{
  "day": "2026-10-10",
  "boundary": "UTC calendar day",
  "published_count": 411,
  "by_severity": {
    "CRITICAL": 73,
    "HIGH": 140,
    "MEDIUM": 178,
    "LOW": 13
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 7,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-104801",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00755,
      "epss_percentile": 0.53807,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeisle",
      "product": "PPOM – Product Addons & Custom Fields for WooCommerce",
      "cwe": "CWE-22",
      "title": "PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104801"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-103889",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00742,
      "epss_percentile": 0.53344,
      "kev": false,
      "kev_due_at": null,
      "vendor": "expivi",
      "product": "3D Product configurator for WooCommerce",
      "cwe": "CWE-434",
      "title": "3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103889"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-104763",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00732,
      "epss_percentile": 0.52974,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpazleen",
      "product": "Post Export Import with Media",
      "cwe": "CWE-22",
      "title": "Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104763"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-97348",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00731,
      "epss_percentile": 0.52962,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gpriday",
      "product": "SiteOrigin Widgets Bundle",
      "cwe": "CWE-22",
      "title": "SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97348"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-94589",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00656,
      "epss_percentile": 0.49934,
      "kev": false,
      "kev_due_at": null,
      "vendor": "htplugins",
      "product": "Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)",
      "cwe": "CWE-434",
      "title": "Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94589"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-83526",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00644,
      "epss_percentile": 0.49387,
      "kev": false,
      "kev_due_at": null,
      "vendor": "foliovision",
      "product": "FV Player 8",
      "cwe": "CWE-434",
      "title": "FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83526"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-104722",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00637,
      "epss_percentile": 0.49031,
      "kev": false,
      "kev_due_at": null,
      "vendor": "webilia",
      "product": "Listdom: AI-powered Business Directory with Classifieds Ads Listings",
      "cwe": "CWE-22",
      "title": "Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104722"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-104899",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00636,
      "epss_percentile": 0.48939,
      "kev": false,
      "kev_due_at": null,
      "vendor": "paoltaia",
      "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
      "cwe": "CWE-98",
      "title": "GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104899"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-91136",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.0056,
      "epss_percentile": 0.44918,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Divi Essential",
      "product": "Divi Plus",
      "cwe": "CWE-22",
      "title": "Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91136"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-93746",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00526,
      "epss_percentile": 0.42874,
      "kev": false,
      "kev_due_at": null,
      "vendor": "webtoffee",
      "product": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels",
      "cwe": "CWE-639",
      "title": "WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93746"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-104759",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00515,
      "epss_percentile": 0.42085,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpo365",
      "product": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)",
      "cwe": "CWE-287",
      "title": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104759"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-104732",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00473,
      "epss_percentile": 0.39044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "inilerm",
      "product": "Advanced IP Blocker",
      "cwe": "CWE-287",
      "title": "Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104732"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-104803",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00449,
      "epss_percentile": 0.37118,
      "kev": false,
      "kev_due_at": null,
      "vendor": "whyun",
      "product": "WPCOM Member",
      "cwe": "CWE-287",
      "title": "WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104803"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-104723",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00447,
      "epss_percentile": 0.36945,
      "kev": false,
      "kev_due_at": null,
      "vendor": "lifterlms",
      "product": "LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes",
      "cwe": "CWE-502",
      "title": "LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104723"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-104023",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00433,
      "epss_percentile": 0.35646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "supsysticcom",
      "product": "Smart Popup by Supsystic",
      "cwe": "CWE-89",
      "title": "Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104023"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-89301",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00429,
      "epss_percentile": 0.35223,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rtcamp",
      "product": "rtMedia for WordPress, BuddyPress and bbPress",
      "cwe": "CWE-862",
      "title": "rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89301"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-104797",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00408,
      "epss_percentile": 0.33041,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nasirahmed",
      "product": "Advanced Form Integration — Connect Forms to 300+ Apps",
      "cwe": "CWE-287",
      "title": "Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104797"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-104021",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.004,
      "epss_percentile": 0.32166,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hostspa",
      "product": "Fastcache by Host.it",
      "cwe": "CWE-94",
      "title": "Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104021"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-96662",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00387,
      "epss_percentile": 0.30779,
      "kev": false,
      "kev_due_at": null,
      "vendor": "latepoint",
      "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
      "cwe": "CWE-89",
      "title": "Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96662"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-100178",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00372,
      "epss_percentile": 0.29135,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gwin",
      "product": "WPAdverts – Classifieds Plugin",
      "cwe": "CWE-79",
      "title": "WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100178"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-106606",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0037,
      "epss_percentile": 0.28891,
      "kev": false,
      "kev_due_at": null,
      "vendor": "YITH",
      "product": "YITH WooCommerce Affiliates",
      "cwe": "CWE-502",
      "title": "WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106606"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-97670",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00369,
      "epss_percentile": 0.28761,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themefusion",
      "product": "Avada (Fusion) Builder",
      "cwe": "CWE-94",
      "title": "Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97670"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-92975",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00352,
      "epss_percentile": 0.26844,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trainingbusinesspros",
      "product": "Groundhogg — CRM, Newsletters, and Marketing Automation",
      "cwe": "CWE-269",
      "title": "Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92975"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-104725",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00334,
      "epss_percentile": 0.24838,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trainingbusinesspros",
      "product": "Groundhogg — CRM, Newsletters, and Marketing Automation",
      "cwe": "CWE-269",
      "title": "Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104725"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-93936",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00331,
      "epss_percentile": 0.24326,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "IPharm",
      "cwe": "CWE-502",
      "title": "WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93936"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-93937",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00331,
      "epss_percentile": 0.24327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Hygia",
      "cwe": "CWE-502",
      "title": "WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93937"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-93938",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00331,
      "epss_percentile": 0.24328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Hogwords",
      "cwe": "CWE-502",
      "title": "WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93938"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-93940",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00331,
      "epss_percentile": 0.24327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Greeny",
      "cwe": "CWE-502",
      "title": "WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93940"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-93941",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00331,
      "epss_percentile": 0.24327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Edema",
      "cwe": "CWE-502",
      "title": "WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93941"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-93945",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00331,
      "epss_percentile": 0.24327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Axiomthemes",
      "product": "Balance",
      "cwe": "CWE-502",
      "title": "WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93945"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-96765",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00321,
      "epss_percentile": 0.23154,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpo365",
      "product": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)",
      "cwe": "CWE-79",
      "title": "WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96765"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-62045",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0032,
      "epss_percentile": 0.2303,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Booklovers",
      "cwe": "CWE-502",
      "title": "WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62045"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-62046",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0032,
      "epss_percentile": 0.23031,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Gutentype",
      "cwe": "CWE-502",
      "title": "WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62046"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-93927",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0032,
      "epss_percentile": 0.2303,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Axiomthemes",
      "product": "Veto",
      "cwe": "CWE-502",
      "title": "WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93927"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-93929",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.0032,
      "epss_percentile": 0.23031,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Travesia",
      "cwe": "CWE-502",
      "title": "WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93929"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-12626",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00318,
      "epss_percentile": 0.22789,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ladela",
      "product": "Online Scheduling and Appointment Booking System – Bookly",
      "cwe": "CWE-502",
      "title": "Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12626"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-93930",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Tantra",
      "cwe": "CWE-502",
      "title": "WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93930"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-93931",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22329,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Smash",
      "cwe": "CWE-502",
      "title": "WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93931"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-93932",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Smart Casa",
      "cwe": "CWE-502",
      "title": "WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93932"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-93933",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22327,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Rosalinda",
