{
  "day": "2026-09-27",
  "boundary": "UTC calendar day",
  "published_count": 151,
  "by_severity": {
    "CRITICAL": 10,
    "HIGH": 61,
    "MEDIUM": 56,
    "LOW": 24
  },
  "kev_count": 2,
  "exploit_reference_count": 3,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-88771",
      "cvss_base": 9.5,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": true,
      "kev_due_at": "2026-09-30",
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": "CWE-20",
      "title": "A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88771"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-88772",
      "cvss_base": 9.5,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": true,
      "kev_due_at": "2026-09-30",
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": "CWE-119",
      "title": "Memory overflow vulnerability leading to Remote Code Execution or Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88772"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-100852",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.03722,
      "epss_percentile": 0.89412,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-78",
      "title": "AzuraCast before 0.23.8 Command Injection via Streamer Username",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100852"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-100741",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.01729,
      "epss_percentile": 0.76662,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progressive Robot Ltd",
      "product": "hMailServer",
      "cwe": "CWE-95",
      "title": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100741"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-100864",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00686,
      "epss_percentile": 0.50736,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-94",
      "title": "heym before 0.0.91 Remote Code Execution via Expression Engine",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100864"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-100844",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00641,
      "epss_percentile": 0.48623,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-78",
      "title": "MONAI before 1.6.0 OS Command Injection via dataset_name_or_id",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100844"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-89136",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00552,
      "epss_percentile": 0.439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-287",
      "title": "Client accepts unsolicited RawPublicKey server certificate type",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89136"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-100746",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00498,
      "epss_percentile": 0.4024,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coollabsio",
      "product": "Coolify",
      "cwe": "CWE-287",
      "title": "coollabsio Coolify GitHub App Setup redirect missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100746"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-100744",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00454,
      "epss_percentile": 0.36906,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coollabsio",
      "product": "Coolify",
      "cwe": "CWE-862",
      "title": "coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100744"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-100740",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00453,
      "epss_percentile": 0.36852,
      "kev": false,
      "kev_due_at": null,
      "vendor": "D-Link",
      "product": "DIR-895L",
      "cwe": "CWE-119",
      "title": "D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100740"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-100865",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00446,
      "epss_percentile": 0.3632,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-94",
      "title": "Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100865"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-100721",
      "cvss_base": 9.5,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.004,
      "epss_percentile": 0.31617,
      "kev": false,
      "kev_due_at": null,
      "vendor": "patriksimek",
      "product": "vm2",
      "cwe": "CWE-863",
      "title": "vm2 before 3.12.2 Authorization Bypass via Custom Resolver",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100721"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-100856",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.0037,
      "epss_percentile": 0.28391,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-94",
      "title": "AzuraCast before 0.23.6 Code Injection via Remote Relay Password",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100856"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-93302",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00363,
      "epss_percentile": 0.2757,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Trusted peer certificate match ignores public key, allowing forged CA clones",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93302"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-100724",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00344,
      "epss_percentile": 0.25326,
      "kev": false,
      "kev_due_at": null,
      "vendor": "http4k",
      "product": "http4k",
      "cwe": "CWE-444",
      "title": "http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100724"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-100857",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00336,
      "epss_percentile": 0.24392,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-94",
      "title": "AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100857"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-100834",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0032,
      "epss_percentile": 0.22538,
      "kev": false,
      "kev_due_at": null,
      "vendor": "http4k",
      "product": "http4k",
      "cwe": "CWE-294",
      "title": "http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100834"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-100723",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00316,
      "epss_percentile": 0.21992,
      "kev": false,
      "kev_due_at": null,
      "vendor": "patriksimek",
      "product": "vm2",
      "cwe": "CWE-200",
      "title": "vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100723"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-84069",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00309,
      "epss_percentile": 0.21328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WebFacing™",
      "cwe": "CWE-22",
      "title": "WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84069"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-100745",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00309,
      "epss_percentile": 0.21261,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6428nC",
      "cwe": "CWE-119",
      "title": "Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100745"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-15442",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00283,
      "epss_percentile": 0.18672,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-416",
      "title": "Heap use-after-free on read during bidirectional (D)TLS shutdown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15442"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-100846",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00271,
      "epss_percentile": 0.17338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-502",
      "title": "MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100846"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-100858",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00268,
