{
  "day": "2026-10-11",
  "boundary": "UTC calendar day",
  "published_count": 233,
  "by_severity": {
    "CRITICAL": 16,
    "HIGH": 73,
    "MEDIUM": 106,
    "LOW": 38
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 0,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-108576",
      "cvss_base": 10,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.02451,
      "epss_percentile": 0.8395,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TOZED",
      "product": "X300",
      "cwe": "CWE-77",
      "title": "TOZED X300 IPPingDiagnostics process_ping os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108576"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-108540",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.01703,
      "epss_percentile": 0.7663,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenSpug",
      "product": "Spug",
      "cwe": "CWE-77",
      "title": "OpenSpug File Transfer transfer os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108540"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-108963",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01685,
      "epss_percentile": 0.76378,
      "kev": false,
      "kev_due_at": null,
      "vendor": "David-Crty",
      "product": "databasement",
      "cwe": "CWE-88",
      "title": "databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108963"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-108772",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00704,
      "epss_percentile": 0.52005,
      "kev": false,
      "kev_due_at": null,
      "vendor": "bleenco",
      "product": "abstruse",
      "cwe": "CWE-22",
      "title": "bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108772"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-104028",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00553,
      "epss_percentile": 0.44586,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Anton Extensions",
      "cwe": "CWE-434",
      "title": "Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104028"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-108707",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00552,
      "epss_percentile": 0.4453,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WuKongOpenSource",
      "product": "Wukong_HRM",
      "cwe": "CWE-287",
      "title": "Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108707"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-108744",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00547,
      "epss_percentile": 0.44214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MinaSaad1",
      "product": "pbi-cli",
      "cwe": "CWE-78",
      "title": "pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108744"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-108859",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00545,
      "epss_percentile": 0.4414,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mark3labs",
      "product": "mcp-go",
      "cwe": "CWE-770",
      "title": "mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108859"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-108567",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00531,
      "epss_percentile": 0.43231,
      "kev": false,
      "kev_due_at": null,
      "vendor": "InstantSoft",
      "product": "icms2",
      "cwe": "CWE-22",
      "title": "InstantSoft icms2 Image image.php files_delete_file path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108567"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-108976",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00505,
      "epss_percentile": 0.41371,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GNU",
      "product": "Emacs",
      "cwe": "CWE-184",
      "title": "GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108976"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-108578",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00485,
      "epss_percentile": 0.39932,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Neterbit",
      "product": "NW-431F",
      "cwe": "CWE-200",
      "title": "Neterbit NW-431F Embedded Web Server sms.json information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108578"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-108860",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00476,
      "epss_percentile": 0.39334,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SciSharp",
      "product": "BotSharp",
      "cwe": "CWE-321",
      "title": "BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108860"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-108681",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00451,
      "epss_percentile": 0.3732,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhayujie",
      "product": "CowAgent",
      "cwe": "CWE-404",
      "title": "zhayujie CowAgent Web Console web_channel.py denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108681"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-108768",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00451,
      "epss_percentile": 0.37321,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhayujie",
      "product": "CowAgent",
      "cwe": "CWE-400",
      "title": "zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108768"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-108769",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00451,
      "epss_percentile": 0.3732,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhayujie",
      "product": "CowAgent",
      "cwe": "CWE-404",
      "title": "zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108769"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-108863",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00423,
      "epss_percentile": 0.34718,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Katanemo",
      "product": "Plano",
      "cwe": "CWE-306",
      "title": "Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108863"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-108522",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00419,
      "epss_percentile": 0.3433,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Studio-Saelix",
      "product": "Sencho",
      "cwe": "CWE-287",
      "title": "Studio-Saelix Sencho Login Endpoint login improper authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108522"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-108770",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00406,
      "epss_percentile": 0.32897,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Appwrite",
      "cwe": "CWE-918",
      "title": "Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108770"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-108682",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00398,
      "epss_percentile": 0.32012,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhayujie",
      "product": "CowAgent",
      "cwe": "CWE-404",
      "title": "zhayujie CowAgent Web Console upload read denial of service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108682"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-108902",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00375,
      "epss_percentile": 0.29499,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ph7software",
      "product": "ph7builder",
      "cwe": "CWE-22",
      "title": "pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108902"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-108913",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00368,
      "epss_percentile": 0.28785,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Omarchy",
      "product": "Omarchy",
      "cwe": "CWE-829",
      "title": "omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108913"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-87762",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00361,
      "epss_percentile": 0.2796,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Adwised Web Push Notification",
      "cwe": "CWE-79",
      "title": "Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87762"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-108584",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0036,
      "epss_percentile": 0.27833,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FunnyWolf",
      "product": "Viper",
      "cwe": "CWE-259",
      "title": "FunnyWolf Viper config hard-coded credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108584"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-108714",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00358,
      "epss_percentile": 0.27586,
      "kev": false,
      "kev_due_at": null,
      "vendor": "modelcontextprotocol",
      "product": "kotlin-sdk",
      "cwe": "CWE-770",
      "title": "MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108714"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-108710",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00349,
      "epss_percentile": 0.26589,
      "kev": false,
      "kev_due_at": null,
      "vendor": "orneryd",
      "product": "NornicDB",
      "cwe": "CWE-862",
      "title": "NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108710"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-108753",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00342,
      "epss_percentile": 0.2581,
      "kev": false,
      "kev_due_at": null,
      "vendor": "agnaistic",
      "product": "agnai",
      "cwe": "CWE-798",