      "cwe": "CWE-502",
      "title": "WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93933"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-93934",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Partiso",
      "cwe": "CWE-502",
      "title": "WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93934"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-93935",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22329,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Let's Play",
      "cwe": "CWE-502",
      "title": "WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93935"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-93942",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Dwell",
      "cwe": "CWE-502",
      "title": "WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93942"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-93943",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Convex",
      "cwe": "CWE-502",
      "title": "WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93943"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-93944",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00313,
      "epss_percentile": 0.22328,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Camelia",
      "cwe": "CWE-502",
      "title": "WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93944"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-103482",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00313,
      "epss_percentile": 0.22293,
      "kev": false,
      "kev_due_at": null,
      "vendor": "picocodes",
      "product": "Noptin – Newsletter, New Post Notifications & Email Automation",
      "cwe": "CWE-79",
      "title": "Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103482"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-103478",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00307,
      "epss_percentile": 0.21614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codename065",
      "product": "Premium Packages – Sell Digital Products Securely",
      "cwe": "CWE-79",
      "title": "Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103478"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-102291",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00304,
      "epss_percentile": 0.21335,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeum",
      "product": "Kirki – Freeform Page Builder, Website Builder & Customizer",
      "cwe": "CWE-74",
      "title": "Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102291"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-104766",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00302,
      "epss_percentile": 0.21098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "latepoint",
      "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
      "cwe": "CWE-269",
      "title": "Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104766"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-100147",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00297,
      "epss_percentile": 0.20584,
      "kev": false,
      "kev_due_at": null,
      "vendor": "teamfunnelkit",
      "product": "FunnelKit – Funnel Builder for WooCommerce Checkout",
      "cwe": "CWE-79",
      "title": "FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100147"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-101920",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00297,
      "epss_percentile": 0.20585,
      "kev": false,
      "kev_due_at": null,
      "vendor": "molongui",
      "product": "Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress",
      "cwe": "CWE-79",
      "title": "Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101920"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-104728",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00293,
      "epss_percentile": 0.2011,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rubengc",
      "product": "AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI",
      "cwe": "CWE-862",
      "title": "AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104728"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-100196",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00292,
      "epss_percentile": 0.20068,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wp_media",
      "product": "LazyLoad Plugin – Lazy Load Images, Videos, and Iframes",
      "cwe": "CWE-79",
      "title": "LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100196"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-96667",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00291,
      "epss_percentile": 0.1996,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rameez_iqbal",
      "product": "Real Estate Manager – Property Listing and Agent Management",
      "cwe": "CWE-79",
      "title": "Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96667"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-77183",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0029,
      "epss_percentile": 0.19818,
      "kev": false,
      "kev_due_at": null,
      "vendor": "foosales",
      "product": "FooSales – Point of Sale (POS) for WooCommerce",
      "cwe": "CWE-269",
      "title": "FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77183"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-94375",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00288,
      "epss_percentile": 0.19655,
      "kev": false,
      "kev_due_at": null,
      "vendor": "webtoffee",
      "product": "Order Export & Order Import for WooCommerce",
      "cwe": "CWE-552",
      "title": "Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94375"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-107645",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00286,
      "epss_percentile": 0.19386,
      "kev": false,
      "kev_due_at": null,
      "vendor": "creativethemeshq",
      "product": "Blocksy Companion",
      "cwe": "CWE-269",
      "title": "Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107645"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-103365",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0028,
      "epss_percentile": 0.18792,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ladela",
      "product": "Online Scheduling and Appointment Booking System – Bookly",
      "cwe": "CWE-200",
      "title": "Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103365"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-107712",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00275,
      "epss_percentile": 0.18297,
      "kev": false,
      "kev_due_at": null,
      "vendor": "murgroland",
      "product": "WP Booking System – Booking Calendar",
      "cwe": "CWE-89",
      "title": "WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107712"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-102774",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00275,
      "epss_percentile": 0.1827,
      "kev": false,
      "kev_due_at": null,
      "vendor": "brainstormforce",
      "product": "SureDash – Community, Courses & Member Dashboard",
      "cwe": "CWE-79",
      "title": "SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102774"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-104741",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00269,
      "epss_percentile": 0.17553,
      "kev": false,
      "kev_due_at": null,
      "vendor": "senols",
      "product": "AI Puffer – AI Chatbot, AI Writer & Automation",
      "cwe": "CWE-862",
      "title": "AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104741"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-104742",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00269,
      "epss_percentile": 0.17553,
      "kev": false,
      "kev_due_at": null,
      "vendor": "senols",
      "product": "AI Puffer – AI Chatbot, AI Writer & Automation",
      "cwe": "CWE-862",
      "title": "AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104742"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-100161",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16577,
      "kev": false,
      "kev_due_at": null,
      "vendor": "villatheme",
      "product": "Photo Reviews for WooCommerce",
      "cwe": "CWE-79",
      "title": "Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100161"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-104006",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00256,
      "epss_percentile": 0.15941,
      "kev": false,
      "kev_due_at": null,
      "vendor": "softaculous",
      "product": "SpeedyCache – Cache, Optimization, Performance",
      "cwe": "CWE-524",
      "title": "SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104006"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-93775",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.15562,
      "kev": false,
      "kev_due_at": null,
      "vendor": "eteubert",
      "product": "Podlove Podcast Publisher",
      "cwe": "CWE-79",
      "title": "Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93775"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-96278",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00254,
      "epss_percentile": 0.15558,
      "kev": false,
      "kev_due_at": null,
      "vendor": "opajaap",
      "product": "WP Photo Album Plus",
      "cwe": "CWE-79",
      "title": "WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96278"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-104898",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00254,
      "epss_percentile": 0.15601,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ladela",
      "product": "Online Scheduling and Appointment Booking System – Bookly",
      "cwe": "CWE-639",
      "title": "Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104898"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-101921",
      "cvss_base": 4.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00251,
      "epss_percentile": 0.15164,
      "kev": false,
      "kev_due_at": null,
      "vendor": "smub",
      "product": "WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More",
      "cwe": "CWE-79",
      "title": "WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101921"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-96653",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00249,
      "epss_percentile": 0.14887,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdirectorykit",
      "product": "WP Directory Kit",
      "cwe": "CWE-89",
      "title": "WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96653"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-94538",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00248,
      "epss_percentile": 0.14845,
      "kev": false,
      "kev_due_at": null,
      "vendor": "JoomUnited",
      "product": "WP File Download",
      "cwe": "CWE-862",
      "title": "WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94538"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-93949",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00243,
      "epss_percentile": 0.14291,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Omegathemes",
      "product": "Grocery Shopping Store",
      "cwe": "CWE-288",
      "title": "WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93949"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-103964",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00243,
      "epss_percentile": 0.14282,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codename065",
      "product": "Download Manager",
      "cwe": "CWE-200",
      "title": "Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103964"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-95684",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "e4jvikwp",
      "product": "VikBooking Hotel Booking Engine & PMS",
      "cwe": "CWE-79",
      "title": "VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95684"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-96558",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14042,
      "kev": false,
      "kev_due_at": null,
      "vendor": "expresstech",
      "product": "Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker",
      "cwe": "CWE-79",
      "title": "Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96558"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-96572",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14042,
      "kev": false,
      "kev_due_at": null,
      "vendor": "aguidrevitch",
      "product": "WP Meteor Website Speed Optimization Addon",
      "cwe": "CWE-79",
      "title": "WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96572"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-96682",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14044,
      "kev": false,
      "kev_due_at": null,
      "vendor": "2winfactor",
      "product": "Presto Player",
      "cwe": "CWE-79",
      "title": "Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96682"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-107657",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14045,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hivepress",
      "product": "HivePress – Business Directory, Listings & Classified Ads Plugin",
      "cwe": "CWE-79",
      "title": "HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107657"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-107742",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14046,
      "kev": false,
      "kev_due_at": null,
      "vendor": "10web",
      "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer",
      "cwe": "CWE-79",
      "title": "10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107742"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-108506",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00237,
      "epss_percentile": 0.13548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZTE",
      "product": "Z80 Ultra",
      "cwe": "CWE-269",
