{
  "day": "2026-10-12",
  "boundary": "UTC calendar day",
  "published_count": 683,
  "by_severity": {
    "CRITICAL": 44,
    "HIGH": 264,
    "MEDIUM": 284,
    "LOW": 77
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 14,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-108804",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.02388,
      "epss_percentile": 0.8349,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TRENDnet",
      "product": "TEW-751DR",
      "cwe": "CWE-77",
      "title": "TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108804"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-108817",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.01076,
      "epss_percentile": 0.64059,
      "kev": false,
      "kev_due_at": null,
      "vendor": "agno-agi",
      "product": "agno",
      "cwe": "CWE-77",
      "title": "agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108817"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-108980",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.01063,
      "epss_percentile": 0.63708,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Blinko",
      "product": "Blinko",
      "cwe": "CWE-24",
      "title": "Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108980"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-108822",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00767,
      "epss_percentile": 0.54294,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Kamailio",
      "cwe": "CWE-119",
      "title": "Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108822"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-78355",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00722,
      "epss_percentile": 0.52691,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-22",
      "title": "Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78355"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-108784",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00571,
      "epss_percentile": 0.45645,
      "kev": false,
      "kev_due_at": null,
      "vendor": "macrozheng",
      "product": "mall",
      "cwe": "CWE-840",
      "title": "macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108784"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-108790",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00541,
      "epss_percentile": 0.43856,
      "kev": false,
      "kev_due_at": null,
      "vendor": "westboy",
      "product": "CicadasCMS",
      "cwe": "CWE-22",
      "title": "westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108790"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-108819",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0054,
      "epss_percentile": 0.43766,
      "kev": false,
      "kev_due_at": null,
      "vendor": "agno-agi",
      "product": "agno",
      "cwe": "CWE-913",
      "title": "agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108819"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-108818",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00531,
      "epss_percentile": 0.43277,
      "kev": false,
      "kev_due_at": null,
      "vendor": "agno-agi",
      "product": "agno",
      "cwe": "CWE-287",
      "title": "agno-agi agno auth.py get_authentication_dependency missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108818"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-21132",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00521,
      "epss_percentile": 0.42571,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Internet",
      "cwe": null,
      "title": "Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21132"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-108820",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00474,
      "epss_percentile": 0.39177,
      "kev": false,
      "kev_due_at": null,
      "vendor": "agno-agi",
      "product": "agno",
      "cwe": "CWE-250",
      "title": "agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108820"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-66086",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00455,
      "epss_percentile": 0.37674,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.",
      "product": "Modem",
      "cwe": "CWE-121",
      "title": "Stack-based Buffer Overflow in Modem",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66086"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-87690",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00411,
      "epss_percentile": 0.33462,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Rapid7",
      "product": "Metasploit Framework",
      "cwe": "CWE-22",
      "title": "Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87690"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-108821",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.004,
      "epss_percentile": 0.32237,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tencent",
      "product": "WeKnora",
      "cwe": "CWE-74",
      "title": "Tencent WeKnora SQL Validator inject.go validateSubquery sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108821"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-108799",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00393,
      "epss_percentile": 0.31541,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jackq",
      "product": "XCMS",
      "cwe": "CWE-74",
      "title": "jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108799"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-93582",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00392,
      "epss_percentile": 0.31323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-290",
      "title": "Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93582"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-108783",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00375,
      "epss_percentile": 0.29481,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PRVTPRO",
      "product": "Amnezia-Web-Panel",
      "cwe": "CWE-1392",
      "title": "PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108783"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-108791",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00365,
      "epss_percentile": 0.28393,
      "kev": false,
      "kev_due_at": null,
      "vendor": "westboy",
      "product": "CicadasCMS",
      "cwe": "CWE-22",
      "title": "westboy CicadasCMS Template Management input TemplateController.input path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108791"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-108801",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00333,
      "epss_percentile": 0.2458,
      "kev": false,
      "kev_due_at": null,
      "vendor": "prasathmani",
      "product": "TinyFileManager",
      "cwe": "CWE-284",
      "title": "prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108801"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-108810",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00322,
      "epss_percentile": 0.2331,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tsi-coop",
      "product": "tsi-dpdp-cms",
      "cwe": "CWE-200",
      "title": "tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108810"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-108812",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00307,
      "epss_percentile": 0.21737,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "SEMCMS",
      "cwe": "CWE-266",
      "title": "SEMCMS SEMCMS_User.php user improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108812"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-108816",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00305,
      "epss_percentile": 0.21488,
      "kev": false,
      "kev_due_at": null,
      "vendor": "agno-agi",
      "product": "agno",
      "cwe": "CWE-74",
      "title": "agno-agi agno PythonTools python.py run_python_code code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108816"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-78357",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00304,
      "epss_percentile": 0.21413,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-613",
      "title": "Insufficient Session Revocation for JWT Authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78357"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-108785",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00289,
      "epss_percentile": 0.19785,
      "kev": false,
      "kev_due_at": null,
      "vendor": "macrozheng",
      "product": "mall",
      "cwe": "CWE-613",
      "title": "macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108785"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-78356",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00283,
      "epss_percentile": 0.19197,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-497",
      "title": "Unauthenticated Disclosure of Agent Frontend Configuration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78356"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-108798",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00278,
      "epss_percentile": 0.18698,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZKTeco",
      "product": "BioTime",
      "cwe": "CWE-320",
      "title": "ZKTeco BioTime hard-coded key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108798"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2023-25996",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0027,
      "epss_percentile": 0.1772,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Pluggabl LLC.",
      "product": "Booster Elite for WooCommerce",
      "cwe": "CWE-201",
      "title": "WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25996"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-108805",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00254,
      "epss_percentile": 0.15619,
      "kev": false,
      "kev_due_at": null,
      "vendor": "krupalshah",
      "product": "EmployeeRecruitmentSystem",
      "cwe": "CWE-74",
      "title": "krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108805"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-108806",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00254,
      "epss_percentile": 0.15622,
      "kev": false,
      "kev_due_at": null,
      "vendor": "krupalshah",
      "product": "EmployeeRecruitmentSystem",
      "cwe": "CWE-74",
      "title": "krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108806"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-108807",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00254,
      "epss_percentile": 0.15619,
      "kev": false,
      "kev_due_at": null,
      "vendor": "krupalshah",
      "product": "EmployeeRecruitmentSystem",
      "cwe": "CWE-74",
      "title": "krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108807"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-109082",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00248,
      "epss_percentile": 0.14809,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Build of Keycloak",
      "cwe": "CWE-287",
      "title": "Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109082"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-108815",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.0024,
      "epss_percentile": 0.13938,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "idcCMS",
      "cwe": "CWE-79",
      "title": "idcCMS member_deal.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108815"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-108796",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00218,
      "epss_percentile": 0.11299,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZKTeco",
      "product": "BioTime",
      "cwe": "CWE-285",
      "title": "ZKTeco BioTime Biometric Data Endpoint finger_data authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108796"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-108797",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00218,
      "epss_percentile": 0.11299,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZKTeco",
      "product": "BioTime",
      "cwe": "CWE-285",
      "title": "ZKTeco BioTime Employee REST API employees authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108797"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-109080",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00215,
      "epss_percentile": 0.11014,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Flock",
      "product": "Night Shift",
      "cwe": "CWE-89",
      "title": "SQL injection in Night Shift bulk license plate search allows cross-organization data access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109080"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-107863",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00214,
      "epss_percentile": 0.10825,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Codection",
      "product": "Products Restricted Users for WooCommerce",
      "cwe": "CWE-862",
      "title": "WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107863"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-108800",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00211,
      "epss_percentile": 0.10544,
      "kev": false,
      "kev_due_at": null,
      "vendor": "yangzongzhuan",
      "product": "RuoYi",
      "cwe": "CWE-352",
      "title": "yangzongzhuan RuoYi cross-site request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108800"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-108795",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00203,
      "epss_percentile": 0.09471,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZKTeco",
      "product": "BioTime",
      "cwe": "CWE-266",
      "title": "ZKTeco BioTime System Settings API systemSettings access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108795"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-108811",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00203,
      "epss_percentile": 0.09471,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "WMCMS",
      "cwe": "CWE-200",
      "title": "WMCMS index.php information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108811"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-108803",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.0923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "y_project",
      "product": "RuoYi",
      "cwe": "CWE-613",
      "title": "y_project RuoYi Disable API add changeStatus session expiration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108803"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-108786",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00201,
      "epss_percentile": 0.0923,
      "kev": false,
      "kev_due_at": null,
      "vendor": "houtini-ai",
      "product": "seo-crawler-mcp",
      "cwe": "CWE-918",
      "title": "houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108786"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-108787",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00201,
      "epss_percentile": 0.09231,
      "kev": false,
      "kev_due_at": null,
      "vendor": "houtini-ai",
      "product": "voice-analyser-mcp",
      "cwe": "CWE-918",
      "title": "houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108787"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-108802",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00199,
      "epss_percentile": 0.089,
      "kev": false,
      "kev_due_at": null,
      "vendor": "y_project",
      "product": "RuoYi",
      "cwe": "CWE-79",
      "title": "y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108802"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-108794",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00196,
      "epss_percentile": 0.08609,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZKTeco",
      "product": "BioTime",
      "cwe": "CWE-74",
      "title": "ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108794"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-108781",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00196,
      "epss_percentile": 0.08611,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-74",
      "title": "erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108781"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-107427",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00195,
      "epss_percentile": 0.08443,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NOUS Ouvert Utile et Simple",
      "product": "Event post",
      "cwe": "CWE-639",
      "title": "WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107427"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-108779",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00192,
      "epss_percentile": 0.08191,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-74",
      "title": "erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108779"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-108782",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00192,
      "epss_percentile": 0.08191,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erzhongxmu",
      "product": "JEEWMS",
      "cwe": "CWE-74",
      "title": "erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108782"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-108813",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00192,
      "epss_percentile": 0.0819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "SEMCMS",
      "cwe": "CWE-74",
      "title": "SEMCMS SEMCMS_Download.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108813"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-108814",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00192,
      "epss_percentile": 0.0819,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "SEMCMS",
      "cwe": "CWE-74",
      "title": "SEMCMS SEMCMS_Banner.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108814"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-93581",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00189,
      "epss_percentile": 0.07809,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-1236",
      "title": "Insufficient Neutralization of Formula Elements in CSV Exports",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93581"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-21134",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00188,
      "epss_percentile": 0.07735,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Flow",
      "cwe": null,
      "title": "Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21134"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-106605",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00186,
      "epss_percentile": 0.07512,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP Desk",
      "product": "Flexible Quantity – Measurement Price Calculator for WooCommerce",
      "cwe": "CWE-1284",
      "title": "WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106605"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-107423",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00185,
      "epss_percentile": 0.07454,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP User Manager",
      "product": "WP User Manager",
      "cwe": "CWE-862",
      "title": "WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107423"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-107869",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00185,
      "epss_percentile": 0.07455,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WP Desk",
      "product": "Flexible Subscriptions",
      "cwe": "CWE-862",