      "title": "Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108753"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-84734",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00341,
      "epss_percentile": 0.25709,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Mindstien Quick Login",
      "cwe": "CWE-287",
      "title": "Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84734"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-84737",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00341,
      "epss_percentile": 0.25709,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Freeton WP",
      "cwe": "CWE-287",
      "title": "Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84737"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-85118",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00341,
      "epss_percentile": 0.2571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "AI Content Generator Marketing",
      "cwe": "CWE-269",
      "title": "AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85118"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-86798",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0034,
      "epss_percentile": 0.25532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "HootBoard",
      "cwe": "CWE-79",
      "title": "HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86798"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-87760",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0034,
      "epss_percentile": 0.25532,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Web Vitals Tracking",
      "cwe": "CWE-79",
      "title": "Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87760"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-108543",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00339,
      "epss_percentile": 0.2544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ag2ai",
      "product": "ag2",
      "cwe": "CWE-22",
      "title": "ag2ai ag2 UserProxyAgent os.path.join path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108543"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-14854",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00338,
      "epss_percentile": 0.25349,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WooCommerce Bookings",
      "cwe": "CWE-400",
      "title": "WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14854"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-108544",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00335,
      "epss_percentile": 0.24935,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Lippu",
      "product": "Docx Reader Office Viewer App",
      "cwe": "CWE-22",
      "title": "Lippu Docx Reader Office Viewer App path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108544"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-108740",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00328,
      "epss_percentile": 0.24039,
      "kev": false,
      "kev_due_at": null,
      "vendor": "arp242",
      "product": "GoatCounter",
      "cwe": "CWE-915",
      "title": "GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108740"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-108865",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00324,
      "epss_percentile": 0.23528,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AmoyLab",
      "product": "Unla",
      "cwe": "CWE-287",
      "title": "AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108865"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-81420",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00324,
      "epss_percentile": 0.23567,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Tcard WP",
      "cwe": "CWE-89",
      "title": "Tcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81420"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-103695",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00324,
      "epss_percentile": 0.23568,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Mobile builder",
      "cwe": "CWE-89",
      "title": "Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103695"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-108739",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00323,
      "epss_percentile": 0.23401,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openagents-org",
      "product": "OpenAgents",
      "cwe": "CWE-306",
      "title": "OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108739"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-108724",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00323,
      "epss_percentile": 0.23396,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Sylius",
      "product": "Sylius",
      "cwe": "CWE-639",
      "title": "Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108724"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-108759",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00321,
      "epss_percentile": 0.23176,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EricLBuehler",
      "product": "mistral.rs",
      "cwe": "CWE-59",
      "title": "mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108759"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-108571",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00318,
      "epss_percentile": 0.22883,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Xinhu",
      "product": "Rainrock RockOA",
      "cwe": "CWE-74",
      "title": "Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108571"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-85126",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00316,
      "epss_percentile": 0.22716,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Crowdfundly",
      "cwe": "CWE-269",
      "title": "Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85126"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-104680",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00316,
      "epss_percentile": 0.22715,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Envira Gallery",
      "cwe": "CWE-269",
      "title": "Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104680"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-108904",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00316,
      "epss_percentile": 0.22618,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ph7software",
      "product": "ph7builder",
      "cwe": "CWE-522",
      "title": "pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108904"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-108755",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00315,
      "epss_percentile": 0.22515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hatchet-dev",
      "product": "hatchet",
      "cwe": "CWE-770",
      "title": "Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108755"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-108683",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0031,
      "epss_percentile": 0.21977,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zhayujie",
      "product": "CowAgent",
      "cwe": "CWE-400",
      "title": "zhayujie CowAgent Media Download memory allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108683"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-85121",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00309,
      "epss_percentile": 0.21922,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Insurify",
      "cwe": "CWE-862",
      "title": "Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85121"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-86706",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00309,
      "epss_percentile": 0.21922,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Quick quotes",
      "cwe": "CWE-862",
      "title": "Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86706"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-86717",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00309,
      "epss_percentile": 0.21923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Insurify",
      "cwe": "CWE-862",
      "title": "Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86717"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-108905",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00306,
      "epss_percentile": 0.21611,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ph7software",
      "product": "ph7builder",
      "cwe": "CWE-798",
      "title": "pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108905"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-84258",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00303,
      "epss_percentile": 0.21311,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to Ninja Forms",
      "cwe": "CWE-79",
      "title": "click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84258"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-84259",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00303,
      "epss_percentile": 0.2131,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to WPForms",
      "cwe": "CWE-79",
      "title": "click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84259"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-84260",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00303,
      "epss_percentile": 0.2131,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to Gravity Forms",
      "cwe": "CWE-79",
