Security Box Score — October 1, 2026

CISA adds 1 to KEV; 395 CVEs published, led by Apache Software Foundation (28).

395 CVEs published October 1, 2026: 41 critical, 166 high, 144 medium, 24 low; 1 in the KEV catalog at press time; 1 with a public exploit reference; 20 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 370 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	395	50382	—	—
KEV catalog size	1731

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

3267 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	0	6205	530	2638	713	1	15	6	0.1	7.8	.0019	0
microsoft	0	2901	201	1992	692	16	290	31	1.1	7.8	.0047	0
google	0	2831	356	1096	1244	131	80	9	0.3	7.5	.0027	-26 ▼
red hat	18	917	54	386	424	53	2	0	0.0	6.7	.0035	+6 ▲
apple	0	564	67	166	317	14	89	9	1.6	6.5	.0019	0
suse	0	53	8	27	16	2	0	0	0.0	7.5	.0036	-3 ▼
canonical	0	50	16	12	17	5	0	0	0.0	7.8	.0021	0
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	0	182	54	72	55	1	60	17	9.3	7.8	.0046	0
ubiquiti	0	65	36	28	1	0	3	3	4.6	9.1	.0050	0
palo alto networks	0	46	1	4	26	15	13	2	4.3	4.7	.0022	0
fortinet	1	42	12	10	17	3	30	8	19.0	7.2	.0040	+1 ▲
netgear	0	34	0	0	27	7	0	0	0.0	4.3	.0027	0
f5	0	26	7	14	4	1	5	2	7.7	8.7	.0050	0
ivanti	0	24	6	16	2	0	25	5	20.8	8.8	.0152	0
sonicwall	0	19	7	8	4	0	19	4	21.1	8.3	.0050	-2 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	28	735	163	314	239	18	33	2	0.3	7.5	.0061	+28 ▲
mozilla	0	379	122	169	87	0	9	0	0.0	8.8	.0030	-34 ▼
gitlab	0	104	7	24	62	11	5	3	2.9	5.3	.0034	0
drupal	0	94	11	9	66	8	4	1	1.1	5.7	.0027	0
github	0	23	2	11	10	0	0	0	0.0	7.4	.0054	-3 ▼
docker	0	12	1	8	3	0	0	0	0.0	8.4	.0017	0
wordpress	0	6	1	4	1	0	3	3	50.0	8.7	.0392	0
eclipse	0	2	2	0	0	0	0	0	0.0	9.3	.0050	0

Enterprise Applications
Vendor	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS
oracle	2905	581	1660	563	101	28	4	0.1	7.8	.0036
ibm	1023	196	473	336	18	6	1	0.1	7.5	.0037
adobe	830	82	364	375	9	21	5	0.6	7.5	.0036
progress	66	15	40	11	0	6	1	1.5	8.1	.0046
zohocorp	42	6	29	7	0	0	0	0.0	8.3	.0117
solarwinds	26	18	5	3	0	10	4	15.4	9.1	.0067
veeam	19	6	10	3	0	1	0	0.0	8.6	.0042
servicenow	10	7	3	0	0	2	0	0.0	9.4	.0036

Industrial & Embedded
Vendor	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	74	22	28	12	12	3	8.5	.0164	0
siemens	52	6	33	10	3	0	7.3	.0026	0
synology	46	5	10	25	6	0	5.6	.0032	0
rockwell automation	43	5	32	6	0	0	8.6	.0029	-16 ▼
advantech	20	2	17	1	0	0	8.6	.0071	0
schneider electric	18	2	11	5	0	0	8.5	.0044	-4 ▼
hitachi energy	12	2	4	6	0	0	7.0	.0025	0
abb	11	1	6	4	0	0	7.2	.0018	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	0	378	34	170	152	22	2	1	0.3	7.2	.0027	-13 ▼
nvidia	0	301	25	206	70	0	0	0	0.0	7.8	.0019	-30 ▼
sourcecodester	0	237	0	0	142	95	0	0	0.0	5.5	.0042	0
openclaw	0	223	4	114	84	21	0	0	0.0	7.1	.0032	0
spring	0	170	13	60	83	14	0	0	0.0	6.5	.0033	0
mongodb	0	169	6	99	60	4	1	0	0.0	7.1	.0038	0
hewlett packard enterprise (hpe)	0	166	22	80	55	9	1	1	0.6	7.2	.0042	-86 ▼
itsourcecode	2	155	0	0	37	118	0	0	0.0	2.1	.0033	+2 ▲

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-85706	.9296	99.8	10.0
CVE-2026-85046	.4888	98.8	8.8
CVE-2026-76461	.2827	98.1	9.8
CVE-2026-87902	.1976	97.3	8.1
CVE-2026-93616	.1965	97.3	9.8
CVE-2026-76460	.1403	96.4	10.0
CVE-2026-86218	.1293	96.2	10.0
CVE-2026-85102	.0755	94.3	9.8
CVE-2026-79756	.0752	94.3	8.7
CVE-2026-12269	.0699	94.0	8.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-85706	10.0	.9296	KEV
CVE-2026-76460	10.0	.1403	KEV
CVE-2026-86218	10.0	.1293	KEV
CVE-2026-75650	10.0	.0395	KEV
CVE-2026-82004	10.0	.0325
CVE-2026-86152	10.0	.0288
CVE-2026-85978	10.0	.0144
CVE-2026-73369	10.0	.0125
CVE-2026-75699	10.0	.0125
CVE-2026-75703	10.0	.0125

Most disclosures (vendor)
Vendor	CVEs
linux	2115
microsoft	1002
google	636
oracle	634
ibm	404
red hat	270
apple	247
adobe	224
apache	223
dell	194

Most KEV additions (YTD)
Vendor	KEV
microsoft	31
cisco	17
apple	9
google	9
fortinet	8
linux	6
adobe	5
ivanti	5
berriai	4
checkpoint	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	112
npm	18
Packagist	17
PyPI	14
crates.io	9
Go	4
RubyGems	2
NuGet	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-58704	Google	0
CVE-2026-75650	Adobe	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-86950	Apple	0
CVE-2026-87491	Google	0
CVE-2026-93952	Arista Networks	0
CVE-2026-84869	ConnectWise	2
CVE-2026-86218	N-able	2

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1779
CVE-2021-27102	n/a	2021-11-17	1779
CVE-2021-27101	n/a	2021-11-17	1779
CVE-2021-27103	n/a	2021-11-17	1779
CVE-2021-21017	Adobe	2021-11-17	1779
CVE-2021-28550	Adobe	2021-11-17	1779
CVE-2021-42013	Apache Software Foundation	2021-11-17	1779
CVE-2021-41773	Apache Software Foundation	2021-11-17	1779
CVE-2021-30858	Apple	2021-11-17	1779
CVE-2021-30860	Apple	2021-11-17	1779

Transactions

ADDED TO KEV — CVE-2026-104286 (Fortinet FortiMail). Remediation due October 4, 2026.

EXPLOIT PUBLISHED — Google Chrome: 14 CVEs (CVE-2026-95290, CVE-2026-95295, CVE-2026-95300, CVE-2026-95301, CVE-2026-95330, CVE-2026-95342, CVE-2026-95344, CVE-2026-95358, CVE-2026-95362, CVE-2026-95364, CVE-2026-95366, CVE-2026-95370, CVE-2026-95375, CVE-2026-95376). Public exploit references added.

EXPLOIT PUBLISHED — dolibarr: 9 CVEs (CVE-2026-71503, CVE-2026-71504, CVE-2026-71505, CVE-2026-71506, CVE-2026-71507, CVE-2026-71508, CVE-2026-71509, CVE-2026-71510, CVE-2026-71511). Public exploit references added.

EXPLOIT PUBLISHED — PassMark Software PerformanceTest: 7 CVEs (CVE-2026-80112, CVE-2026-80113, CVE-2026-80114, CVE-2026-80115, CVE-2026-80116, CVE-2026-80118, CVE-2026-80119). Public exploit references added.

EXPLOIT PUBLISHED — FileRun: 4 CVEs (CVE-2026-73693, CVE-2026-73694, CVE-2026-73698, CVE-2026-73699). Public exploit references added.

EXPLOIT PUBLISHED — Trusted Domain Project OpenDMARC: 4 CVEs (CVE-2026-100891, CVE-2026-101015, CVE-2026-101278, CVE-2026-101281). Public exploit references added.

EXPLOIT PUBLISHED — wazuh-manager: 4 CVEs (CVE-2026-74038, CVE-2026-74039, CVE-2026-74044, CVE-2026-74046). Public exploit references added.