      "title": "Unauthorized access vulnerability in ZTE Z80 Ultra product",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108506"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-96840",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00236,
      "epss_percentile": 0.13477,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpxpo",
      "product": "Post Grid Gutenberg Blocks – PostX",
      "cwe": "CWE-79",
      "title": "Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96840"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-104724",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00236,
      "epss_percentile": 0.13381,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fireplugins",
      "product": "FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment",
      "cwe": "CWE-89",
      "title": "FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104724"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-96648",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00235,
      "epss_percentile": 0.13267,
      "kev": false,
      "kev_due_at": null,
      "vendor": "supsysticcom",
      "product": "Data Tables Generator by Supsystic",
      "cwe": "CWE-79",
      "title": "Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96648"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-97630",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00234,
      "epss_percentile": 0.13118,
      "kev": false,
      "kev_due_at": null,
      "vendor": "foliovision",
      "product": "FV Flowplayer Video Player",
      "cwe": "CWE-79",
      "title": "FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97630"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-104915",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0023,
      "epss_percentile": 0.12781,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kodezen",
      "product": "Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning",
      "cwe": "CWE-862",
      "title": "Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104915"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-5727",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00227,
      "epss_percentile": 0.12448,
      "kev": false,
      "kev_due_at": null,
      "vendor": "elemntor",
      "product": "Hello Plus",
      "cwe": "CWE-862",
      "title": "Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5727"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-103424",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00221,
      "epss_percentile": 0.1167,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cleantalk",
      "product": "Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA",
      "cwe": "CWE-79",
      "title": "Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103424"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-87869",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0022,
      "epss_percentile": 0.11545,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stepasyuk",
      "product": "Filter Everything — WordPress & WooCommerce Filters",
      "cwe": "CWE-79",
      "title": "Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87869"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-96574",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00216,
      "epss_percentile": 0.11048,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wedevs",
      "product": "User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission",
      "cwe": "CWE-79",
      "title": "User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96574"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-104735",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00216,
      "epss_percentile": 0.11048,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeisle",
      "product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator",
      "cwe": "CWE-79",
      "title": "RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104735"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-104762",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00216,
      "epss_percentile": 0.11049,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stellarwp",
      "product": "Kadence Blocks — Page Builder Toolkit for Gutenberg Editor",
      "cwe": "CWE-79",
      "title": "Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104762"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-89100",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00215,
      "epss_percentile": 0.10977,
      "kev": false,
      "kev_due_at": null,
      "vendor": "paymentplugins",
      "product": "Payment Plugins for Stripe WooCommerce",
      "cwe": "CWE-79",
      "title": "Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89100"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-103998",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00215,
      "epss_percentile": 0.10976,
      "kev": false,
      "kev_due_at": null,
      "vendor": "10web",
      "product": "Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder",
      "cwe": "CWE-79",
      "title": "Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103998"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-18496",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00214,
      "epss_percentile": 0.10835,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdevelop",
      "product": "Booking Calendar",
      "cwe": "CWE-200",
      "title": "Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18496"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-97643",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00212,
      "epss_percentile": 0.10641,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stellarwp",
      "product": "GiveWP – Donation Plugin and Fundraising Platform",
      "cwe": "CWE-79",
      "title": "GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97643"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-91050",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.10452,
      "kev": false,
      "kev_due_at": null,
      "vendor": "latepoint",
      "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
      "cwe": "CWE-639",
      "title": "Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91050"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-103427",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0021,
      "epss_percentile": 0.10418,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpinsider-1",
      "product": "Simple Membership",
      "cwe": "CWE-79",
      "title": "Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103427"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-104752",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00208,
      "epss_percentile": 0.10087,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Rank Math SEO",
      "cwe": "CWE-434",
      "title": "Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104752"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-103897",
      "cvss_base": 4.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00208,
      "epss_percentile": 0.10008,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dfactory",
      "product": "Responsive Lightbox & Gallery",
      "cwe": "CWE-79",
      "title": "Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103897"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-93950",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00202,
      "epss_percentile": 0.09265,
      "kev": false,
      "kev_due_at": null,
      "vendor": "StylemixThemes",
      "product": "Motors",
      "cwe": "CWE-862",
      "title": "WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93950"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-101324",
      "cvss_base": 4.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00202,
      "epss_percentile": 0.09283,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpmanageninja",
      "product": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
      "cwe": "CWE-79",
      "title": "Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101324"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-16776",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.09159,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sonaar",
      "product": "MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar",
      "cwe": "CWE-79",
      "title": "MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16776"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-96563",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.09162,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stylemix",
      "product": "Motors – Car Dealership & Classified Listings Plugin",
      "cwe": "CWE-79",
      "title": "Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96563"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-97396",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.09161,
      "kev": false,
      "kev_due_at": null,
      "vendor": "retainful",
      "product": "Email Marketing for WordPress and WooCommerce – Retainful",
      "cwe": "CWE-79",
      "title": "Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97396"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-102401",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.09162,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codename065",
      "product": "Download Manager",
      "cwe": "CWE-79",
      "title": "Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102401"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-103520",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.09157,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hivepress",
      "product": "HivePress – Business Directory, Listings & Classified Ads Plugin",
      "cwe": "CWE-79",
      "title": "HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103520"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-104993",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.0916,
      "kev": false,
      "kev_due_at": null,
      "vendor": "paoltaia",
      "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory",
      "cwe": "CWE-79",
      "title": "GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104993"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-93883",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00197,
      "epss_percentile": 0.08678,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pluginsware",
      "product": "Advanced Classifieds & Directory Pro",
      "cwe": "CWE-79",
      "title": "Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93883"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-96743",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08258,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jonua",
      "product": "Table Field Add-on for ACF and SCF",
      "cwe": "CWE-79",
      "title": "Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96743"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-102402",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08261,
      "kev": false,
      "kev_due_at": null,
      "vendor": "techlabpro1",
      "product": "Team – Team Members Showcase Plugin",
      "cwe": "CWE-79",
      "title": "Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102402"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-103912",
      "cvss_base": 4.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08288,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jetmonsters",
      "product": "JetFormBuilder — Dynamic Blocks Form Builder",
      "cwe": "CWE-79",
      "title": "JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103912"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-14335",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0019,
      "epss_percentile": 0.07982,
      "kev": false,
      "kev_due_at": null,
      "vendor": "smub",
      "product": "Easy Digital Downloads – eCommerce Payments and Subscriptions made easy",
      "cwe": "CWE-79",
      "title": "Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14335"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-3717",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00189,
      "epss_percentile": 0.07811,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bestwpdeveloper",
      "product": "WP CV Builder",
      "cwe": "CWE-862",
      "title": "CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3717"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-6723",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00189,
      "epss_percentile": 0.07811,
      "kev": false,
      "kev_due_at": null,
      "vendor": "croixhaug",
      "product": "Simply Schedule Appointments",
      "cwe": "CWE-863",
      "title": "Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6723"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-4791",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00187,
      "epss_percentile": 0.07629,
      "kev": false,
      "kev_due_at": null,
      "vendor": "peprodev",
      "product": "PeproDev Ultimate Profile Solutions",
      "cwe": "CWE-79",
      "title": "PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4791"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-14379",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00187,
      "epss_percentile": 0.07628,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rubengc",
      "product": "GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI",
      "cwe": "CWE-79",
      "title": "GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14379"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-17025",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00187,
      "epss_percentile": 0.07627,
      "kev": false,
      "kev_due_at": null,
      "vendor": "silverks",
      "product": "Graphene",
      "cwe": "CWE-79",
      "title": "Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17025"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-87781",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00177,
      "epss_percentile": 0.0668,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "LTL Freight Quotes",
      "cwe": "CWE-89",