      "title": "click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84260"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-84261",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00303,
      "epss_percentile": 0.21311,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to Contact Form 7",
      "cwe": "CWE-79",
      "title": "click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84261"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-108774",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00303,
      "epss_percentile": 0.21267,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-89",
      "title": "erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108774"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-108775",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00303,
      "epss_percentile": 0.21266,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-89",
      "title": "erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108775"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-108569",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00303,
      "epss_percentile": 0.21266,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Furion",
      "product": ".NET Framework",
      "cwe": "CWE-74",
      "title": "Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108569"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-108748",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00301,
      "epss_percentile": 0.21086,
      "kev": false,
      "kev_due_at": null,
      "vendor": "quarkiverse",
      "product": "quarkus-langchain4j",
      "cwe": "CWE-401",
      "title": "Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108748"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-108539",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00301,
      "epss_percentile": 0.21025,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "GPAC",
      "cwe": "CWE-119",
      "title": "GPAC MP4Box filter_queue.c gf_fq_pop use after free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108539"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-108749",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00296,
      "epss_percentile": 0.20516,
      "kev": false,
      "kev_due_at": null,
      "vendor": "docling-project",
      "product": "docling-serve",
      "cwe": "CWE-306",
      "title": "docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108749"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-108853",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00294,
      "epss_percentile": 0.20348,
      "kev": false,
      "kev_due_at": null,
      "vendor": "UnicomAI",
      "product": "Wanwu",
      "cwe": "CWE-639",
      "title": "UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108853"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-108729",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00293,
      "epss_percentile": 0.20185,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cortezaproject",
      "product": "corteza",
      "cwe": "CWE-863",
      "title": "Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108729"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-108577",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00293,
      "epss_percentile": 0.20238,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Konstanty Bialkowski",
      "product": "libmodplug",
      "cwe": "CWE-400",
      "title": "Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108577"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-81649",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00291,
      "epss_percentile": 0.19999,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Fundiin cho WooCommerce",
      "cwe": "CWE-863",
      "title": "Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81649"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-12980",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0029,
      "epss_percentile": 0.19929,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Post Snippets",
      "cwe": "CWE-79",
      "title": "Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12980"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-81153",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0029,
      "epss_percentile": 0.19928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Robo Gallery",
      "cwe": "CWE-79",
      "title": "Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81153"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-81154",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0029,
      "epss_percentile": 0.19928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Robo Gallery",
      "cwe": "CWE-79",
      "title": "Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81154"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-81155",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0029,
      "epss_percentile": 0.19928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Robo Gallery",
      "cwe": "CWE-79",
      "title": "Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81155"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-81156",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0029,
      "epss_percentile": 0.19928,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Robo Gallery",
      "cwe": "CWE-79",
      "title": "Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81156"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-103694",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00286,
      "epss_percentile": 0.1948,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Mobile builder",
      "cwe": "CWE-269",
      "title": "Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103694"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-108708",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00283,
      "epss_percentile": 0.19236,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WuKongOpenSource",
      "product": "Wukong_HRM",
      "cwe": "CWE-862",
      "title": "Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108708"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-108746",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00283,
      "epss_percentile": 0.19236,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Vearch",
      "product": "vearch",
      "cwe": "CWE-863",
      "title": "Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108746"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-107761",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00283,
      "epss_percentile": 0.19237,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitroomHQ",
      "product": "postiz-app",
      "cwe": "CWE-201",
      "title": "Channel tokens and organization API key exposed in API responses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107761"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-88827",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00282,
      "epss_percentile": 0.19077,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Disable Users",
      "cwe": "CWE-287",
      "title": "Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88827"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-108719",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00282,
      "epss_percentile": 0.19108,
      "kev": false,
      "kev_due_at": null,
      "vendor": "theopenco",
      "product": "LLMGateway",
      "cwe": "CWE-918",
      "title": "LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108719"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-59508",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0028,
      "epss_percentile": 0.18838,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Interuse",
      "product": "i-Bos",
      "cwe": "CWE-89",
      "title": "Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59508"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-87761",
      "cvss_base": 8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00279,
      "epss_percentile": 0.1873,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Adwised Web Push Notification",
      "cwe": "CWE-79",
      "title": "Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87761"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-108711",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00277,
      "epss_percentile": 0.18604,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Plastic Labs",
      "product": "honcho",
      "cwe": "CWE-863",
      "title": "Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108711"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-108712",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00277,
      "epss_percentile": 0.18604,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SuiteCRM",
      "product": "SuiteCRM",
      "cwe": "CWE-862",
      "title": "SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108712"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-108720",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00277,
      "epss_percentile": 0.18604,
      "kev": false,
      "kev_due_at": null,
      "vendor": "phpipam",
      "product": "phpipam",
      "cwe": "CWE-862",
      "title": "phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108720"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-108732",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00277,
      "epss_percentile": 0.18604,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "hrms",
      "cwe": "CWE-862",
      "title": "Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108732"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-87764",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00276,