      "title": "WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107869"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-108808",
      "cvss_base": 1.2,
      "cvss_severity": "LOW",
      "epss_score": 0.00184,
      "epss_percentile": 0.07309,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eleveo",
      "product": "Call Recording Software",
      "cwe": "CWE-598",
      "title": "Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108808"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-107193",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00181,
      "epss_percentile": 0.07091,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Satellite 6",
      "cwe": "CWE-639",
      "title": "Foreman: api filter lookup ignores a search-limited filter permission",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107193"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-108809",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.0018,
      "epss_percentile": 0.06933,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eleveo",
      "product": "Call Recording Software",
      "cwe": "CWE-613",
      "title": "Eleveo Call Recording Software logout session expiration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108809"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-108985",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00177,
      "epss_percentile": 0.0671,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sahlberg",
      "product": "libnfs",
      "cwe": "CWE-787",
      "title": "ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108985"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-108789",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": 0.00176,
      "epss_percentile": 0.06573,
      "kev": false,
      "kev_due_at": null,
      "vendor": "deepseek-ai",
      "product": "deepseek-harness",
      "cwe": "CWE-840",
      "title": "deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108789"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-21120",
      "cvss_base": 8.9,
      "cvss_severity": "HIGH",
      "epss_score": 0.00174,
      "epss_percentile": 0.06302,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": "CWE-416",
      "title": "Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21120"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-21124",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00174,
      "epss_percentile": 0.063,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": "CWE-20",
      "title": "Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21124"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-21125",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": 0.00174,
      "epss_percentile": 0.06301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": "CWE-20",
      "title": "Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21125"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-21114",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00174,
      "epss_percentile": 0.06301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21114"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-21122",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": 0.00174,
      "epss_percentile": 0.06301,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21122"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-21137",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00174,
      "epss_percentile": 0.06294,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Smart Switch",
      "cwe": "CWE-22",
      "title": "Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21137"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-103356",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0017,
      "epss_percentile": 0.05769,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VillaTheme",
      "product": "TMDS",
      "cwe": "CWE-862",
      "title": "WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103356"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-107429",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00166,
      "epss_percentile": 0.05338,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoWhisper.com",
      "product": "Paid Videochat Turnkey Site",
      "cwe": "CWE-1284",
      "title": "WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107429"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2025-15703",
      "cvss_base": 3.5,
      "cvss_severity": "LOW",
      "epss_score": 0.00166,
      "epss_percentile": 0.05394,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "HireZoot",
      "cwe": "CWE-79",
      "title": "WP Job Openings < 4.0.0 - Admin+ Stored XSS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15703"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-78359",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00163,
      "epss_percentile": 0.05084,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-694",
      "title": "Duplicate Identity / Identity Shadowing across CustomerUser backends",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78359"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-107864",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00161,
      "epss_percentile": 0.04707,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Igor Funa",
      "product": "Ad Inserter",
      "cwe": "CWE-79",
      "title": "WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107864"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-107865",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00161,
      "epss_percentile": 0.04708,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crocoblock",
      "product": "JetMenu",
      "cwe": "CWE-79",
      "title": "WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107865"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-107866",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00161,
      "epss_percentile": 0.04708,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Crocoblock",
      "product": "JetElements For Elementor",
      "cwe": "CWE-79",
      "title": "WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107866"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-108168",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00161,
      "epss_percentile": 0.0471,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DLX Plugins",
      "product": "Custom Query Blocks",
      "cwe": "CWE-79",
      "title": "WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108168"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-21126",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00159,
      "epss_percentile": 0.04461,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21126"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-21115",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00159,
      "epss_percentile": 0.04461,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21115"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-21116",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00159,
      "epss_percentile": 0.0446,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21116"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-21121",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00151,
      "epss_percentile": 0.0372,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21121"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-107203",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00151,
      "epss_percentile": 0.03787,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Satellite 6",
      "cwe": "CWE-863",
      "title": "Foreman: domain and subnet interface api skips host search filters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107203"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-21117",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00151,
      "epss_percentile": 0.0372,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21117"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-98385",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00145,
      "epss_percentile": 0.03266,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linux",
      "product": "Linux",
      "cwe": null,
      "title": "sched/cache: Decouple sched_cache_group from mm to fix UAF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98385"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2026-21123",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00144,
      "epss_percentile": 0.0321,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21123"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-107791",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00144,
      "epss_percentile": 0.0322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP Comment Cleaner",
      "cwe": "CWE-862",
      "title": "WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107791"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-84167",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00144,
      "epss_percentile": 0.0322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Hotel Booking",
      "cwe": "CWE-639",
      "title": "Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84167"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-21119",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00142,
      "epss_percentile": 0.03037,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21119"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-48212",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00142,
      "epss_percentile": 0.03077,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-79",
      "title": "Stored XSS in external pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48212"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-78358",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00139,
      "epss_percentile": 0.02801,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-352",
      "title": "Cross-Site Request Forgery in Administrative Actions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78358"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-107430",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00138,
      "epss_percentile": 0.02744,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoWhisper.com",
      "product": "VideoWhisper Site Manager for ChatGPT, Claude, Codex",
      "cwe": "CWE-862",
      "title": "WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107430"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-107432",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00138,
      "epss_percentile": 0.02744,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NOUS Ouvert Utile et Simple",
      "product": "Event post",
      "cwe": "CWE-862",
      "title": "WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107432"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-21133",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00137,
      "epss_percentile": 0.0266,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Flow",
      "cwe": null,
      "title": "Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21133"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-21136",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00136,
      "epss_percentile": 0.02646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Smart Switch",
      "cwe": null,
      "title": "Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21136"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-1907",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00131,
      "epss_percentile": 0.02323,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Kong",
      "product": "Kong Enterprise Gateway",
      "cwe": "CWE-89",
      "title": "SQL Injection in Clustering Communication (Hybrid Mode)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1907"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-21118",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0013,
      "epss_percentile": 0.0228,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Mobile Devices",
      "cwe": null,
      "title": "Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21118"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-21139",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": 0.0012,
      "epss_percentile": 0.01705,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Continuity Service for windows",
      "cwe": null,
      "title": "Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21139"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-21128",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00119,
      "epss_percentile": 0.01627,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Checkout",
      "cwe": null,
      "title": "Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21128"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-48211",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00117,
      "epss_percentile": 0.01547,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OTRS GmbH (former OTRS AG)",
      "product": "OTRS",
      "cwe": "CWE-352",
      "title": "Cross-Site Request Forgery in Import/Export Admin console",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48211"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-108981",
      "cvss_base": 3.6,
      "cvss_severity": "LOW",
      "epss_score": 0.00116,
      "epss_percentile": 0.01515,
      "kev": false,
      "kev_due_at": null,
      "vendor": "denji",
      "product": "ngx_cache_purge",
      "cwe": "CWE-61",
      "title": "ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat() and therefore follows symlinks.)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108981"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-107437",
      "cvss_base": 6.2,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00114,
      "epss_percentile": 0.01404,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GeoVision Inc.",
      "product": "GV-E-map Server",
      "cwe": "CWE-798",
      "title": "Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107437"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2026-21127",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00113,
      "epss_percentile": 0.01322,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Account",
      "cwe": null,
      "title": "Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21127"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-108788",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": 0.00112,
      "epss_percentile": 0.01283,
      "kev": false,
      "kev_due_at": null,
      "vendor": "deepseek-ai",
      "product": "deepseek-harness",
      "cwe": "CWE-264",
      "title": "deepseek-ai deepseek-harness Sandbox spawn sandbox",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108788"
    },
    {
      "rank": 101,
      "cve_id": "CVE-2026-66085",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00111,
      "epss_percentile": 0.01244,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.",
      "product": "Modem",
      "cwe": "CWE-20",
      "title": "Information Disclosure in Modem",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66085"
    },
    {
      "rank": 102,
      "cve_id": "CVE-2026-21129",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00111,
      "epss_percentile": 0.01235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Checkout",
      "cwe": null,
      "title": "Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21129"
    },
    {
      "rank": 103,
      "cve_id": "CVE-2026-21130",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00111,
      "epss_percentile": 0.01235,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Checkout",
      "cwe": null,
      "title": "Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21130"
    },
    {
      "rank": 104,
      "cve_id": "CVE-2026-108982",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00107,
      "epss_percentile": 0.01076,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IDRIX",
      "product": "VeraCrypt",
      "cwe": "CWE-459",
      "title": "VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108982"
    },
    {
      "rank": 105,
      "cve_id": "CVE-2026-84166",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00106,
      "epss_percentile": 0.01036,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Hotel Booking",
      "cwe": "CWE-352",
      "title": "Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84166"
    },
    {
      "rank": 106,
      "cve_id": "CVE-2026-21135",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00105,
      "epss_percentile": 0.01002,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Internet",
      "cwe": null,
      "title": "Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21135"
    },
    {
      "rank": 107,
      "cve_id": "CVE-2026-21131",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": 0.00105,
      "epss_percentile": 0.01002,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Samsung Flow",
      "cwe": null,
      "title": "Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21131"
    },
    {
      "rank": 108,
      "cve_id": "CVE-2026-21138",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00099,
      "epss_percentile": 0.00772,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Samsung Mobile",
      "product": "Smart Switch",
      "cwe": null,
      "title": "Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21138"
    },
    {
      "rank": 109,
      "cve_id": "CVE-2026-87765",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00098,
      "epss_percentile": 0.0073,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unisoc (Shanghai) Technologies Co., Ltd.",
      "product": "kernel",
      "cwe": "CWE-20",
      "title": "Improper Input Validation in Kernel APsys DVFS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87765"
    },
    {
      "rank": 110,
      "cve_id": "CVE-2026-77366",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "The-40-Thieves",
      "product": "obsidian-tc",
      "cwe": "CWE-639",
      "title": "obsidian-tc tokens can access arbitrary configured vaults",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77366"
    },
    {
      "rank": 111,
      "cve_id": "CVE-2026-85947",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-269",
      "title": "Improper privilege management in Progress MarkLogic Server forest operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85947"
    },
    {
      "rank": 112,
      "cve_id": "CVE-2026-85948",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-269",
      "title": "Improper privilege management in Progress MarkLogic Server Management API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85948"
    },
    {
      "rank": 113,
      "cve_id": "CVE-2026-85955",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-269",
      "title": "Improper privilege management in Progress MarkLogic Server xdmp:eval-in",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85955"
    },
    {
      "rank": 114,
      "cve_id": "CVE-2026-96012",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2 Mirror for i",
      "cwe": "CWE-264",
      "title": "IBM Db2 Mirror for i Privilege Escalation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96012"
    },
    {
      "rank": 115,
      "cve_id": "CVE-2026-96119",
      "cvss_base": 9.9,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-94",
      "title": "IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96119"
    },
    {
      "rank": 116,
      "cve_id": "CVE-2026-57118",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MervinPraison",
      "product": "PraisonAI",
      "cwe": "CWE-306",
      "title": "PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57118"
    },
    {
      "rank": 117,
      "cve_id": "CVE-2026-90920",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo AI Service",