      "title": "LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87781"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-106138",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00175,
      "epss_percentile": 0.06374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software",
      "product": "KendoReact",
      "cwe": "CWE-80",
      "title": "Cross-Site Scripting via Chart Tooltip in KendoReact",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106138"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-106139",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00175,
      "epss_percentile": 0.06374,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software",
      "product": "Kendo UI for Vue",
      "cwe": "CWE-80",
      "title": "Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106139"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-5725",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00168,
      "epss_percentile": 0.05624,
      "kev": false,
      "kev_due_at": null,
      "vendor": "archetyped",
      "product": "Favicon Rotator",
      "cwe": "CWE-79",
      "title": "Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5725"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-12054",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00168,
      "epss_percentile": 0.05625,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codename065",
      "product": "Download Manager",
      "cwe": "CWE-79",
      "title": "Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12054"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-104753",
      "cvss_base": 4.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00168,
      "epss_percentile": 0.05519,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Rank Math SEO",
      "cwe": "CWE-89",
      "title": "Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104753"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-6243",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00167,
      "epss_percentile": 0.05439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "shabti",
      "product": "Frontend Admin by DynamiApps",
      "cwe": "CWE-79",
      "title": "Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6243"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-107323",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00163,
      "epss_percentile": 0.05077,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Gallery PhotoBlocks",
      "cwe": "CWE-79",
      "title": "Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107323"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-104754",
      "cvss_base": 3.5,
      "cvss_severity": "LOW",
      "epss_score": 0.00163,
      "epss_percentile": 0.05077,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Rank Math SEO",
      "cwe": "CWE-79",
      "title": "Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104754"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-108501",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00162,
      "epss_percentile": 0.04799,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZTE",
      "product": "ZTE Z80 Ultra",
      "cwe": "CWE-269",
      "title": "Unauthorized access vulnerability in ZTE Z80 Ultra product",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108501"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-107321",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.04669,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "W3 Total Cache",
      "cwe": "CWE-22",
      "title": "W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107321"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-87780",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00156,
      "epss_percentile": 0.04175,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "LTL Freight Quotes",
      "cwe": "CWE-79",
      "title": "LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87780"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-9696",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04208,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codename065",
      "product": "Download Manager",
      "cwe": "CWE-79",
      "title": "Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9696"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-14877",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04204,
      "kev": false,
      "kev_due_at": null,
      "vendor": "supsysticcom",
      "product": "Data Tables Generator by Supsystic",
      "cwe": "CWE-79",
      "title": "Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14877"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-14882",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04204,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themefusecom",
      "product": "Brizy – Page Builder",
      "cwe": "CWE-79",
      "title": "Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14882"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-18558",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04206,
      "kev": false,
      "kev_due_at": null,
      "vendor": "awsmin",
      "product": "Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files",
      "cwe": "CWE-79",
      "title": "Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18558"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-78068",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04206,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jonua",
      "product": "Table Field Add-on for ACF and SCF",
      "cwe": "CWE-79",
      "title": "Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78068"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-91862",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04207,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jetmonsters",
      "product": "Getwid – Gutenberg Blocks",
      "cwe": "CWE-79",
      "title": "Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91862"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-94421",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04205,
      "kev": false,
      "kev_due_at": null,
      "vendor": "andy_moyle",
      "product": "Church Admin",
      "cwe": "CWE-79",
      "title": "Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94421"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-97340",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04205,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeFusion",
      "product": "Avada | Website Builder For WordPress & WooCommerce",
      "cwe": "CWE-79",
      "title": "Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97340"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-105990",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04219,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Accept PayPal Payments using Contact Form 7",
      "cwe": "CWE-200",
      "title": "Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105990"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-105995",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00156,
      "epss_percentile": 0.04219,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Booking Package",
      "cwe": "CWE-200",
      "title": "Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105995"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-15178",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00155,
      "epss_percentile": 0.04142,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpmanageninja",
      "product": "Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder",
      "cwe": "CWE-862",
      "title": "Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15178"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-93951",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00146,
      "epss_percentile": 0.03364,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bracketweb",
      "product": "Zeinet",
      "cwe": "CWE-79",
      "title": "WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93951"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-107120",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00146,
      "epss_percentile": 0.03386,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Contest Gallery",
      "cwe": "CWE-287",
      "title": "Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107120"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-101947",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": 0.00143,
      "epss_percentile": 0.03109,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CellHubs",
      "product": "ExifTool for photo and video",
      "cwe": "CWE-78",
      "title": "ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101947"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-105989",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00142,
      "epss_percentile": 0.03056,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Accept PayPal Payments using Contact Form 7",
      "cwe": "CWE-862",
      "title": "Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105989"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-105976",
      "cvss_base": 4.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00142,
      "epss_percentile": 0.03018,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Portfolio Filter Gallery",
      "cwe": "CWE-863",
      "title": "Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105976"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-105977",
      "cvss_base": 2.2,
      "cvss_severity": "LOW",
      "epss_score": 0.00142,
      "epss_percentile": 0.03018,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Portfolio Filter Gallery",
      "cwe": "CWE-639",
      "title": "Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105977"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-94256",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.02652,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "SMS Alert",
      "cwe": "CWE-287",
      "title": "SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94256"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-94257",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00136,
      "epss_percentile": 0.02652,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "SMS Alert",
      "cwe": "CWE-269",
      "title": "SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94257"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-85571",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.02412,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Tutor LMS",
      "cwe": "CWE-639",
      "title": "Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85571"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-108502",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00129,
      "epss_percentile": 0.02197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZTE",
      "product": "Z80 Ultra",
      "cwe": "CWE-269",
      "title": "Information disclosure vulnerability in ZTE Z80 Ultra product",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108502"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-108503",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00129,
      "epss_percentile": 0.02197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZTE",
      "product": "Z80 Ultra",
      "cwe": "CWE-276",
      "title": "Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108503"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-104022",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00125,
      "epss_percentile": 0.01956,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kodezen",
      "product": "Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning",
      "cwe": "CWE-269",
      "title": "Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104022"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-108504",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00123,
      "epss_percentile": 0.01853,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZTE",
      "product": "Z80 Ultra",
      "cwe": "CWE-269",
      "title": "Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108504"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-108505",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00111,
      "epss_percentile": 0.01247,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZTE",
      "product": "Z80 Ultra",
      "cwe": "CWE-269",
      "title": "Information disclosure vulnerability in ZTE Z80 Ultra product",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108505"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-42696",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Royal Plugins",
      "product": "SiteVault – Backup, Restore, Migration &amp; Cloning",
      "cwe": "CWE-94",
      "title": "WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42696"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-62024",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CodeBard",
      "product": "CodeBard Help Desk",
      "cwe": "CWE-434",
      "title": "WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62024"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-62129",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPFunnels",
      "product": "Creator LMS",
      "cwe": "CWE-434",
      "title": "WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62129"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-39801",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sergey",
      "product": "AIWU",
      "cwe": "CWE-266",
      "title": "WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39801"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-42716",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "payever",
      "product": "Payever - WooCommerce Gateway",
      "cwe": "CWE-502",
      "title": "WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42716"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-42718",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Pluggabl",
      "product": "Booster for WooCommerce",
      "cwe": "CWE-502",
      "title": "WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42718"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-42719",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sarah Giles",