      "epss_percentile": 0.18472,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "BuddyPress Instant Chat",
      "cwe": "CWE-79",
      "title": "BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87764"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-88903",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00276,
      "epss_percentile": 0.18473,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Topcontent",
      "cwe": "CWE-79",
      "title": "Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88903"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-88905",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00276,
      "epss_percentile": 0.18472,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "KeyWord Collector",
      "cwe": "CWE-79",
      "title": "KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88905"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-96227",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00276,
      "epss_percentile": 0.18472,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Piotnet Forms",
      "cwe": "CWE-79",
      "title": "Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96227"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-108718",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00271,
      "epss_percentile": 0.17838,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rill Data",
      "product": "rill",
      "cwe": "CWE-862",
      "title": "Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108718"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-108903",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0027,
      "epss_percentile": 0.17768,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ph7software",
      "product": "ph7builder",
      "cwe": "CWE-807",
      "title": "pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108903"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-108695",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00269,
      "epss_percentile": 0.17559,
      "kev": false,
      "kev_due_at": null,
      "vendor": "multivendorx",
      "product": "MultiVendorX",
      "cwe": "CWE-863",
      "title": "MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108695"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-108715",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.17602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-639",
      "title": "LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108715"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-108735",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00269,
      "epss_percentile": 0.17602,
      "kev": false,
      "kev_due_at": null,
      "vendor": "miniflux",
      "product": "miniflux",
      "cwe": "CWE-918",
      "title": "Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108735"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-108727",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00268,
      "epss_percentile": 0.17474,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tianma-if",
      "product": "EdgeEver",
      "cwe": "CWE-862",
      "title": "EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108727"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-108750",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00268,
      "epss_percentile": 0.17488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenDocMan",
      "product": "OpenDocMan",
      "cwe": "CWE-409",
      "title": "OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108750"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-89232",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00267,
      "epss_percentile": 0.17352,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Recordbrowser",
      "cwe": "CWE-89",
      "title": "RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89232"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-89234",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00267,
      "epss_percentile": 0.17352,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP-Partner",
      "cwe": "CWE-89",
      "title": "WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89234"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-108717",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00264,
      "epss_percentile": 0.16942,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Combodo",
      "product": "iTop",
      "cwe": "CWE-862",
      "title": "Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108717"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-108758",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16615,
      "kev": false,
      "kev_due_at": null,
      "vendor": "alextselegidis",
      "product": "easyappointments",
      "cwe": "CWE-639",
      "title": "Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108758"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-88930",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Social Web Suite",
      "cwe": "CWE-89",
      "title": "Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88930"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-89195",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Site Setup Wizard",
      "cwe": "CWE-89",
      "title": "Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89195"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-89213",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Llavero.io",
      "cwe": "CWE-89",
      "title": "Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89213"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-89214",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.1666,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WpCues Basic Quiz",
      "cwe": "CWE-89",
      "title": "WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89214"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-89285",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16659,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Datalist it",
      "cwe": "CWE-89",
      "title": "Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89285"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-89287",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ASPL Product Quotation",
      "cwe": "CWE-89",
      "title": "ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89287"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-89297",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Loja Automática",
      "cwe": "CWE-89",
      "title": "Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89297"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-89299",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16657,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP Verify API",
      "cwe": "CWE-89",
      "title": "WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89299"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-89302",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00262,
      "epss_percentile": 0.16658,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Post Voting System",
      "cwe": "CWE-89",
      "title": "Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89302"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-108694",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0026,
      "epss_percentile": 0.16326,
      "kev": false,
      "kev_due_at": null,
      "vendor": "C4illin",
      "product": "ConvertX",
      "cwe": "CWE-73",
      "title": "ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108694"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-108713",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00259,
      "epss_percentile": 0.16268,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SuiteCRM",
      "product": "SuiteCRM",
      "cwe": "CWE-862",
      "title": "SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108713"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-108733",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00259,
      "epss_percentile": 0.16269,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "hrms",
      "cwe": "CWE-862",
      "title": "Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108733"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-108684",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00256,
      "epss_percentile": 0.15846,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "Jeewms",
      "cwe": "CWE-74",
      "title": "erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108684"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-108737",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00253,
      "epss_percentile": 0.15518,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Traccar",
      "product": "Traccar",
      "cwe": "CWE-640",
      "title": "Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108737"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-106029",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00253,
      "epss_percentile": 0.15573,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WeddingCity Lite",
      "cwe": "CWE-862",
      "title": "WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106029"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-108726",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00251,
      "epss_percentile": 0.15163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "glpi-project",
      "product": "GLPI",
      "cwe": "CWE-862",