      "cwe": "CWE-94",
      "title": "Maximo AI Service Code Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90920"
    },
    {
      "rank": 118,
      "cve_id": "CVE-2026-109390",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AnyDesk",
      "product": "AnyDesk",
      "cwe": "CWE-130",
      "title": "AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109390"
    },
    {
      "rank": 119,
      "cve_id": "CVE-2026-109575",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "HAProxy",
      "product": "Data Plane API EE",
      "cwe": "CWE-306",
      "title": "In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109575"
    },
    {
      "rank": 120,
      "cve_id": "CVE-2026-9191",
      "cvss_base": 9.6,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-346",
      "title": "Insufficient isolation of user-supplied code in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9191"
    },
    {
      "rank": 121,
      "cve_id": "CVE-2026-82101",
      "cvss_base": 9.6,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DataStage on Cloud Pak for Data",
      "cwe": "CWE-22",
      "title": "DataStage on Cloud Pak for Data Path Traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82101"
    },
    {
      "rank": 122,
      "cve_id": "CVE-2026-82103",
      "cvss_base": 9.6,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DataStage on Cloud Pak for Data",
      "cwe": "CWE-200",
      "title": "DataStage on Cloud Pak for Data Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82103"
    },
    {
      "rank": 123,
      "cve_id": "CVE-2026-82110",
      "cvss_base": 9.6,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DataStage on Cloud Pak for Data",
      "cwe": "CWE-22",
      "title": "DataStage on Cloud Pak for Data Path Traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82110"
    },
    {
      "rank": 124,
      "cve_id": "CVE-2026-85956",
      "cvss_base": 9.6,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-269",
      "title": "Improper privilege management in Progress MarkLogic Server backup and restore operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85956"
    },
    {
      "rank": 125,
      "cve_id": "CVE-2026-108929",
      "cvss_base": 9.4,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-74",
      "title": "Netcore NR268 DDNS DDNSset.cgi execvp argument injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108929"
    },
    {
      "rank": 126,
      "cve_id": "CVE-2025-71429",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RVC-Boss",
      "product": "GPT-SoVITS",
      "cwe": "CWE-78",
      "title": "GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71429"
    },
    {
      "rank": 127,
      "cve_id": "CVE-2026-44828",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Qexo",
      "product": "Qexo",
      "cwe": "CWE-538",
      "title": "Qexo initialization endpoint can reset setup state and expose stored credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44828"
    },
    {
      "rank": 128,
      "cve_id": "CVE-2026-92681",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Neo4j",
      "product": "@neo4j/graphql",
      "cwe": "CWE-306",
      "title": "@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92681"
    },
    {
      "rank": 129,
      "cve_id": "CVE-2026-108892",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linksys",
      "product": "E1700",
      "cwe": "CWE-119",
      "title": "Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108892"
    },
    {
      "rank": 130,
      "cve_id": "CVE-2026-108907",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-287",
      "title": "Netcore NR268 CGI Execution user_ok improper authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108907"
    },
    {
      "rank": 131,
      "cve_id": "CVE-2026-108917",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-74",
      "title": "Edimax BR-6208AC formAutoFWupgrade command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108917"
    },
    {
      "rank": 132,
      "cve_id": "CVE-2026-108918",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-74",
      "title": "Edimax BR-6208AC formWlanMP command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108918"
    },
    {
      "rank": 133,
      "cve_id": "CVE-2026-109321",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-login-oauth",
      "cwe": "CWE-1391",
      "title": "Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109321"
    },
    {
      "rank": 134,
      "cve_id": "CVE-2026-109372",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zitadel",
      "product": "zitadel",
      "cwe": "CWE-287",
      "title": "ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109372"
    },
    {
      "rank": 135,
      "cve_id": "CVE-2026-109566",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zofe",
      "product": "rapyd-admin",
      "cwe": "CWE-798",
      "title": "Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109566"
    },
    {
      "rank": 136,
      "cve_id": "CVE-2026-109569",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Th0rgal",
      "product": "sandboxed.sh",
      "cwe": "CWE-1188",
      "title": "sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109569"
    },
    {
      "rank": 137,
      "cve_id": "CVE-2020-37279",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "karuppiah7890",
      "product": "easy-pdf-merge",
      "cwe": "CWE-78",
      "title": "easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-37279"
    },
    {
      "rank": 138,
      "cve_id": "CVE-2026-109238",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "unclecode",
      "product": "crawl4ai",
      "cwe": "CWE-918",
      "title": "Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109238"
    },
    {
      "rank": 139,
      "cve_id": "CVE-2026-109357",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-90",
      "title": "LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109357"
    },
    {
      "rank": 140,
      "cve_id": "CVE-2026-109373",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zitadel",
      "product": "zitadel",
      "cwe": "CWE-441",
      "title": "ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109373"
    },
    {
      "rank": 141,
      "cve_id": "CVE-2026-109391",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Square",
      "product": "Squash",
      "cwe": "CWE-502",
      "title": "Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109391"
    },
    {
      "rank": 142,
      "cve_id": "CVE-2026-109399",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sbabic",
      "product": "swupdate",
      "cwe": "CWE-295",
      "title": "SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109399"
    },
    {
      "rank": 143,
      "cve_id": "CVE-2026-109422",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NetEase",
      "product": "NetEase Cloud Music for Windows",
      "cwe": "CWE-749",
      "title": "NetEase Cloud Music RCE via os.navigateExternal IPC",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109422"
    },
    {
      "rank": 144,
      "cve_id": "CVE-2026-109573",
      "cvss_base": 9.2,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-89",
      "title": "phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109573"
    },
    {
      "rank": 145,
      "cve_id": "CVE-2026-53997",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NetHerman",
      "product": "Portal del Hermano (portaldelhermano.es)",
      "cwe": "CWE-307",
      "title": "Netherman Portal del Hermano Account Takeover via Password Reset Oracle",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53997"
    },
    {
      "rank": 146,
      "cve_id": "CVE-2026-87744",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Exploit Intelligence",
      "cwe": "CWE-425",
      "title": "Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87744"
    },
    {
      "rank": 147,
      "cve_id": "CVE-2026-108362",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "ra-tls-clients",
      "cwe": "CWE-346",
      "title": "Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108362"
    },
    {
      "rank": 148,
      "cve_id": "CVE-2026-109394",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thirty bees",
      "product": "thirty bees",
      "cwe": "CWE-639",
      "title": "Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109394"
    },
    {
      "rank": 149,
      "cve_id": "CVE-2026-109423",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NetEase",
      "product": "NetEase Cloud Music for Windows",
      "cwe": "CWE-295",
      "title": "NetEase Cloud Music TLS Certificate Validation Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109423"
    },
    {
      "rank": 150,
      "cve_id": "CVE-2026-49483",
      "cvss_base": 8.9,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codefori",
      "product": "vscode-ibmi",
      "cwe": "CWE-345",
      "title": "Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49483"
    },
    {
      "rank": 151,
      "cve_id": "CVE-2021-48012",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gin-Quin",
      "product": "fast-toml",
      "cwe": "CWE-1321",
      "title": "fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-48012"
    },
    {
      "rank": 152,
      "cve_id": "CVE-2026-12613",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Ministry of Justice General Directorate of Information Technology",
      "product": "UYAP Document Editor",
      "cwe": "CWE-502",
      "title": "Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12613"
    },
    {
      "rank": 153,
      "cve_id": "CVE-2026-19620",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-288",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19620"
    },
    {
      "rank": 154,
      "cve_id": "CVE-2026-19622",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-288",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19622"
    },
    {
      "rank": 155,
      "cve_id": "CVE-2026-52903",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ManageIQ",
      "product": "ManageIQ",
      "cwe": "CWE-502",
      "title": "YAML safe_load production fallback to unsafe_load enables RCE via deserialization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52903"
    },
    {
      "rank": 156,
      "cve_id": "CVE-2026-57143",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MervinPraison",
      "product": "praisonaiagents",
      "cwe": "CWE-20",
      "title": "PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57143"
    },
    {
      "rank": 157,
      "cve_id": "CVE-2026-77363",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "The-40-Thieves",
      "product": "obsidian-tc",
      "cwe": "CWE-346",
      "title": "obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77363"
    },
    {
      "rank": 158,
      "cve_id": "CVE-2026-82096",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DataStage on Cloud Pak for Data",
      "cwe": "CWE-78",
      "title": "DataStage on Cloud Pak for Data Command Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82096"
    },
    {
      "rank": 159,
      "cve_id": "CVE-2026-82108",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DataStage on Cloud Pak for Data",
      "cwe": "CWE-94",
      "title": "DataStage on Cloud Pak for Data Code Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-82108"
    },
    {
      "rank": 160,
      "cve_id": "CVE-2026-84313",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-287",
      "title": "Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84313"
    },
    {
      "rank": 161,
      "cve_id": "CVE-2026-84316",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-20",
      "title": "Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line \";\" separation → authenticated directive injection (RCE on the official image)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84316"
    },
    {
      "rank": 162,
      "cve_id": "CVE-2026-84317",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-20",
      "title": "Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84317"
    },
    {
      "rank": 163,
      "cve_id": "CVE-2026-84318",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-693",
      "title": "Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84318"
    },
    {
      "rank": 164,
      "cve_id": "CVE-2026-102627",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "TRIRIGA Application Platform",
      "cwe": "CWE-22",
      "title": "Security Vulnerability identified in IBM TRIRIGA - Zip Slip",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102627"
    },
    {
      "rank": 165,
      "cve_id": "CVE-2026-105407",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dassault Systèmes",
      "product": "Tuleap Enterprise Edition",
      "cwe": "CWE-78",
      "title": "OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105407"
    },
    {
      "rank": 166,
      "cve_id": "CVE-2026-105464",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-269",
      "title": "IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105464"
    },
    {
      "rank": 167,
      "cve_id": "CVE-2026-105465",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-269",
      "title": "IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105465"
    },
    {
      "rank": 168,
      "cve_id": "CVE-2026-109371",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zitadel",
      "product": "zitadel",
      "cwe": "CWE-306",
      "title": "ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109371"
    },
    {
      "rank": 169,
      "cve_id": "CVE-2020-37280",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PelionIoT",
      "product": "cbor-sync",
      "cwe": "CWE-789",
      "title": "cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-37280"
    },
    {
      "rank": 170,
      "cve_id": "CVE-2021-48011",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "lukejacksonn",
      "product": "servor",
      "cwe": "CWE-22",
      "title": "Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-48011"
    },
    {
      "rank": 171,
      "cve_id": "CVE-2024-58390",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-269",
      "title": "Frappe before 15.41.0 Privilege Escalation via Document Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58390"
    },
    {
      "rank": 172,
      "cve_id": "CVE-2026-18529",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - Location Service for Esri Component",
      "cwe": "CWE-78",
      "title": "IBM Maximo Application Suite - Location Service for Esri Component Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18529"
    },
    {
      "rank": 173,
      "cve_id": "CVE-2026-18537",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - Location Service for Esri Component",
      "cwe": "CWE-94",
      "title": "IBM Maximo Application Suite - Location Service for Esri Component Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18537"
    },
    {
      "rank": 174,
      "cve_id": "CVE-2026-84314",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-285",
      "title": "Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84314"
    },
    {
      "rank": 175,
      "cve_id": "CVE-2026-103903",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MikroTik",
      "product": "RouterOS",
      "cwe": "CWE-863",
      "title": "MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103903"
    },
    {
      "rank": 176,
      "cve_id": "CVE-2026-105408",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dassault Systèmes",
      "product": "Tuleap Enterprise Edition",
      "cwe": "CWE-79",
      "title": "Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105408"
    },
    {
      "rank": 177,
      "cve_id": "CVE-2026-105409",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dassault Systèmes",
      "product": "Tuleap Enterprise Edition",
      "cwe": "CWE-79",
      "title": "Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105409"
    },
    {
      "rank": 178,
      "cve_id": "CVE-2026-105410",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dassault Systèmes",
      "product": "Tuleap Enterprise Edition",
      "cwe": "CWE-79",
      "title": "Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105410"
    },
    {
      "rank": 179,
      "cve_id": "CVE-2026-109185",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Privilege Escalation via PUT /user/updateUser",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109185"
    },
    {
      "rank": 180,
      "cve_id": "CVE-2026-109186",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-915",
      "title": "jshERP through 3.6 Mass Assignment via PUT /user/update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109186"
    },
    {
      "rank": 181,
      "cve_id": "CVE-2026-109199",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-94",
      "title": "LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109199"
    },
    {
      "rank": 182,
      "cve_id": "CVE-2026-109201",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-862",
      "title": "LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109201"
    },
    {
      "rank": 183,
      "cve_id": "CVE-2026-109205",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-770",
      "title": "LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109205"
    },
    {
      "rank": 184,
      "cve_id": "CVE-2026-109225",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sgl-project",
      "product": "sglang",
      "cwe": "CWE-770",
      "title": "SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109225"
    },
    {
      "rank": 185,
      "cve_id": "CVE-2026-109226",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sgl-project",
      "product": "sglang",
      "cwe": "CWE-409",
      "title": "SGLang through 0.5.21 Audio Decompression Amplification via load_audio",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109226"
    },
    {
      "rank": 186,
      "cve_id": "CVE-2026-109227",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sgl-project",
      "product": "sglang",
      "cwe": "CWE-770",
      "title": "SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109227"
    },
    {
      "rank": 187,
      "cve_id": "CVE-2026-109228",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sgl-project",
      "product": "sglang",
      "cwe": "CWE-770",
      "title": "SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109228"
    },
    {
      "rank": 188,
      "cve_id": "CVE-2026-109229",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "sgl-project",
      "product": "sglang",
      "cwe": "CWE-409",
      "title": "SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109229"
    },
    {
      "rank": 189,
      "cve_id": "CVE-2026-109305",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "craftcms",
      "product": "cms",
      "cwe": "CWE-1336",
      "title": "Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109305"
    },
    {
      "rank": 190,
      "cve_id": "CVE-2026-109308",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "craftcms",
      "product": "cms",
      "cwe": "CWE-94",
      "title": "Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109308"
    },
    {
      "rank": 191,
      "cve_id": "CVE-2026-109318",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "trilbymedia",
      "product": "grav-plugin-git-sync",
      "cwe": "CWE-78",
      "title": "Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109318"
    },
    {
      "rank": 192,
      "cve_id": "CVE-2026-109325",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav",
      "cwe": "CWE-200",
      "title": "Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109325"
    },
