-295	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-96445	6.8	—	Red Hat	Red Hat Build of Keycloak	CWE-287	Keycloak-services: keycloak-services: conditional otp skip-header policy eval…
CVE-2026-88839	6.7	—	Red Hat	Red Hat Hardened Images	CWE-787	Busybox: busybox: passwd/group parser writes heap pointers out of bounds due …
CVE-2026-84716	6.6	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-266	Automation-controller: automation-controller: instance install_bundle issues …
CVE-2026-84724	6.6	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-88	Automation-controller: automation-controller: systemjob extra_vars.days argum…
CVE-2026-18179	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-862	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-18180	6.5	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-89	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-73581	6.5	—	Apache Software Foundation	Apache Tomcat	CWE-299	Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when c…
CVE-2026-77112	6.5	—	Global IT Informatics Technology Services Inc.	Weoll	CWE-918	SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll
CVE-2026-77421	6.5	—	jline	jline3	CWE-1333	JLine: ReDoS in Nano Editor Regex Search Mode
CVE-2026-79304	6.5	—	n/a	n/a	—	CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileConte…
CVE-2026-79306	6.5	—	n/a	n/a	—	CyberPanel v1.9.1 contains a path traversal vulnerability in the compress met…
CVE-2026-84713	6.5	—	Red Hat	Red Hat Ansible Automation Platform 2.7	CWE-639	Automation-controller: automation-controller: notification.recipients/subject…
CVE-2026-84720	6.5	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-639	Automation-controller: automation-controller: workflowjobnode.ancestor_artifa…
CVE-2026-86601	6.5	—	Unknown	WP Recipe Maker	CWE-74	WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via …
CVE-2026-88837	6.5	—	Red Hat	Red Hat Hardened Images	CWE-305	Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, …
CVE-2026-92164	6.5	—	streamlink	streamlink	CWE-73	Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading loc…
CVE-2026-93529	6.5	—	Bilal Naseer	WSP MCP – AI Agents Connector	CWE-862	WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Contr…
CVE-2026-93618	6.5	—	Crocoblock. Jetimpex Inc.	JetTricks	CWE-79	WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-93620	6.5	—	PayPlus Tech Team	PayPlus Payment Gateway	CWE-862	WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vul…
CVE-2026-93772	6.5	—	Tomdever	wpForo Forum	CWE-79	WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-94118	6.5	—	Leap13	Premium Blocks – Gutenberg Blocks for WordPress	CWE-79	WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - …
CVE-2026-94168	6.5	—	Leap13	Premium Addons for Elementor	CWE-79	WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Script…
CVE-2026-94391	6.5	—	Rustaurius	Ultimate FAQ	CWE-79	WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerab…
CVE-2026-94461	6.5	—	metaphorcreations	Ditty	CWE-79	WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
CVE-2026-94498	6.5	—	AppMySite	AppMySite	CWE-862	WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
CVE-2026-94500	6.5	—	Roxnor	ElementsKit Elementor addons Lite	CWE-79	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scri…
CVE-2026-94671	6.5	—	RadiusTheme	The Post Grid	CWE-79	WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerab…
CVE-2026-94680	6.5	—	RadiusTheme	The Post Grid	CWE-79	WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerab…
CVE-2026-94682	6.5	—	SecondLineThemes	Podcast Importer SecondLine	CWE-79	WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting …
CVE-2026-94684	6.5	—	oceanwp	Ocean Extra	CWE-79	WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-95523	6.5	—	weDevs	WP User Frontend	CWE-290	WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
CVE-2026-95525	6.5	—	weDevs	WP User Frontend	CWE-22	WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnera…
CVE-2026-95527	6.5	—	Conekta Group	Conekta Payment Gateway	CWE-862	WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vul…
CVE-2026-95530	6.5	—	PixelYourSite	PixelYourSite – Your smart PIXEL (TAG) Manager	CWE-79	WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - C…
CVE-2026-95586	6.5	—	Themefic	Ultimate Addons for Contact Form 7	CWE-79	WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Sc…
CVE-2026-95602	6.5	—	YITH	YITH WooCommerce Request A Quote	CWE-639	WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct …
CVE-2026-63000	6.4	—	redaxo	core	CWE-352	REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon …
CVE-2026-73586	6.4	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-613	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-84721	6.4	—	Red Hat	Red Hat Ansible Automation Platform 2.7	CWE-918	Automation-controller: automation-controller: email notification backend allo…
CVE-2026-59980	6.3	—	python-hyper	hpack	CWE-400	hpack: Unbounded variable integer decoding can cause run-away computation on …
CVE-2026-73589	6.3	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-261	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-92700	6.3	—	caddyserver	caddy	CWE-178	Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files vi…