EXPLOIT PUBLISHED — Softaculous Virtualizor: 3 CVEs (CVE-2026-43641, CVE-2026-43642, CVE-2026-43643). Public exploit references added.

EXPLOIT PUBLISHED — SPIP: 3 CVEs (CVE-2026-72708, CVE-2026-72709, CVE-2026-72710). Public exploit references added.

EXPLOIT PUBLISHED — Ziroom ZHOME A0101: 3 CVEs (CVE-2026-101261, CVE-2026-101264, CVE-2026-102793). Public exploit references added.

EXPLOIT PUBLISHED — CVE-2010-0738. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2010-1428. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2010-2861. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2015-2291. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2016-20076 (ChrisHurst Simple Backup). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2018-19323. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2018-6882. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2019-25743 (Soliloquywp Soliloquy Lite). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2020-0796 (Microsoft Windows 10 Version 1903 for 32-bit Systems). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-21975 (VMware vRealize Operations). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-22175 (GitLab). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2021-27065 (Microsoft Exchange Server 2013 Cumulative Update 21). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-27925. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2022-30333. Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-46805 (Ivanti ICS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-54342 (Eclipse Equinox OSGi). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2023-54344 (Eclipse Equinox OSGi). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2024-58304 (SPA-CART CMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2024-58387 (Inspur Haiyue HCM Cloud). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2025-62593 (ray-project ray). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-100894 (mathurvishal CloudClassroom-PHP-Project). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-100900 (DevaslanPHP project-management). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-100903 (ООО НПО Ритм GEOritm). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-100907 (Eyeplus). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101000 (Netcore NBR100V2). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101009 (aaPanel BaoTa). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101012 (mathurvishal CloudClassroom-PHP-Project). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101018 (dayrui XunruiCMS). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101037 (FAST FAC1200R). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101040 (Ricoh SP 330DN). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101054 (Thinkware U3000). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101067 (dbgate). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101070 (dbgate). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101073 (Netcore NR289-GE). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101076 (Netcore NR289-GE). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101079 (agentverus-scanner). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101132 (deepseek-harness). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101142 (Eleveo Quality Management). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101145 (Eleveo Call Recording Software). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101188 (Netcore POWER13). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101859 (raspap-webgui). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-101878 (bitwarden server). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102241 (Netcore NAP930). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102245 (MODSetter SurfSense). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102249 (REBUILD). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102361 (gz-yami mall4j). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102365 (gz-yami mall4j). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102373 (GestSup). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102507 (BishopFox sliver). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-102805 (Nothings stb). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-103113 (OS4ED openSIS-Classic). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-11553 (Tenda HG7). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-22681 (Volcengine OpenViking). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-44402 (Voltronic Power SNMP Web Pro). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-57517 (Control Web Panel). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-57863 (crater-invoice-inc crater). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-58143 (Cotonti). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-58144 (Cotonti). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-6958 (Invicti Security Corp. Acunetix). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-7006 (Sublime HQ Pty Ltd Sublime Text 4). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-73678 (MindsDB Minds Platform). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82017 (IGEL OS 12). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82524 (unopim). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82536 (RooCodeInc Roo-Code). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82537 (RooCodeInc Roo-Code). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93339 (Metaphor Creations Ditty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93353 (9001 copyparty). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-93355 (BerriAI litellm). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-95675 (D-LINK DAP-1360). Public exploit reference added.

DUE DATE PASSED — CVE-2026-88771 (Citrix NetScaler ADC). CISA remediation deadline was September 30, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-88772 (Citrix NetScaler ADC). CISA remediation deadline was September 30, 2026; still in catalog.

RESCORED — moodle: 5 CVEs (CVE-2026-102578, CVE-2026-102580, CVE-2026-102581, CVE-2026-102582, CVE-2026-102586). CVSS rescored — before/after on each CVE page.

RESCORED — CVE-2013-0431. CVSS 5.3 → 3.7 (NVD).

RESCORED — CVE-2015-3246. CVSS 5.1 → 7.4 (NVD).

RESCORED — CVE-2021-22175 (GitLab). CVSS 6.8 → 9.8 (NVD).

RESCORED — CVE-2023-27351 (PaperCut NG). CVSS 8.2 → 7.5 (NVD).

RESCORED — CVE-2024-7399 (Samsung Electronics MagicINFO 9 Server). CVSS 8.8 → 9.8 (NVD).

RESCORED — CVE-2024-9379 (Ivanti CSA (Cloud Services Appliance)). CVSS 6.5 → 7.2 (NVD).

RESCORED — CVE-2026-100268 (JetBrains YouTrack). CVSS 7.7 → 2.7 (NVD).

RESCORED — CVE-2026-10031 (drakkan SFTPGo). CVSS 2.3 → 5.3 (NVD).

RESCORED — CVE-2026-81438 (Dell OpenManage Server Administrator Managed Node (Patch) for Windows). CVSS 3.7 → 7.5 (NVD).

RESCORED — CVE-2026-81439 (Dell OpenManage Server Administrator Managed Node (Patch) for Windows). CVSS 3.7 → 6.5 (NVD).

RESCORED — CVE-2026-81440 (Dell OpenManage Server Administrator Managed Node (Patch) for Windows). CVSS 7.3 → 9.8 (NVD).

RESCORED — CVE-2026-81441 (Dell OpenManage Server Administrator Managed Node (Patch) for Windows). CVSS 4 → 5.5 (NVD).

RESCORED — CVE-2026-81475 (Dell OpenManage Server Administrator Managed Node (Patch) for Windows). CVSS 8.1 → 9.8 (NVD).

RESCORED — CVE-2026-81476 (Dell OpenManage Server Administrator Managed Node (Patch) for Windows). CVSS 8.1 → 9.8 (NVD).

RESCORED — CVE-2026-84440 (IBM Guardium Data Protection). CVSS 7.5 → 8.8 (NVD).

RESCORED — CVE-2026-94184 (Red Hat Enterprise Linux 10). CVSS 8.1 → 5.3 (NVD).

PATCH SHIPPED — Brocade SANnav: 8 CVEs (CVE-2026-14441, CVE-2026-14442, CVE-2026-14443, CVE-2026-82368, CVE-2026-82369, CVE-2026-82370, CVE-2026-82371, CVE-2026-82372). Fix versions published.

PATCH SHIPPED — CVE-2026-79654 (Red Hat Satellite 6.16 for RHEL 8). Fixed in Red Hat Satellite 6.16 for RHEL 8 0:4.14.0.23-1.el8sat.

Yesterday's Results

How to read these box scores · glossary

395 CVEs published. 25 box scores, 370 table rows — nothing truncated.

CVE-2026-104286CRITICAL

Fortinet FortiMail — An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —   YES

AFFECTED
  Product    Versions  Fixed
  FortiMail  8.0.0 –   —

TIMELINE
  Oct 1   Added to CISA KEV, due Oct 4
  Oct 1   Reserved by CNA
  Oct 1   Published (CNA: fortinet)

CWE-22 · CNA: fortinet · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis · KEV due October 4, 2026

CVE-2026-55393CRITICAL

Teledyne FLIR Aware2 — Local File Inclusion in Teledyne FLIR Robots running Aware2

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   H   H   H   10.0      —      —     —

AFFECTED
  Product  Versions     Fixed
  Aware2   unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Oct 1   Published (CNA: Mandiant)

CWE-22 · CNA: Mandiant · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-101148CRITICAL

Unknown BackupSheep WordPress Backup Plugin — BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0      —      —     —

AFFECTED
  Product                              Versions     Fixed
  BackupSheep WordPress Backup Plugin  unspecified  —

TIMELINE
  Sep 28  Reserved by CNA
  Oct 1   Published (CNA: WPScan)

CWE-73 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-79901CRITICAL

Fortra BoKS Manager boks-server — Predictable Active Directory service-account passwords in BoKS Manager

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9      —      —     —

AFFECTED
  Product                   Versions     Fixed
  BoKS Manager boks-server  unspecified  —

TIMELINE
  Aug 25  Reserved by CNA
  Oct 1   Published (CNA: Fortra)

CWE-338 · CNA: Fortra · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-96658CRITICAL

Red Hat Red Hat Satellite 6.16 for RHEL 8 — Foreman: safemode bypass leading to rce

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   L   N  C  H  H  H    9.9      —      —     —

AFFECTED
  Product                            Versions     Fixed
  Red Hat Satellite 6.16 for RHEL 8  unspecified  0:1.5.0-2.el8sat
  Red Hat Satellite 6.16 for RHEL 9  unspecified  0:1.5.0-2.el9sat
  Red Hat Satellite 6.18 for RHEL 9  unspecified  0:1.5.0-2.el9sat
  Red Hat Satellite 6.19 for RHEL 9  unspecified  0:3.18.0.14-1.el9sat