      "epss_percentile": 0.1703,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-918",
      "title": "heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100858"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-100722",
      "cvss_base": 8.9,
      "cvss_severity": "HIGH",
      "epss_score": 0.0026,
      "epss_percentile": 0.15905,
      "kev": false,
      "kev_due_at": null,
      "vendor": "patriksimek",
      "product": "vm2",
      "cwe": "CWE-248",
      "title": "vm2 before 3.12.2 Host Process Termination via Construct Trap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100722"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-100847",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00255,
      "epss_percentile": 0.15309,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-89",
      "title": "AzuraCast before 0.23.8 DQL Injection via sortOrder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100847"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-100859",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00253,
      "epss_percentile": 0.15148,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-918",
      "title": "Heym before 0.0.106 Credential Exfiltration via URL Override",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100859"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-89102",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.0025,
      "epss_percentile": 0.14668,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "OCSP stapling v2 multi accepts non-CA chain certificates as issuers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89102"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-100863",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00246,
      "epss_percentile": 0.14202,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-918",
      "title": "Heym before 0.0.91 SSRF via image fetching and IPv6 validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100863"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-100853",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00242,
      "epss_percentile": 0.13764,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-862",
      "title": "AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100853"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-100725",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00239,
      "epss_percentile": 0.13488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "http4k",
      "product": "http4k",
      "cwe": "CWE-200",
      "title": "http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100725"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-100849",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00239,
      "epss_percentile": 0.13485,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-918",
      "title": "AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100849"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-89133",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00227,
      "epss_percentile": 0.1211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "NameConstraints not enforced across unconstrained intermediate CA",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89133"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-94417",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00227,
      "epss_percentile": 0.12097,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-299",
      "title": "CRL check skipped when OCSP enabled and certificate has no OCSP URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94417"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-100833",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00226,
      "epss_percentile": 0.12,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-20",
      "title": "Contrast before 1.23.1 Image Substitution via Policy Generation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100833"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-100850",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00225,
      "epss_percentile": 0.11936,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-918",
      "title": "AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100850"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-100838",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00221,
      "epss_percentile": 0.114,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-59",
      "title": "Contrast before 1.19.1 CopyFile Policy Symlink Subversion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100838"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-100835",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00217,
      "epss_percentile": 0.10897,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-295",
      "title": "Contrast before 1.16.0 Remote Attestation Relay Attack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100835"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-89134",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00216,
      "epss_percentile": 0.10853,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Subject CN name-constraint check bypassed when non-DNS SAN present",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89134"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-100837",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00213,
      "epss_percentile": 0.10386,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-1289",
      "title": "Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100837"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-100855",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00209,
      "epss_percentile": 0.09844,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-862",
      "title": "AzuraCast before 0.23.6 Missing Permission Check via /play",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100855"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-100840",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00207,
      "epss_percentile": 0.09681,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-95",
      "title": "MONAI through 1.6.0 Remote Code Execution via bundle configuration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100840"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-100851",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00207,
      "epss_percentile": 0.09716,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-200",
      "title": "AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100851"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-89135",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00207,
      "epss_percentile": 0.09716,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-295",
      "title": "Failed X509_verify_cert leaves unverified CA in shared CertManager",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89135"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2025-71423",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00206,
      "epss_percentile": 0.09478,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-532",
      "title": "Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71423"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-100862",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00194,
      "epss_percentile": 0.0811,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-312",
      "title": "heym before 0.0.91 Multiple Secrets Plaintext Storage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100862"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-93304",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00194,
      "epss_percentile": 0.08161,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-696",