      "title": "GLPI through 12.0.0 Missing Authorization via ajax/map.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108726"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-108730",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00251,
      "epss_percentile": 0.15163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "The-Commit-Company",
      "product": "raven",
      "cwe": "CWE-862",
      "title": "Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108730"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-108734",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00251,
      "epss_percentile": 0.15163,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "crm",
      "cwe": "CWE-862",
      "title": "Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108734"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-108839",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00251,
      "epss_percentile": 0.15206,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thClaws",
      "product": "thClaws",
      "cwe": "CWE-59",
      "title": "thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108839"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-108752",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00245,
      "epss_percentile": 0.14533,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jupyterhub",
      "product": "jupyterhub",
      "cwe": "CWE-694",
      "title": "JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108752"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-108698",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00243,
      "epss_percentile": 0.14276,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hyper-mcp-rs",
      "product": "hyper-mcp",
      "cwe": "CWE-367",
      "title": "hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108698"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-108760",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00242,
      "epss_percentile": 0.14141,
      "kev": false,
      "kev_due_at": null,
      "vendor": "llama-farm",
      "product": "llamafarm",
      "cwe": "CWE-1327",
      "title": "LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108760"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-108850",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00239,
      "epss_percentile": 0.13811,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guy-hartstein",
      "product": "company-research-agent",
      "cwe": "CWE-918",
      "title": "Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108850"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-108692",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00238,
      "epss_percentile": 0.13731,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-862",
      "title": "1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108692"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-108700",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00238,
      "epss_percentile": 0.13732,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-862",
      "title": "1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108700"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-108691",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00238,
      "epss_percentile": 0.13713,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gz-yami",
      "product": "mall4j",
      "cwe": "CWE-783",
      "title": "mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108691"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-108574",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00238,
      "epss_percentile": 0.1371,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BerriAI",
      "product": "LiteLLM",
      "cwe": "CWE-285",
      "title": "BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108574"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-108541",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00237,
      "epss_percentile": 0.1359,
      "kev": false,
      "kev_due_at": null,
      "vendor": "highwarden",
      "product": "Super Store Finder",
      "cwe": "CWE-74",
      "title": "highwarden Super Store Finder index.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108541"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2026-89304",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00234,
      "epss_percentile": 0.13206,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "paymendo",
      "cwe": "CWE-89",
      "title": "Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89304"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-108861",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00233,
      "epss_percentile": 0.13109,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erpipe-org",
      "product": "Odoo MCP",
      "cwe": "CWE-200",
      "title": "Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108861"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-108728",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00232,
      "epss_percentile": 0.12918,
      "kev": false,
      "kev_due_at": null,
      "vendor": "flyteorg",
      "product": "flyte",
      "cwe": "CWE-312",
      "title": "Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108728"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-108722",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00232,
      "epss_percentile": 0.12971,
      "kev": false,
      "kev_due_at": null,
      "vendor": "e2b-dev",
      "product": "open-computer-use",
      "cwe": "CWE-79",
      "title": "open-computer-use through commit 610bac8 Stored XSS via log.html Session Log",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108722"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-104681",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.0023,
      "epss_percentile": 0.127,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Envira Gallery",
      "cwe": "CWE-200",
      "title": "Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104681"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-107694",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.0023,
      "epss_percentile": 0.12701,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution",
      "cwe": "CWE-200",
      "title": "Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107694"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-108757",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00229,
      "epss_percentile": 0.12622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Nexting",
      "product": "pinclaw",
      "cwe": "CWE-306",
      "title": "Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108757"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-108702",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00228,
      "epss_percentile": 0.12477,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-862",
      "title": "CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108702"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-108570",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00228,
      "epss_percentile": 0.1246,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Furion",
      "product": ".NET Framework",
      "cwe": "CWE-791",
      "title": "Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108570"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-108862",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00227,
      "epss_percentile": 0.12418,
      "kev": false,
      "kev_due_at": null,
      "vendor": "APIParkLab",
      "product": "APIPark",
      "cwe": "CWE-639",
      "title": "APIPark through 1.9.7-beta IDOR via application authorization endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108862"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-108854",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00227,
      "epss_percentile": 0.1243,
      "kev": false,
      "kev_due_at": null,
      "vendor": "UnicomAI",
      "product": "Wanwu",
      "cwe": "CWE-639",
      "title": "Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108854"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2026-108731",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00223,
      "epss_percentile": 0.1187,
      "kev": false,
      "kev_due_at": null,
      "vendor": "The-Commit-Company",
      "product": "raven",
      "cwe": "CWE-862",
      "title": "Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108731"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-108696",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00222,
      "epss_percentile": 0.11731,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CoreUnion",
      "product": "CoreShop",
      "cwe": "CWE-639",
      "title": "CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108696"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-108704",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00222,
      "epss_percentile": 0.11731,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-639",
      "title": "CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108704"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-108572",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00222,
      "epss_percentile": 0.11755,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Casdoor",
      "cwe": "CWE-918",
      "title": "Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108572"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-108856",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.0022,
      "epss_percentile": 0.11612,
