{
  "day": "2026-10-09",
  "boundary": "UTC calendar day",
  "published_count": 316,
  "by_severity": {
    "CRITICAL": 36,
    "HIGH": 132,
    "MEDIUM": 104,
    "LOW": 17
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 27,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-107908",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00595,
      "epss_percentile": 0.46851,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-787",
      "title": "Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107908"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-7827",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00584,
      "epss_percentile": 0.46298,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-121",
      "title": "Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7827"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-5759",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00554,
      "epss_percentile": 0.44555,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-415",
      "title": "Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5759"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-107910",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00477,
      "epss_percentile": 0.39264,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-287",
      "title": "Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107910"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-107909",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00436,
      "epss_percentile": 0.35953,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-787",
      "title": "Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107909"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-7826",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00433,
      "epss_percentile": 0.3566,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-125",
      "title": "Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7826"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-104635",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00387,
      "epss_percentile": 0.30729,
      "kev": false,
      "kev_due_at": null,
      "vendor": "elixir-protobuf",
      "product": "protobuf",
      "cwe": "CWE-674",
      "title": "Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104635"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-107911",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00354,
      "epss_percentile": 0.27031,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FalkorDB",
      "product": "FalkorDB",
      "cwe": "CWE-843",
      "title": "Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107911"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-78019",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00329,
      "epss_percentile": 0.24051,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-829",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesystem access for attacker, and Remote execution.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78019"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-4264",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0032,
      "epss_percentile": 0.22996,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BeeTienda",
      "product": "eCommerce Platform",
      "cwe": "CWE-79",
      "title": "Reflected Cross-Site Scripting in BeeTienda eCommerce platform",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4264"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-19570",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00292,
      "epss_percentile": 0.19944,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-120",
      "title": "Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19570"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-97076",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0029,
      "epss_percentile": 0.19806,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP Media",
      "product": "WP Rocket",
      "cwe": "CWE-624",
      "title": "WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97076"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-101028",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.17483,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ash-project",
      "product": "ash",
      "cwe": "CWE-863",
      "title": "Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101028"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-107889",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00268,
      "epss_percentile": 0.17441,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Build of Keycloak",
      "cwe": "CWE-79",
      "title": "Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107889"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-76779",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00261,
      "epss_percentile": 0.16402,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-307",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76779"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-87110",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00253,
      "epss_percentile": 0.15484,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MongoDB",
      "product": "Ops Manager",
      "cwe": "CWE-770",
      "title": "Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87110"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-81929",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14048,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OceanWP",
      "product": "Ocean Pro Demos",
      "cwe": "CWE-79",
      "title": "Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81929"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2025-14123",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00237,
      "epss_percentile": 0.13484,
      "kev": false,
      "kev_due_at": null,
      "vendor": "davidanderson",
      "product": "Redux Framework",
      "cwe": "CWE-269",
      "title": "Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14123"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-87109",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00221,
      "epss_percentile": 0.11655,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MongoDB",
      "product": "Ops Manager",
      "cwe": "CWE-201",
      "title": "Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87109"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-78017",
      "cvss_base": 3.8,
      "cvss_severity": "LOW",
      "epss_score": 0.00217,
      "epss_percentile": 0.11103,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-754",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection mechanism bypass.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78017"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-78022",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00203,
      "epss_percentile": 0.09368,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-636",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78022"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-106155",
      "cvss_base": 8.9,
      "cvss_severity": "HIGH",
      "epss_score": 0.00199,
      "epss_percentile": 0.089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software",
      "product": "Telerik Report Server",
      "cwe": "CWE-79",
      "title": "Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106155"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2025-15700",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00194,
      "epss_percentile": 0.08333,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "AWP Classifieds",
      "cwe": "CWE-434",
      "title": "AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15700"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-78020",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00179,
      "epss_percentile": 0.06833,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-295",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78020"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-84224",
      "cvss_base": 4.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00179,
      "epss_percentile": 0.06843,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Kirki",
      "cwe": "CWE-918",
      "title": "Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84224"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-78021",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00178,
      "epss_percentile": 0.0674,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-209",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78021"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-98380",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00177,
      "epss_percentile": 0.06665,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "net/sched: reject IDR error pointers when deleting actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98380"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-98379",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00164,
      "epss_percentile": 0.05159,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "netfilter: ip6t_rpfilter: reject routes without inet6_dev",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98379"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-98383",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00164,
      "epss_percentile": 0.05159,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98383"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-76769",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.04791,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-862",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76769"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-98378",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00161,
      "epss_percentile": 0.04683,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Skip unsettled links in link iterator",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98378"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-98381",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00161,
      "epss_percentile": 0.04683,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "veth: manage XDP program pointers during channel resize",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98381"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-97075",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00159,
      "epss_percentile": 0.04502,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP Media",
      "product": "WP Rocket",
      "cwe": "CWE-862",
      "title": "WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97075"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-106097",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.042,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Code Snippets",
      "cwe": "CWE-89",
      "title": "Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106097"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-98377",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.0421,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "vlan: require the MAC header to be present in __vlan_insert_inner_tag()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98377"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-98382",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.04209,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Reject dev-bound-only programs on other devices",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98382"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-98384",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.04209,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98384"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-78016",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00155,
      "epss_percentile": 0.04076,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-1287",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information tampering.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78016"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-98376",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00148,