CVE-2026-96456	6.3	—	Pollen Robotics	Reachy Mini	CWE-287	Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authent…
CVE-2026-6718	6.2	—	IBM	Concert	CWE-276	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-19267	6.2	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-306	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-88835	6.1	—	Red Hat	Red Hat Hardened Images	CWE-125	Busybox: busybox: dpkg read_package_field() steps past nul terminator, causin…
CVE-2026-63131	6.0	—	openbao	openbao	CWE-863	OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific …
CVE-2026-66067	6.0	—	rabbitmq	rabbitmq-server	CWE-770	RabbitMQ: Stream protocol skips per vhost per user connection limits
CVE-2026-66072	6.0	—	rabbitmq	rabbitmq-server	CWE-400	RabbitMQ: Atom table exhaustion via stream `chunk_selector`
CVE-2026-66074	6.0	—	rabbitmq	rabbitmq-server	CWE-1333	RabbitMQ: ReDoS via management API ?name= filter
CVE-2026-67219	6.0	—	rabbitmq	rabbitmq-server	CWE-770	RabbitMQ: Consistent-hash exchange unbounded weight
CVE-2026-67220	6.0	—	rabbitmq	rabbitmq-server	CWE-400	RabbitMQ: JMS topic exchange erl_scan atom exhaustion
CVE-2026-5696	5.9	—	Microweber	Administration panel	CWE-79	Multiple vulnerabilities in the Microweber administration panel
CVE-2026-6669	5.9	—	n/a	PgBouncer	CWE-400	Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer
CVE-2026-66080	5.9	—	rabbitmq	rabbitmq-server	CWE-770	RabbitMQ: Super-stream partitions unbounded allocation
CVE-2026-67221	5.9	—	rabbitmq	rabbitmq-server	CWE-312	RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
CVE-2026-66068	5.6	—	rabbitmq	rabbitmq-server	CWE-532	RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
CVE-2026-86612	5.6	—	Unknown	Ninja Tables	CWE-74	Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Flu…
CVE-2026-77420	5.5	—	jline	jline3	CWE-1333	JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
CVE-2026-96513	5.5	—	Neethuharii	CafeManagement	CWE-284	Neethuharii CafeManagement AddProductCode.php unrestricted upload
CVE-2026-96514	5.5	—	Neethuharii	CafeManagement	CWE-74	Neethuharii CafeManagement Login CafePortalLogin.php sql injection
CVE-2026-96556	5.5	—	Neethuharii	CafeManagement	CWE-266	Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization
CVE-2026-96601	5.5	—	Abdurrab5	online-makeup-store	CWE-74	Abdurrab5 online-makeup-store Admin Login index.php sql injection
CVE-2026-96602	5.5	—	Abdurrab5	online-makeup-store	CWE-74	Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection
CVE-2026-96603	5.5	—	Abdurrab5	online-makeup-store	CWE-862	Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization
CVE-2026-96604	5.5	—	SoftNews Media Group	DataLife Engine	CWE-74	SoftNews Media Group DataLife Engine Search search.php strip_data sql injection
CVE-2026-96606	5.5	—	LB-Link	BL-CPE600EU	CWE-200	LB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure
CVE-2026-18505	5.4	—	IBM	Financial Transaction Manager (FTM) for RedHat OpenShift	CWE-601	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-71177	5.4	—	Dell	Secure Connect Gateway (SCG) Policy Manager	CWE-1021	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-80444	5.4	—	Abis Technology Ltd. Co.	AVESİS	CWE-601	Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS
CVE-2026-88974	5.4	—	wp-graphql	wp-graphql	CWE-863	WPGraphQL: Contributor can publish and modify posts without the required capa…
CVE-2026-92874	5.4	—	GitLab	GitLab	CWE-863	Incorrect Authorization in GitLab
CVE-2026-94679	5.4	—	WPManageNinja	Fluent Support	CWE-862	WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
CVE-2026-3626	5.3	—	IBM	Concert	CWE-209	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-6925	5.3	—	IBM	Concert	CWE-22	Multiple Vulnerabilities in IBM Concert Software
CVE-2026-52744	5.3	—	gocd	gocd	CWE-862	GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
CVE-2026-67405	5.3	—	rabbitmq	rabbitmq-server	CWE-1385	RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
CVE-2026-73858	5.3	—	solspace	craft-freeform	CWE-1336	Solspace Freeform: Limited Twig template injection via submitted field values
CVE-2026-84091	5.3	—	Unknown	SUMIT Payment Gateway for WooCommerce	CWE-287	SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confi…
CVE-2026-84712	5.3	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-497	Automation-controller: automation-controller: unauthenticated /api/v2/ping/ d…
CVE-2026-84717	5.3	—	Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	CWE-204	Automation-controller: automation-controller: unauthenticated 200-vs-403 orac…
CVE-2026-87070	5.3	—	Unknown	Forminator Forms	CWE-348	Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP S…
CVE-2026-87071	5.3	—	Unknown	Forminator Forms	CWE-20	Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitte…
CVE-2026-87978	5.3	—	Unknown	Paymob for WooCommerce	CWE-345	Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverifi…

Results continue: ranks 401–472.

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-23 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.