    {
      "rank": 193,
      "cve_id": "CVE-2026-109326",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav",
      "cwe": "CWE-527",
      "title": "Grav before 2.1.7 Information Disclosure via Nested .git Directories",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109326"
    },
    {
      "rank": 194,
      "cve_id": "CVE-2026-109359",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-345",
      "title": "Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109359"
    },
    {
      "rank": 195,
      "cve_id": "CVE-2026-109363",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZcashFoundation",
      "product": "zebra",
      "cwe": "CWE-617",
      "title": "Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109363"
    },
    {
      "rank": 196,
      "cve_id": "CVE-2026-109380",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ayuhito",
      "product": "modern-tar",
      "cwe": "CWE-1284",
      "title": "modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109380"
    },
    {
      "rank": 197,
      "cve_id": "CVE-2026-109398",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gumlet",
      "product": "php-image-resize",
      "cwe": "CWE-409",
      "title": "Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109398"
    },
    {
      "rank": 198,
      "cve_id": "CVE-2026-109563",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "rdfjs",
      "product": "N3.js",
      "cwe": "CWE-1333",
      "title": "N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109563"
    },
    {
      "rank": 199,
      "cve_id": "CVE-2026-109608",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109608"
    },
    {
      "rank": 200,
      "cve_id": "CVE-2026-109652",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-1336",
      "title": "Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109652"
    },
    {
      "rank": 201,
      "cve_id": "CVE-2026-109667",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-269",
      "title": "Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109667"
    },
    {
      "rank": 202,
      "cve_id": "CVE-2025-71432",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71432"
    },
    {
      "rank": 203,
      "cve_id": "CVE-2026-65954",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PHPCSStandards",
      "product": "PHPCSUtils",
      "cwe": "CWE-95",
      "title": "PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65954"
    },
    {
      "rank": 204,
      "cve_id": "CVE-2026-85954",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-269",
      "title": "Improper privilege management in Progress MarkLogic Server higher-order XQuery functions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85954"
    },
    {
      "rank": 205,
      "cve_id": "CVE-2026-92682",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Neo4j",
      "product": "@neo4j/graphql",
      "cwe": "CWE-863",
      "title": "@neo4j/graphql: authorization relationship and connection filters invert the \"none\" quantifier",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92682"
    },
    {
      "rank": 206,
      "cve_id": "CVE-2026-108893",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linksys",
      "product": "E1700",
      "cwe": "CWE-119",
      "title": "Linksys E1700 setVlan stack-based overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108893"
    },
    {
      "rank": 207,
      "cve_id": "CVE-2026-108894",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linksys",
      "product": "E1700",
      "cwe": "CWE-77",
      "title": "Linksys E1700 Static Route addStaticRoute os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108894"
    },
    {
      "rank": 208,
      "cve_id": "CVE-2026-108895",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linksys",
      "product": "E1700",
      "cwe": "CWE-77",
      "title": "Linksys E1700 setDMZ os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108895"
    },
    {
      "rank": 209,
      "cve_id": "CVE-2026-108896",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linksys",
      "product": "E1700",
      "cwe": "CWE-77",
      "title": "Linksys E1700 setLinksysIpv6 os command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108896"
    },
    {
      "rank": 210,
      "cve_id": "CVE-2026-108914",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-119",
      "title": "Edimax BR-6208AC formWlSiteSurvey buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108914"
    },
    {
      "rank": 211,
      "cve_id": "CVE-2026-108915",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-119",
      "title": "Edimax BR-6208AC formWlanMP buffer overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108915"
    },
    {
      "rank": 212,
      "cve_id": "CVE-2026-109237",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "unclecode",
      "product": "crawl4ai",
      "cwe": "CWE-502",
      "title": "Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109237"
    },
    {
      "rank": 213,
      "cve_id": "CVE-2026-109286",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-346",
      "title": "Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109286"
    },
    {
      "rank": 214,
      "cve_id": "CVE-2026-109312",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-login",
      "cwe": "CWE-287",
      "title": "Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109312"
    },
    {
      "rank": 215,
      "cve_id": "CVE-2026-109313",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-login",
      "cwe": "CWE-287",
      "title": "Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109313"
    },
    {
      "rank": 216,
      "cve_id": "CVE-2026-109317",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-api",
      "cwe": "CWE-269",
      "title": "Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109317"
    },
    {
      "rank": 217,
      "cve_id": "CVE-2026-109334",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-639",
      "title": "SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109334"
    },
    {
      "rank": 218,
      "cve_id": "CVE-2026-109343",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-639",
      "title": "SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109343"
    },
    {
      "rank": 219,
      "cve_id": "CVE-2026-109347",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vrana",
      "product": "adminer",
      "cwe": "CWE-94",
      "title": "Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109347"
    },
    {
      "rank": 220,
      "cve_id": "CVE-2026-109397",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": "CWE-434",
      "title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109397"
    },
    {
      "rank": 221,
      "cve_id": "CVE-2026-109567",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zofe",
      "product": "rapyd-admin",
      "cwe": "CWE-269",
      "title": "Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109567"
    },
    {
      "rank": 222,
      "cve_id": "CVE-2026-109633",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109633"
    },
    {
      "rank": 223,
      "cve_id": "CVE-2026-85951",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-918",
      "title": "Server-side request forgery in Progress MarkLogic Server Azure deployments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85951"
    },
    {
      "rank": 224,
      "cve_id": "CVE-2026-85952",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-918",
      "title": "Server-side request forgery in Progress MarkLogic Server Linux cloud deployments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85952"
    },
    {
      "rank": 225,
      "cve_id": "CVE-2026-85953",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-22",
      "title": "Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85953"
    },
    {
      "rank": 226,
      "cve_id": "CVE-2026-108953",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cfdude",
      "product": "mac-shell-mcp",
      "cwe": "CWE-78",
      "title": "mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108953"
    },
    {
      "rank": 227,
      "cve_id": "CVE-2026-109291",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-79",
      "title": "Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109291"
    },
    {
      "rank": 228,
      "cve_id": "CVE-2026-109314",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-login",
      "cwe": "CWE-200",
      "title": "Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109314"
    },
    {
      "rank": 229,
      "cve_id": "CVE-2026-109329",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-639",
      "title": "Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109329"
    },
    {
      "rank": 230,
      "cve_id": "CVE-2026-109346",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "better-auth",
      "product": "better-auth",
      "cwe": "CWE-451",
      "title": "better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109346"
    },
    {
      "rank": 231,
      "cve_id": "CVE-2026-109358",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "edgelesssys",
      "product": "contrast",
      "cwe": "CWE-732",
      "title": "Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109358"
    },
    {
      "rank": 232,
      "cve_id": "CVE-2026-109558",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tianma-if",
      "product": "EdgeEver",
      "cwe": "CWE-79",
      "title": "EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109558"
    },
    {
      "rank": 233,
      "cve_id": "CVE-2026-109604",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "ERPNext before 15.112.0 Stored XSS via Tool View Record Names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109604"
    },
    {
      "rank": 234,
      "cve_id": "CVE-2026-109612",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.120.0 Stored XSS via Report View",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109612"
    },
    {
      "rank": 235,
      "cve_id": "CVE-2026-109653",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109653"
    },
    {
      "rank": 236,
      "cve_id": "CVE-2026-109671",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109671"
    },
    {
      "rank": 237,
      "cve_id": "CVE-2026-109673",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109673"
    },
    {
      "rank": 238,
      "cve_id": "CVE-2026-85950",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-269",
      "title": "Improper privilege management in Progress MarkLogic Server REST extensions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85950"
    },
    {
      "rank": 239,
      "cve_id": "CVE-2026-109290",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-79",
      "title": "Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109290"
    },
    {
      "rank": 240,
      "cve_id": "CVE-2026-109557",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tianma-if",
      "product": "EdgeEver",
      "cwe": "CWE-79",
      "title": "EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109557"
    },
    {
      "rank": 241,
      "cve_id": "CVE-2026-109559",
      "cvss_base": 8.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tianma-if",
      "product": "EdgeEver",
      "cwe": "CWE-863",
      "title": "EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109559"
    },
    {
      "rank": 242,
      "cve_id": "CVE-2026-84315",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-862",
      "title": "Nginx UI OTP secure-session step-up is missing on sensitive mutation routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84315"
    },
    {
      "rank": 243,
      "cve_id": "CVE-2026-84319",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-693",
      "title": "Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84319"
    },
    {
      "rank": 244,
      "cve_id": "CVE-2026-92877",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Eclipse Foundation",
      "product": "jaxb-ri (core)",
      "cwe": "CWE-611",
      "title": "The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92877"
    },
    {
      "rank": 245,
      "cve_id": "CVE-2026-93886",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-79",
      "title": "IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93886"
    },
    {
      "rank": 246,
      "cve_id": "CVE-2023-54411",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-290",
      "title": "Frappe before 13.32.0 Weak Authentication via Print View Key",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54411"
    },
    {
      "rank": 247,
      "cve_id": "CVE-2026-19627",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-22",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19627"
    },
    {
      "rank": 248,
      "cve_id": "CVE-2026-96262",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "PowerVM Hypervisor",
      "cwe": "CWE-121",
      "title": "IBM Power Systems Firmware Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96262"
    },
    {
      "rank": 249,
      "cve_id": "CVE-2026-96263",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "PowerVM Hypervisor",
      "cwe": "CWE-121",
      "title": "IBM Power Systems Firmware Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96263"
    },
    {
      "rank": 250,
      "cve_id": "CVE-2026-96264",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "PowerVM Hypervisor",
      "cwe": "CWE-121",
      "title": "IBM Power Systems Firmware Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96264"
    },
    {
      "rank": 251,
      "cve_id": "CVE-2026-96265",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "PowerVM Hypervisor",
      "cwe": "CWE-119",
      "title": "IBM Power Systems Firmware Improper Memory Buffer Restriction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96265"
    },
    {
      "rank": 252,
      "cve_id": "CVE-2026-96266",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "PowerVM Hypervisor",
      "cwe": "CWE-121",
      "title": "IBM Power Systems Firmware Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96266"
    },
    {
      "rank": 253,
      "cve_id": "CVE-2026-109257",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-415",
      "title": "FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109257"
    },
    {
      "rank": 254,
      "cve_id": "CVE-2026-109301",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parse-community",
      "product": "parse-server",
      "cwe": "CWE-248",
      "title": "Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109301"
    },
    {
      "rank": 255,
      "cve_id": "CVE-2026-109424",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NetEase",
      "product": "NetEase Cloud Music for Windows",
      "cwe": "CWE-321",
      "title": "NetEase Cloud Music Weak Encryption via eapi/xeapi",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109424"
    },
    {
      "rank": 256,
      "cve_id": "CVE-2026-109426",
      "cvss_base": 8.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "weebzone",
      "product": "Telegram-Stremio",
      "cwe": "CWE-312",
      "title": "Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109426"
    },
    {
      "rank": 257,
      "cve_id": "CVE-2026-59976",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "C4illin",
      "product": "ConvertX",
      "cwe": "CWE-22",
      "title": "ConvertX: Path Traversal vulnerability leading to Arbitrary File Write",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59976"
    },
    {
      "rank": 258,
      "cve_id": "CVE-2026-59977",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "C4illin",
      "product": "ConvertX",
      "cwe": "CWE-352",
      "title": "ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59977"
    },
    {
      "rank": 259,
      "cve_id": "CVE-2026-84360",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-288",
      "title": "Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84360"
    },
    {
      "rank": 260,
      "cve_id": "CVE-2026-85457",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-121",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85457"
    },
    {
      "rank": 261,
      "cve_id": "CVE-2026-85949",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-532",
      "title": "Sensitive information exposure in Progress MarkLogic Server trace logs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85949"
    },
    {
      "rank": 262,
      "cve_id": "CVE-2026-93892",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "TRIRIGA Application Platform",
      "cwe": "CWE-200",
      "title": "Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93892"
    },
    {
      "rank": 263,
      "cve_id": "CVE-2026-105411",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dassault Systèmes",
      "product": "Tuleap Enterprise Edition",
      "cwe": "CWE-639",
      "title": "Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105411"
    },
    {
      "rank": 264,
      "cve_id": "CVE-2026-108479",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Patreon",
      "product": "Patreon WordPress",
      "cwe": "CWE-352",
      "title": "WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108479"
    },
    {
      "rank": 265,
      "cve_id": "CVE-2026-85965",
      "cvss_base": 8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-416",
      "title": "Use-after-free in Progress MarkLogic Server JavaScript engine integration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85965"
    },
    {
      "rank": 266,
      "cve_id": "CVE-2026-18390",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Ministry of Justice General Directorate of Information Technology",
      "product": "UYAP Document Editor",
      "cwe": "CWE-78",
      "title": "Command Injection in Ministry of Justice's UYAP Document Editor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18390"
    },
    {
      "rank": 267,
      "cve_id": "CVE-2026-75782",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Aspera Enterprise WebApps",
      "cwe": "CWE-426",
      "title": "IBM Aspera Enterprise Webapps Untrusted Search Path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75782"
    },
    {
      "rank": 268,
      "cve_id": "CVE-2026-95837",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "containerd",
      "product": "containerd",
      "cwe": "CWE-269",
      "title": "containerd CRI plugin: Checkpoint restore bypasses destination security context",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95837"
    },
    {
      "rank": 269,
      "cve_id": "CVE-2026-108094",
      "cvss_base": 7.8,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Enterprise Linux 10",
      "cwe": "CWE-416",
      "title": "Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108094"
    },
    {
      "rank": 270,
      "cve_id": "CVE-2026-18166",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-284",
      "title": "IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18166"
    },
    {
      "rank": 271,
      "cve_id": "CVE-2026-18517",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - Location Service for Esri Component",
      "cwe": "CWE-284",
      "title": "IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18517"
    },
    {
      "rank": 272,
      "cve_id": "CVE-2026-75888",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat OpenShift Container Platform 4",
      "cwe": "CWE-918",
      "title": "Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75888"
    },
    {
      "rank": 273,
      "cve_id": "CVE-2026-85964",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-22",
      "title": "Path traversal in Progress MarkLogic Server Query Console",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85964"
    },
    {
      "rank": 274,