      "epss_percentile": 0.03497,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "bpf: Use array_map_meta_equal for percpu array inner map replacement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98376"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-84220",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00146,
      "epss_percentile": 0.03326,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Kirki",
      "cwe": "CWE-74",
      "title": "Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84220"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-98375",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00146,
      "epss_percentile": 0.03397,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "xen/netfront: drop RX packets with a short Ethernet header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98375"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-106145",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00145,
      "epss_percentile": 0.03299,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software",
      "product": "Telerik Report Server",
      "cwe": "CWE-266",
      "title": "Privilege Escalation in Telerik Report Server Service-Agent Hub",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106145"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-92990",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00145,
      "epss_percentile": 0.03313,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "SendPress Newsletters",
      "cwe": "CWE-200",
      "title": "SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92990"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-88931",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00144,
      "epss_percentile": 0.03182,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Social Web Suite",
      "cwe": "CWE-862",
      "title": "Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88931"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-87108",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00141,
      "epss_percentile": 0.02976,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MongoDB",
      "product": "Ops Manager",
      "cwe": "CWE-639",
      "title": "Ops Manager Improper Authorization in Daily Host Monitoring Retrieval",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87108"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-86850",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00136,
      "epss_percentile": 0.02647,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "SKU Error Fixer for WooCommerce",
      "cwe": "CWE-862",
      "title": "SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86850"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-87841",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00136,
      "epss_percentile": 0.02647,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "UnitechPay",
      "cwe": "CWE-862",
      "title": "UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87841"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-93548",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00132,
      "epss_percentile": 0.02407,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "FooSales",
      "cwe": "CWE-269",
      "title": "FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93548"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-92989",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02407,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "SendPress Newsletters",
      "cwe": "CWE-284",
      "title": "SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92989"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-106095",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00132,
      "epss_percentile": 0.02407,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Code Snippets",
      "cwe": "CWE-862",
      "title": "Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106095"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-107655",
      "cvss_base": 4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00128,
      "epss_percentile": 0.02133,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-476",
      "title": "Cups: null pointer dereference via embedded job ticket comments allows remote denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107655"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-19569",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.01685,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-190",
      "title": "Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19569"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-19575",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.01685,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-843",
      "title": "Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19575"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-107914",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.01671,
      "kev": false,
      "kev_due_at": null,
      "vendor": "backdropcms",
      "product": "Backdrop",
      "cwe": "CWE-459",
      "title": "Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the \"Synchronize, import, and export configuration\" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107914"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-107886",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00103,
      "epss_percentile": 0.00944,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenPrinting",
      "product": "CUPS",
      "cwe": "CWE-415",
      "title": "OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107886"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-78015",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.001,
      "epss_percentile": 0.00788,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-348",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78015"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-19574",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00097,
      "epss_percentile": 0.00683,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-284",
      "title": "ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19574"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-78013",
      "cvss_base": 5.2,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00097,
      "epss_percentile": 0.0068,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-1188",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Protection mechanism bypass.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78013"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-107885",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00097,
      "epss_percentile": 0.00682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenPrinting",
      "product": "CUPS",
      "cwe": "CWE-770",
      "title": "OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107885"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-107890",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00097,
      "epss_percentile": 0.00682,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenPrinting",
      "product": "CUPS",
      "cwe": "CWE-476",
      "title": "OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107890"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-107888",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00096,
      "epss_percentile": 0.00674,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenPrinting",
      "product": "CUPS",
      "cwe": "CWE-476",
      "title": "OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107888"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-19571",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00091,
      "epss_percentile": 0.00457,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-362",
      "title": "Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19571"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-78018",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0009,
      "epss_percentile": 0.0041,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-1188",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78018"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-94503",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PX-lab",
      "product": "Zombify",
      "cwe": "CWE-434",
      "title": "WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94503"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-108263",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "astron-agent",
      "cwe": "CWE-95",
      "title": "Astron Agent: Unsandboxed code-node leads to cross-tenant RCE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108263"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-85531",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipay Electronic Money and Payment Services Inc.",
      "product": "OpenCart Virtual POS Module",
      "cwe": "CWE-347",
      "title": "Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85531"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-86405",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sipay Electronic Money and Payment Services Inc.",
      "product": "PrestaShop Virtual POS Module",
      "cwe": "CWE-347",
      "title": "Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86405"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-108474",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "JetBrains",
      "product": "Exposed",
      "cwe": "CWE-89",
      "title": "In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108474"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-107806",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-94",
      "title": "Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107806"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-15340",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Savannah",
      "product": "lwIP SMTP client",
      "cwe": "CWE-120",
      "title": "Savannah lwIP SMTP client Classic Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15340"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-28745",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-257",
      "title": "Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28745"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-33367",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-306",
      "title": "Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33367"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-39460",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-522",
      "title": "Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39460"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-93947",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shinetheme",
      "product": "Traveler",
      "cwe": "CWE-89",
      "title": "WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93947"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-96327",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VibeThemes",
      "product": "WPLMS",
      "cwe": "CWE-89",
      "title": "WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96327"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-96328",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jegtheme",
      "product": "JNews - Pay Writer",
      "cwe": "CWE-89",
      "title": "WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96328"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-96330",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tagDiv",
      "product": "tagDiv Opt-In Builder",
      "cwe": "CWE-89",
      "title": "WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96330"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-96331",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdreams",
      "product": "Ajax Search Pro",
      "cwe": "CWE-89",