      "product": "Dynamic User Directory",
      "cwe": "CWE-502",
      "title": "WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42719"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-42723",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AncoraThemes",
      "product": "CleanSkin",
      "cwe": "CWE-502",
      "title": "WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42723"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-62022",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Select-Themes",
      "product": "Tonda Membership",
      "cwe": "CWE-266",
      "title": "WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62022"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-62032",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Designinvento",
      "product": "DirectoryPress",
      "cwe": "CWE-98",
      "title": "WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62032"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-62050",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Splendour",
      "cwe": "CWE-502",
      "title": "WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62050"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-62051",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Stargaze",
      "cwe": "CWE-502",
      "title": "WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62051"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-62052",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Tipsy",
      "cwe": "CWE-502",
      "title": "WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62052"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-62053",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Wine House",
      "cwe": "CWE-502",
      "title": "WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62053"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-62054",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Yacht Rental",
      "cwe": "CWE-502",
      "title": "WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62054"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-62076",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "The4",
      "product": "Kalles",
      "cwe": "CWE-502",
      "title": "WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62076"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-62077",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BoldThemes",
      "product": "Avala",
      "cwe": "CWE-502",
      "title": "WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62077"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-62086",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Juno",
      "cwe": "CWE-502",
      "title": "WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62086"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-62087",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Equadio",
      "cwe": "CWE-502",
      "title": "WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62087"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-62090",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "WineShop",
      "cwe": "CWE-502",
      "title": "WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62090"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-62120",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Law Office",
      "cwe": "CWE-502",
      "title": "WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62120"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-62123",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Invetex",
      "cwe": "CWE-502",
      "title": "WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62123"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-62124",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "N7 | Golf Club Sports & Events",
      "cwe": "CWE-502",
      "title": "WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62124"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-62125",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Asia Garden",
      "cwe": "CWE-502",
      "title": "WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62125"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-66482",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AncoraThemes",
      "product": "Drone Media",
      "cwe": "CWE-502",
      "title": "WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66482"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-66483",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Education Center",
      "cwe": "CWE-502",
      "title": "WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66483"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-66563",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Windsor",
      "cwe": "CWE-502",
      "title": "WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66563"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-66564",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "ShiftCV",
      "cwe": "CWE-502",
      "title": "WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66564"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-66565",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axiomthemes",
      "product": "FC United",
      "cwe": "CWE-502",
      "title": "WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66565"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-66567",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AncoraThemes",
      "product": "Anesta",
      "cwe": "CWE-502",
      "title": "WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66567"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-66568",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axiomthemes",
      "product": "Original",
      "cwe": "CWE-502",
      "title": "WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66568"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-66569",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axiomthemes",
      "product": "Kicker",
      "cwe": "CWE-502",
      "title": "WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66569"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-78529",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Alliance",
      "cwe": "CWE-502",
      "title": "WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78529"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-78531",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Jacqueline",
      "cwe": "CWE-502",
      "title": "WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78531"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-78533",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AncoraThemes",
      "product": "Qwery",
      "cwe": "CWE-502",
      "title": "WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78533"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-78535",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeRex",
      "product": "Photolia",
      "cwe": "CWE-502",
      "title": "WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78535"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-81797",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeRex",
      "product": "Buzz Stone | Magazine & Viral Blog WordPress Theme",
      "cwe": "CWE-502",
      "title": "WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81797"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-104398",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VillaTheme",
      "product": "AFFI – Affiliate Marketing for WooCommerce",
      "cwe": "CWE-502",
      "title": "WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104398"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-105892",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rtCamp Inc.",
      "product": "rtMedia for WordPress, BuddyPress and bbPress",
      "cwe": "CWE-22",
      "title": "WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105892"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-106610",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "miniOrange",
      "product": "miniorange otp verification",
      "cwe": "CWE-266",
      "title": "WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106610"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-40800",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ELEXtensions",
      "product": "ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes",
      "cwe": "CWE-89",
      "title": "WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40800"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-62031",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Stylemix",
      "product": "uListing",
      "cwe": "CWE-89",
      "title": "WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62031"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-105889",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tickera",
      "product": "Tickera",
      "cwe": "CWE-89",
      "title": "WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105889"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-108551",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ferdikoomen",
      "product": "openapi-typescript-codegen",
      "cwe": "CWE-94",
      "title": "openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108551"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-108598",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "floci-io",
      "product": "floci",
      "cwe": "CWE-94",
      "title": "Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108598"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-108549",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "chenhg5",
      "product": "cc-connect",
      "cwe": "CWE-306",
      "title": "cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108549"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-62025",
      "cvss_base": 9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tailored Media",
      "product": "Tailored Tools",
      "cwe": "CWE-434",
      "title": "WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62025"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-62021",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rascals",
      "product": "Angio",
      "cwe": "CWE-502",
      "title": "WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62021"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-105885",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "10Web",
      "product": "Slider by 10Web",
      "cwe": "CWE-502",
      "title": "WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105885"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-108550",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "skillhub",
      "cwe": "CWE-863",
      "title": "SkillHub before 0.2.22 Account Takeover via Account Merge Flow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108550"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-108628",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108628"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-108657",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108657"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-42633",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Marcus",
      "product": "Events Manager",
      "cwe": "CWE-89",
      "title": "WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42633"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-42712",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QODE",
      "product": "Qode Tours",
      "cwe": "CWE-89",
      "title": "WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42712"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-62117",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dmitry V.",
      "product": "Barcode Scanner with Inventory & Order Manager",
      "cwe": "CWE-89",
      "title": "WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62117"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-96341",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPMU DEV",
      "product": "Forminator",
      "cwe": "CWE-266",
      "title": "WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96341"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-108545",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SillyTavern",
      "product": "SillyTavern",
      "cwe": "CWE-400",
      "title": "SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108545"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-39802",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "everestthemes",
      "product": "Everest Backup",
      "cwe": "CWE-94",
      "title": "WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39802"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-40777",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rashid",
      "product": "WPSection",
      "cwe": "CWE-862",
      "title": "WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40777"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-40801",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Wordable",
      "product": "Wordable",
      "cwe": "CWE-862",
      "title": "WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40801"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-42704",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "axiomthemes",
      "product": "Kids Care",
      "cwe": "CWE-98",
      "title": "WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42704"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-42724",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AncoraThemes",
      "product": "CleanSkin",
      "cwe": "CWE-98",
      "title": "WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42724"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-42777",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edge-Themes",
      "product": "Aalto",
      "cwe": "CWE-98",
      "title": "WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42777"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-48193",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Uminex",
      "cwe": "CWE-98",