      "cve_id": "CVE-2026-85966",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-200",
      "title": "Exposure of sensitive information in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85966"
    },
    {
      "rank": 275,
      "cve_id": "CVE-2026-109360",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-502",
      "title": "MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109360"
    },
    {
      "rank": 276,
      "cve_id": "CVE-2026-109560",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "continuedev",
      "product": "continue",
      "cwe": "CWE-863",
      "title": "Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109560"
    },
    {
      "rank": 277,
      "cve_id": "CVE-2026-93891",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "TRIRIGA Application Platform",
      "cwe": "CWE-611",
      "title": "Security Vulnerability identified in IBM TRIRIGA - XXE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93891"
    },
    {
      "rank": 278,
      "cve_id": "CVE-2026-109292",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-200",
      "title": "Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109292"
    },
    {
      "rank": 279,
      "cve_id": "CVE-2026-75061",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-22",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75061"
    },
    {
      "rank": 280,
      "cve_id": "CVE-2026-75095",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Aspera Enterprise WebApps",
      "cwe": "CWE-400",
      "title": "IBM Aspera Enterprise Webapps Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75095"
    },
    {
      "rank": 281,
      "cve_id": "CVE-2026-75881",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - IoT Component",
      "cwe": "CWE-400",
      "title": "IBM Maximo Application Suite - IoT Component Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75881"
    },
    {
      "rank": 282,
      "cve_id": "CVE-2026-78673",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo AI Service",
      "cwe": "CWE-20",
      "title": "Maximo AI Service Improper Input Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78673"
    },
    {
      "rank": 283,
      "cve_id": "CVE-2026-85957",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-611",
      "title": "Improper XML external entity restriction in Progress MarkLogic Server SAML processing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85957"
    },
    {
      "rank": 284,
      "cve_id": "CVE-2026-85958",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-287",
      "title": "Improper OAuth token validation in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85958"
    },
    {
      "rank": 285,
      "cve_id": "CVE-2026-85959",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-778",
      "title": "Insufficient authentication logging in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85959"
    },
    {
      "rank": 286,
      "cve_id": "CVE-2026-85960",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-352",
      "title": "Cross-site request forgery in Progress MarkLogic Server Query Console",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85960"
    },
    {
      "rank": 287,
      "cve_id": "CVE-2026-85961",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-532",
      "title": "Sensitive information exposure in Progress MarkLogic Server Azure deployments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85961"
    },
    {
      "rank": 288,
      "cve_id": "CVE-2026-85962",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-287",
      "title": "Improper authentication in Progress MarkLogic Server SAML processing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85962"
    },
    {
      "rank": 289,
      "cve_id": "CVE-2026-85963",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-321",
      "title": "Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85963"
    },
    {
      "rank": 290,
      "cve_id": "CVE-2026-85975",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-319",
      "title": "Cleartext transmission in Progress MarkLogic Server Amazon S3 connections",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85975"
    },
    {
      "rank": 291,
      "cve_id": "CVE-2026-90911",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo AI Service",
      "cwe": "CWE-400",
      "title": "Maximo AI Service Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90911"
    },
    {
      "rank": 292,
      "cve_id": "CVE-2026-90912",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo AI Service",
      "cwe": "CWE-674",
      "title": "Maximo AI Service Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90912"
    },
    {
      "rank": 293,
      "cve_id": "CVE-2026-90921",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo AI Service",
      "cwe": "CWE-130",
      "title": "Maximo AI Service Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-90921"
    },
    {
      "rank": 294,
      "cve_id": "CVE-2026-92876",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - IoT Component",
      "cwe": "CWE-674",
      "title": "IBM Maximo Application Suite - IoT Component Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92876"
    },
    {
      "rank": 295,
      "cve_id": "CVE-2026-96612",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex",
      "cwe": "CWE-22",
      "title": "Path traversal in Hex via unvalidated dependency app names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96612"
    },
    {
      "rank": 296,
      "cve_id": "CVE-2026-103060",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erlang",
      "product": "rebar3",
      "cwe": "CWE-22",
      "title": "Path traversal in rebar3 via unvalidated dependency app names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103060"
    },
    {
      "rank": 297,
      "cve_id": "CVE-2026-103902",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "DigiDoc",
      "product": "libdigidocpp",
      "cwe": "CWE-347",
      "title": "DigiDoc improper signature verification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103902"
    },
    {
      "rank": 298,
      "cve_id": "CVE-2026-105052",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite",
      "cwe": "CWE-22",
      "title": "IBM Maximo Application Suite Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105052"
    },
    {
      "rank": 299,
      "cve_id": "CVE-2026-109331",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jovancoding",
      "product": "Network-AI",
      "cwe": "CWE-436",
      "title": "Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109331"
    },
    {
      "rank": 300,
      "cve_id": "CVE-2026-83535",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat OpenStack Platform 18.0",
      "cwe": "CWE-208",
      "title": "Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83535"
    },
    {
      "rank": 301,
      "cve_id": "CVE-2026-84418",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DataStage on Cloud Pak for Data",
      "cwe": "CWE-295",
      "title": "DataStage on Cloud Pak for Data Improper Certificate Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84418"
    },
    {
      "rank": 302,
      "cve_id": "CVE-2026-85972",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-303",
      "title": "Improper Kerberos server verification in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85972"
    },
    {
      "rank": 303,
      "cve_id": "CVE-2026-85973",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-319",
      "title": "Cleartext transmission in Progress MarkLogic Server cluster join operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85973"
    },
    {
      "rank": 304,
      "cve_id": "CVE-2026-85974",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-297",
      "title": "Improper TLS hostname verification in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85974"
    },
    {
      "rank": 305,
      "cve_id": "CVE-2026-93695",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress",
      "product": "ShareFile Storage Zones Controller",
      "cwe": "CWE-22",
      "title": "Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93695"
    },
    {
      "rank": 306,
      "cve_id": "CVE-2026-108481",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Patreon",
      "product": "Patreon WordPress",
      "cwe": "CWE-352",
      "title": "WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108481"
    },
    {
      "rank": 307,
      "cve_id": "CVE-2026-109245",
      "cvss_base": 7.4,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-295",
      "title": "FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109245"
    },
    {
      "rank": 308,
      "cve_id": "CVE-2026-96261",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "PowerVM Hypervisor",
      "cwe": "CWE-121",
      "title": "IBM Power Systems Firmware Buffer Overflow",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96261"
    },
    {
      "rank": 309,
      "cve_id": "CVE-2026-108906",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-119",
      "title": "Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108906"
    },
    {
      "rank": 310,
      "cve_id": "CVE-2026-109556",
      "cvss_base": 7.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tianma-if",
      "product": "EdgeEver",
      "cwe": "CWE-749",
      "title": "EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109556"
    },
    {
      "rank": 311,
      "cve_id": "CVE-2026-18513",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - Location Service for Esri Component",
      "cwe": "CWE-269",
      "title": "IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18513"
    },
    {
      "rank": 312,
      "cve_id": "CVE-2026-41510",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-693",
      "title": "OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41510"
    },
    {
      "rank": 313,
      "cve_id": "CVE-2026-103521",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": "CWE-434",
      "title": "CVE-2026-103521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103521"
    },
    {
      "rank": 314,
      "cve_id": "CVE-2026-103522",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": "CWE-434",
      "title": "CVE-2026-103522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103522"
    },
    {
      "rank": 315,
      "cve_id": "CVE-2026-108361",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Privasys",
      "product": "ra-tls-clients",
      "cwe": "CWE-367",
      "title": "Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108361"
    },
    {
      "rank": 316,
      "cve_id": "CVE-2026-109288",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-79",
      "title": "Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109288"
    },
    {
      "rank": 317,
      "cve_id": "CVE-2026-109572",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-862",
      "title": "Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109572"
    },
    {
      "rank": 318,
      "cve_id": "CVE-2026-109640",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109640"
    },
    {
      "rank": 319,
      "cve_id": "CVE-2023-54412",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-284",
      "title": "Frappe before 13.46.3 Improper Access Control for Email Templates",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54412"
    },
    {
      "rank": 320,
      "cve_id": "CVE-2026-17475",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-285",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17475"
    },
    {
      "rank": 321,
      "cve_id": "CVE-2026-84312",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-287",
      "title": "Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84312"
    },
    {
      "rank": 322,
      "cve_id": "CVE-2026-85968",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-125",
      "title": "Out-of-bounds read in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85968"
    },
    {
      "rank": 323,
      "cve_id": "CVE-2026-85969",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85969"
    },
    {
      "rank": 324,
      "cve_id": "CVE-2026-85970",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-611",
      "title": "Improper XML external entity restriction in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85970"
    },
    {
      "rank": 325,
      "cve_id": "CVE-2026-85971",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-732",
      "title": "Incorrect log file permissions in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85971"
    },
    {
      "rank": 326,
      "cve_id": "CVE-2026-105412",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Dassault Systèmes",
      "product": "Tuleap Enterprise Edition",
      "cwe": "CWE-89",
      "title": "SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105412"
    },
    {
      "rank": 327,
      "cve_id": "CVE-2026-105668",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex",
      "cwe": "CWE-693",
      "title": "Hex release-age cooldown is lifted package-wide when the locked release is retired",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105668"
    },
    {
      "rank": 328,
      "cve_id": "CVE-2026-108951",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "lavalite",
      "product": "cms",
      "cwe": "CWE-863",
      "title": "LavaLite CMS through 10.1.2 Authorization Bypass via User Update API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108951"
    },
    {
      "rank": 329,
      "cve_id": "CVE-2026-109164",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TDuckCloud",
      "product": "tduck-survey-form",
      "cwe": "CWE-639",
      "title": "TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109164"
    },
    {
      "rank": 330,
      "cve_id": "CVE-2026-109166",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dromara",
      "product": "lamp-cloud",
      "cwe": "CWE-639",
      "title": "lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109166"
    },
    {
      "rank": 331,
      "cve_id": "CVE-2026-109168",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "dromara",
      "product": "lamp-cloud",
      "cwe": "CWE-639",
      "title": "lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109168"
    },
    {
      "rank": 332,
      "cve_id": "CVE-2026-109169",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-89",
      "title": "LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109169"
    },
    {
      "rank": 333,
      "cve_id": "CVE-2026-109170",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-89",
      "title": "LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109170"
    },
    {
      "rank": 334,
      "cve_id": "CVE-2026-109174",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "moxi624",
      "product": "MoguBlog",
      "cwe": "CWE-863",
      "title": "MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109174"
    },
    {
      "rank": 335,
      "cve_id": "CVE-2026-109187",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109187"
    },
    {
      "rank": 336,
      "cve_id": "CVE-2026-109202",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-862",
      "title": "LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109202"
    },
    {
      "rank": 337,
      "cve_id": "CVE-2026-109203",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-862",
      "title": "LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109203"
    },
    {
      "rank": 338,
      "cve_id": "CVE-2026-109242",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-908",
      "title": "FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109242"
    },
    {
      "rank": 339,
      "cve_id": "CVE-2026-109246",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-191",
      "title": "FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109246"
    },
    {
      "rank": 340,
      "cve_id": "CVE-2026-109293",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-200",
      "title": "Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109293"
    },
    {
      "rank": 341,
      "cve_id": "CVE-2026-109294",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-400",
      "title": "Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109294"
    },
    {
      "rank": 342,
      "cve_id": "CVE-2026-109295",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-1333",
      "title": "Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109295"
    },
    {
      "rank": 343,
      "cve_id": "CVE-2026-109297",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-400",
      "title": "Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109297"
    },
    {
      "rank": 344,
      "cve_id": "CVE-2026-109298",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-400",
      "title": "Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109298"
    },
    {
      "rank": 345,
      "cve_id": "CVE-2026-109299",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-400",
      "title": "Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109299"
    },
    {
      "rank": 346,
      "cve_id": "CVE-2026-109310",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-770",
      "title": "SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109310"
    },
    {
      "rank": 347,
      "cve_id": "CVE-2026-109311",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "vllm-project",
      "product": "vllm",
      "cwe": "CWE-20",
      "title": "vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109311"
    },
    {
      "rank": 348,
      "cve_id": "CVE-2026-109315",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav",
      "cwe": "CWE-200",
      "title": "Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109315"
    },
    {
      "rank": 349,
      "cve_id": "CVE-2026-109324",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav",
      "cwe": "CWE-409",
      "title": "Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109324"
    },
    {
      "rank": 350,
      "cve_id": "CVE-2026-109333",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-862",
      "title": "SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109333"
    },
    {
      "rank": 351,
      "cve_id": "CVE-2026-109335",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-200",
      "title": "SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109335"
    },
    {
      "rank": 352,
      "cve_id": "CVE-2026-109338",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-248",
      "title": "SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109338"
    },
    {
      "rank": 353,
      "cve_id": "CVE-2026-109341",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-200",
      "title": "SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109341"
    },
    {
      "rank": 354,
      "cve_id": "CVE-2026-109349",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitoxideLabs",
      "product": "gix-pack",
      "cwe": "CWE-617",
      "title": "gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109349"
    },
    {
      "rank": 355,
      "cve_id": "CVE-2026-109350",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitoxideLabs",
      "product": "gix-pack",
      "cwe": "CWE-617",
      "title": "Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109350"
    },
    {
      "rank": 356,
      "cve_id": "CVE-2026-109351",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitoxideLabs",
      "product": "gix-pack",
      "cwe": "CWE-770",
      "title": "Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109351"
    },
    {
      "rank": 357,
      "cve_id": "CVE-2026-109353",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-89",
      "title": "LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109353"