      "title": "WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96331"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-96809",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MultiNet Interactive AB",
      "product": "EduAdmin Booking",
      "cwe": "CWE-89",
      "title": "WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96809"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-100730",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grid Protection Alliance",
      "product": "openPDC",
      "cwe": "CWE-502",
      "title": "Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100730"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-105278",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grid Protection Alliance",
      "product": "openPDC (Docker image)",
      "cwe": "CWE-798",
      "title": "Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105278"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-107824",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "duty1g",
      "product": "x64dbg-mcp-server",
      "cwe": "CWE-306",
      "title": "x64dbg-MCP Server exposes debugger operations to unauthenticated network clients",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107824"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-107845",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-79",
      "title": "Contao: Cross-site scripting in the comments bundle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107845"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-107935",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Build of Podman Desktop",
      "cwe": "CWE-22",
      "title": "Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107935"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-108107",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hotspotbilling",
      "product": "phpnuxbill",
      "cwe": "CWE-89",
      "title": "PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108107"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-108109",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hotspotbilling",
      "product": "phpnuxbill",
      "cwe": "CWE-307",
      "title": "PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108109"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-108261",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tinacms",
      "product": "tinacms",
      "cwe": "CWE-346",
      "title": "TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108261"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-32645",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-798",
      "title": "Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32645"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-108157",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "smp46",
      "product": "pingvin-share-x",
      "cwe": "CWE-287",
      "title": "Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108157"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-108264",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wizarrrr",
      "product": "wizarr",
      "cwe": "CWE-1336",
      "title": "Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108264"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-108265",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "enclave-os-mini",
      "cwe": "CWE-346",
      "title": "enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108265"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-108266",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "rustls",
      "cwe": "CWE-346",
      "title": "Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108266"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-108267",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "go",
      "cwe": "CWE-346",
      "title": "Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108267"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-108268",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "enclave-os-virtual",
      "cwe": "CWE-346",
      "title": "enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108268"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-108269",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "ra-tls-clients",
      "cwe": "CWE-346",
      "title": "ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108269"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-55797",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "argoproj",
      "product": "argo-cd",
      "cwe": "CWE-78",
      "title": "Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55797"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-94064",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BuddhaThemes",
      "product": "Neo | Barber Shop WordPress Theme",
      "cwe": "CWE-502",
      "title": "WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94064"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-94065",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BuddhaThemes",
      "product": "ColorFolio",
      "cwe": "CWE-502",
      "title": "WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94065"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-96671",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fifu.app",
      "product": "Featured Image from URL",
      "cwe": "CWE-352",
      "title": "WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96671"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-103412",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Camel Karavan",
      "cwe": "CWE-22",
      "title": "Apache Camel Karavan: project file name path traversal when committing a project to Git",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103412"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-103413",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Camel Karavan",
      "cwe": "CWE-20",
      "title": "Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103413"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-104392",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ExpressTech",
      "product": "Quiz And Survey Master",
      "cwe": "CWE-502",
      "title": "WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104392"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-107807",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-312",
      "title": "Nginx UI: Node Secret Credential Exposure via URL Query Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107807"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-107809",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-352",
      "title": "Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107809"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-107811",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-200",
      "title": "0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107811"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-107813",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-862",
      "title": "Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107813"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-104084",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Smartertools",
      "product": "Smartermail",
      "cwe": "CWE-613",
      "title": "SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104084"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-105281",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grid Protection Alliance",
      "product": "openPDC",
      "cwe": "CWE-306",
      "title": "Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105281"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-108106",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "xerial",
      "product": "snappy-java",
      "cwe": "CWE-789",
      "title": "Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108106"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-108113",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ILIAS-eLearning e.V.",
      "product": "ILIAS",
      "cwe": "CWE-434",
      "title": "ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108113"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-104082",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Smartertools",
      "product": "Smartermail",
      "cwe": "CWE-94",
      "title": "SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104082"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-8374",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SwitchBot",
      "product": "Lock Series Lock",
      "cwe": "CWE-1204",
      "title": "Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8374"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-39453",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-617",
      "title": "Red Lion Controls N-Tron 700 Series Reachable Assertion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39453"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-94663",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Metagauss",
      "product": "ProfileGrid",
      "cwe": "CWE-89",
      "title": "WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94663"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-95599",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Taskbuilder",
      "product": "Taskbuilder",
      "cwe": "CWE-89",
      "title": "WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95599"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-95607",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VibeThemes",
      "product": "WPLMS",
      "cwe": "CWE-89",
      "title": "WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95607"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-95610",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "UpSolution",
      "product": "UpSolution Core",
      "cwe": "CWE-89",
      "title": "WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95610"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-95702",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Google",
      "product": "gVisor",
      "cwe": "CWE-415",
      "title": "Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95702"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-96329",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tagDiv",
      "product": "tagDiv Opt-In Builder",
      "cwe": "CWE-89",
      "title": "WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96329"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-107815",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-787",
      "title": "MariaDB: one byte OOB write in DOS tables of the CONNECT engine",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107815"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-29797",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-494",
      "title": "Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29797"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-107814",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-732",
      "title": "MariaDB: Insecure $HOME in MariaDB rpm packages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107814"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-107818",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-15",
      "title": "MariaDB: environment injection via wsrep bootstrap in the mariadb.service file",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107818"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-22061",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NetApp",
      "product": "Trident",
      "cwe": "CWE-215",
      "title": "CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22061"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-71884",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Legion of the Bouncy Castle Inc.",
      "product": "BC-LTS-JAVA",
      "cwe": "CWE-323",
      "title": "Packet CTR reports a full success length after the counter is exhausted",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71884"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-90983",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Hayat Health Facilities Inc. (Hayat Hospital)",