      "title": "(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93304"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2025-71425",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0019,
      "epss_percentile": 0.07717,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-532",
      "title": "Contrast before 1.8.1 Information Disclosure via Logging",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71425"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-100843",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00188,
      "epss_percentile": 0.07591,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-502",
      "title": "MONAI before 1.6.0 Remote Code Execution via algo_from_pickle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100843"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-96896",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00184,
      "epss_percentile": 0.07158,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Malcure Malware Shield — Removal, Repair, Monitor",
      "cwe": "CWE-862",
      "title": "Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96896"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-100861",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00182,
      "epss_percentile": 0.06999,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-918",
      "title": "heym before 0.0.105 SSRF via credential-controlled base URLs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100861"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-100848",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00178,
      "epss_percentile": 0.06571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-918",
      "title": "AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100848"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-92436",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00177,
      "epss_percentile": 0.0648,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Mailchimp for WooCommerce",
      "cwe": "CWE-639",
      "title": "Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92436"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-86609",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00172,
      "epss_percentile": 0.05932,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Download Manager",
      "cwe": "CWE-79",
      "title": "Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86609"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2025-71424",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00163,
      "epss_percentile": 0.0493,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-693",
      "title": "Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71424"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-100854",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.04424,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AzuraCast",
      "product": "AzuraCast",
      "cwe": "CWE-862",
      "title": "AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100854"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-81655",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00152,
      "epss_percentile": 0.03682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Ad Inserter",
      "cwe": "CWE-94",
      "title": "Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81655"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-85002",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03683,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "EmbedPress",
      "cwe": "CWE-79",
      "title": "EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85002"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-89006",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WPeMatico RSS Feed Fetcher",
      "cwe": "CWE-79",
      "title": "WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89006"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-96895",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03683,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP YouTube Lyte",
      "cwe": "CWE-79",
      "title": "WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96895"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-96899",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03683,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Optima Express IDX",
      "cwe": "CWE-79",
      "title": "Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96899"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-97319",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "PowerPress Podcasting plugin by Blubrry",
      "cwe": "CWE-79",
      "title": "PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97319"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-86841",
      "cvss_base": 4.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0015,
      "epss_percentile": 0.03531,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Online Scheduling and Appointment Booking System",
      "cwe": "CWE-502",
      "title": "Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86841"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-100839",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00149,
      "epss_percentile": 0.03424,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-94",
      "title": "Contrast before 1.18.0 AML Injection Remote Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100839"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-100842",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00148,
      "epss_percentile": 0.03388,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-95",
      "title": "MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100842"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-100836",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00147,
      "epss_percentile": 0.0328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-129",
      "title": "Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100836"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-92995",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00145,
      "epss_percentile": 0.0319,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Verge3D Publishing and E-Commerce",
      "cwe": "CWE-200",
      "title": "Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92995"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2025-71426",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0014,
      "epss_percentile": 0.0279,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-285",
      "title": "Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71426"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-82841",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00139,
      "epss_percentile": 0.02713,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "UpdraftPlus: WP Backup & Migration Plugin",
      "cwe": "CWE-200",
      "title": "UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82841"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-96897",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00137,
      "epss_percentile": 0.0255,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Optima Express IDX",
      "cwe": "CWE-862",
      "title": "Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96897"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-100845",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.02508,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-502",
      "title": "MONAI before 1.6.0 Remote Code Execution via NumpyReader",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100845"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-97227",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02298,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "NextScripts: Social Networks Auto-Poster",
      "cwe": "CWE-862",