TIMELINE
  Sep 23  Reserved by CNA
  Oct 1   Published (CNA: redhat)

CWE-94 · CNA: redhat · CVSS v3.1 · 5 references · NVD status: Awaiting Analysis

CVE-2026-12627CRITICAL

Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product                                         Versions   Fixed
  Fortra's Core Privileged Access Manager (BoKS)  8.1.0.0 –  —

TIMELINE
  Jun 18  Reserved by CNA
  Oct 1   Published (CNA: Fortra)

CWE-121 · CNA: Fortra · CVSS v3.1 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-15989CRITICAL

WebRehab Super Forms – Drag & Drop Form Builder — Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product                                 Versions     Fixed
  Super Forms – Drag & Drop Form Builder  unspecified  —

TIMELINE
  Jul 16  Reserved by CNA
  Oct 1   Published (CNA: Wordfence)

CWE-269 · CNA: Wordfence · CVSS v3.1 · 2 references · NVD status: Deferred

CVE-2026-56154CRITICAL

Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product             Versions  Fixed
  Apache HTTP Server  2.4.0 –   —

TIMELINE
  Jun 19  Reserved by CNA
  Oct 1   Published (CNA: apache)

CWE-416 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-57941CRITICAL

Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product             Versions  Fixed
  Apache HTTP Server  2.4.0 –   —

TIMELINE
  Jun 26  Reserved by CNA
  Oct 1   Published (CNA: apache)

CWE-416 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-59797CRITICAL

Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product             Versions  Fixed
  Apache HTTP Server  2.4.0 –   —

TIMELINE
  Jul 7   Reserved by CNA
  Oct 1   Published (CNA: apache)

CWE-269 · CNA: apache · CVSS v3.1 · 2 references · NVD status: Awaiting Analysis

CVE-2026-75957CRITICAL

superdav42 Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform — Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product                                                        Versions     Fixed
  Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform  unspecified  —

TIMELINE
  Aug 18  Reserved by CNA
  Oct 1   Published (CNA: Wordfence)

CWE-287 · CNA: Wordfence · CVSS v3.1 · 13 references · NVD status: Deferred

CVE-2026-103752CRITICAL

Paul Ryan Authorizer — WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8      —      —     —

AFFECTED
  Product     Versions  Fixed
  Authorizer  n/a –     3.16.0

TIMELINE
  Oct 1   Reserved by CNA
  Oct 1   Published (CNA: Patchstack)

CWE-266 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-56662CRITICAL

GetSimpleCMS-CE GetSimpleCMS-CE — GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   R  C  H  H  H    9.6      —      —     —

AFFECTED
  Product          Versions  Fixed
  GetSimpleCMS-CE  < 1.5 –   —

TIMELINE
  Jun 22  Reserved by CNA
  Oct 1   Published (CNA: GitHub_M)

CWE-352 · CNA: GitHub_M · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-14157CRITICAL

ASUS Router — Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user …

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   H   N   H   H   H    9.4      —      —     —

AFFECTED
  Product  Versions              Fixed
  Router   3.0.0.6_102 series –  —

TIMELINE
  Jun 30  Reserved by CNA
  Oct 1   Published (CNA: ASUS)

CWE-134 · CNA: ASUS · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-14984CRITICAL

Teledyne FLIR Aware2 — Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    9.4      —      —     —

AFFECTED
  Product  Versions     Fixed
  Aware2   unspecified  —

TIMELINE
  Jul 7   Reserved by CNA
  Oct 1   Published (CNA: Mandiant)

CWE-319 · CNA: Mandiant · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-18397CRITICAL

Thales SConnect — SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    9.4      —      —     —

AFFECTED
  Product   Versions     Fixed
  SConnect  unspecified  —

TIMELINE
  Jul 30  Reserved by CNA
  Oct 1   Published (CNA: THA-PSIRT)

CWE-130, CWE-252, CWE-347, CWE-457 · CNA: THA-PSIRT · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-55395CRITICAL

Teledyne FLIR Aware2 — Hardcoded Passwords in Teledyne FLIR Robots running Aware2

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   A   L   N   N   N   H   H   H    9.4      —      —     —

AFFECTED
  Product  Versions     Fixed
  Aware2   unspecified  —

TIMELINE
  Jun 16  Reserved by CNA
  Oct 1   Published (CNA: Mandiant)

CWE-798 · CNA: Mandiant · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-94620CRITICAL

foundation50 classroom50 — Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    9.4      —      —     —

AFFECTED
  Product      Versions    Fixed
  classroom50  < 1.11.0 –  —

TIMELINE
  Sep 21  Reserved by CNA
  Oct 1   Published (CNA: GitHub_M)

CWE-22, CWE-59 · CNA: GitHub_M · CVSS v4.0 · 2 references · NVD status: Received

CVE-2025-41753CRITICAL

WAGO 0751-9x01 — Path traversal in dynamically created BACnet File Objects

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3      —      —     —

AFFECTED
  Product              Versions  Fixed
  0751-9x01            1.0.0 –   —
  0750-811x-xxxx-xxxx  1.0.0 –   —
  0750-821x-xxx-xxx    1.0.0 –   —
  0762-420x-8000-000x  1.0.0 –   —
  0762-430x-8000-000x  1.0.0 –   —
  0762-520x-8000-000x  1.0.0 –   —
  0762-530x-8000-000x  1.0.0 –   —
  0762-620x-8000-000x  1.0.0 –   —
  0762-630x-8000-000x  1.0.0 –   —
  0752-8303-8000-0002  1.0.0 –   —
  + 12 more

TIMELINE
  Apr 16  Reserved by CNA
  Oct 1   Published (CNA: CERTVDE)

CWE-22 · CNA: CERTVDE · CVSS v4.0 · 1 reference · NVD status: Awaiting Analysis

CVE-2026-13043CRITICAL

WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    9.3      —      —     —

AFFECTED
  Product            Versions     Fixed
  Endpoint Security  unspecified  —

TIMELINE
  Jun 23  Reserved by CNA
  Oct 1   Published (CNA: WatchGuard)

CWE-306, CWE-798 · CNA: WatchGuard · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-62071CRITICAL

nickboss WordPress File Upload — WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  C  H  N  L    9.3      —      —     —

AFFECTED
  Product                Versions  Fixed
  WordPress File Upload  n/a –     5.2.0

TIMELINE
  Jul 13  Reserved by CNA
  Oct 1   Published (CNA: Patchstack)

CWE-89 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

CVE-2026-71449CRITICAL

Johnson Controls EasyIO FS32 — : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embed…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3      —      —     —

AFFECTED
  Product      Versions     Fixed
  EasyIO FS32  unspecified  —

TIMELINE
  Aug 6   Reserved by CNA
  Oct 1   Published (CNA: jci)

CWE-321 · CNA: jci · CVSS v4.0 · 1 reference · NVD status: Received

CVE-2026-76142CRITICAL

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   L   H   H    9.3      —      —     —

AFFECTED
  Product                            Versions  Fixed
  Genian NAC 5.0.75 LTS Release      135823 –  —
  Genian NAC 5.0.85 Release Stable   147181 –  —
  Genian NAC 5.0.86 Release          148018 –  —
  Genian ZTNA 6.0.35 LTS Release     135814 –  —
  Genian ZTNA 6.0.45 Release Stable  147169 –  —
  Genian ZTNA 6.0.46 Release         148028 –  —

TIMELINE
  Aug 19  Reserved by CNA
  Oct 1   Published (CNA: krcert)

CWE-284, CWE-306 · CNA: krcert · CVSS v4.0 · 2 references · NVD status: Deferred

CVE-2026-82824CRITICAL

Hitachi Industrial Equipment Systems Hitachi Coding Software Suite — Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3      —      —     —

AFFECTED
  Product                        Versions     Fixed
  Hitachi Coding Software Suite  unspecified  4.0.0

TIMELINE
  Aug 31  Reserved by CNA
  Oct 1   Published (CNA: Hitachi)

CWE-35 · CNA: Hitachi · CVSS v4.0 · 1 reference · NVD status: Deferred

CVE-2026-82825CRITICAL

Hitachi Industrial Equipment Systems Hitachi Coding Software Suite — Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3      —      —     —

AFFECTED
  Product                        Versions     Fixed
  Hitachi Coding Software Suite  unspecified  4.0.0

TIMELINE
  Aug 31  Reserved by CNA
  Oct 1   Published (CNA: Hitachi)