      "product": "Hayat Mobile",
      "cwe": "CWE-603",
      "title": "OTP Code Exposure in Hayat Hospital's Hayat Mobile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90983"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-102554",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Google",
      "product": "Guava",
      "cwe": "CWE-502",
      "title": "Denial of Service via Eager Array Allocation During Deserialization in Guava",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102554"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-107837",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RIOT-OS",
      "product": "RIOT",
      "cwe": "CWE-125",
      "title": "RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107837"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-108105",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open5gs",
      "product": "open5gs",
      "cwe": "CWE-617",
      "title": "Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108105"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-108259",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tinacms",
      "product": "tinacms",
      "cwe": "CWE-94",
      "title": "Tina: Code injection via unescaped Git branch name in generated client source",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108259"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-57458",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-269",
      "title": "Vikunja: Scoped API token can mint unrestricted OAuth session credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57458"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-62376",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-312",
      "title": "Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62376"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-94062",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Fuelthemes",
      "product": "Werkstatt",
      "cwe": "CWE-98",
      "title": "WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94062"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-94067",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Fuelthemes",
      "product": "The Voux",
      "cwe": "CWE-98",
      "title": "WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94067"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-107808",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-287",
      "title": "Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107808"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-107810",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-59",
      "title": "Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107810"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-107821",
      "cvss_base": 8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-1285",
      "title": "MariaDB: insufficient validation of binary frm data when opening a table",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107821"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-92705",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TypesettingTools",
      "product": "Aegisub",
      "cwe": "CWE-158",
      "title": "Aegisub executes arbitrary code through automatically loaded Automation scripts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92705"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-78024",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-918",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, Server-side request forgery, and Unauthorized access.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78024"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-104629",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grid Protection Alliance",
      "product": "openPDC",
      "cwe": "CWE-470",
      "title": "Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104629"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-108101",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danielbrendel",
      "product": "hortusfox-web",
      "cwe": "CWE-434",
      "title": "HortusFox through 6.3 Unrestricted File Upload via Plant Attachments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108101"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-108159",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "astron-rpa",
      "cwe": "CWE-79",
      "title": "AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108159"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-108160",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "astron-rpa",
      "cwe": "CWE-494",
      "title": "AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108160"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-108110",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "himovo",
      "product": "MOVO",
      "cwe": "CWE-639",
      "title": "MOVO through 0.2.3 Authorization Bypass via Document Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108110"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-108260",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tinacms",
      "product": "tinacms",
      "cwe": "CWE-79",
      "title": "@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108260"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-62367",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-287",
      "title": "Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62367"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-75345",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75345"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-75346",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-125",
      "title": "An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75346"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-75347",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75347"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-75348",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-125",
      "title": "An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75348"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-75349",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75349"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-75350",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75350"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-75351",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-125",
      "title": "OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75351"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-78025",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-306",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78025"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-78795",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-200",
      "title": "An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78795"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-94664",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "add-ons.org",
      "product": "PDF for Contact Form 7",
      "cwe": "CWE-22",
      "title": "WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94664"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-94666",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZealousWeb",
      "product": "Generate PDF using Contact Form 7",
      "cwe": "CWE-22",
      "title": "WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94666"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-96333",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Liquid Web / StellarWP",
      "product": "GiveWP",
      "cwe": "CWE-290",
      "title": "WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96333"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-96336",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPMU DEV",
      "product": "Forminator",
      "cwe": "CWE-290",
      "title": "WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96336"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-96461",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TMS",
      "product": "Amelia",
      "cwe": "CWE-862",
      "title": "WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96461"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-107805",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-400",
      "title": "Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107805"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-107812",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-494",
      "title": "Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107812"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-107826",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-674",
      "title": "OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107826"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-107838",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RIOT-OS",
      "product": "RIOT",
      "cwe": "CWE-252",
      "title": "RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107838"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-107839",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "luskaner",
      "product": "ageLANServer",
      "cwe": "CWE-400",
      "title": "ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107839"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-107840",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jhaals",
      "product": "yopass",
      "cwe": "CWE-400",
      "title": "yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107840"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-106581",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Docker",
      "product": "Docker Desktop",
      "cwe": "CWE-347",
      "title": "Docker Desktop for Windows installer failed to verify external packages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106581"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-94568",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP Hosting AS",
      "product": "Pay with Vipps for WooCommerce",
      "cwe": "CWE-502",
      "title": "WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94568"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-104081",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kalcaddle",
      "product": "KodExplorer",
      "cwe": "CWE-22",
      "title": "KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104081"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-105872",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mklacroix",
      "product": "Product Configurator for WooCommerce",
      "cwe": "CWE-502",
      "title": "WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105872"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-107823",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-116",
      "title": "MariaDB: privilege escalation via incorrect view frm parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107823"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-62026",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MIGHTYminnow",
      "product": "Dashboard Notes",
      "cwe": "CWE-352",
      "title": "WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62026"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-78023",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-639",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78023"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-94058",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bracketweb",
      "product": "Treck",
      "cwe": "CWE-79",
      "title": "WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94058"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-94059",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bracketweb",
      "product": "Ogency",
      "cwe": "CWE-79",
      "title": "WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94059"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-94060",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bracketweb",