      "title": "NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97227"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-89001",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.0232,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WPeMatico RSS Feed Fetcher",
      "cwe": "CWE-269",
      "title": "WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89001"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-89000",
      "cvss_base": 4.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02299,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WPeMatico RSS Feed Fetcher",
      "cwe": "CWE-918",
      "title": "WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89000"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-89003",
      "cvss_base": 4.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02298,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WPeMatico RSS Feed Fetcher",
      "cwe": "CWE-918",
      "title": "WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89003"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-86839",
      "cvss_base": 3.8,
      "cvss_severity": "LOW",
      "epss_score": 0.00132,
      "epss_percentile": 0.02298,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Online Scheduling and Appointment Booking System",
      "cwe": "CWE-639",
      "title": "Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86839"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-100841",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00125,
      "epss_percentile": 0.0193,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-502",
      "title": "MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100841"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-100860",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00115,
      "epss_percentile": 0.01405,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-636",
      "title": "heym before 0.0.105 Authentication Bypass via Redis Node",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100860"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-94419",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00077,
      "epss_percentile": 0.00097,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-287",
      "title": "Client session cache reference poisoning allows resumption with wrong server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94419"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2025-71422",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00074,
      "epss_percentile": 0.0006,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-347",
      "title": "Contrast before 1.12.1 Insecure LUKS2 Persistent Storage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71422"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-94418",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00053,
      "epss_percentile": 0.00002,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wolfSSL",
      "product": "wolfSSL",
      "cwe": "CWE-347",
      "title": "Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94418"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-88773",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": "CWE-444",
      "title": "HTTP Request Smuggling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88773"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-100886",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Seetong",
      "product": "T8108",
      "cwe": "CWE-287",
      "title": "Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100886"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-101065",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "obot-platform",
      "product": "obot",
      "cwe": "CWE-306",
      "title": "Obot Quickstart Docker Deployment Unauthenticated Admin Access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101065"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-101084",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "obot-platform",
      "product": "obot",
      "cwe": "CWE-639",
      "title": "obot before v0.21.1 Authorization Bypass via /mcp-connect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101084"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-101090",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nezhahq",
      "product": "nezha",
      "cwe": "CWE-601",
      "title": "Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101090"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-101045",
      "cvss_base": 8.9,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fleetdm",
      "product": "fleet",
      "cwe": "CWE-78",
      "title": "Fleet Homebrew Cask OS Command Injection via Metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101045"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-88775",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": null,
      "title": "Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88775"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-88776",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": null,
      "title": "Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88776"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-88777",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": null,
      "title": "Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88777"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-88778",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": "CWE-342",
      "title": "TCP Initial Sequence Number (ISN) prediction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88778"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-100870",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sylius",
      "product": "Sylius",
      "cwe": "CWE-640",
      "title": "Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100870"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-100871",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sylius",
      "product": "Sylius",
      "cwe": "CWE-287",
      "title": "Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100871"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-100872",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sylius",
      "product": "Sylius",
      "cwe": "CWE-345",
      "title": "Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100872"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-101062",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "obot-platform",
      "product": "obot",
      "cwe": "CWE-863",
      "title": "Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101062"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-101060",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "universal-tool-calling-protocol",
      "product": "python-utcp",
      "cwe": "CWE-918",
      "title": "python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101060"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-101043",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-201",
      "title": "pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101043"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-101049",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-287",
      "title": "Heym before 0.0.53 Slack Webhook Signature Verification Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101049"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-101050",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-287",
      "title": "Heym before 0.0.53 Authentication Bypass via Telegram Webhook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101050"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-101064",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "obot-platform",
      "product": "obot",
      "cwe": "CWE-918",
      "title": "Obot before v0.23.0 Server-Side Request Forgery via MCP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101064"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-100869",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sylius",