CWE-306 · CNA: Hitachi · CVSS v4.0 · 1 reference · NVD status: Deferred

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-82827	9.3	—	Hitachi Industrial Equipment Systems	Hitachi Coding Software Suite	CWE-321	A hard-coded JWT signing secret key may allow administrative functions to be …
CVE-2026-82829	9.3	—	Hitachi Industrial Equipment Systems	Hitachi Coding Software Suite	CWE-912	Hidden accounts or hard-coded credentials may permit unauthorized access with…
CVE-2026-103244	9.3	—	sgoudelis	ground-station	CWE-306	ground-station before 0.8.0 Authentication Bypass via setup.restore
CVE-2026-103264	9.3	—	fleetdm	fleet	CWE-287	Fleet before 4.87.0 Authentication Bypass via Device Identifiers
CVE-2026-103655	9.3	—	MISP	MISP	CWE-294	MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
CVE-2026-103764	9.3	—	kvcache-ai	Mooncake	CWE-822	Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/…
CVE-2026-103922	9.3	—	ionic-team	capacitor	CWE-346	Capacitor Android and iOS: remote content can be loaded at the app origin via…
CVE-2026-102628	9.2	—	Eummena	Cadmos LTI	CWE-215	Cadmos LTI exposure of sensitive information via debug mode
CVE-2026-53953	9.1	—	GetSimpleCMS-CE	GetSimpleCMS-CE	CWE-338	GetSimple CMS: Predictable Password Reset Password Allows Administrator Accou…
CVE-2026-55083	9.1	—	dhis2	dhis2-core	CWE-502	DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
CVE-2026-56660	9.1	—	GetSimpleCMS-CE	GetSimpleCMS-CE	CWE-352	GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
CVE-2026-79898	9.1	—	Fortra	BoKS Manager	CWE-78	Fortra BoKS Manager crlserver command injection vulnerability
CVE-2026-92966	9.1	—	latepoint	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress	CWE-94	Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Exe…
CVE-2026-96659	9.1	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-267	Foreman: excessive permissions for viewer role on preview
CVE-2026-86345	9.0	—	Red Hat	Red Hat Directory Server 11	CWE-923	389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path …
CVE-2026-102667	9.0	—	Joyland	Joyland.ai	CWE-749	Joyland AI WebView command injection
CVE-2026-13313	8.9	—	ASUS	Router	CWE-489	An Active Debug Code vulnerability in certain ASUS router models allows a rem…
CVE-2026-12405	8.8	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-78	Rubygem-foreman_remote_execution: command injection in job invocations via ef…
CVE-2026-19807	8.8	—	bytecorestack	ByteCoreStack – MCP Connector for AI Tools	CWE-269	ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via…
CVE-2026-66246	8.8	—	HCL Software	iControl	CWE-250	HCL iControl is affected by multiple security vulnerabilities
CVE-2026-70650	8.8	—	GetSimpleCMS-CE	GetSimpleCMS-CE	CWE-79	GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) vi…
CVE-2026-80275	8.8	—	Comelit Group S.p.A.	1456B Multi-User Gateway	CWE-425	Comelit 1456B gateway allows low priviledge user to overwrite installer passw…
CVE-2026-93546	8.8	—	Apache Software Foundation	Apache HTTP Server	CWE-190	Apache HTTP Server: mod_dav_fs namespace overflow
CVE-2026-95687	8.8	—	wpclever	WPC Shop as a Customer for WooCommerce	CWE-269	WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+)…
CVE-2026-97284	8.8	—	Icegram	Icegram	CWE-502	WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
CVE-2026-101147	8.8	—	Unknown	Featured Image from URL (FIFU)	CWE-352	Featured Image from URL (FIFU) Free & Premium - Administrator Account Creatio…
CVE-2026-103068	8.8	—	ByteCore Stack	ByteCoreStack – MCP Connector for AI Tools	CWE-266	WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privil…
CVE-2026-103484	8.8	—	n/a	pgvector	CWE-787	pgvector buffer overflow in IVFFlat index build
CVE-2026-103765	8.8	—	kvcache-ai	Mooncake	CWE-306	Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server
CVE-2026-104018	8.8	—	Wind River Systems Inc	VxWorks 7	CWE-269	VxWorks 7 improper privilege management
CVE-2026-104051	8.8	—	HaschekSolutions	pictshare	CWE-522	PictShare < 3.7.1 Sensitive Information Disclosure via info API
CVE-2024-58388	8.7	—	Sharp Corporation	Multiple Multifunction Printers	CWE-22	Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.…
CVE-2026-19253	8.7	—	Unknown	Cache Enabler	CWE-73	Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletio…
CVE-2026-54049	8.7	—	sakaiproject	sakai	CWE-79	Sakai Conversations has a Stored XSS Issue
CVE-2026-55230	8.7	—	givanz	Vvveb	CWE-79	Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted gr…
CVE-2026-71542	8.7	—	GetSimpleCMS-CE	GetSimpleCMS-CE	CWE-79	GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in…
CVE-2026-82826	8.7	—	Hitachi Industrial Equipment Systems	Hitachi Coding Software Suite	CWE-319	Authentication information or sensitive data may be intercepted in transit
CVE-2026-82828	8.7	—	Hitachi Industrial Equipment Systems	Hitachi Coding Software Suite	CWE-863	Improper authorization may allow a general user to perform operations equival…
CVE-2026-102369	8.7	—	TP-Link Systems Inc.	Tapo C200 v5	CWE-287	Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Lin…
CVE-2026-103262	8.7	—	tornadoweb	tornado	CWE-409	Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
CVE-2026-103268	8.7	—	TryGhost	Ghost	CWE-862	Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
CVE-2026-103271	8.7	—	TryGhost	Ghost	CWE-863	Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
CVE-2026-103272	8.7	—	TryGhost	Ghost	CWE-203	Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
CVE-2026-103761	8.7	—	kvcache-ai	Mooncake	CWE-770	Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded…
CVE-2026-104020	8.7	—	Amazon	ion-python	CWE-674	Uncontrolled recursion in the Ion reader in Amazon Ion Python
CVE-2026-104057	8.7	—	akhilrex	podgrab	CWE-362	Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
CVE-2026-64949	8.6	—	Pandora FMS	Pandora FMS	CWE-434	Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File…
CVE-2026-88789	8.6	—	Apache Software Foundation	Apache Camel Quarkus	CWE-611	Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops up…
CVE-2026-89296	8.6	—	Unknown	Pro Like Button	CWE-89	Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
CVE-2026-95588	8.6	—	AcyMailing Newsletter Team	AcyMailing SMTP Newsletter	CWE-22	WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deleti…
CVE-2026-101888	8.6	—	Codexonics	Prime Mover	CWE-22	Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
CVE-2026-103277	8.6	—	TryGhost	Ghost	CWE-79	Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
CVE-2026-103283	8.6	—	TryGhost	Ghost	CWE-613	Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
CVE-2026-103292	8.6	—	TryGhost	Ghost	CWE-79	Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
CVE-2026-103758	8.6	—	obot-platform	obot	CWE-863	Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ R…
CVE-2026-103766	8.6	—	MacWarrior	clipbucket-v5	CWE-89	ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Par…
CVE-2026-55396	8.5	—	Teledyne FLIR	Aware2	CWE-319	Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2
CVE-2026-102294	8.5	—	TP-Link System Inc.	TL-WR841N v14	CWE-78	Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration
CVE-2026-102379	8.5	—	VillaTheme	BuildKit – Product Builder for WooCommerce – Custom PC Builder	CWE-89	WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plug…
CVE-2026-103259	8.5	—	n8n-io	n8n	CWE-863	n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Cre…
CVE-2026-103278	8.5	—	TryGhost	Ghost	CWE-23	Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
CVE-2026-103286	8.5	—	TryGhost	Ghost	CWE-266	Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
CVE-2026-103338	8.5	—	Unlimited Elements	Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	CWE-89	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) …
CVE-2026-64950	8.4	—	Pandora FMS	Pandora FMS	CWE-79	Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
CVE-2026-73975	8.4	—	4TUResearchData	djehuty	CWE-943	djehuty: Authenticated SPARQL injection in session editing allows writing arb…
CVE-2026-76146	8.4	—	Genians, Inc	Genian SSL PNS (xenics_auther)	CWE-78	Genians, Inc Genian SSL PNS OS Command Injection
CVE-2026-102514	8.4	—	PeaZip	PeaZip	CWE-787	Out-of-bounds write in PeaZip PEA extractor allows code execution via a craft…
CVE-2026-101322	8.3	—	Eclipse Foundation	Eclipse BaSyx AAS Web UI	CWE-201	In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260…
CVE-2026-103246	8.3	—	n8n-io	n8n	CWE-639	n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Too…
CVE-2026-103757	8.3	—	Budibase	budibase	CWE-918	Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
CVE-2023-54404	8.2	—	colinhacks	zod	CWE-770	Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation
CVE-2026-12540	8.2	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-78	Foreman: command injection in foreman-rake errors:fetch_log via request_id pa…