      "product": "Voldor",
      "cwe": "CWE-79",
      "title": "WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94060"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-94061",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Designthemes",
      "product": "Whistle - Sports Club",
      "cwe": "CWE-79",
      "title": "WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94061"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-94063",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Education Center",
      "cwe": "CWE-79",
      "title": "WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94063"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-94066",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SpabRice",
      "product": "Pond",
      "cwe": "CWE-79",
      "title": "WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94066"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-94158",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bkninja",
      "product": "Gloria Admin Panel",
      "cwe": "CWE-79",
      "title": "WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94158"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-94159",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "KlbTheme",
      "product": "Total Donations",
      "cwe": "CWE-79",
      "title": "WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94159"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-94161",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeGoods",
      "product": "Grand Restaurant",
      "cwe": "CWE-79",
      "title": "WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94161"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-94166",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "UpSolution",
      "product": "UpSolution Core",
      "cwe": "CWE-79",
      "title": "WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94166"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-94167",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Extend Themes",
      "product": "Kubio AI Page Builder",
      "cwe": "CWE-79",
      "title": "WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94167"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-94170",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Heateor Support",
      "product": "Sassy Social Share",
      "cwe": "CWE-79",
      "title": "WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94170"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-94415",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Muffingroup",
      "product": "Betheme",
      "cwe": "CWE-79",
      "title": "WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94415"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-94632",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Stiofan",
      "product": "BlockStrap Page Builder - Bootstrap Blocks",
      "cwe": "CWE-79",
      "title": "WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94632"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-94641",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Stiofan",
      "product": "UsersWP",
      "cwe": "CWE-79",
      "title": "WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94641"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-94661",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crocoblock",
      "product": "JetBlog",
      "cwe": "CWE-79",
      "title": "WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94661"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-94668",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dimitri Grassi",
      "product": "Salon booking system",
      "cwe": "CWE-79",
      "title": "WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94668"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-95591",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "e4jvikwp",
      "product": "VikBooking Hotel Booking Engine & PMS",
      "cwe": "CWE-79",
      "title": "WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95591"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-95596",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Mamunur Rashid",
      "product": "ShopBuilder – Elementor WooCommerce Builder Addons",
      "cwe": "CWE-79",
      "title": "WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95596"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-95598",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codepeople",
      "product": "Search in Place",
      "cwe": "CWE-79",
      "title": "WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95598"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-95608",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PluginUs.Net",
      "product": "HUSKY",
      "cwe": "CWE-79",
      "title": "WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95608"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-95609",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "David Lingren",
      "product": "Media LIbrary Assistant",
      "cwe": "CWE-79",
      "title": "WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95609"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-96332",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "yalla ya!",
      "product": "Simple Payment",
      "cwe": "CWE-79",
      "title": "WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96332"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-96553",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Damian Góra",
      "product": "FiboSearch",
      "cwe": "CWE-79",
      "title": "WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96553"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-96607",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Basix",
      "product": "NEX-Forms",
      "cwe": "CWE-79",
      "title": "WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96607"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-96761",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Welcart",
      "product": "Welcart e-Commerce",
      "cwe": "CWE-79",
      "title": "WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96761"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-105318",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Datasolution",
      "product": "AcyMailing SMTP Newsletter",
      "cwe": "CWE-79",
      "title": "WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105318"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-105870",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Delight Star Inc.",
      "product": "WP Associate Post R2",
      "cwe": "CWE-79",
      "title": "WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105870"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-105883",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeHunk",
      "product": "Th Shop Mania",
      "cwe": "CWE-862",
      "title": "WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105883"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-107836",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RIOT-OS",
      "product": "RIOT",
      "cwe": "CWE-125",
      "title": "RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107836"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-107852",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jexactyl",
      "product": "Jexactyl",
      "cwe": "CWE-345",
      "title": "Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107852"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-108096",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AWS",
      "product": "aws-amplify/graphql-index-transformer",
      "cwe": "CWE-639",
      "title": "Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108096"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-108100",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "danielbrendel",
      "product": "hortusfox-web",
      "cwe": "CWE-89",
      "title": "HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108100"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-108108",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hotspotbilling",
      "product": "phpnuxbill",
      "cwe": "CWE-287",
      "title": "PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108108"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-108125",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "wp-post-author",
      "cwe": "CWE-89",
      "title": "WordPress Post Author Authenticated SQLi",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108125"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-108158",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mynaparrot",
      "product": "plugNmeet-server",
      "cwe": "CWE-22",
      "title": "plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108158"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-85479",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grid Protection Alliance",
      "product": "openPDC",
      "cwe": "CWE-306",
      "title": "Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85479"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-105877",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QuarkA",
      "product": "QA Analytics",
      "cwe": "CWE-201",
      "title": "WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105877"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-108102",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open5gs",
      "product": "open5gs",
      "cwe": "CWE-125",
      "title": "Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108102"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-108103",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open5gs",
      "product": "open5gs",
      "cwe": "CWE-125",
      "title": "Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108103"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-108156",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "netease-youdao",
      "product": "LobsterAI",
      "cwe": "CWE-73",
      "title": "LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108156"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-108258",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "posit-dev",
      "product": "py-shiny",
      "cwe": "CWE-22",
      "title": "Shiny for Python - Path traversal in bookmark restore",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108258"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-33272",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Lion Controls",
      "product": "700 Series",
      "cwe": "CWE-288",
      "title": "Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33272"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-89235",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Testimonials by BestWebSoft",
      "cwe": "CWE-89",
      "title": "Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89235"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-102916",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "illumos",
      "product": "illumos-gate",
      "cwe": "CWE-617",
      "title": "Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102916"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-104112",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "illumos",
      "product": "illumos-gate",
      "cwe": "CWE-772",
      "title": "Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104112"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-107783",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AWS",
      "product": "aws-tools-for-powershell",
      "cwe": "CWE-532",
      "title": "Insertion of sensitive information into log file in AWS Tools for PowerShell",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107783"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-42695",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FolioVision",
      "product": "FV Flowplayer Video Player",