      "product": "Sylius",
      "cwe": "CWE-863",
      "title": "Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100869"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-96280",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-197",
      "title": "Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96280"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-101042",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parse-community",
      "product": "parse-server",
      "cwe": "CWE-287",
      "title": "Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101042"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-101032",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "denisidoro",
      "product": "navi",
      "cwe": "CWE-78",
      "title": "navi through 2.24.0 OS Command Injection via Cheatsheet Variables",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101032"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-101044",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pnpm",
      "product": "pnpm",
      "cwe": "CWE-22",
      "title": "pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101044"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-101058",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "universal-tool-calling-protocol",
      "product": "python-utcp",
      "cwe": "CWE-918",
      "title": "python-utcp before 1.1.12 SSRF via Remote HTTP Manual",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101058"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-101059",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "universal-tool-calling-protocol",
      "product": "python-utcp",
      "cwe": "CWE-918",
      "title": "utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101059"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-101085",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nezhahq",
      "product": "nezha",
      "cwe": "CWE-197",
      "title": "Nezha before 2.3.8 Denial of Service via Alert Rule",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101085"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-101086",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nezhahq",
      "product": "nezha",
      "cwe": "CWE-269",
      "title": "Nezha Dashboard before 2.3.5 Task Type Validation Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101086"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-88774",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Citrix NetScaler",
      "product": "ADC",
      "cwe": null,
      "title": "Feature policy bypass due to improper HTTP URL based expression usage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88774"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-97164",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "svenbluege.de",
      "product": "Event Gallery for Joomla",
      "cwe": "CWE-22",
      "title": "Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97164"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-100748",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "svenbluege.de",
      "product": "Event Gallery for Joomla",
      "cwe": "CWE-352",
      "title": "Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100748"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-100888",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Trusted Domain Project",
      "product": "OpenDKIM",
      "cwe": "CWE-787",
      "title": "Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100888"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-100889",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Trusted Domain Project",
      "product": "OpenDKIM",
      "cwe": "CWE-193",
      "title": "Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100889"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-101047",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fleetdm",
      "product": "fleet",
      "cwe": "CWE-862",
      "title": "Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101047"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-101056",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cloudreve",
      "product": "cloudreve",
      "cwe": "CWE-863",
      "title": "Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101056"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-101063",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "obot-platform",
      "product": "obot",
      "cwe": "CWE-862",
      "title": "Obot before v0.23.0 Authentication Bypass via Registry API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101063"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-96279",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-59",
      "title": "Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96279"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-101041",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vulnerability-lookup",
      "product": "vulnerability-lookup",
      "cwe": "CWE-20",
      "title": "Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101041"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-96281",
      "cvss_base": 6.2,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-284",
      "title": "Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96281"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-101088",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nezhahq",
      "product": "nezha",
      "cwe": "CWE-367",
      "title": "Nezha before 2.3.1 Denial of Service via Concurrent Server Delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101088"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-100874",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mathurvishal",
      "product": "CloudClassroom-PHP-Project",
      "cwe": "CWE-74",
      "title": "mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100874"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-100875",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mathurvishal",
      "product": "CloudClassroom-PHP-Project",
      "cwe": "CWE-74",
      "title": "mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100875"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-100885",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Krayin",
      "product": "laravel-crm",
      "cwe": "CWE-285",
      "title": "Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100885"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-97165",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "svenbluege.de",
      "product": "Event Gallery for Joomla",
      "cwe": "CWE-79",
      "title": "Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97165"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-100868",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "penpot",
      "product": "penpot",
      "cwe": "CWE-1327",
      "title": "Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100868"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-100887",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "amirsanni",
      "product": "Mini-Inventory-and-Sales-Management-System",
      "cwe": "CWE-89",
      "title": "amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100887"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-101033",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TomBursch",
      "product": "kitchenowl",
      "cwe": "CWE-639",
      "title": "KitchenOwl through 0.7.10 IDOR via unchecked category ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101033"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-101048",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cloudreve",
      "product": "cloudreve",
      "cwe": "CWE-863",
      "title": "Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101048"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-101087",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nezhahq",