      "kev": false,
      "kev_due_at": null,
      "vendor": "UnicomAI",
      "product": "Wanwu",
      "cwe": "CWE-639",
      "title": "UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108856"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-108538",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.0022,
      "epss_percentile": 0.11437,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "GPAC",
      "cwe": "CWE-119",
      "title": "GPAC MP4Box os_thread.c gf_mx_v use after free",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108538"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-108756",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00219,
      "epss_percentile": 0.11338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Abilityai",
      "product": "trinity",
      "cwe": "CWE-862",
      "title": "Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108756"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-108855",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00219,
      "epss_percentile": 0.11338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "UnicomAI",
      "product": "Wanwu",
      "cwe": "CWE-862",
      "title": "UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108855"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-104684",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00218,
      "epss_percentile": 0.11266,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Envira Gallery",
      "cwe": "CWE-639",
      "title": "Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104684"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-108521",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00218,
      "epss_percentile": 0.11306,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Studio-Saelix",
      "product": "Sencho",
      "cwe": "CWE-918",
      "title": "Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108521"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-19577",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00217,
      "epss_percentile": 0.11194,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-125",
      "title": "Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19577"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-108690",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00217,
      "epss_percentile": 0.11228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gz-yami",
      "product": "mall4j",
      "cwe": "CWE-783",
      "title": "mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108690"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-89283",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00215,
      "epss_percentile": 0.11028,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP Posts Password Batch Manager",
      "cwe": "CWE-862",
      "title": "WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89283"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-89305",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00215,
      "epss_percentile": 0.11014,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "paymendo",
      "cwe": "CWE-89",
      "title": "Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89305"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2026-108725",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00215,
      "epss_percentile": 0.10988,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cheshire-cat-ai",
      "product": "core",
      "cwe": "CWE-79",
      "title": "Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108725"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-108883",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00213,
      "epss_percentile": 0.10729,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108883"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-108747",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00212,
      "epss_percentile": 0.10614,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Lightdash",
      "product": "lightdash",
      "cwe": "CWE-639",
      "title": "Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108747"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-108877",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.10546,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108877"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-108882",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.10547,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108882"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-108884",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.10548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108884"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-108885",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.10548,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108885"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-108688",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00208,
      "epss_percentile": 0.10105,
      "kev": false,
      "kev_due_at": null,
      "vendor": "elunez",
      "product": "eladmin",
      "cwe": "CWE-862",
      "title": "Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108688"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-108745",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00207,
      "epss_percentile": 0.09923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DBeaver",
      "product": "CloudBeaver",
      "cwe": "CWE-862",
      "title": "CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108745"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-108736",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.09745,
      "kev": false,
      "kev_due_at": null,
      "vendor": "alexjustesen",
      "product": "speedtest-tracker",
      "cwe": "CWE-348",
      "title": "Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108736"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-108868",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.09796,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108868"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-108869",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00206,
      "epss_percentile": 0.09796,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108869"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-108925",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00205,
      "epss_percentile": 0.09624,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cohesity",
      "product": "NetBackup Administration Console web interface",
      "cwe": "CWE-80",
      "title": "Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108925"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-104682",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00205,
      "epss_percentile": 0.09638,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Envira Gallery",
      "cwe": "CWE-862",
      "title": "Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104682"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-107507",
      "cvss_base": 2.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00205,
      "epss_percentile": 0.09637,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Squadeno",
      "cwe": "CWE-863",
      "title": "Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107507"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-108542",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00201,
      "epss_percentile": 0.09231,
      "kev": false,
      "kev_due_at": null,
      "vendor": "021is",
      "product": "elvix-sdk",
      "cwe": "CWE-918",
      "title": "021is elvix-sdk MCP Request index.ts server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108542"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-108575",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00201,
      "epss_percentile": 0.09229,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BerriAI",
      "product": "LiteLLM",
      "cwe": "CWE-266",
      "title": "BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108575"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-108716",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.002,
      "epss_percentile": 0.09038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "punkpeye",
      "product": "mcp-remote",
      "cwe": "CWE-319",
      "title": "mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108716"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2026-108697",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00199,
      "epss_percentile": 0.08994,
      "kev": false,
      "kev_due_at": null,
      "vendor": "CoreShop",
      "product": "CoreShop",
      "cwe": "CWE-862",
      "title": "CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108697"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2026-108566",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00199,
      "epss_percentile": 0.08902,
      "kev": false,
      "kev_due_at": null,
      "vendor": "InstantSoft",
      "product": "icms2",
      "cwe": "CWE-79",
      "title": "InstantSoft icms2 Private Message index.tpl.php index cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108566"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2026-108701",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00196,
      "epss_percentile": 0.08552,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-862",
      "title": "1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108701"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-108705",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00196,