      "cwe": "CWE-79",
      "title": "WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42695"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-48484",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pyload",
      "product": "pyload",
      "cwe": "CWE-20",
      "title": "pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48484"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-62029",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPFunnels Team",
      "product": "WPFunnels",
      "cwe": "CWE-79",
      "title": "WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62029"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-62039",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "Html5 Audio Player",
      "cwe": "CWE-79",
      "title": "WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62039"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-62049",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crocoblock",
      "product": "JetBlocks For Elementor",
      "cwe": "CWE-79",
      "title": "WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62049"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-78341",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-863",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78341"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-86851",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Livees Checkout",
      "cwe": "CWE-862",
      "title": "Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86851"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-94665",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Mamunur Rashid",
      "product": "Classified Listing",
      "cwe": "CWE-79",
      "title": "WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94665"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-94667",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crocoblock",
      "product": "JetReviews",
      "cwe": "CWE-79",
      "title": "WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94667"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-95589",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Magepeople inc.",
      "product": "Deposits and Partial Payments for WooCommerce",
      "cwe": "CWE-862",
      "title": "WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95589"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-95597",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codemstory",
      "product": "워드프레스 결제 심플페이",
      "cwe": "CWE-862",
      "title": "WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95597"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-96337",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "properfraction",
      "product": "ProfilePress",
      "cwe": "CWE-862",
      "title": "WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96337"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-107803",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ProcessMaker",
      "product": "processmaker",
      "cwe": "CWE-89",
      "title": "ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107803"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-107816",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-125",
      "title": "MariaDB: `qc_info` plugin can do OOB reads if query contains \\0",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107816"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-107822",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-706",
      "title": "MariaDB: database privilege escalation via user / role name collision in the acl cache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107822"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-78339",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-732",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78339"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-78340",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-22",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Filesystem access for attacker.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78340"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-107785",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sirius Computer, Inc.",
      "product": "Crux Agent",
      "cwe": "CWE-252",
      "title": "Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107785"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-108104",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "xerial",
      "product": "snappy-java",
      "cwe": "CWE-415",
      "title": "Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108104"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-108119",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 6",
      "cwe": "CWE-59",
      "title": "Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108119"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-79363",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": "CWE-79",
      "title": "Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79363"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-96518",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "properfraction",
      "product": "ProfilePress",
      "cwe": "CWE-862",
      "title": "WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96518"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-107819",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-297",
      "title": "MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107819"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-107833",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-674",
      "title": "OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107833"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-78027",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-918",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78027"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2026-107841",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "john-broadway",
      "product": "pacioli",
      "cwe": "CWE-863",
      "title": "pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107841"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-96334",
      "cvss_base": 5.6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeGrill",
      "product": "User Registration",
      "cwe": "CWE-862",
      "title": "WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96334"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-96539",
      "cvss_base": 5.6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Ultimate Member",
      "product": "Ultimate Member",
      "cwe": "CWE-266",
      "title": "WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96539"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-108063",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-476",
      "title": "Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108063"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-108093",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-476",
      "title": "Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108093"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-62028",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "Before After Image Comparison – Image comparison for WP",
      "cwe": "CWE-862",
      "title": "WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62028"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-62041",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Ashok Dudhat",
      "product": "WP Event Manager",
      "cwe": "CWE-862",
      "title": "WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62041"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-92085",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TMT Machinery Industry and Trade Co. Ltd.",
      "product": "Talassoft Industrial Management Software",
      "cwe": "CWE-79",
      "title": "Stored XSS in TMT Machine's Talassoft Industrial Management Software",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92085"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-104113",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OmniOS",
      "product": "OmniOS",
      "cwe": "CWE-415",
      "title": "Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104113"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2026-104114",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "illumos",
      "product": "illumos-gate",
      "cwe": "CWE-476",
      "title": "NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104114"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-104115",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "illumos",
      "product": "illumos-gate",
      "cwe": "CWE-121",
      "title": "Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104115"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-106601",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Automattic",
      "product": "Jetpack",
      "cwe": "CWE-288",
      "title": "WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106601"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-107419",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cool Plugins",
      "product": "AI Translation for Polylang",
      "cwe": "CWE-862",
      "title": "WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107419"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-107854",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jexactyl",
      "product": "Jexactyl",
      "cwe": "CWE-639",
      "title": "Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107854"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-62040",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DEV Institute",
      "product": "Restrict User Access – Membership Plugin with Force",
      "cwe": "CWE-862",
      "title": "WordPress Restrict User Access – Membership plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62040"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-62042",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "unFocus Projects",
      "product": "Scripts n Styles",
      "cwe": "CWE-862",
      "title": "WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62042"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-75597",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pyload",
      "product": "pyload",
      "cwe": "CWE-209",
      "title": "pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75597"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-87846",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Shipping for Nova Poshta",
      "cwe": "CWE-862",
      "title": "Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87846"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-101022",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Grid Protection Alliance",
      "product": "openPDC",
      "cwe": "CWE-918",
      "title": "Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101022"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-103329",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Super Payments",
      "cwe": "CWE-347",
      "title": "Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103329"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-104079",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Syed Balkhi",
      "product": "Envira Gallery",
      "cwe": "CWE-862",
      "title": "Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104079"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-104083",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Smartertools",
      "product": "Smartermail",
      "cwe": "CWE-79",
      "title": "SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104083"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-107804",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-346",
      "title": "Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107804"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-107820",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "duty1g",