CVE-2026-12541	8.2	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-78	Foreman: command injection in foreman-rake database tasks
CVE-2026-94250	8.2	—	Apache Software Foundation	Apache APISIX	CWE-770	Apache APISIX: Batch response aggregation can exhaust worker memory
CVE-2026-96780	8.2	—	patorjk	figlet.js	CWE-835	figlet is vulnerable to denial of service via unbounded loop when whitespaceB…
CVE-2026-103263	8.2	—	tornadoweb	tornado	CWE-59	Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
CVE-2026-103760	8.2	—	kvcache-ai	Mooncake	CWE-400	Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Hands…
CVE-2026-104356	8.2	—	HaschekSolutions	pictshare	CWE-338	PictShare < 3.7.1 Predictable Delete Code via rand()
CVE-2026-14316	8.1	—	Fortra	Core Privileged Access Manager (BoKS)	CWE-122	Heap buffer overflow in boks_sshd revoked-key error handling
CVE-2026-15983	8.1	—	WebRehab	Super Forms – Drag & Drop Form Builder	CWE-73	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory…
CVE-2026-73636	8.1	—	Apache Software Foundation	Apache HTTP Server	CWE-294	Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
CVE-2026-103257	8.1	—	n8n-io	n8n	CWE-22	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
CVE-2026-103493	8.1	—	JetBrains	YouTrack	CWE-79	In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX co…
CVE-2026-103067	8.0	—	Memberful	Memberful - Membership Plugin	CWE-352	WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request…
CVE-2026-79899	7.9	—	Fortra	BoKS Manager	CWE-377	Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability
CVE-2026-8618	7.7	—	TP-Link Systems Inc.	Deco M9 Plus V2	CWE-121	Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv…
CVE-2026-12544	7.7	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-502	Foreman: ssti and insecure deserialization in foreman-rake configuration
CVE-2026-84682	7.7	—	TP-Link Systems Inc.	Archer AX90 v1	CWE-78	TDDPv2 setProductVer Command Injection in Archer AX90
CVE-2026-103431	7.7	—	—	collectl	CWE-150	Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape seque…
CVE-2025-71427	7.6	—	GongRzhe	Office-PowerPoint-MCP-Server	CWE-22	Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentati…
CVE-2026-55232	7.6	—	givanz	Vvveb	CWE-918	Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() …
CVE-2026-62059	7.6	—	Ultimate Member	Ultimate Member	CWE-89	WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
CVE-2026-62060	7.6	—	captivateaudio	Captivate Sync	CWE-89	WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability
CVE-2026-97277	7.6	—	Apps Mav	Social Boost	CWE-862	WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability
CVE-2026-97297	7.6	—	Apps Mav	Gratisfaction	CWE-862	WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
CVE-2026-103279	7.6	—	TryGhost	Ghost	CWE-613	Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
CVE-2026-103651	7.6	—	MISP	MISP	CWE-287	MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor …
CVE-2026-12423	7.5	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-306	Foreman: unauthenticated information disclosure via provisioning token valida…
CVE-2026-46729	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-476	Apache HTTP Server: mod_heartmonitor denial of service
CVE-2026-47360	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-200	Apache HTTP Server: mod_session: Session cookie not removed during internal r…
CVE-2026-48005	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-306	Apache HTTP Server: mod_auth_digest reauthentication attack
CVE-2026-56153	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-787	Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
CVE-2026-56449	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-787	Apache HTTP Server: mod_proxy_html: crash in dump_content
CVE-2026-56661	7.5	—	GetSimpleCMS-CE	GetSimpleCMS-CE	CWE-918	GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
CVE-2026-59685	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-787	Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name…
CVE-2026-62073	7.5	—	Themeisle	WP Full Stripe Free	CWE-862	WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnera…
CVE-2026-63045	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-284	Apache HTTP Server: mod_proxy_ftp PASV address handling
CVE-2026-63292	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-121	Apache HTTP Server: mod_vhost_alias stack overflow
CVE-2026-63686	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-476	Apache HTTP Server: mod_xml2enc crash on charset conversion failure
CVE-2026-63718	7.5	—	Apache Software Foundation	Apache HTTP Server	CWE-444	Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
CVE-2026-64947	7.5	—	Pandora FMS	Pandora FMS	CWE-352	CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in …
CVE-2026-68495	7.5	—	FasterXML	jackson-dataformats-binary	CWE-400	jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraint…
CVE-2026-68496	7.5	—	FasterXML	jackson-dataformats-binary	CWE-400	jackson-dataformats-binary: Smile parser does not enforce StreamReadConstrain…
CVE-2026-76145	7.5	—	Genians, Inc	Genian SSL PNS (frodo-core)	CWE-269	Genians, Inc Genian SSL PNS Improper Privilege Management
CVE-2026-79896	7.5	—	Fortra	BoKS Manager	CWE-125	Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerabi…
CVE-2026-80276	7.5	—	Comelit Group S.p.A.	1456B Multi-User Gateway	CWE-306	Comelit 1456B gateway exposes remote configuration password via unauthenticat…
CVE-2026-81739	7.5	—	Unknown	Paytm Payment Gateway	CWE-79	Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
CVE-2026-81809	7.5	—	Unknown	Paytm Payment Gateway	CWE-89	Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
CVE-2026-86344	7.5	—	Red Hat	Red Hat Directory Server 11	CWE-400	389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via c…
CVE-2026-92245	7.5	—	croixhaug	Simply Schedule Appointments	CWE-862	Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthen…
CVE-2026-93882	7.5	—	thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	CWE-639	LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sen…
CVE-2026-96255	7.5	—	Unknown	Payments for Hubtel	CWE-200	Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Dis…
CVE-2026-100514	7.5	—	Pete Nelson	REST API Log	CWE-639	WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (I…
CVE-2026-100517	7.5	—	VillaTheme	Photo Reviews for WooCommerce	CWE-639	WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Ob…
CVE-2026-102504	7.5	—	—	Imager	CWE-190	Imager versions before 1.037 for Perl exit the process reading a raw image wi…
CVE-2026-103251	7.5	—	n8n-io	n8n	CWE-862	n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via…
CVE-2026-15911	7.4	—	confluent	confluent-kafka	CWE-295	Confluent Kafka Python Improper TLS Certificate Validation
CVE-2026-64946	7.4	—	Pandora FMS	Pandora FMS	CWE-79	CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Uploa…
CVE-2026-67105	7.4	—	HCL Software	HCL BigFix Service Management	CWE-319	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-103921	7.4	—	ardatan	graphql-tools	CWE-295	GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocke…
CVE-2026-64893	7.3	—	Johnson Controls	EasyIO NEO	CWE-319	- Cleartext Transmission of Sensitive Information vulnerability in Johnson Co…
CVE-2026-73637	7.3	—	Apache Software Foundation	Apache HTTP Server	CWE-416	Apache HTTP Server: mod_auth_digest DoS attack
CVE-2026-76143	7.3	—	Genians, Inc	Genian SSL PNS (frodo-core)	CWE-862	Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
CVE-2026-14995	7.2	—	optimizingmatters	Autoptimize	CWE-79	Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQ…
CVE-2026-34493	7.2	—	Johnson Controls	EasyIO FS32	CWE-1191	- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allow…
CVE-2026-34494	7.2	—	Johnson Controls	Neo Series MVP2	CWE-1191	- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 a…
CVE-2026-53964	7.2	—	adfinis	document-merge-service	CWE-1336	Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
CVE-2026-55231	7.2	—	givanz	Vvveb	CWE-22	Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrar…
CVE-2026-56589	7.2	—	HCL Software	HCL BigFix Service Management	CWE-79	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-71452	7.2	—	Johnson Controls	EasyIO FS32	CWE-78	- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows O…
CVE-2026-75786	7.2	—	Pandora FMS	Pandora FMS	CWE-89	SQL Injection in Grafana Integration Endpoint (query.php)
CVE-2026-85235	7.2	—	wpmudev	Forminator Forms – Contact Form, Payment Form & Custom Form Builder	CWE-79	Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via …
CVE-2026-85679	7.2	—	extendify	Extendify	CWE-79	Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.…
CVE-2026-92144	7.2	—	wpmudev	Forminator Forms – Contact Form, Payment Form & Custom Form Builder	CWE-79	Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via …