      "title": "WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48193"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-48194",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "DukaMarket",
      "cwe": "CWE-98",
      "title": "WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48194"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-62020",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Mikado-Themes",
      "product": "TouchUp",
      "cwe": "CWE-98",
      "title": "WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62020"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-62065",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CocoBasic",
      "product": "Cardea",
      "cwe": "CWE-98",
      "title": "WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62065"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-62066",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CocoBasic",
      "product": "Volos",
      "cwe": "CWE-98",
      "title": "WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62066"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-62067",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CocoBasic",
      "product": "Kaven",
      "cwe": "CWE-98",
      "title": "WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62067"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-62068",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CocoBasic",
      "product": "Teoro",
      "cwe": "CWE-98",
      "title": "WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62068"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-62069",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CocoBasic",
      "product": "Fabius",
      "cwe": "CWE-98",
      "title": "WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62069"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-62070",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CKThemes",
      "product": "Flipmart",
      "cwe": "CWE-98",
      "title": "WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62070"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-62074",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX",
      "product": "Ozeum",
      "cwe": "CWE-98",
      "title": "WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62074"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-62075",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Mymoun",
      "product": "Backhoe",
      "cwe": "CWE-98",
      "title": "WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62075"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-62092",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Armania",
      "cwe": "CWE-98",
      "title": "WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62092"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-62094",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "TechOne",
      "cwe": "CWE-98",
      "title": "WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62094"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-62096",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Biolife",
      "cwe": "CWE-98",
      "title": "WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62096"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-62099",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Boutique",
      "cwe": "CWE-98",
      "title": "WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62099"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-62115",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "KuteShop",
      "cwe": "CWE-98",
      "title": "WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62115"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-66566",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Elated-Themes",
      "product": "Ambient",
      "cwe": "CWE-98",
      "title": "WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66566"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-40805",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PeepSo",
      "product": "PeepSo",
      "cwe": "CWE-22",
      "title": "WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40805"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-78530",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Chimpstudio",
      "product": "FoodBakery",
      "cwe": "CWE-22",
      "title": "WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78530"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-108161",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fusionpbx",
      "product": "fusionpbx",
      "cwe": "CWE-78",
      "title": "FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108161"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-108546",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "spotweb",
      "product": "spotweb",
      "cwe": "CWE-78",
      "title": "Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108546"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-108553",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenRefine",
      "product": "OpenRefine",
      "cwe": "CWE-352",
      "title": "OpenRefine through 3.10.1 CSRF to RCE via get-rows Command",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108553"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-40802",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pubjet",
      "product": "Pubjet | پاب‌جت",
      "cwe": "CWE-862",
      "title": "WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40802"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-42717",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VaultDweller",
      "product": "Leyka",
      "cwe": "CWE-89",
      "title": "WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42717"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-42722",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shabti Kaplan",
      "product": "Frontend Admin by DynamiApps",
      "cwe": "CWE-89",
      "title": "WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42722"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-45440",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Smackcoders Inc.",
      "product": "WP Ultimate CSV Importer",
      "cwe": "CWE-89",
      "title": "WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45440"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-62033",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Stylemix",
      "product": "uListing",
      "cwe": "CWE-862",
      "title": "WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62033"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-42630",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Web Plura",
      "product": "Web Plura Backup &amp; Restore Manager",
      "cwe": "CWE-201",
      "title": "WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42630"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-42705",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeGoods",
      "product": "Grand News",
      "cwe": "CWE-862",
      "title": "WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42705"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2026-42706",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeGoods",
      "product": "DK",
      "cwe": "CWE-862",
      "title": "WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42706"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-62043",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sevenspark",
      "product": "Contact Form 7 – Dynamic Text Extension",
      "cwe": "CWE-201",
      "title": "WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62043"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-65459",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPMU DEV",
      "product": "Forminator",
      "cwe": "CWE-862",
      "title": "WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65459"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-103071",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VillaTheme",
      "product": "Thank You Page Customizer for WooCommerce",
      "cwe": "CWE-94",
      "title": "WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103071"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-106609",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Web Impian",
      "product": "Bayarcash WooCommerce",
      "cwe": "CWE-862",
      "title": "WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106609"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-62038",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DigitalME",
      "product": "eRoom",
      "cwe": "CWE-288",
      "title": "WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62038"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-62118",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dmitry V.",
      "product": "Barcode Scanner with Inventory & Order Manager",
      "cwe": "CWE-862",
      "title": "WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62118"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-108593",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "decolua",
      "product": "9router",
      "cwe": "CWE-94",
      "title": "9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108593"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-27350",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Builderius.io",
      "product": "Builderius",
      "cwe": "CWE-918",
      "title": "WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27350"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2026-62030",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "StreamCast",
      "cwe": "CWE-918",
      "title": "WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62030"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-62044",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "Super Video Player",
      "cwe": "CWE-502",
      "title": "WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62044"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-62130",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Amir Helzer",
      "product": "WooCommerce Multilingual & Multicurrency",
      "cwe": "CWE-502",
      "title": "WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62130"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-94676",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tainacan Community",
      "product": "Tainacan",
      "cwe": "CWE-502",
      "title": "WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94676"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-106608",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Automattic",
      "product": "WooCommerce",
      "cwe": "CWE-266",
      "title": "WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106608"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-39799",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Joomunited",
      "product": "WP File Download",
      "cwe": "CWE-79",
      "title": "WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39799"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-39800",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Anton Bond",
      "product": "Additional Order Filters for WooCommerce",
      "cwe": "CWE-79",
      "title": "WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39800"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-40803",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jotform",
      "product": "Jotform &#8211; AI Chatbot",
      "cwe": "CWE-79",
      "title": "WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40803"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-42631",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QODE",
      "product": "Qode Music",
      "cwe": "CWE-79",
      "title": "WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42631"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-42632",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QODE",
      "product": "Qode Real Estate",
      "cwe": "CWE-79",
      "title": "WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42632"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-42693",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TieLabs",
      "product": "Jannah",
      "cwe": "CWE-79",
      "title": "WordPress Jannah theme <= 7.6.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42693"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-42697",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Inisev",
      "product": "Social Share Icons & Social Share Buttons",
      "cwe": "CWE-79",
      "title": "WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42697"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-42699",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FolioVision",
      "product": "FV Player 8",
      "cwe": "CWE-79",
      "title": "WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42699"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-42702",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Themeum",
      "product": "Tutor LMS",
      "cwe": "CWE-79",
      "title": "WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42702"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-42709",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RadiusTheme",
      "product": "Food Menu – Restaurant Menu & Online Ordering for WooCommerce",
      "cwe": "CWE-79",
      "title": "WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42709"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-42711",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "10Web",
      "product": "Slider by 10Web",
      "cwe": "CWE-79",
      "title": "WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42711"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-42715",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "10Web",
      "product": "Photo Gallery by 10Web",
      "cwe": "CWE-79",
      "title": "WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42715"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-57742",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ThemeREX Group",
      "product": "Kids Planet",
      "cwe": "CWE-79",