    },
    {
      "rank": 358,
      "cve_id": "CVE-2026-109427",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "weebzone",
      "product": "Telegram-Stremio",
      "cwe": "CWE-639",
      "title": "Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109427"
    },
    {
      "rank": 359,
      "cve_id": "CVE-2026-109568",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "MarceauKa",
      "product": "Shaark",
      "cwe": "CWE-639",
      "title": "Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109568"
    },
    {
      "rank": 360,
      "cve_id": "CVE-2026-109601",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-73",
      "title": "Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109601"
    },
    {
      "rank": 361,
      "cve_id": "CVE-2026-109609",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109609"
    },
    {
      "rank": 362,
      "cve_id": "CVE-2026-109610",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109610"
    },
    {
      "rank": 363,
      "cve_id": "CVE-2026-109613",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109613"
    },
    {
      "rank": 364,
      "cve_id": "CVE-2026-109614",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109614"
    },
    {
      "rank": 365,
      "cve_id": "CVE-2026-109615",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109615"
    },
    {
      "rank": 366,
      "cve_id": "CVE-2026-109616",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109616"
    },
    {
      "rank": 367,
      "cve_id": "CVE-2026-109617",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109617"
    },
    {
      "rank": 368,
      "cve_id": "CVE-2026-109621",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109621"
    },
    {
      "rank": 369,
      "cve_id": "CVE-2026-109624",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109624"
    },
    {
      "rank": 370,
      "cve_id": "CVE-2026-109625",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109625"
    },
    {
      "rank": 371,
      "cve_id": "CVE-2026-109626",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109626"
    },
    {
      "rank": 372,
      "cve_id": "CVE-2026-109627",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109627"
    },
    {
      "rank": 373,
      "cve_id": "CVE-2026-109628",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109628"
    },
    {
      "rank": 374,
      "cve_id": "CVE-2026-109631",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109631"
    },
    {
      "rank": 375,
      "cve_id": "CVE-2026-109632",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109632"
    },
    {
      "rank": 376,
      "cve_id": "CVE-2026-109636",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109636"
    },
    {
      "rank": 377,
      "cve_id": "CVE-2026-109637",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109637"
    },
    {
      "rank": 378,
      "cve_id": "CVE-2026-109638",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109638"
    },
    {
      "rank": 379,
      "cve_id": "CVE-2026-109639",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109639"
    },
    {
      "rank": 380,
      "cve_id": "CVE-2026-109643",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109643"
    },
    {
      "rank": 381,
      "cve_id": "CVE-2026-109644",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109644"
    },
    {
      "rank": 382,
      "cve_id": "CVE-2026-109645",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109645"
    },
    {
      "rank": 383,
      "cve_id": "CVE-2026-109646",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109646"
    },
    {
      "rank": 384,
      "cve_id": "CVE-2026-109647",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109647"
    },
    {
      "rank": 385,
      "cve_id": "CVE-2026-109648",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109648"
    },
    {
      "rank": 386,
      "cve_id": "CVE-2026-109649",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109649"
    },
    {
      "rank": 387,
      "cve_id": "CVE-2026-109650",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109650"
    },
    {
      "rank": 388,
      "cve_id": "CVE-2026-109655",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109655"
    },
    {
      "rank": 389,
      "cve_id": "CVE-2026-109656",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109656"
    },
    {
      "rank": 390,
      "cve_id": "CVE-2026-109658",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109658"
    },
    {
      "rank": 391,
      "cve_id": "CVE-2026-109659",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109659"
    },
    {
      "rank": 392,
      "cve_id": "CVE-2026-109660",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109660"
    },
    {
      "rank": 393,
      "cve_id": "CVE-2026-109661",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109661"
    },
    {
      "rank": 394,
      "cve_id": "CVE-2026-109663",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109663"
    },
    {
      "rank": 395,
      "cve_id": "CVE-2026-109666",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109666"
    },
    {
      "rank": 396,
      "cve_id": "CVE-2026-109672",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109672"
    },
    {
      "rank": 397,
      "cve_id": "CVE-2026-109674",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109674"
    },
    {
      "rank": 398,
      "cve_id": "CVE-2026-104355",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Temporal Technologies, Inc.",
      "product": "Temporal Server",
      "cwe": "CWE-863",
      "title": "Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104355"
    },
    {
      "rank": 399,
      "cve_id": "CVE-2026-109250",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-129",
      "title": "FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109250"
    },
    {
      "rank": 400,
      "cve_id": "CVE-2026-109361",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Project-MONAI",
      "product": "MONAI",
      "cwe": "CWE-502",
      "title": "MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109361"
    },
    {
      "rank": 401,
      "cve_id": "CVE-2023-54406",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-372",
      "title": "Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54406"
    },
    {
      "rank": 402,
      "cve_id": "CVE-2023-54407",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-532",
      "title": "Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54407"
    },
    {
      "rank": 403,
      "cve_id": "CVE-2026-105280",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex",
      "cwe": "CWE-354",
      "title": "Hex writes unverified package tarballs to standard output in mix hex.package fetch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105280"
    },
    {
      "rank": 404,
      "cve_id": "CVE-2026-108939",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EricLBuehler",
      "product": "mistral.rs",
      "cwe": "CWE-918",
      "title": "EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108939"
    },
    {
      "rank": 405,
      "cve_id": "CVE-2026-108940",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "EricLBuehler",
      "product": "Mistral.rs",
      "cwe": "CWE-22",
      "title": "EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108940"
    },
    {
      "rank": 406,
      "cve_id": "CVE-2026-108950",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "opensource-socialnetwork",
      "product": "opensource-socialnetwork",
      "cwe": "CWE-862",
      "title": "Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108950"
    },
    {
      "rank": 407,
      "cve_id": "CVE-2026-109206",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-204",
      "title": "LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109206"
    },
    {
      "rank": 408,
      "cve_id": "CVE-2026-109239",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "unclecode",
      "product": "crawl4ai",
      "cwe": "CWE-918",
      "title": "Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109239"
    },
    {
      "rank": 409,
      "cve_id": "CVE-2026-109248",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109248"
    },
    {
      "rank": 410,
      "cve_id": "CVE-2026-109259",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-200",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109259"
    },
    {
      "rank": 411,
      "cve_id": "CVE-2026-109262",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-401",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109262"
    },
    {
      "rank": 412,
      "cve_id": "CVE-2026-109265",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-125",
      "title": "ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109265"
    },
    {
      "rank": 413,
      "cve_id": "CVE-2026-109266",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-79",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via CIP Encoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109266"
    },
    {
      "rank": 414,
      "cve_id": "CVE-2026-109267",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-674",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109267"
    },
    {
      "rank": 415,
      "cve_id": "CVE-2026-109269",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-125",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109269"
    },
    {
      "rank": 416,
      "cve_id": "CVE-2026-109273",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-908",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109273"
    },
    {
      "rank": 417,
      "cve_id": "CVE-2026-109276",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-459",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109276"
    },
    {
      "rank": 418,
      "cve_id": "CVE-2026-109304",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "craftcms",
      "product": "cms",
      "cwe": "CWE-200",
      "title": "Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109304"
    },
    {
      "rank": 419,
      "cve_id": "CVE-2026-109309",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "siyuan-note",
      "product": "siyuan",
      "cwe": "CWE-22",
      "title": "SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109309"
    },
    {
      "rank": 420,
      "cve_id": "CVE-2026-109316",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-data-manager",
      "cwe": "CWE-862",
      "title": "Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109316"
    },
    {
      "rank": 421,
      "cve_id": "CVE-2026-109323",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-star-ratings",
      "cwe": "CWE-862",
      "title": "Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109323"
    },
    {
      "rank": 422,
      "cve_id": "CVE-2026-109339",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-770",
      "title": "SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109339"
    },
    {
      "rank": 423,
      "cve_id": "CVE-2026-109364",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZcashFoundation",
      "product": "zebra",
      "cwe": "CWE-693",
      "title": "Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109364"
    },
    {
      "rank": 424,
      "cve_id": "CVE-2026-109379",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cockpit-hq",
      "product": "cockpit",
      "cwe": "CWE-208",
      "title": "Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109379"
    },
    {
      "rank": 425,
      "cve_id": "CVE-2026-109425",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tink-crypto",
      "product": "tink-go",
      "cwe": "CWE-1286",
      "title": "Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109425"
    },
    {
      "rank": 426,
      "cve_id": "CVE-2026-109600",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-862",
      "title": "Frappe before 16.31.0 Improper Access Control in Document Follow Notifications",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109600"
    },
    {
      "rank": 427,
      "cve_id": "CVE-2026-109634",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-89",
      "title": "Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109634"
    },
    {
      "rank": 428,
      "cve_id": "CVE-2026-109641",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109641"
    },
    {
      "rank": 429,
      "cve_id": "CVE-2026-107226",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "AsyncHttpClient",
      "product": "async-http-client",
      "cwe": "CWE-384",
      "title": "AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107226"
    },
    {
      "rank": 430,
      "cve_id": "CVE-2026-109244",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-732",
      "title": "FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109244"
    },
    {
      "rank": 431,
      "cve_id": "CVE-2026-109249",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109249"
    },
    {
      "rank": 432,
      "cve_id": "CVE-2026-109574",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gohugoio",
      "product": "hugo",
      "cwe": "CWE-22",
      "title": "Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109574"
    },
    {
      "rank": 433,
      "cve_id": "CVE-2026-109595",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gohugoio",
      "product": "hugo",
      "cwe": "CWE-22",
      "title": "Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109595"
    },
    {
      "rank": 434,
      "cve_id": "CVE-2026-109596",
      "cvss_base": 6.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gohugoio",
      "product": "hugo",
      "cwe": "CWE-59",
      "title": "Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109596"
    },
    {
      "rank": 435,
      "cve_id": "CVE-2026-18533",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Maximo Application Suite - Location Service for Esri Component",
      "cwe": "CWE-94",
      "title": "IBM Maximo Application Suite - Location Service for Esri Component Code Execution",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18533"
    },
    {
      "rank": 436,
      "cve_id": "CVE-2026-41210",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "moonlight-stream",
      "product": "moonlight-qt",
      "cwe": "CWE-787",
      "title": "Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41210"
    },
    {
      "rank": 437,
      "cve_id": "CVE-2026-53922",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "openwrt",
      "product": "odhcpd",
      "cwe": "CWE-121",
      "title": "odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53922"
    },
    {
      "rank": 438,
      "cve_id": "CVE-2026-77364",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "The-40-Thieves",
      "product": "obsidian-tc",
      "cwe": "CWE-200",
      "title": "obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77364"
    },
    {
      "rank": 439,
      "cve_id": "CVE-2026-78404",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-269",
      "title": "IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78404"
    },
    {
      "rank": 440,
      "cve_id": "CVE-2026-93693",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress",
      "product": "ShareFile Storage Zones Controller",
      "cwe": "CWE-20",
      "title": "Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93693"
    },
    {
      "rank": 441,
      "cve_id": "CVE-2026-94451",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Exploit Intelligence",
      "cwe": "CWE-20",
      "title": "Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94451"
    },
    {
      "rank": 442,
      "cve_id": "CVE-2026-105466",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-770",
      "title": "IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105466"
    },
    {
      "rank": 443,
      "cve_id": "CVE-2026-107862",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ExpressTech",
      "product": "Quiz And Survey Master",
      "cwe": "CWE-79",
      "title": "WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107862"
    },
    {
      "rank": 444,
      "cve_id": "CVE-2026-108478",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BdThemes",
      "product": "Element Pack Elementor Addons",
      "cwe": "CWE-79",
      "title": "WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108478"
    },
    {
      "rank": 445,
      "cve_id": "CVE-2026-108482",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LeapWorx",
      "product": "Premium Addons for Elementor",
      "cwe": "CWE-79",
      "title": "WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108482"
    },
    {
      "rank": 446,
      "cve_id": "CVE-2026-18541",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-79",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18541"
    },
    {
      "rank": 447,
      "cve_id": "CVE-2026-85471",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "mirror registry for Red Hat OpenShift",
      "cwe": "CWE-918",
      "title": "Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85471"
    },
    {
      "rank": 448,
      "cve_id": "CVE-2026-109194",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Quay 3",
      "cwe": "CWE-639",
      "title": "Quay: build trigger uuid idor in quay api",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109194"
    },
    {
      "rank": 449,
      "cve_id": "CVE-2025-71431",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-90",
      "title": "Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71431"
    },
    {
      "rank": 450,
      "cve_id": "CVE-2026-84320",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-22",
      "title": "Nginx UI: Auto backup name allows path traversal outside validated storage path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84320"
    },
    {
      "rank": 451,
      "cve_id": "CVE-2026-105283",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ash-project",
      "product": "ash_typescript",
      "cwe": "CWE-209",
      "title": "Internal error terms inspected into AshTypescript RPC error responses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105283"
    },
    {
      "rank": 452,
      "cve_id": "CVE-2026-109260",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-401",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109260"
    },
    {
      "rank": 453,
      "cve_id": "CVE-2026-109261",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-401",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109261"
    },
    {
      "rank": 454,
      "cve_id": "CVE-2026-109263",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-401",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109263"
    },
    {
      "rank": 455,
      "cve_id": "CVE-2026-109264",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-674",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109264"
    },
    {
      "rank": 456,
      "cve_id": "CVE-2026-109268",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-416",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109268"
    },
    {
      "rank": 457,
      "cve_id": "CVE-2026-109271",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-415",
      "title": "ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109271"
    },
    {
      "rank": 458,
      "cve_id": "CVE-2026-109272",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-476",
      "title": "ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109272"
    },
    {
      "rank": 459,
      "cve_id": "CVE-2026-109275",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-74",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109275"
    },
    {
      "rank": 460,
      "cve_id": "CVE-2026-109278",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-401",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109278"