CVE-2026-92244	7.2	—	wpovernight	PDF Invoices & Packing Slips for WooCommerce	CWE-79	PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stor…
CVE-2026-94390	7.2	—	Dotstore	Hide Shipping Method For WooCommerce	CWE-502	WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object I…
CVE-2026-96561	7.2	—	tigroumeow	AI Engine – The Chatbot, AI Framework & MCP for WordPress	CWE-79	AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_'…
CVE-2026-96573	7.2	—	codepeople	Appointment Hour Booking – Booking Calendar	CWE-79	Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-S…
CVE-2026-96813	7.2	—	10web	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder	CWE-79	Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting …
CVE-2026-97661	7.2	—	scottpaterson	Business Essentials for Contact Form 7	CWE-79	Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cros…
CVE-2026-103082	7.2	—	LA-Studio	LA-Studio Element Kit for Elementor	CWE-918	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side R…
CVE-2026-103490	7.2	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible v…
CVE-2026-9032	7.1	—	TP-Link Systems Inc.	Tapo C200 V5	CWE-476	Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service…
CVE-2026-14983	7.1	—	Teledyne FLIR	Aware2	CWE-306	Missing Authentication in Teledyne FLIR Robots running Aware2
CVE-2026-64948	7.1	—	Pandora FMS	Pandora FMS	CWE-639	Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group M…
CVE-2026-71426	7.1	—	GetSimpleCMS-CE	GetSimpleCMS-CE	CWE-22	GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "temp…
CVE-2026-73976	7.1	—	4TUResearchData	djehuty	CWE-943	djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operat…
CVE-2026-78210	7.1	—	Octopus Deploy	Octopus Server	CWE-863	In affected versions of Octopus Server, users with certain scoped permission …
CVE-2026-78578	7.1	—	TP-Link Systems Inc.	Tapo C200 v5	CWE-306	Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Den…
CVE-2026-82357	7.1	—	RT-Labs AB	C-Open	CWE-476	RT-Labs AB C-Open CANopen NULL pointer dereference
CVE-2026-82358	7.1	—	RT-Labs AB	C-Open	CWE-863	RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass
CVE-2026-92412	7.1	—	Unknown	Five Star Restaurant Reviews	CWE-79	Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
CVE-2026-96577	7.1	—	Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	CWE-306	Oc-mirror__release-4.21: embedded local cache registry listens on all interfa…
CVE-2026-97260	7.1	—	maxfoundry	MaxGalleria	CWE-79	WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-97268	7.1	—	Premmerce	Premmerce Wishlist for WooCommerce	CWE-79	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Sc…
CVE-2026-97273	7.1	—	Premmerce	Premmerce Wishlist for WooCommerce	CWE-79	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Sc…
CVE-2026-102378	7.1	—	bPlugins	Parallax Section block	CWE-79	WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS)…
CVE-2026-103248	7.1	—	n8n-io	n8n	CWE-89	n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
CVE-2026-103252	7.1	—	n8n-io	n8n	CWE-639	n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential…
CVE-2026-103255	7.1	—	n8n-io	n8n	CWE-73	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection vi…
CVE-2026-103256	7.1	—	n8n-io	n8n	CWE-522	n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentica…
CVE-2026-103266	7.1	—	TryGhost	Ghost	CWE-863	Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
CVE-2026-103288	7.1	—	TryGhost	Ghost	CWE-639	Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
CVE-2026-103289	7.1	—	TryGhost	Ghost	CWE-943	Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
CVE-2026-103488	7.1	—	JetBrains	YouTrack	CWE-863	In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authe…
CVE-2026-103659	7.1	—	MISP	MISP	CWE-285	MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisatio…
CVE-2026-93495	7.0	—	ASUS	Motherboard(PRIME Z390-A )	CWE-665	Improper initialization in an ASUS certain motherboard allows an physically p…
CVE-2026-101889	7.0	—	Codexonics	Prime Mover	CWE-22	Prime Mover < 2.2.1 Path Traversal via wprime-config.json
CVE-2026-103250	7.0	—	n8n-io	n8n	CWE-943	n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
CVE-2026-103253	7.0	—	n8n-io	n8n	CWE-89	n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Dro…
CVE-2026-103254	7.0	—	n8n-io	n8n	CWE-22	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
CVE-2026-104059	7.0	—	lektor	lektor	CWE-352	Lektor 3.3.14 CSRF via Admin API Endpoints
CVE-2026-97662	6.9	—	AWS	security-agent-mcp-server	CWE-73	Argument injection in the diff scan operation in AWS security-agent-mcp-serve…
CVE-2026-100251	6.9	—	Wormhole App	Wormhole	CWE-918	Wormhole.app SSRF
CVE-2026-102666	6.9	—	Joyland	Joyland.ai	CWE-798	Joyland AI hard-coded credentials for push notifications
CVE-2026-102668	6.9	—	Joyland	Joyland.ai	CWE-295	Joyland AI accepts TLS certificates without validation
CVE-2026-102669	6.9	—	Joyland	Joyland.ai	CWE-297	Joyland AI hostname checking disabled
CVE-2026-102671	6.9	—	Joyland	Joyland.ai	CWE-295	Joyland AI WebView accepts invalid SSL certificates
CVE-2026-103245	6.9	—	n8n-io	n8n	CWE-347	n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
CVE-2026-103249	6.9	—	n8n-io	n8n	CWE-79	n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
CVE-2026-103258	6.9	—	n8n-io	n8n	CWE-943	n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interp…
CVE-2026-103261	6.9	—	tornadoweb	tornado	CWE-770	Tornado before 6.5.9 Denial of Service via Query String
CVE-2026-103269	6.9	—	TryGhost	Ghost	CWE-862	Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
CVE-2026-103274	6.9	—	TryGhost	Ghost	CWE-862	Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
CVE-2026-103276	6.9	—	TryGhost	Ghost	CWE-173	Ghost before 6.20.0 File Read via URL Encoding Bypass
CVE-2026-103280	6.9	—	TryGhost	Ghost	CWE-201	Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
CVE-2026-103505	6.9	—	AWS	aws-efs-csi-driver	CWE-88	AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
CVE-2026-103532	6.9	—	immich-app	Immich	CWE-266	immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess imprope…
CVE-2026-78249	6.8	—	Fujifilm Business Innovation Corp.	Apeos 3060 / 2560 / 1860 Japan model	CWE-22	A path traversal vulnerability exists in the web management interface of mult…
CVE-2026-12545	6.7	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-78	Rubygem-hammer_cli: command injection via insecure editor invocation
CVE-2026-103494	6.6	—	JetBrains	YouTrack	CWE-266	In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible v…
CVE-2026-55251	6.5	—	netbox-community	devicetype-library	CWE-94	NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Mal…
CVE-2026-56097	6.5	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-89	Rubygem-katello: sql injection in registry proxy via labels
CVE-2026-67075	6.5	—	HCLSoftware	Digital Experience	CWE-79	HCL Digital Experience is affected by improper input sanitation
CVE-2026-79900	6.5	—	Fortra	BoKS Manager boks-server	CWE-787	Heap overflow in KSL checksum initialization
CVE-2026-90974	6.5	—	Unknown	WP Fusion Lite	CWE-862	WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings U…
CVE-2026-91109	6.5	—	croixhaug	Simply Schedule Appointments	CWE-639	Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference …
CVE-2026-97251	6.5	—	magepeopleteam	Bus Ticket Booking with Seat Reservation	CWE-639	WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure…
CVE-2026-97258	6.5	—	Aruba.it	Aruba Migration Tool	CWE-862	WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulner…
CVE-2026-97269	6.5	—	WPFunnels	WPFunnels	CWE-639	WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDO…
CVE-2026-97280	6.5	—	Mamunur Rashid	Review Schema	CWE-862	WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability
CVE-2026-102394	6.5	—	WPDeveloper	Essential Addons for Elementor	CWE-79	WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripti…
CVE-2026-103063	6.5	—	Wpmet	ElementsKit Elementor addons Lite	CWE-79	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scri…
CVE-2026-103064	6.5	—	Wpmet	ElementsKit Elementor addons Lite	CWE-79	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scri…
CVE-2026-103339	6.5	—	Wpmet	Metform	CWE-79	WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-103343	6.5	—	WP ManageNinja LLC	FluentForm	CWE-79	WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability
CVE-2026-103491	6.5	—	JetBrains	YouTrack	CWE-639	In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API al…
CVE-2026-103492	6.5	—	JetBrains	YouTrack	CWE-835	In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted…
CVE-2026-103679	6.5	—	—	tnef	CWE-416	Tnef: use-after-free and double-free in get_body_files() via multi-value body…
CVE-2026-103884	6.5	—	Red Hat	Red Hat Build of Keycloak	CWE-22	Keycloak-services: keycloak-services: path traversal in x.509 crl distributio…