      "product": "x64dbg-mcp-server",
      "cwe": "CWE-190",
      "title": "x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107820"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-107834",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-400",
      "title": "OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107834"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-107842",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-200",
      "title": "Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107842"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-107843",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-204",
      "title": "Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107843"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-107844",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-22",
      "title": "Contao: Path traversal in the images controller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107844"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-108111",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ageerle",
      "product": "ruoyi-ai",
      "cwe": "CWE-862",
      "title": "ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108111"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-108112",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ageerle",
      "product": "ruoyi-ai",
      "cwe": "CWE-862",
      "title": "ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108112"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2016-20098",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "toolbox-team",
      "product": "reddit-moderator-toolbox",
      "cwe": "CWE-79",
      "title": "Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-20098"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-96396",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-122",
      "title": "The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96396"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-108124",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "wp-post-author",
      "cwe": "CWE-89",
      "title": "WordPress Post Author Authenticated SQLi",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108124"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-106602",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Automattic",
      "product": "Jetpack",
      "cwe": "CWE-288",
      "title": "WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106602"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-103220",
      "cvss_base": 4.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-129",
      "title": "The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103220"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-107856",
      "cvss_base": 4.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "civiform",
      "product": "civiform",
      "cwe": "CWE-639",
      "title": "CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107856"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-107817",
      "cvss_base": 4.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MariaDB",
      "product": "server",
      "cwe": "CWE-125",
      "title": "MariaDB: mysql_json plugin OOB reads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107817"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-107857",
      "cvss_base": 4.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dongdongbh",
      "product": "Mindwtr",
      "cwe": "CWE-312",
      "title": "Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107857"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-39779",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Asgaros",
      "product": "Asgaros Forum",
      "cwe": "CWE-862",
      "title": "WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39779"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-62036",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AREOI",
      "product": "All Bootstrap Blocks",
      "cwe": "CWE-497",
      "title": "WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62036"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-78026",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dell",
      "product": "Secure Connect Gateway (SCG) Policy Manager",
      "cwe": "CWE-639",
      "title": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78026"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-85348",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "GDPR Data Request Form",
      "cwe": "CWE-352",
      "title": "GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85348"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-107850",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-639",
      "title": "Contao: Improper access control in the preview links module",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107850"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-107851",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-524",
      "title": "Contao: Improper access control in the table access voter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107851"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-107825",
      "cvss_base": 4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-20",
      "title": "OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107825"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-107835",
      "cvss_base": 4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-436",
      "title": "OWASP Coraza WAF: Cookie Parser Confusion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107835"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-96393",
      "cvss_base": 3.6,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-822",
      "title": "The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96393"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-96395",
      "cvss_base": 3.6,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-125",
      "title": "The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96395"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-101094",
      "cvss_base": 3.6,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-126",
      "title": "The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101094"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-101130",
      "cvss_base": 3.6,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-126",
      "title": "The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101130"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-107848",
      "cvss_base": 3.5,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "contao",
      "product": "contao",
      "cwe": "CWE-352",
      "title": "Contao: Cross-site request forgery in custom backend actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107848"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-96394",
      "cvss_base": 2.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "canva",
      "product": "affinity",
      "cwe": "CWE-126",
      "title": "The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96394"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-104116",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "illumos",
      "product": "illumos-gate",
      "cwe": "CWE-862",
      "title": "Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104116"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-104117",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "illumos",
      "product": "illumos-gate",
      "cwe": "CWE-862",
      "title": "Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104117"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2025-61560",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61560"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-71575",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": "CWE-613",
      "title": "Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71575"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-73179",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": "CWE-367",
      "title": "Apache CXF: JPA authorization-code consume is non-atomic",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73179"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-75352",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75352"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-75353",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75353"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-78384",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78384"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2026-78796",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\\cgi-bin\\upgrade file",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78796"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-78797",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78797"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-78835",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "n/a",
      "cwe": null,
      "title": "Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78835"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-79650",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": "CWE-601",
      "title": "Apache CXF: OIDC RP Open Redirect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79650"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-86463",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: FIQL Query Parser Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86463"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-97468",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: Authentication bypass via weak cache keys for validated STS tokens",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97468"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-97791",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97791"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-100227",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: XML Signature wrapping in JAX-RS XML Security",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100227"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-107937",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107937"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-107938",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107938"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-108039",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache CXF",
      "cwe": null,
      "title": "Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108039"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2000-1200",
      "detail": "EXPLOIT PUBLISHED — CVE-2000-1200. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2001-1184",
      "detail": "EXPLOIT PUBLISHED — CVE-2001-1184. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2002-0478",
      "detail": "EXPLOIT PUBLISHED — CVE-2002-0478. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2004-0230",
      "detail": "EXPLOIT PUBLISHED — CVE-2004-0230. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2012-4534",
      "detail": "EXPLOIT PUBLISHED — CVE-2012-4534. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2012-5568",
      "detail": "EXPLOIT PUBLISHED — CVE-2012-5568. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2013-0340",
      "detail": "EXPLOIT PUBLISHED — CVE-2013-0340 (libexpat). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2021-3199",
      "detail": "EXPLOIT PUBLISHED — CVE-2021-3199. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2022-2845",
      "detail": "EXPLOIT PUBLISHED — CVE-2022-2845 (vim/vim). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2022-2849",
      "detail": "EXPLOIT PUBLISHED — CVE-2022-2849 (vim/vim). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2022-2946",
      "detail": "EXPLOIT PUBLISHED — CVE-2022-2946 (vim/vim). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2023-22894",