      "product": "nezha",
      "cwe": "CWE-918",
      "title": "Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101087"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-100747",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "svenbluege.de",
      "product": "Event Gallery for Joomla",
      "cwe": "CWE-352",
      "title": "Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100747"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-100749",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "svenbluege.de",
      "product": "Event Gallery for Joomla",
      "cwe": "CWE-352",
      "title": "Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100749"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-100866",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "o2sh",
      "product": "onefetch",
      "cwe": "CWE-150",
      "title": "onefetch through 2.28.1 Terminal Escape Sequence Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100866"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-100867",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "spaceship-prompt",
      "product": "spaceship-prompt",
      "cwe": "CWE-150",
      "title": "spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100867"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-96283",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-862",
      "title": "Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96283"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-96282",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-59",
      "title": "Flatpak: flatpak: extension metadata path traversal file existence oracle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96282"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-96284",
      "cvss_base": 2.5,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-59",
      "title": "Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96284"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-101046",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fleetdm",
      "product": "fleet",
      "cwe": "CWE-89",
      "title": "Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101046"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-101051",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cloudreve",
      "product": "cloudreve",
      "cwe": "CWE-22",
      "title": "Cloudreve before 4.16.1 Path Traversal via Remote Download",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101051"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-101057",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "universal-tool-calling-protocol",
      "product": "python-utcp",
      "cwe": "CWE-319",
      "title": "utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101057"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-101061",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "universal-tool-calling-protocol",
      "product": "python-utcp",
      "cwe": "CWE-918",
      "title": "utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101061"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-101089",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nezhahq",
      "product": "nezha",
      "cwe": "CWE-522",
      "title": "Nezha before 2.2.7 Information Disclosure via /api/v1/profile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101089"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-100873",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mathurvishal",
      "product": "CloudClassroom-PHP-Project",
      "cwe": "CWE-352",
      "title": "mathurvishal CloudClassroom-PHP-Project cross-site request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100873"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-100876",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mathurvishal",
      "product": "CloudClassroom-PHP-Project",
      "cwe": "CWE-287",
      "title": "mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100876"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-100877",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mathurvishal",
      "product": "CloudClassroom-PHP-Project",
      "cwe": "CWE-79",
      "title": "mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100877"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-100878",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhistaredu",
      "product": "StarTraining",
      "cwe": "CWE-285",
      "title": "zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100878"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-100879",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhistaredu",
      "product": "StarTraining",
      "cwe": "CWE-862",
      "title": "zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100879"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-100883",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Krayin",
      "product": "laravel-crm",
      "cwe": "CWE-266",
      "title": "Krayin laravel-crm acl.php access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100883"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-100884",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Krayin",
      "product": "laravel-crm",
      "cwe": "CWE-99",
      "title": "Krayin laravel-crm attachment-download Endpoint acl.php resource injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100884"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-100880",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhistaredu",
      "product": "StarTraining",
      "cwe": "CWE-79",
      "title": "zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100880"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-100882",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Krayin",
      "product": "laravel-crm",
      "cwe": "CWE-79",
      "title": "Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100882"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-100881",
      "cvss_base": 1.2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhistaredu",
      "product": "StarTraining",
      "cwe": "CWE-79",
      "title": "zhistaredu StarTraining application.yml cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100881"
    }
  ],
  "transactions": [
    {
      "type": "KEV_ADDED",
      "cve_id": "CVE-2026-88771",
      "detail": "ADDED TO KEV — CVE-2026-88771 (Citrix NetScaler ADC). Remediation due September 30, 2026."
    },
    {
      "type": "KEV_ADDED",
      "cve_id": "CVE-2026-88772",
      "detail": "ADDED TO KEV — CVE-2026-88772 (Citrix NetScaler ADC). Remediation due September 30, 2026."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-92927",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-92927 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-93988",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-93988 (webkul qloapps). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-93997",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-93997 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-94015",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-94015 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-94016",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-94016 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-94033",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-94033 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-94034",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-94034 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-94035",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-94035 (SourceCodester Drug Recommendation System). Public exploit reference added."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-96276",
      "detail": "RESCORED — CVE-2026-96276 (Red Hat Enterprise Linux 10). CVSS 9.8 → 6.5 (NVD)."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}