      "epss_percentile": 0.08552,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-862",
      "title": "CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108705"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-108742",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00196,
      "epss_percentile": 0.08554,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DBeaver",
      "product": "CloudBeaver",
      "cwe": "CWE-862",
      "title": "CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108742"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-108706",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.0824,
      "kev": false,
      "kev_due_at": null,
      "vendor": "elunez",
      "product": "eladmin",
      "cwe": "CWE-862",
      "title": "eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108706"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-108866",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108866"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-108867",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108867"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-108878",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08234,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108878"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-108879",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.0824,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-639",
      "title": "JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108879"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-108881",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.0824,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108881"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-108886",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08238,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108886"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-108887",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.0824,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108887"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-108888",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08237,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108888"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-108891",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108891"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-108777",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00192,
      "epss_percentile": 0.08189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-89",
      "title": "erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108777"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-108778",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00192,
      "epss_percentile": 0.08189,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-89",
      "title": "erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108778"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-108773",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00192,
      "epss_percentile": 0.08188,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-74",
      "title": "erzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108773"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-108872",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.07917,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108872"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-108873",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.07918,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108873"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-108874",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.07916,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108874"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-108875",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.07917,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108875"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-108876",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.07918,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108876"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-108880",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0019,
      "epss_percentile": 0.07915,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108880"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-84251",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00185,
      "epss_percentile": 0.0741,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to Ninja Forms",
      "cwe": "CWE-862",
      "title": "click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84251"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-84252",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00185,
      "epss_percentile": 0.07409,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to WPForms",
      "cwe": "CWE-862",
      "title": "click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84252"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-84253",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00185,
      "epss_percentile": 0.07409,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to Gravity Forms",
      "cwe": "CWE-862",
      "title": "click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84253"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-84254",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00185,
      "epss_percentile": 0.07409,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "click5 CRM add-on to Contact Form 7",
      "cwe": "CWE-862",
      "title": "click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84254"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-108852",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00185,
      "epss_percentile": 0.0741,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OvidijusParsiunas",
      "product": "Deep Chat",
      "cwe": "CWE-79",
      "title": "Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108852"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-108741",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00182,
      "epss_percentile": 0.07134,
      "kev": false,
      "kev_due_at": null,
      "vendor": "shepherd-agents",
      "product": "Shepherd",
      "cwe": "CWE-367",
      "title": "Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108741"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-19935",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00179,
      "epss_percentile": 0.06858,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-416",
      "title": "Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19935"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-93550",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00176,
      "epss_percentile": 0.06611,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Veeqo for WooCommerce",
      "cwe": "CWE-434",
      "title": "Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93550"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-97183",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00176,
      "epss_percentile": 0.06612,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP-Invoice",
      "cwe": "CWE-200",
      "title": "WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97183"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2026-108689",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00171,
      "epss_percentile": 0.05978,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WuKongOpenSource",
      "product": "Wukong AICRM",
      "cwe": "CWE-639",
      "title": "Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108689"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-108703",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00171,
      "epss_percentile": 0.0598,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1Panel-dev",
      "product": "CordysCRM",
      "cwe": "CWE-862",
      "title": "CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108703"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-108870",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00171,
      "epss_percentile": 0.05979,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108870"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-108871",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00171,
      "epss_percentile": 0.05978,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jeecgboot",
      "product": "JeecgBoot",
      "cwe": "CWE-862",
      "title": "JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108871"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-19576",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00169,
      "epss_percentile": 0.05753,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-787",
      "title": "Stack out-of-bounds write in the Goodix GT911 touch controller driver from an unvalidated device-reported touch point count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19576"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-108573",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00169,
      "epss_percentile": 0.05724,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Open Asset Import Library",
      "product": "Assimp",
      "cwe": "CWE-119",
      "title": "Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108573"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-108864",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00169,