      "detail": "EXPLOIT PUBLISHED — CVE-2023-22894. Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104047",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104047 (Red Hat Enterprise Linux 10). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104048",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104048 (Red Hat Enterprise Linux 10). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-106121",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-106121 (rabbitmq-java-client). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-106122",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-106122 (rabbitmq-java-client). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-106123",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-106123 (rabbitmq-java-client). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-106509",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-106509 (backstage). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-107269",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-107269 (gophish). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-107696",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-107696 (FFmpeg). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-107707",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-107707 (Intego Antivirus). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-11318",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-11318 (Zuler Technology DeskIn). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-3833",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-3833 (gnutls). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-4878",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-4878 (Red Hat Enterprise Linux 10). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-48864",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-48864 (Red Hat Enterprise Linux 10). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-58014",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-58014 (GNOME GLib). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-58015",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-58015 (GNOME GLib). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-97332",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-97332 (Unknown User Private Files). Public exploit reference added."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-7870",
      "detail": "RESCORED — CVE-2025-7870 (Portabilis i-Diario). CVSS 5.1 → 2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-7871",
      "detail": "RESCORED — CVE-2025-7871 (Portabilis i-Diario). CVSS 5.1 → 2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-7872",
      "detail": "RESCORED — CVE-2025-7872 (Portabilis i-Diario). CVSS 5.1 → 2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-100833",
      "detail": "RESCORED — CVE-2026-100833 (edgelesssys contrast). CVSS 7.6 → 8.6 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-104048",
      "detail": "RESCORED — CVE-2026-104048 (Red Hat Enterprise Linux 10). CVSS 6.8 → 8.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-106121",
      "detail": "RESCORED — CVE-2026-106121 (rabbitmq-java-client). CVSS 4.9 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-106505",
      "detail": "RESCORED — CVE-2026-106505 (backstage). CVSS 7.7 → 8.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-106507",
      "detail": "RESCORED — CVE-2026-106507 (backstage). CVSS 5.3 → 6.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-106508",
      "detail": "RESCORED — CVE-2026-106508 (backstage). CVSS 5.3 → 6.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-106509",
      "detail": "RESCORED — CVE-2026-106509 (backstage). CVSS 7.7 → 8.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-106587",
      "detail": "RESCORED — CVE-2026-106587 (OpenBSD OpenSSH). CVSS 3.6 → 3.3 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-11930",
      "detail": "RESCORED — CVE-2026-11930 (IBM Security Verify Access). CVSS 5.9 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-11936",
      "detail": "RESCORED — CVE-2026-11936 (IBM Security Verify Access). CVSS 4.9 → 5.4 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-11939",
      "detail": "RESCORED — CVE-2026-11939 (IBM Security Verify Access). CVSS 2.7 → 5.3 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-12091",
      "detail": "RESCORED — CVE-2026-12091 (IBM Security Verify Access). CVSS 3.7 → 5.3 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-17189",
      "detail": "RESCORED — CVE-2026-17189 (IBM Security Verify Access). CVSS 8.2 → 6.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-19498",
      "detail": "RESCORED — CVE-2026-19498 (IBM Security Verify Access). CVSS 5.9 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-49243",
      "detail": "RESCORED — CVE-2026-49243 (webmin). CVSS 5.1 → 9.6 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-76459",
      "detail": "RESCORED — CVE-2026-76459 (Cisco NX-OS Software). CVSS 8.8 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-78388",
      "detail": "RESCORED — CVE-2026-78388 (IBM Security Verify Access). CVSS 4.3 → 8.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-84244",
      "detail": "RESCORED — CVE-2026-84244 (IBM Guardium Data Protection). CVSS 9.3 → 6.1 (NVD)."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105398",
      "detail": "REJECTED — CVE-2026-105398 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105399",
      "detail": "REJECTED — CVE-2026-105399 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105400",
      "detail": "REJECTED — CVE-2026-105400 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105401",
      "detail": "REJECTED — CVE-2026-105401 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105402",
      "detail": "REJECTED — CVE-2026-105402 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105403",
      "detail": "REJECTED — CVE-2026-105403 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105404",
      "detail": "REJECTED — CVE-2026-105404 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105405",
      "detail": "REJECTED — CVE-2026-105405 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105823",
      "detail": "REJECTED — CVE-2026-105823 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105824",
      "detail": "REJECTED — CVE-2026-105824 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105825",
      "detail": "REJECTED — CVE-2026-105825 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105826",
      "detail": "REJECTED — CVE-2026-105826 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-105827",
      "detail": "REJECTED — CVE-2026-105827 (ImageMagick). Record withdrawn by the CNA."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-19611",
      "detail": "PATCH SHIPPED — CVE-2026-19611 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 2.8.4.Final-redhat-00002."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93488",
      "detail": "PATCH SHIPPED — CVE-2026-93488 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93491",
      "detail": "PATCH SHIPPED — CVE-2026-93491 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93558",
      "detail": "PATCH SHIPPED — CVE-2026-93558 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93564",
      "detail": "PATCH SHIPPED — CVE-2026-93564 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93565",
      "detail": "PATCH SHIPPED — CVE-2026-93565 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93567",
      "detail": "PATCH SHIPPED — CVE-2026-93567 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93568",
      "detail": "PATCH SHIPPED — CVE-2026-93568 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-93569",
      "detail": "PATCH SHIPPED — CVE-2026-93569 (Red Hat Build of Apache Camel 3.33.3.SP2). Fixed in Red Hat Build of Apache Camel 3.33.3.SP2 4.1.138.Final-redhat-00001."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-1999-0024",
      "detail": "ENRICHED — CVE-1999-0024. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-1999-0472",
      "detail": "ENRICHED — CVE-1999-0472. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-1999-0516",
      "detail": "ENRICHED — CVE-1999-0516. Received CVSS 7.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-1999-0792",
      "detail": "ENRICHED — CVE-1999-0792. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2000-0147",
      "detail": "ENRICHED — CVE-2000-0147. Received CVSS 2.1 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2000-0515",
      "detail": "ENRICHED — CVE-2000-0515. Received CVSS 10.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2000-1200",
      "detail": "ENRICHED — CVE-2000-1200. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2001-0380",
      "detail": "ENRICHED — CVE-2001-0380. Received CVSS 6.4 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2001-0514",
      "detail": "ENRICHED — CVE-2001-0514. Received CVSS 7.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2001-1184",
      "detail": "ENRICHED — CVE-2001-1184. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2001-1210",
      "detail": "ENRICHED — CVE-2001-1210. Received CVSS 6.4 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2002-0109",
      "detail": "ENRICHED — CVE-2002-0109. Received CVSS 6.4 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2002-0478",
      "detail": "ENRICHED — CVE-2002-0478. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2002-0510",
      "detail": "ENRICHED — CVE-2002-0510. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2002-1117",
      "detail": "ENRICHED — CVE-2002-1117. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2004-0230",
      "detail": "ENRICHED — CVE-2004-0230. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2006-0987",
      "detail": "ENRICHED — CVE-2006-0987. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2011-3389",
      "detail": "ENRICHED — CVE-2011-3389. Received CVSS 4.3 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-2524",
      "detail": "ENRICHED — CVE-2012-2524. Received CVSS 9.3 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-3544",
      "detail": "ENRICHED — CVE-2012-3544. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-4431",
      "detail": "ENRICHED — CVE-2012-4431. Received CVSS 4.3 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-4534",
      "detail": "ENRICHED — CVE-2012-4534. Received CVSS 2.6 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-5568",
      "detail": "ENRICHED — CVE-2012-5568. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-5885",
      "detail": "ENRICHED — CVE-2012-5885. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-5886",
      "detail": "ENRICHED — CVE-2012-5886. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2012-5887",
      "detail": "ENRICHED — CVE-2012-5887. Received CVSS 5.0 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-0340",
      "detail": "ENRICHED — CVE-2013-0340 (libexpat). Received CVSS 6.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-2067",
      "detail": "ENRICHED — CVE-2013-2067. Received CVSS 6.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-4286",
      "detail": "ENRICHED — CVE-2013-4286. Received CVSS 5.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-4322",
      "detail": "ENRICHED — CVE-2013-4322. Received CVSS 4.3 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-4444",
      "detail": "ENRICHED — CVE-2013-4444. Received CVSS 6.8 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-4590",
      "detail": "ENRICHED — CVE-2013-4590. Received CVSS 4.3 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2013-4786",
      "detail": "ENRICHED — CVE-2013-4786. Received CVSS 7.5 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2015-2466",
      "detail": "ENRICHED — CVE-2015-2466. Received CVSS 9.3 and CPE data from NVD."
    },
    {
      "type": "ENRICHED",
      "cve_id": "CVE-2015-2467",
      "detail": "ENRICHED — CVE-2015-2467. Received CVSS 9.3 and CPE data from NVD."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}