CVE-2026-86610	6.4	—	Unknown	Download Manager	CWE-79	Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
CVE-2026-89424	6.4	—	inisev	Duplicate Post	CWE-79	Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scrip…
CVE-2026-90992	6.4	—	davidanderson	Redux Framework	CWE-79	Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scr…
CVE-2026-94212	6.4	—	Apache Software Foundation	Apache APISIX	CWE-347	Apache APISIX: unauthenticated impersonation issue in saml-auth
CVE-2026-96256	6.4	—	wpdevteam	Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns	CWE-79	Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cro…
CVE-2026-96268	6.4	—	awesomesupport	Awesome Support – WordPress HelpDesk & Support Plugin	CWE-79	Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scri…
CVE-2026-101925	6.4	—	robin-w	bbp style pack	CWE-79	bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scrip…
CVE-2026-64892	6.3	—	Johnson Controls	Easy IO Neo	CWE-200	- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO…
CVE-2026-94269	6.3	—	Apache Software Foundation	Apache APISIX	CWE-647	Apache APISIX: Servlet-style normalization creates a route/upstream authoriza…
CVE-2026-97281	6.3	—	weDevs	WP Project Manager	CWE-862	WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerab…
CVE-2026-102505	6.3	—	—	Imager	CWE-131	Imager versions before 1.037 for Perl overflow a heap buffer fetching float s…
CVE-2026-103004	6.3	—	vercel	next.js	CWE-524	next.js cache leak on warm `use cache` handlers accessing root param
CVE-2026-103260	6.3	—	n8n-io	n8n	CWE-862	n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait …
CVE-2026-104058	6.3	—	akhilrex	podgrab	CWE-306	Podgrab Missing Authentication on WebSocket /ws Endpoint
CVE-2026-104182	6.2	—	uhop	stream-json	CWE-407	stream-json: JSONC parser and verifier re-scan the whole accumulated comment …
CVE-2026-19902	6.1	—	spacetime	Ad Inserter – Ad Manager & AdSense Ads	CWE-79	Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dyn…
CVE-2026-83589	6.1	—	Red Hat	Red Hat OpenShift Container Platform 4	CWE-601	Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
CVE-2026-89047	6.1	—	inisev	Social Media Share Buttons & Social Sharing Icons	CWE-79	Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Ba…
CVE-2026-89427	6.1	—	spacetime	Ad Inserter – Ad Manager & AdSense Ads	CWE-79	Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
CVE-2026-100179	6.1	—	codepeople	Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More	CWE-79	Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting …
CVE-2026-104002	6.0	—	AWS	powertools-lambda-python	CWE-390	Fail-open error handling in the data masking utility in Powertools for AWS La…
CVE-2026-34189	5.9	—	Pandora FMS	Pandora FMS	CWE-352	CSRF in Event Response Deletion
CVE-2026-34190	5.9	—	Pandora FMS	Pandora FMS	CWE-352	CSRF in Alert Command Deletion
CVE-2026-76147	5.9	—	Genians, Inc	Genian NAC 4.0.175 Release	CWE-22	Genians, Inc Genian NAC/ZTNA Remote Code Execution
CVE-2026-103754	5.9	—	Red Hat	Red Hat Ansible Automation Platform 2	CWE-22	Ansible-runner: ansible-runner: path traversal and symlink escape in unstream…
CVE-2026-71454	5.8	—	CWE-79 - Cross-site Scripting	CAPEC-63	CWE-79	Improper neutralization of input during web page generation ('cross-site scri…
CVE-2026-103247	5.8	—	n8n-io	n8n	CWE-639	n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
CVE-2026-78242	5.7	—	Apache Software Foundation	Apache APISIX	CWE-532	Apache APISIX: data-mask may fail to redact request headers in logger output
CVE-2026-27872	5.6	—	Johnson Controls	Easy IO FG	CWE-269	EasyIO FG
CVE-2026-27873	5.6	—	Johnson Controls	EasyIO FG	CWE-798	- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG a…
CVE-2026-71448	5.6	—	Johnson Controls	EasyIO FS32	CWE-1188	: Insecure Default Initialization of Resource vulnerability in Johnson Contro…
CVE-2026-71451	5.6	—	Johnson Controls	EasyIO FS32	CWE-78	- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows -…
CVE-2026-71453	5.6	—	Johnson Controls	EasyIO FS32	CWE-73	- External Control of File Name or Path vulnerability in Johnson Controls Eas…
CVE-2026-103497	5.5	—	JetBrains	YouTrack	CWE-918	In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VC…
CVE-2026-103536	5.5	—	ZongXR	Supermarket	CWE-287	ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrde…
CVE-2026-103538	5.5	—	ZongXR	SuperMarket	CWE-287	ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderControll…
CVE-2026-103641	5.5	—	Red Hat	Red Hat Enterprise Linux 10	CWE-125	Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanl…
CVE-2026-103687	5.5	—	rhukster	dom-sanitizer	CWE-183	rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete black…
CVE-2026-12241	5.4	—	mihail-barinov	Advanced Woo Labels – Product Labels & Badges for WooCommerce	CWE-79	Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Impro…
CVE-2026-62063	5.4	—	Magepeople inc.	WpTravelly	CWE-862	WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability
CVE-2026-90972	5.4	—	Unknown	WP Fusion Lite	CWE-284	WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CR…
CVE-2026-102370	5.4	—	TP-Link Systems Inc.	Kasa EC70 V4	CWE-1191	Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa…
CVE-2026-103496	5.4	—	JetBrains	YouTrack	CWE-639	In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed readi…
CVE-2026-103678	5.4	—	—	tnef	CWE-125	Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf…
CVE-2026-104181	5.4	—	filamentphp	filament	CWE-306	Filament: Multi-factor authentication (app) management actions do not require…
CVE-2026-12542	5.3	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-78	Foreman: command injection in foreman-tail
CVE-2026-55394	5.3	—	Teledyne FLIR	Aware2	CWE-319	Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2
CVE-2026-58415	5.3	—	Apache Software Foundation	Apache HTTP Server	CWE-552	Apache HTTP Server: mod_dav_fs property database read access
CVE-2026-62058	5.3	—	WPExperts	CF7 Apps	CWE-201	WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability
CVE-2026-62061	5.3	—	Metagauss	ProfileGrid	CWE-639	WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (…
CVE-2026-67104	5.3	—	HCL Software	HCL BigFix Service Management	CWE-200	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-67106	5.3	—	HCL Software	HCL BigFix Service Management	CWE-200	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-67171	5.3	—	HCL Software	HCL BigFix Service Management	CWE-200	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-78577	5.3	—	TP-Link Systems Inc.	Tapo C200 v5	CWE-306	Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 &…
CVE-2026-79768	5.3	—	Apache Software Foundation	Apache HTTP Server	CWE-55	Apache HTTP Server: mod_userdir information disclosure
CVE-2026-82806	5.3	—	Apache Software Foundation	Apache APISIX	CWE-488	Apache APISIX: cross-request permission pollution via static permission list …
CVE-2026-92537	5.3	—	satollo	Newsletter – Send awesome emails from WordPress	CWE-522	Newsletter <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials vi…
CVE-2026-92548	5.3	—	hcabrera	WP Popular Posts	CWE-200	WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_t…
CVE-2026-96173	5.3	—	Unknown	Payments for Hubtel	CWE-639	Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR
CVE-2026-96200	5.3	—	Unknown	Payments for Hubtel	CWE-862	Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery vi…
CVE-2026-102381	5.3	—	Ahmad	Majestic Support	CWE-862	WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability
CVE-2026-102390	5.3	—	VillaTheme	AFFI – Affiliate Marketing for WooCommerce	CWE-862	WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken…
CVE-2026-102670	5.3	—	Joyland	Joyland.ai	CWE-319	Joyland AI enables HTTP
CVE-2026-103265	5.3	—	fleetdm	fleet	CWE-863	Fleet before 4.89.0 Information Disclosure via MDM Command Results
CVE-2026-103267	5.3	—	TryGhost	Ghost	CWE-807	Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
CVE-2026-103273	5.3	—	TryGhost	Ghost	CWE-863	Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token
CVE-2026-103275	5.3	—	TryGhost	Ghost	CWE-203	Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
CVE-2026-103281	5.3	—	TryGhost	Ghost	CWE-201	Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
CVE-2026-103282	5.3	—	TryGhost	Ghost	CWE-362	Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
CVE-2026-103284	5.3	—	TryGhost	Ghost	CWE-863	Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
CVE-2026-103285	5.3	—	TryGhost	Ghost	CWE-352	Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
CVE-2026-103291	5.3	—	TryGhost	Ghost	CWE-918	Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
CVE-2026-103336	5.3	—	Smackcoders Inc.	WP Ultimate CSV Importer	CWE-201	WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vu…