      "epss_percentile": 0.05711,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iflytek",
      "product": "astron-agent",
      "cwe": "CWE-639",
      "title": "iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108864"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-103305",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00167,
      "epss_percentile": 0.05439,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Prenotazioni",
      "cwe": "CWE-79",
      "title": "Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103305"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-91829",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00164,
      "epss_percentile": 0.051,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Subscribe to Comments",
      "cwe": "CWE-79",
      "title": "Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91829"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-19735",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0016,
      "epss_percentile": 0.0469,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-330",
      "title": "Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19735"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-88826",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00152,
      "epss_percentile": 0.03855,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "SmugMug Embed",
      "cwe": "CWE-79",
      "title": "SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88826"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-94235",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00152,
      "epss_percentile": 0.03839,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "MemberHero",
      "cwe": "CWE-862",
      "title": "Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94235"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-108978",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00148,
      "epss_percentile": 0.03504,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Opensource",
      "product": "rlottie",
      "cwe": "CWE-122",
      "title": "Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108978"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-108751",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00142,
      "epss_percentile": 0.03004,
      "kev": false,
      "kev_due_at": null,
      "vendor": "modu-ai",
      "product": "moai-adk",
      "cwe": "CWE-59",
      "title": "MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108751"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-108723",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00136,
      "epss_percentile": 0.02643,
      "kev": false,
      "kev_due_at": null,
      "vendor": "QingYunA",
      "product": "answer-me-with-html",
      "cwe": "CWE-59",
      "title": "answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108723"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-108568",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00133,
      "epss_percentile": 0.02466,
      "kev": false,
      "kev_due_at": null,
      "vendor": "InstantSoft",
      "product": "icms2",
      "cwe": "CWE-345",
      "title": "InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108568"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-108721",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00132,
      "epss_percentile": 0.0242,
      "kev": false,
      "kev_due_at": null,
      "vendor": "iFurySt",
      "product": "open-computer-use",
      "cwe": "CWE-178",
      "title": "Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108721"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-108693",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00127,
      "epss_percentile": 0.02088,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-427",
      "title": "ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108693"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-108699",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.00123,
      "epss_percentile": 0.01852,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hyper-mcp-rs",
      "product": "hyper-mcp",
      "cwe": "CWE-347",
      "title": "hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108699"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-19669",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.01684,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-787",
      "title": "Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19669"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-108858",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00114,
      "epss_percentile": 0.0139,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Predibase",
      "product": "LoRAX",
      "cwe": "CWE-532",
      "title": "Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108858"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-108738",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": 0.00113,
      "epss_percentile": 0.01356,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Traccar",
      "product": "Traccar",
      "cwe": "CWE-352",
      "title": "Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108738"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-19736",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00112,
      "epss_percentile": 0.01295,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19736"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-108754",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0011,
      "epss_percentile": 0.01211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tbphp",
      "product": "gpt-load",
      "cwe": "CWE-532",
      "title": "GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108754"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-108857",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0011,
      "epss_percentile": 0.01211,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Hugging Face",
      "product": "Text Embeddings Inference",
      "cwe": "CWE-532",
      "title": "Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108857"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-18418",
      "cvss_base": 3.4,
      "cvss_severity": "LOW",
      "epss_score": 0.00109,
      "epss_percentile": 0.01143,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-125",
      "title": "Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18418"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-19738",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00104,
      "epss_percentile": 0.00979,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-401",
      "title": "Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19738"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-19740",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00104,
      "epss_percentile": 0.0098,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-401",
      "title": "Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19740"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-19739",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00102,
      "epss_percentile": 0.00885,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-401",
      "title": "Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19739"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-108851",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00101,
      "epss_percentile": 0.00857,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-862",
      "title": "phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108851"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-19737",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.001,
      "epss_percentile": 0.00807,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-476",
      "title": "NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19737"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-88785",
      "cvss_base": 4.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0009,
      "epss_percentile": 0.00414,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Simple Membership",
      "cwe": "CWE-200",
      "title": "Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-88785"
    }
  ],
  "transactions": [
    {
      "type": "DISPUTED",
      "cve_id": "CVE-2026-96515",
      "detail": "DISPUTED — CVE-2026-96515 (Netlink ICT Pvt Ltd Netlink ICT HG323RW Router). Record marked disputed."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-12894",
      "detail": "PATCH SHIPPED — CVE-2026-12894 (quarkus-qute). Fixed in Red Hat Build of Apache Camel 3.33.3.SP1 3.33.3.redhat-00005."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-27408",
      "detail": "PATCH SHIPPED — CVE-2026-27408 (imithemes NativeChurch). Fixed in NativeChurch 4.9.5."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-79992",
      "detail": "PATCH SHIPPED — CVE-2026-79992 (Red Hat Enterprise Linux 8). Fixed in Red Hat Enterprise Linux 8 1:26.1-15.el8_10.2."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-86320",
      "detail": "PATCH SHIPPED — CVE-2026-86320 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:1.4.4-1.el10_2.1."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-96275",
      "detail": "PATCH SHIPPED — CVE-2026-96275 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:1.16.0-9.el10_2.4."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-96280",
      "detail": "PATCH SHIPPED — CVE-2026-96280 (Red Hat Enterprise Linux 10). Fixed in Red Hat Enterprise Linux 10 0:1.16.0-9.el10_2.4."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}