    },
    {
      "rank": 461,
      "cve_id": "CVE-2026-109302",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parse-community",
      "product": "parse-server",
      "cwe": "CWE-863",
      "title": "Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109302"
    },
    {
      "rank": 462,
      "cve_id": "CVE-2026-109365",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZcashFoundation",
      "product": "zebra",
      "cwe": "CWE-345",
      "title": "Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109365"
    },
    {
      "rank": 463,
      "cve_id": "CVE-2026-109366",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ZcashFoundation",
      "product": "zebra",
      "cwe": "CWE-354",
      "title": "Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109366"
    },
    {
      "rank": 464,
      "cve_id": "CVE-2026-75621",
      "cvss_base": 6.2,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Aspera Enterprise WebApps",
      "cwe": "CWE-250",
      "title": "IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75621"
    },
    {
      "rank": 465,
      "cve_id": "CVE-2025-27895",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DB2 Recovery Expert for Linux, UNIX and Windows",
      "cwe": "CWE-79",
      "title": "DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27895"
    },
    {
      "rank": 466,
      "cve_id": "CVE-2025-27896",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DB2 Recovery Expert for Linux, UNIX and Windows",
      "cwe": "CWE-79",
      "title": "IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27896"
    },
    {
      "rank": 467,
      "cve_id": "CVE-2025-27897",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DB2 Recovery Expert for Linux, UNIX and Windows",
      "cwe": "CWE-79",
      "title": "IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27897"
    },
    {
      "rank": 468,
      "cve_id": "CVE-2025-27902",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "DB2 Recovery Expert for Linux, UNIX and Windows",
      "cwe": "CWE-1022",
      "title": "IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27902"
    },
    {
      "rank": 469,
      "cve_id": "CVE-2026-85967",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-79",
      "title": "Cross-site scripting in Progress MarkLogic Server",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85967"
    },
    {
      "rank": 470,
      "cve_id": "CVE-2026-104140",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "qgis",
      "product": "QGIS",
      "cwe": "CWE-79",
      "title": "QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104140"
    },
    {
      "rank": 471,
      "cve_id": "CVE-2026-109255",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-122",
      "title": "FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109255"
    },
    {
      "rank": 472,
      "cve_id": "CVE-2022-51020",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "mher",
      "product": "flower",
      "cwe": "CWE-352",
      "title": "Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-51020"
    },
    {
      "rank": 473,
      "cve_id": "CVE-2026-89140",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Temporal Technologies, Inc.",
      "product": "Temporal Server",
      "cwe": "CWE-639",
      "title": "Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-89140"
    },
    {
      "rank": 474,
      "cve_id": "CVE-2026-109251",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-129",
      "title": "FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109251"
    },
    {
      "rank": 475,
      "cve_id": "CVE-2026-109252",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-476",
      "title": "FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109252"
    },
    {
      "rank": 476,
      "cve_id": "CVE-2026-109253",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-125",
      "title": "FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109253"
    },
    {
      "rank": 477,
      "cve_id": "CVE-2026-109254",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-416",
      "title": "FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109254"
    },
    {
      "rank": 478,
      "cve_id": "CVE-2026-109256",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-122",
      "title": "FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109256"
    },
    {
      "rank": 479,
      "cve_id": "CVE-2026-109306",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "craftcms",
      "product": "cms",
      "cwe": "CWE-862",
      "title": "Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109306"
    },
    {
      "rank": 480,
      "cve_id": "CVE-2023-54409",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-80",
      "title": "Frappe before 13.46.1 XSS via html2text Weak Sanitization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54409"
    },
    {
      "rank": 481,
      "cve_id": "CVE-2026-19938",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-416",
      "title": "Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19938"
    },
    {
      "rank": 482,
      "cve_id": "CVE-2026-103061",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gleam",
      "product": "Gleam",
      "cwe": "CWE-22",
      "title": "Path traversal in Gleam via unvalidated package application names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103061"
    },
    {
      "rank": 483,
      "cve_id": "CVE-2026-103502",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex_core",
      "cwe": "CWE-295",
      "title": "hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103502"
    },
    {
      "rank": 484,
      "cve_id": "CVE-2026-103503",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex",
      "cwe": "CWE-295",
      "title": "Hex trusts its bundled CA certificates when cacerts_path is set",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103503"
    },
    {
      "rank": 485,
      "cve_id": "CVE-2026-103658",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GNU",
      "product": "Aspell",
      "cwe": "CWE-122",
      "title": "GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103658"
    },
    {
      "rank": 486,
      "cve_id": "CVE-2026-109448",
      "cvss_base": 5.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PostgreSQL",
      "product": "psqlODBC",
      "cwe": "CWE-124",
      "title": "psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109448"
    },
    {
      "rank": 487,
      "cve_id": "CVE-2026-41504",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-93",
      "title": "OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41504"
    },
    {
      "rank": 488,
      "cve_id": "CVE-2026-41508",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-693",
      "title": "OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41508"
    },
    {
      "rank": 489,
      "cve_id": "CVE-2026-104774",
      "cvss_base": 5.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "corazawaf",
      "product": "coraza",
      "cwe": "CWE-172",
      "title": "OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104774"
    },
    {
      "rank": 490,
      "cve_id": "CVE-2026-19937",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-772",
      "title": "Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19937"
    },
    {
      "rank": 491,
      "cve_id": "CVE-2026-102539",
      "cvss_base": 5.7,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "super-productivity",
      "product": "super-productivity",
      "cwe": "CWE-312",
      "title": "Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102539"
    },
    {
      "rank": 492,
      "cve_id": "CVE-2026-104332",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-121",
      "title": "IBM® Db2® Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104332"
    },
    {
      "rank": 493,
      "cve_id": "CVE-2026-108826",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Zen Cart",
      "cwe": "CWE-74",
      "title": "Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108826"
    },
    {
      "rank": 494,
      "cve_id": "CVE-2026-108836",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Ollama",
      "cwe": "CWE-918",
      "title": "Ollama Pull API name.go IsValid server-side request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108836"
    },
    {
      "rank": 495,
      "cve_id": "CVE-2026-108897",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Smart Media4U Technology",
      "product": "SHAREit App",
      "cwe": "CWE-749",
      "title": "Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108897"
    },
    {
      "rank": 496,
      "cve_id": "CVE-2026-108899",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "tobychui",
      "product": "zoraxy",
      "cwe": "CWE-266",
      "title": "tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108899"
    },
    {
      "rank": 497,
      "cve_id": "CVE-2026-108900",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Exponent",
      "product": "CMS",
      "cwe": "CWE-74",
      "title": "Exponent CMS XML-RPC xmlrpc.php userLogin sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108900"
    },
    {
      "rank": 498,
      "cve_id": "CVE-2026-108916",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-74",
      "title": "Edimax BR-6208AC formAccept command injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108916"
    },
    {
      "rank": 499,
      "cve_id": "CVE-2026-108921",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "KusalkaSilva",
      "product": "Learning-Management-System",
      "cwe": "CWE-287",
      "title": "KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108921"
    },
    {
      "rank": 500,
      "cve_id": "CVE-2026-108937",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Online Ticket Reservation System",
      "cwe": "CWE-200",
      "title": "code-projects Online Ticket Reservation System medallion.sql file information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108937"
    },
    {
      "rank": 501,
      "cve_id": "CVE-2026-108938",
      "cvss_base": 5.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "code-projects",
      "product": "Matrimonial System",
      "cwe": "CWE-425",
      "title": "code-projects Matrimonial System matrimony.sql file access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108938"
    },
    {
      "rank": 502,
      "cve_id": "CVE-2026-61994",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RocketGeek",
      "product": "WP-Members",
      "cwe": "CWE-862",
      "title": "WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61994"
    },
    {
      "rank": 503,
      "cve_id": "CVE-2026-75063",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Planning Analytics",
      "cwe": "CWE-79",
      "title": "IBM Planning Analytics Local is affected by security vulnerabilities",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75063"
    },
    {
      "rank": 504,
      "cve_id": "CVE-2026-81858",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-125",
      "title": "IBM i is Affected By A Denial of Service Vulnerability in Host Servers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81858"
    },
    {
      "rank": 505,
      "cve_id": "CVE-2026-84321",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "0xJacky",
      "product": "nginx-ui",
      "cwe": "CWE-613",
      "title": "Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84321"
    },
    {
      "rank": 506,
      "cve_id": "CVE-2026-85976",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress Software Corporation",
      "product": "MarkLogic Server",
      "cwe": "CWE-113",
      "title": "HTTP response splitting in Progress MarkLogic Server Query Console",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85976"
    },
    {
      "rank": 507,
      "cve_id": "CVE-2026-107418",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Arraytics",
      "product": "Booktics",
      "cwe": "CWE-862",
      "title": "WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107418"
    },
    {
      "rank": 508,
      "cve_id": "CVE-2023-54410",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-285",
      "title": "Frappe before 13.22.0 Improper Authorization via Document Rename",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54410"
    },
    {
      "rank": 509,
      "cve_id": "CVE-2024-58391",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-79",
      "title": "Frappe before 15.4.0 XSS via Printview Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58391"
    },
    {
      "rank": 510,
      "cve_id": "CVE-2026-17484",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-200",
      "title": "IBM i is Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17484"
    },
    {
      "rank": 511,
      "cve_id": "CVE-2026-17487",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-200",
      "title": "IBM i is Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17487"
    },
    {
      "rank": 512,
      "cve_id": "CVE-2026-18318",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-307",
      "title": "IBM i Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18318"
    },
    {
      "rank": 513,
      "cve_id": "CVE-2026-83536",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat OpenStack Platform 18.0",
      "cwe": "CWE-400",
      "title": "Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-83536"
    },
    {
      "rank": 514,
      "cve_id": "CVE-2026-103080",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VillaTheme",
      "product": "Salevo",
      "cwe": "CWE-472",
      "title": "WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103080"
    },
    {
      "rank": 515,
      "cve_id": "CVE-2026-104102",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "9001",
      "product": "copyparty",
      "cwe": "CWE-22",
      "title": "copyparty FTP: upload outside defined volumes (limited path traversal)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104102"
    },
    {
      "rank": 516,
      "cve_id": "CVE-2026-108477",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Arraytics",
      "product": "Booktics",
      "cwe": "CWE-862",
      "title": "WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108477"
    },
    {
      "rank": 517,
      "cve_id": "CVE-2026-108486",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "WPMU DEV",
      "product": "Forminator",
      "cwe": "CWE-862",
      "title": "WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108486"
    },
    {
      "rank": 518,
      "cve_id": "CVE-2026-108924",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getkirby",
      "product": "Kirby",
      "cwe": "CWE-285",
      "title": "getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108924"
    },
    {
      "rank": 519,
      "cve_id": "CVE-2026-109165",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TDuckCloud",
      "product": "tduck-survey-form",
      "cwe": "CWE-639",
      "title": "TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109165"
    },
    {
      "rank": 520,
      "cve_id": "CVE-2026-109167",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "TDuckCloud",
      "product": "tduck-survey-form",
      "cwe": "CWE-639",
      "title": "TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109167"
    },
    {
      "rank": 521,
      "cve_id": "CVE-2026-109171",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guchengwuyue",
      "product": "yshop-crm",
      "cwe": "CWE-862",
      "title": "yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109171"
    },
    {
      "rank": 522,
      "cve_id": "CVE-2026-109172",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guchengwuyue",
      "product": "yshop-crm",
      "cwe": "CWE-862",
      "title": "yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109172"
    },
    {
      "rank": 523,
      "cve_id": "CVE-2026-109173",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "guchengwuyue",
      "product": "yshop-crm",
      "cwe": "CWE-862",
      "title": "yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109173"
    },
    {
      "rank": 524,
      "cve_id": "CVE-2026-109175",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "moxi624",
      "product": "MoguBlog",
      "cwe": "CWE-639",
      "title": "MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109175"
    },
    {
      "rank": 525,
      "cve_id": "CVE-2026-109176",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "moxi624",
      "product": "MoguBlog",
      "cwe": "CWE-639",
      "title": "MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109176"
    },
    {
      "rank": 526,
      "cve_id": "CVE-2026-109177",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "moxi624",
      "product": "MoguBlog",
      "cwe": "CWE-639",
      "title": "MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109177"
    },
    {
      "rank": 527,
      "cve_id": "CVE-2026-109178",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Missing Authorization via /log Audit Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109178"
    },
    {
      "rank": 528,
      "cve_id": "CVE-2026-109179",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Missing Authorization via /log/list and /log/info",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109179"
    },
    {
      "rank": 529,
      "cve_id": "CVE-2026-109180",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-639",
      "title": "jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109180"
    },
    {
      "rank": 530,
      "cve_id": "CVE-2026-109181",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-863",
      "title": "jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109181"
    },
    {
      "rank": 531,
      "cve_id": "CVE-2026-109182",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-863",
      "title": "jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109182"
    },
    {
      "rank": 532,
      "cve_id": "CVE-2026-109183",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109183"
    },
    {
      "rank": 533,
      "cve_id": "CVE-2026-109184",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109184"
    },
    {
      "rank": 534,
      "cve_id": "CVE-2026-109188",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "jishenghua",
      "product": "jshERP",
      "cwe": "CWE-862",
      "title": "jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109188"
    },
    {
      "rank": 535,
      "cve_id": "CVE-2026-109200",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-918",
      "title": "LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109200"
    },
    {
      "rank": 536,
      "cve_id": "CVE-2026-109204",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "LogicalDOC",
      "product": "LogicalDOC Community Edition",
      "cwe": "CWE-640",
      "title": "LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109204"
    },
    {
      "rank": 537,
      "cve_id": "CVE-2026-109283",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-863",
      "title": "Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109283"
    },
    {
      "rank": 538,
      "cve_id": "CVE-2026-109284",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-862",
      "title": "Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109284"
    },
    {
      "rank": 539,
      "cve_id": "CVE-2026-109287",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-639",
      "title": "Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109287"
    },
    {
      "rank": 540,
      "cve_id": "CVE-2026-109289",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-613",
      "title": "Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109289"