CVE-2026-103340	5.3	—	Gemini Labs	Site Reviews	CWE-862	WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability
CVE-2026-103341	5.3	—	Unlimited Elements	Unlimited Elements For Elementor (Free Widgets, Addons, Templates)	CWE-862	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) …
CVE-2026-103345	5.3	—	Shamim Rajani	Pie Register	CWE-201	WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerabi…
CVE-2026-103347	5.3	—	hcaptcha	hCaptcha for WP	CWE-290	WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability
CVE-2026-103353	5.3	—	WP ManageNinja LLC	FluentForm	CWE-696	WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability
CVE-2026-103858	5.3	—	MISP	MISP	CWE-285	MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access…
CVE-2026-55252	5.1	—	openrundev	openrun	CWE-601	OpenRun: Redirect URL validation bypass using //host paths leads to Open Redi…
CVE-2026-94276	5.1	—	Apache Software Foundation	Apache APISIX	CWE-287	Apache APISIX: Openid-connect introspection validation issue
CVE-2026-101890	5.1	—	Codexonics	Prime Mover	CWE-79	Prime Mover < 2.2.1 Stored XSS via Package Metadata
CVE-2026-103287	5.1	—	TryGhost	Ghost	CWE-918	Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
CVE-2026-103290	5.1	—	TryGhost	Ghost	CWE-35	Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
CVE-2026-103531	5.1	—	n/a	OpenSC	CWE-119	OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
CVE-2026-103662	5.1	—	MISP	MISP	CWE-79	MISP Reflected XSS in Taxonomy Tag Confirmation Forms
CVE-2026-104183	5.1	—	uhop	stream-json	CWE-1321	stream-json: Prototype pollution: Assembler writes this.current[this.key] on …
CVE-2026-27874	5.0	—	Johnson Controls	EasyIO FS32	CWE-798	: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32…
CVE-2026-7173	4.8	—	Crocantickets	Entradium	CWE-79	Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7174	4.8	—	Crocantickets	Entradium	CWE-79	Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175	4.8	—	Crocantickets	Entradium	CWE-79	Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176	4.8	—	Crocantickets	Entradium	CWE-79	Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-9864	4.8	—	Fortra	Core Privileged Access Manager (BoKS)	CWE-338	Fortra BoKS Server Agent adjoin machine-account password generation vulnerabi…
CVE-2026-93832	4.8	—	Motorola	Setup App	CWE-862	A component of one of the Motorola system applications was exported without p…
CVE-2026-103664	4.8	—	MISP	MISP	CWE-79	MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
CVE-2026-87970	4.7	—	Unknown	If-So Dynamic Content	CWE-79	If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
CVE-2026-100184	4.7	—	codepeople	Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More	CWE-79	Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting …
CVE-2026-17053	4.4	—	zephyrproject	zephyr	CWE-862	SMBus callback-removal syscalls accept an unvalidated user pointer, letting u…
CVE-2025-31980	4.3	—	HCL Software	HCL BigFix Service Management	CWE-20	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-42528	4.3	—	Apache Software Foundation	Apache HTTP Server	CWE-789	Apache HTTP Server: mod_dav shared lock overflow
CVE-2026-56098	4.3	—	Red Hat	Red Hat Satellite 6.16 for RHEL 8	CWE-203	Rubygem-katello: improper authorization logic allows resource enumeration
CVE-2026-66247	4.3	—	HCL Software	iControl	CWE-942	iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) poli…
CVE-2026-88999	4.3	—	davidanderson	Redux Framework	CWE-862	Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscribe…
CVE-2026-102382	4.3	—	Ahmad	Majestic Support	CWE-639	WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object Reference…
CVE-2026-103495	4.3	—	JetBrains	YouTrack	CWE-862	In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloa…
CVE-2026-77387	4.0	—	geopy	geopy	CWE-1333	geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
CVE-2026-21833	3.7	—	HCL Software	AION	CWE-1032	HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnera…
CVE-2026-42356	3.7	—	Apache Software Foundation	Apache HTTP Server	CWE-430	Apache HTTP Server: limited RCE for some internal redirects to non-CGI files …
CVE-2026-67172	3.7	—	HCL Software	HCL BigFix Service Management	CWE-200	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-66248	3.1	—	HCL Software	iControl	CWE-209	HCL iControl is affected by an Improper Error Handling vulnerability
CVE-2026-66249	3.1	—	HCL Software	iControl	CWE-614	HCL iControl is affected by a Missing Secure Attribute vulnerability
CVE-2026-66253	3.1	—	HCL Software	iControl	CWE-613	HCL iControl is affected by a Session Timeout vulnerability
CVE-2026-87973	3.1	—	Unknown	If-So Dynamic Content	CWE-79	If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
CVE-2026-103680	3.1	—	—	tnef	CWE-787	Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix g…
CVE-2026-56599	2.2	—	HCL Software	HCL BigFix Service Management	CWE-614	HCL BigFix Service Management is affected by multiple security vulnerabilities.
CVE-2026-94220	2.1	—	Apache Software Foundation	Apache APISIX	CWE-352	Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
CVE-2026-101887	2.1	—	arkq	bluez-alsa	CWE-369	BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
CVE-2026-103534	2.1	—	David-Crty	databasement	CWE-266	David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access c…
CVE-2026-103539	2.1	—	ZongXR	SuperMarket	CWE-287	ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing aut…
CVE-2026-103540	2.1	—	formtools.org	Form Tools	CWE-791	formtools.org Form Tools Client Settings Clients.class.php updateClientSettin…
CVE-2026-103541	2.1	—	formtools.org	Form Tools	CWE-284	formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
CVE-2026-103542	2.1	—	formtools.org	Form Tools	CWE-918	formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side req…
CVE-2026-103543	2.1	—	itsourcecode	Leave Management System	CWE-74	itsourcecode Leave Management System controller.php sql injection
CVE-2026-103544	2.1	—	datadrivenconstruction	OpenConstructionERP	CWE-488	datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_clien…
CVE-2026-103690	2.1	—	itsourcecode	Leave Management System	CWE-74	itsourcecode Leave Management System controller.php sql injection
CVE-2026-103923	2.1	—	KaTeX	KaTeX	CWE-807	KaTeX: Existing prototype pollution can bypass trust restrictions
CVE-2026-103489	2.0	—	JetBrains	YouTrack	CWE-79	In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failu…
CVE-2026-103686	2.0	—	rhukster	dom-sanitizer	CWE-79	rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross s…
CVE-2026-76144	1.8	—	Genians, Inc	Genian SSL PNS (frodo-core)	CWE-434	Genians, Inc Genian SSL PNS Unrestricted File Upload
CVE-2026-103533	1.2	—	David-Crty	databasement	CWE-22	David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 …
CVE-2026-51873	await	—	n/a	n/a	—	Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_pr…
CVE-2026-51874	await	—	n/a	n/a	—	In Devika v1.0, the Patcher Agent save_code_to_project function contains a pa…
CVE-2026-51875	await	—	n/a	n/a	—	In Devika v1.0, the Feature Agent save_code_to_project function contains a pa…
CVE-2026-51876	await	—	n/a	n/a	—	DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book co…
CVE-2026-51878	await	—	n/a	n/a	—	deeptutor 1.4.0 contains an authorization bypass through a user-controlled ob…
CVE-2026-51879	await	—	n/a	n/a	—	deeptutor 1.4.0 contains an authorization bypass through a user-controlled ob…
CVE-2026-51880	await	—	n/a	n/a	—	deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Thro…
CVE-2026-51881	await	—	n/a	n/a	—	deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live…
CVE-2026-51882	await	—	n/a	n/a	—	The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat …
CVE-2026-51883	await	—	n/a	n/a	—	The knowledge base creation and document upload interfaces in Langchain-Chatc…
CVE-2026-51884	await	—	n/a	n/a	—	The /knowledge_base/upload_temp_docs temporary document upload endpoint in La…
CVE-2026-51886	await	—	n/a	n/a	—	langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: ex…
CVE-2026-51888	await	—	n/a	n/a	—	langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact i…
CVE-2026-51892	await	—	n/a	n/a	—	infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/d…
CVE-2026-51893	await	—	n/a	n/a	—	infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace…
CVE-2026-51894	await	—	n/a	n/a	—	infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_m…
CVE-2026-51895	await	—	n/a	n/a	—	Ragflow 0.24.0 and prior contains improper access control in update_metadata_…
CVE-2026-51896	await	—	n/a	n/a	—	infiniflow ragflow 0.25.3 contains improper access control in resume (api/app…
CVE-2026-51897	await	—	n/a	n/a	—	RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/eval…
CVE-2026-104056	await	—	Authlib	Authlib	—	CVE-2026-104056

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-10-01 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.