      "title": "WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57742"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-57806",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "drfuri",
      "product": "Martfury - WooCommerce Marketplace WordPress Theme",
      "cwe": "CWE-79",
      "title": "WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57806"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-62027",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "Team Section Block",
      "cwe": "CWE-79",
      "title": "WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62027"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-62034",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "Before After Image Comparison – Image comparison for WP",
      "cwe": "CWE-79",
      "title": "WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62034"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2026-62037",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bPlugins",
      "product": "Document Embedder",
      "cwe": "CWE-79",
      "title": "WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62037"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-62064",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Bracketweb",
      "product": "Ambed",
      "cwe": "CWE-79",
      "title": "WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62064"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-62082",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "An-Themes",
      "product": "Pin WP",
      "cwe": "CWE-79",
      "title": "WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62082"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-62091",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Armania",
      "cwe": "CWE-79",
      "title": "WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62091"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-62093",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "TechOne",
      "cwe": "CWE-79",
      "title": "WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62093"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-62095",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Biolife",
      "cwe": "CWE-79",
      "title": "WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62095"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-62100",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "KuteShop",
      "cwe": "CWE-79",
      "title": "WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62100"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-62116",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dmitry V.",
      "product": "Barcode Scanner with Inventory & Order Manager",
      "cwe": "CWE-79",
      "title": "WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62116"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-78532",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "designthemes",
      "product": "LMS",
      "cwe": "CWE-79",
      "title": "WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78532"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-78534",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Keen IT Solutions",
      "product": "Educavo",
      "cwe": "CWE-79",
      "title": "WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78534"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-94160",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeStek",
      "product": "ThemeStek Extras for LabtechCO Theme",
      "cwe": "CWE-79",
      "title": "WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94160"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-97263",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Greg Winiarski",
      "product": "WPAdverts",
      "cwe": "CWE-79",
      "title": "WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97263"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-97264",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Greg Winiarski",
      "product": "WPAdverts",
      "cwe": "CWE-79",
      "title": "WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97264"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-102388",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPMU DEV",
      "product": "Forminator",
      "cwe": "CWE-79",
      "title": "WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102388"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-108164",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "opensource-socialnetwork",
      "product": "opensource-socialnetwork",
      "cwe": "CWE-639",
      "title": "Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108164"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-108547",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "astron-rpa",
      "cwe": "CWE-639",
      "title": "AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108547"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-108581",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TencentCloud",
      "product": "Octop",
      "cwe": "CWE-862",
      "title": "Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108581"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-108623",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108623"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-108648",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108648"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-108661",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108661"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-108671",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108671"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-108677",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108677"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-97853",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ericmj",
      "product": "decimal",
      "cwe": "CWE-789",
      "title": "Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97853"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-103357",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VillaTheme",
      "product": "GIFT4U",
      "cwe": "CWE-862",
      "title": "WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103357"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2026-108162",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "smp46",
      "product": "pingvin-share-x",
      "cwe": "CWE-348",
      "title": "Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108162"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-108163",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "smp46",
      "product": "pingvin-share-x",
      "cwe": "CWE-307",
      "title": "Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108163"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-108548",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "astron-rpa",
      "cwe": "CWE-287",
      "title": "AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108548"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-108554",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PDFMathTranslate",
      "product": "PDFMathTranslate",
      "cwe": "CWE-918",
      "title": "PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108554"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-108580",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "phoenixthrush",
      "product": "AniWorld Downloader",
      "cwe": "CWE-307",
      "title": "AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108580"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-66481",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Presto Player",
      "product": "Presto Player Pro",
      "cwe": "CWE-22",
      "title": "WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66481"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2026-108582",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "genspark-ai",
      "product": "GenOffice",
      "cwe": "CWE-732",
      "title": "GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108582"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-40808",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Automattic",
      "product": "Jetpack VideoPress",
      "cwe": "CWE-862",
      "title": "WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40808"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-62098",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kutethemes",
      "product": "Boutique",
      "cwe": "CWE-94",
      "title": "WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62098"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-94590",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CodePeople2",
      "product": "Sell Downloads",
      "cwe": "CWE-940",
      "title": "WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94590"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-62035",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "upcasted",
      "product": "AWS S3 for WordPress Plugin – Upcasted",
      "cwe": "CWE-862",
      "title": "WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62035"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-108592",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SWE-agent",
      "product": "mini-swe-agent",
      "cwe": "CWE-526",
      "title": "mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108592"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-108595",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pulseaiclub",
      "product": "phi",
      "cwe": "CWE-863",
      "title": "Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108595"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-108596",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openlit",
      "product": "openlit",
      "cwe": "CWE-639",
      "title": "OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108596"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-42419",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SwishFolio",
      "product": "Swish Migrate and Backup",
      "cwe": "CWE-201",
      "title": "WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42419"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-66435",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Devin Walker",
      "product": "WP Rollback",
      "cwe": "CWE-201",
      "title": "WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66435"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-108591",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "innocommerce",
      "product": "InnoShop",
      "cwe": "CWE-73",
      "title": "InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108591"
    },
    {
      "rank": 317,
      "cve_id": "CVE-2026-108597",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cohere-ai",
      "product": "cohere-python",
      "cwe": "CWE-22",
      "title": "Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108597"
    },
    {
      "rank": 318,
      "cve_id": "CVE-2026-108604",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TabularisDB",
      "product": "tabularis",
      "cwe": "CWE-863",
      "title": "Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108604"
    },
    {
      "rank": 319,
      "cve_id": "CVE-2026-108599",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "pulseaiclub",
      "product": "phi",
      "cwe": "CWE-59",
      "title": "Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108599"
    },
    {
      "rank": 320,
      "cve_id": "CVE-2026-108600",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-multi-agent",
      "product": "open-multi-agent",
      "cwe": "CWE-59",
      "title": "open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108600"
    },
    {
      "rank": 321,
      "cve_id": "CVE-2026-107434",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "videowhisper",
      "product": "MicroPayments",
      "cwe": "CWE-1284",
      "title": "WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107434"
    },
    {
      "rank": 322,
      "cve_id": "CVE-2026-66480",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "YITH",
      "product": "YITH WooCommerce Product Add-Ons",
      "cwe": "CWE-497",
      "title": "WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66480"
    },
    {
      "rank": 323,
      "cve_id": "CVE-2026-107420",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Narinder Singh",
      "product": "Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway",
      "cwe": "CWE-345",
      "title": "WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107420"
    },
    {
      "rank": 324,
      "cve_id": "CVE-2026-108114",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "strapi",
      "product": "strapi",
      "cwe": "CWE-863",
      "title": "Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108114"
    },
    {
      "rank": 325,
      "cve_id": "CVE-2026-108165",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "immich-app",
      "product": "immich",
      "cwe": "CWE-862",
      "title": "Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108165"
    },
    {
      "rank": 326,
      "cve_id": "CVE-2026-108585",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "argoproj-labs",
      "product": "argocd-mcp",
      "cwe": "CWE-22",
      "title": "argocd-mcp through 0.9.0 Path Traversal via delete_application Tool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108585"
    },
    {
      "rank": 327,
      "cve_id": "CVE-2026-108586",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1mcp-app",
      "product": "@1mcp/agent",
      "cwe": "CWE-863",
      "title": "1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108586"
    },
    {
      "rank": 328,
      "cve_id": "CVE-2026-108602",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Helicone",
      "product": "helicone",
      "cwe": "CWE-918",
      "title": "Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108602"
    },
    {
      "rank": 329,
      "cve_id": "CVE-2026-108605",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108605"
    },
    {
      "rank": 330,
      "cve_id": "CVE-2026-108606",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108606"
    },
    {
      "rank": 331,
      "cve_id": "CVE-2026-108607",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108607"
    },
    {
      "rank": 332,
      "cve_id": "CVE-2026-108608",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108608"
    },
    {
      "rank": 333,
      "cve_id": "CVE-2026-108609",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108609"
    },
    {
      "rank": 334,
      "cve_id": "CVE-2026-108610",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108610"
    },
    {
      "rank": 335,
      "cve_id": "CVE-2026-108611",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108611"
    },
    {
      "rank": 336,
      "cve_id": "CVE-2026-108612",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108612"
    },
    {
      "rank": 337,
      "cve_id": "CVE-2026-108613",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108613"
    },
    {
      "rank": 338,
      "cve_id": "CVE-2026-108614",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108614"
    },
    {
      "rank": 339,
      "cve_id": "CVE-2026-108615",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108615"
    },
    {
      "rank": 340,
      "cve_id": "CVE-2026-108616",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108616"
    },
    {
      "rank": 341,
      "cve_id": "CVE-2026-108617",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108617"
    },
    {
      "rank": 342,
      "cve_id": "CVE-2026-108618",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108618"
    },
    {
      "rank": 343,
      "cve_id": "CVE-2026-108619",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108619"
    },
    {
      "rank": 344,
      "cve_id": "CVE-2026-108620",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108620"
    },
    {
      "rank": 345,
      "cve_id": "CVE-2026-108621",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108621"
    },
    {
      "rank": 346,
      "cve_id": "CVE-2026-108622",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108622"
    },
    {
      "rank": 347,
      "cve_id": "CVE-2026-108624",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108624"
    },
    {
      "rank": 348,
      "cve_id": "CVE-2026-108625",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108625"
    },
    {
      "rank": 349,
      "cve_id": "CVE-2026-108626",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108626"
    },
    {
      "rank": 350,
      "cve_id": "CVE-2026-108627",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108627"
    },
    {
      "rank": 351,
      "cve_id": "CVE-2026-108629",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108629"
    },
    {
      "rank": 352,
      "cve_id": "CVE-2026-108630",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108630"
    },
    {
      "rank": 353,
      "cve_id": "CVE-2026-108631",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108631"
    },
    {
      "rank": 354,
      "cve_id": "CVE-2026-108632",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108632"
    },
    {
      "rank": 355,
      "cve_id": "CVE-2026-108633",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108633"
    },
    {
      "rank": 356,
      "cve_id": "CVE-2026-108634",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108634"
    },
    {
      "rank": 357,
      "cve_id": "CVE-2026-108635",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108635"
    },
    {
      "rank": 358,
      "cve_id": "CVE-2026-108636",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108636"
    },
    {
      "rank": 359,
      "cve_id": "CVE-2026-108637",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108637"
    },
    {
      "rank": 360,
      "cve_id": "CVE-2026-108638",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108638"
    },
    {
      "rank": 361,
      "cve_id": "CVE-2026-108639",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108639"
    },
    {
      "rank": 362,
      "cve_id": "CVE-2026-108640",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108640"
    },
    {
      "rank": 363,
      "cve_id": "CVE-2026-108641",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108641"
    },
    {
      "rank": 364,
      "cve_id": "CVE-2026-108642",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108642"
    },
    {
      "rank": 365,
      "cve_id": "CVE-2026-108643",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108643"
    },
    {
      "rank": 366,
      "cve_id": "CVE-2026-108644",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108644"
    },
    {
      "rank": 367,
      "cve_id": "CVE-2026-108645",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108645"
    },
    {
      "rank": 368,
      "cve_id": "CVE-2026-108646",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108646"
    },
    {
      "rank": 369,
      "cve_id": "CVE-2026-108647",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108647"
    },
    {
      "rank": 370,
      "cve_id": "CVE-2026-108649",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108649"
    },
    {
      "rank": 371,
      "cve_id": "CVE-2026-108650",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108650"
    },
    {
      "rank": 372,
      "cve_id": "CVE-2026-108651",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108651"
    },
    {
      "rank": 373,
      "cve_id": "CVE-2026-108652",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108652"
    },
    {
      "rank": 374,
      "cve_id": "CVE-2026-108653",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108653"
    },
    {
      "rank": 375,
      "cve_id": "CVE-2026-108654",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108654"
    },
    {
      "rank": 376,
      "cve_id": "CVE-2026-108655",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108655"
    },
    {
      "rank": 377,
      "cve_id": "CVE-2026-108656",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108656"
    },
    {
      "rank": 378,
      "cve_id": "CVE-2026-108658",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108658"
    },
    {
      "rank": 379,
      "cve_id": "CVE-2026-108659",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108659"
    },
    {
      "rank": 380,
      "cve_id": "CVE-2026-108660",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108660"
    },
    {
      "rank": 381,
      "cve_id": "CVE-2026-108662",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108662"
    },
    {
      "rank": 382,
      "cve_id": "CVE-2026-108663",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108663"
    },
    {
      "rank": 383,
      "cve_id": "CVE-2026-108664",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108664"
    },
    {
      "rank": 384,
      "cve_id": "CVE-2026-108665",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108665"
    },
    {
      "rank": 385,
      "cve_id": "CVE-2026-108666",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108666"
    },
    {
      "rank": 386,
      "cve_id": "CVE-2026-108667",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108667"
    },
    {
      "rank": 387,
      "cve_id": "CVE-2026-108668",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108668"
    },
    {
      "rank": 388,
      "cve_id": "CVE-2026-108669",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108669"
    },
    {
      "rank": 389,
      "cve_id": "CVE-2026-108670",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108670"
    },
    {
      "rank": 390,
      "cve_id": "CVE-2026-108672",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108672"
    },
    {
      "rank": 391,
      "cve_id": "CVE-2026-108673",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108673"
    },
    {
      "rank": 392,
      "cve_id": "CVE-2026-108674",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108674"
    },
    {
      "rank": 393,
      "cve_id": "CVE-2026-108675",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108675"
    },
    {
      "rank": 394,
      "cve_id": "CVE-2026-108676",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108676"
    },
    {
      "rank": 395,
      "cve_id": "CVE-2026-108678",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108678"
    },
    {
      "rank": 396,
      "cve_id": "CVE-2026-108679",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108679"
    },
    {
      "rank": 397,
      "cve_id": "CVE-2026-108680",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108680"
    },
    {
      "rank": 398,
      "cve_id": "CVE-2026-108603",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "addsumtech",
      "product": "slide-maker",
      "cwe": "CWE-22",
      "title": "slide-maker through 5.8.0 Path Traversal via generate_images_openai.py",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108603"
    },
    {
      "rank": 399,
      "cve_id": "CVE-2026-103685",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VillaTheme",
      "product": "ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce",
      "cwe": "CWE-862",
      "title": "WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103685"
    },
    {
      "rank": 400,
      "cve_id": "CVE-2026-108115",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "kortix-ai",
      "product": "suna",
      "cwe": "CWE-918",
      "title": "Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108115"
    },
    {
      "rank": 401,
      "cve_id": "CVE-2026-108555",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "schlagmichdoch",
      "product": "PairDrop",
      "cwe": "CWE-348",
      "title": "PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108555"
    },
    {
      "rank": 402,
      "cve_id": "CVE-2026-108579",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Openpanel-dev",
      "product": "openpanel",
      "cwe": "CWE-1236",
      "title": "OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108579"
    },
    {
      "rank": 403,
      "cve_id": "CVE-2026-108583",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "54yyyu",
      "product": "zotero-mcp",
      "cwe": "CWE-918",
      "title": "zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108583"
    },
    {
      "rank": 404,
      "cve_id": "CVE-2026-108594",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mealie-recipes",
      "product": "mealie",
      "cwe": "CWE-918",
      "title": "Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108594"
    },
    {
      "rank": 405,
      "cve_id": "CVE-2013-10076",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "ExtUtils-Typemaps-Default",
      "cwe": "CWE-191",
      "title": "ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-10076"
    },
    {
      "rank": 406,
      "cve_id": "CVE-2026-103501",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache DataSketches",
      "cwe": "CWE-122",
      "title": "Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103501"
    },
    {
      "rank": 407,
      "cve_id": "CVE-2026-103513",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache DataSketches",
      "cwe": "CWE-125",
      "title": "Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103513"
    },
    {
      "rank": 408,
      "cve_id": "CVE-2026-103635",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache DataSketches",
      "cwe": "CWE-125",
      "title": "Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103635"
    },
    {
      "rank": 409,
      "cve_id": "CVE-2026-103636",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache DataSketches",
      "cwe": "CWE-125",
      "title": "Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103636"
    },
    {
      "rank": 410,
      "cve_id": "CVE-2026-107373",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "ExtUtils-Typemaps-Default",
      "cwe": "CWE-125",
      "title": "ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107373"
    },
    {
      "rank": 411,
      "cve_id": "CVE-2026-107794",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": null,
      "product": "ExtUtils-Typemaps-Default",
      "cwe": "CWE-191",
      "title": "ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107794"
    }
  ],
  "transactions": [
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-8511",
      "detail": "RESCORED — CVE-2025-8511 (Portabilis i-Diario). CVSS 5.1 → 2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-8786",
      "detail": "RESCORED — CVE-2025-8786 (Portabilis i-Diario). CVSS 5.1 → 2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-8787",
      "detail": "RESCORED — CVE-2025-8787 (Portabilis i-Diario). CVSS 5.1 → 2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-11888",
      "detail": "RESCORED — CVE-2026-11888 (IBM Security Verify Access). CVSS 6.4 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-12109",
      "detail": "RESCORED — CVE-2026-12109 (IBM Security Verify Access). CVSS 5.5 → 7.2 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-16823",
      "detail": "RESCORED — CVE-2026-16823 (IBM Security Verify Access). CVSS 9.1 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-16916",
      "detail": "RESCORED — CVE-2026-16916 (IBM Security Verify Access). CVSS 9.1 → 8.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-19491",
      "detail": "RESCORED — CVE-2026-19491 (IBM Security Verify Access). CVSS 9.1 → 7.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-19494",
      "detail": "RESCORED — CVE-2026-19494 (IBM Security Verify Access). CVSS 8.1 → 6.5 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-82334",
      "detail": "RESCORED — CVE-2026-82334 (IBM Guardium Data Protection). CVSS 8.1 → 9.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-82335",
      "detail": "RESCORED — CVE-2026-82335 (IBM Guardium Data Protection). CVSS 8.1 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-82344",
      "detail": "RESCORED — CVE-2026-82344 (IBM Guardium Data Protection). CVSS 8.1 → 9.8 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-84250",
      "detail": "RESCORED — CVE-2026-84250 (IBM Guardium Data Protection). CVSS 8.4 → 7.8 (NVD)."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}