    },
    {
      "rank": 541,
      "cve_id": "CVE-2026-109296",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-639",
      "title": "Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109296"
    },
    {
      "rank": 542,
      "cve_id": "CVE-2026-109303",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "parse-community",
      "product": "parse-server",
      "cwe": "CWE-639",
      "title": "Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109303"
    },
    {
      "rank": 543,
      "cve_id": "CVE-2026-109319",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-guestbook",
      "cwe": "CWE-862",
      "title": "Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109319"
    },
    {
      "rank": 544,
      "cve_id": "CVE-2026-109320",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-api",
      "cwe": "CWE-613",
      "title": "Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109320"
    },
    {
      "rank": 545,
      "cve_id": "CVE-2026-109322",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "getgrav",
      "product": "grav-plugin-guestbook",
      "cwe": "CWE-79",
      "title": "Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109322"
    },
    {
      "rank": 546,
      "cve_id": "CVE-2026-109328",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-79",
      "title": "Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109328"
    },
    {
      "rank": 547,
      "cve_id": "CVE-2026-109330",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jovancoding",
      "product": "Network-AI",
      "cwe": "CWE-1385",
      "title": "Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109330"
    },
    {
      "rank": 548,
      "cve_id": "CVE-2026-109336",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-863",
      "title": "SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109336"
    },
    {
      "rank": 549,
      "cve_id": "CVE-2026-109337",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-203",
      "title": "SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109337"
    },
    {
      "rank": 550,
      "cve_id": "CVE-2026-109340",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-862",
      "title": "SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109340"
    },
    {
      "rank": 551,
      "cve_id": "CVE-2026-109342",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "surrealdb",
      "product": "surrealdb",
      "cwe": "CWE-306",
      "title": "SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109342"
    },
    {
      "rank": 552,
      "cve_id": "CVE-2026-109348",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "GitoxideLabs",
      "product": "gix-mailmap",
      "cwe": "CWE-407",
      "title": "Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109348"
    },
    {
      "rank": 553,
      "cve_id": "CVE-2026-109352",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-79",
      "title": "LibreNMS before 26.9.0 Stored XSS via wireless sensor description",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109352"
    },
    {
      "rank": 554,
      "cve_id": "CVE-2026-109354",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-22",
      "title": "LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109354"
    },
    {
      "rank": 555,
      "cve_id": "CVE-2026-109355",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-79",
      "title": "LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109355"
    },
    {
      "rank": 556,
      "cve_id": "CVE-2026-109356",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "librenms",
      "product": "librenms",
      "cwe": "CWE-862",
      "title": "LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109356"
    },
    {
      "rank": 557,
      "cve_id": "CVE-2026-109362",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "heymrun",
      "product": "heym",
      "cwe": "CWE-613",
      "title": "Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109362"
    },
    {
      "rank": 558,
      "cve_id": "CVE-2026-109376",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Frappe",
      "product": "ERPNext",
      "cwe": "CWE-863",
      "title": "ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109376"
    },
    {
      "rank": 559,
      "cve_id": "CVE-2026-109377",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Frappe",
      "product": "ERPNext",
      "cwe": "CWE-862",
      "title": "ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109377"
    },
    {
      "rank": 560,
      "cve_id": "CVE-2026-109378",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SPIP",
      "product": "SPIP",
      "cwe": "CWE-918",
      "title": "SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109378"
    },
    {
      "rank": 561,
      "cve_id": "CVE-2026-109393",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Webkul",
      "product": "QloApps",
      "cwe": "CWE-639",
      "title": "QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109393"
    },
    {
      "rank": 562,
      "cve_id": "CVE-2026-109562",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "snapotter-hq",
      "product": "SnapOtter",
      "cwe": "CWE-862",
      "title": "SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109562"
    },
    {
      "rank": 563,
      "cve_id": "CVE-2026-109565",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zofe",
      "product": "rapyd-admin",
      "cwe": "CWE-79",
      "title": "Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109565"
    },
    {
      "rank": 564,
      "cve_id": "CVE-2026-109570",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Fire-Boltt",
      "product": "BSW013",
      "cwe": "CWE-306",
      "title": "Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109570"
    },
    {
      "rank": 565,
      "cve_id": "CVE-2026-109598",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-862",
      "title": "Frappe before 16.33.0 Broken Authorization via send_sms Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109598"
    },
    {
      "rank": 566,
      "cve_id": "CVE-2026-109599",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-862",
      "title": "Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109599"
    },
    {
      "rank": 567,
      "cve_id": "CVE-2026-109611",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109611"
    },
    {
      "rank": 568,
      "cve_id": "CVE-2026-109622",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109622"
    },
    {
      "rank": 569,
      "cve_id": "CVE-2026-109623",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109623"
    },
    {
      "rank": 570,
      "cve_id": "CVE-2026-109629",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109629"
    },
    {
      "rank": 571,
      "cve_id": "CVE-2026-109630",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109630"
    },
    {
      "rank": 572,
      "cve_id": "CVE-2026-109635",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109635"
    },
    {
      "rank": 573,
      "cve_id": "CVE-2026-109642",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109642"
    },
    {
      "rank": 574,
      "cve_id": "CVE-2026-109651",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-918",
      "title": "Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109651"
    },
    {
      "rank": 575,
      "cve_id": "CVE-2026-109654",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109654"
    },
    {
      "rank": 576,
      "cve_id": "CVE-2026-109662",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109662"
    },
    {
      "rank": 577,
      "cve_id": "CVE-2026-109664",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109664"
    },
    {
      "rank": 578,
      "cve_id": "CVE-2026-109665",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109665"
    },
    {
      "rank": 579,
      "cve_id": "CVE-2026-109668",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109668"
    },
    {
      "rank": 580,
      "cve_id": "CVE-2026-109669",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-862",
      "title": "Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109669"
    },
    {
      "rank": 581,
      "cve_id": "CVE-2026-109675",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "suite",
      "cwe": "CWE-639",
      "title": "Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109675"
    },
    {
      "rank": 582,
      "cve_id": "CVE-2026-6232",
      "cvss_base": 5.2,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Semtech",
      "product": "LR1110 Transceiver",
      "cwe": "CWE-787",
      "title": "Out-of-bounds write in LR11xx Transceiver",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6232"
    },
    {
      "rank": 583,
      "cve_id": "CVE-2023-54408",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-79",
      "title": "Frappe before 14.31.0 HTML Injection via Weak Escaping",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54408"
    },
    {
      "rank": 584,
      "cve_id": "CVE-2024-58389",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "HoloViz",
      "product": "Panel",
      "cwe": "CWE-601",
      "title": "HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58389"
    },
    {
      "rank": 585,
      "cve_id": "CVE-2025-71430",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-79",
      "title": "Frappe before 15.91.1 Stored XSS via Leaderboard User Names",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71430"
    },
    {
      "rank": 586,
      "cve_id": "CVE-2026-49484",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "codefori",
      "product": "vscode-ibmi",
      "cwe": "CWE-377",
      "title": "Code for IBM i: Temporary files are visible to all users",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49484"
    },
    {
      "rank": 587,
      "cve_id": "CVE-2026-92832",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Aspera Enterprise WebApps",
      "cwe": "CWE-319",
      "title": "IBM Aspera Enterprise Webapps Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92832"
    },
    {
      "rank": 588,
      "cve_id": "CVE-2026-108952",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "RT-Thread",
      "product": "rt-thread",
      "cwe": "CWE-843",
      "title": "RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108952"
    },
    {
      "rank": 589,
      "cve_id": "CVE-2026-109300",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-79",
      "title": "Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109300"
    },
    {
      "rank": 590,
      "cve_id": "CVE-2026-109327",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-79",
      "title": "Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109327"
    },
    {
      "rank": 591,
      "cve_id": "CVE-2026-109344",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cure53",
      "product": "DOMPurify",
      "cwe": "CWE-79",
      "title": "DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109344"
    },
    {
      "rank": 592,
      "cve_id": "CVE-2026-109345",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "cure53",
      "product": "DOMPurify",
      "cwe": "CWE-79",
      "title": "DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109345"
    },
    {
      "rank": 593,
      "cve_id": "CVE-2026-109374",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zitadel",
      "product": "zitadel",
      "cwe": "CWE-863",
      "title": "ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109374"
    },
    {
      "rank": 594,
      "cve_id": "CVE-2026-109392",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Pimcore",
      "product": "Pimcore",
      "cwe": "CWE-79",
      "title": "Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109392"
    },
    {
      "rank": 595,
      "cve_id": "CVE-2026-109597",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "gohugoio",
      "product": "hugo",
      "cwe": "CWE-79",
      "title": "Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109597"
    },
    {
      "rank": 596,
      "cve_id": "CVE-2026-109602",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-79",
      "title": "Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109602"
    },
    {
      "rank": 597,
      "cve_id": "CVE-2026-109657",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109657"
    },
    {
      "rank": 598,
      "cve_id": "CVE-2026-109670",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "erpnext",
      "cwe": "CWE-79",
      "title": "Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109670"
    },
    {
      "rank": 599,
      "cve_id": "CVE-2026-108476",
      "cvss_base": 5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoWhisper.com",
      "product": "Paid Videochat Turnkey Site",
      "cwe": "CWE-862",
      "title": "WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108476"
    },
    {
      "rank": 600,
      "cve_id": "CVE-2026-109375",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Vercel",
      "product": "deepsec",
      "cwe": "CWE-59",
      "title": "Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109375"
    },
    {
      "rank": 601,
      "cve_id": "CVE-2026-19936",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "zephyrproject",
      "product": "zephyr",
      "cwe": "CWE-362",
      "title": "Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19936"
    },
    {
      "rank": 602,
      "cve_id": "CVE-2026-108835",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Yungengxin",
      "product": "Yun Jia Security Guard",
      "cwe": "CWE-266",
      "title": "Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108835"
    },
    {
      "rank": 603,
      "cve_id": "CVE-2026-109270",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-401",
      "title": "ImageMagick before 7.1.2-32 Memory Leak via -process Option",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109270"
    },
    {
      "rank": 604,
      "cve_id": "CVE-2026-109277",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-404",
      "title": "ImageMagick before 7.1.2-32 Policy Bypass via -script Operation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109277"
    },
    {
      "rank": 605,
      "cve_id": "CVE-2026-109281",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-125",
      "title": "ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109281"
    },
    {
      "rank": 606,
      "cve_id": "CVE-2026-109603",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "frappe",
      "product": "frappe",
      "cwe": "CWE-918",
      "title": "Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109603"
    },
    {
      "rank": 607,
      "cve_id": "CVE-2026-95838",
      "cvss_base": 4.6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "containerd",
      "product": "containerd",
      "cwe": "CWE-400",
      "title": "containerd: Unpack DoS via repeated opaque whiteouts",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95838"
    },
    {
      "rank": 608,
      "cve_id": "CVE-2026-16678",
      "cvss_base": 4.5,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Virtualization Management Interface",
      "cwe": "CWE-772",
      "title": "IBM Power Systems Firmware Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16678"
    },
    {
      "rank": 609,
      "cve_id": "CVE-2026-18343",
      "cvss_base": 4.4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "i",
      "cwe": "CWE-269",
      "title": "IBM i is Affected By An Improper Privilege Management Vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18343"
    },
    {
      "rank": 610,
      "cve_id": "CVE-2026-54459",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "error311",
      "product": "FileRise",
      "cwe": "CWE-352",
      "title": "FileRise: Missing CSRF enforcement for file creation and share-link creation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54459"
    },
    {
      "rank": 611,
      "cve_id": "CVE-2026-75076",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Aspera Enterprise WebApps",
      "cwe": "CWE-200",
      "title": "IBM Aspera Enterprise Webapps Information Disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75076"
    },
    {
      "rank": 612,
      "cve_id": "CVE-2026-97691",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "get-convex",
      "product": "convex-backend",
      "cwe": "CWE-284",
      "title": "Convex: Unauthorized data access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97691"
    },
    {
      "rank": 613,
      "cve_id": "CVE-2026-102596",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "NangoHQ",
      "product": "nango",
      "cwe": "CWE-862",
      "title": "Nango: Production flow RBAC bypass on private flow-read routes",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102596"
    },
    {
      "rank": 614,
      "cve_id": "CVE-2026-102663",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "OpenListTeam",
      "product": "OpenList",
      "cwe": "CWE-200",
      "title": "OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102663"
    },
    {
      "rank": 615,
      "cve_id": "CVE-2026-106495",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "backstage",
      "product": "backstage",
      "cwe": "CWE-284",
      "title": "Backstage: Improper access control in backend action invocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106495"
    },
    {
      "rank": 616,
      "cve_id": "CVE-2026-108475",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "VideoWhisper.com",
      "product": "Broadcast Live Video",
      "cwe": "CWE-862",
      "title": "WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108475"
    },
    {
      "rank": 617,
      "cve_id": "CVE-2026-109243",
      "cvss_base": 4.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-732",
      "title": "FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109243"
    },
    {
      "rank": 618,
      "cve_id": "CVE-2026-93694",
      "cvss_base": 4,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Progress",
      "product": "ShareFile Storage Zones Controller",
      "cwe": "CWE-321",
      "title": "Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93694"
    },
    {
      "rank": 619,
      "cve_id": "CVE-2026-42689",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Pixelite",
      "product": "Events Manager",
      "cwe": "CWE-362",
      "title": "WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42689"
    },
    {
      "rank": 620,
      "cve_id": "CVE-2026-103526",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": "CWE-204",
      "title": "CVE-2026-103526",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103526"
    },
    {
      "rank": 621,
      "cve_id": "CVE-2026-104364",
      "cvss_base": 3.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "IBM",
      "product": "Db2",
      "cwe": "CWE-20",
      "title": "IBM® Db2® Denial of Service",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104364"
    },
    {
      "rank": 622,
      "cve_id": "CVE-2026-109195",
      "cvss_base": 3.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Red Hat",
      "product": "Red Hat Quay 3",
      "cwe": "CWE-639",
      "title": "Quay: repository auto-prune policy uuid idor in quay api",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109195"
    },
    {
      "rank": 623,
      "cve_id": "CVE-2026-108941",
      "cvss_base": 2.4,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Linketic",
      "product": "CityGaussian",
      "cwe": "CWE-94",
      "title": "Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108941"
    },
    {
      "rank": 624,
      "cve_id": "CVE-2026-81856",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex",
      "cwe": "CWE-150",
      "title": "Terminal escape sequence injection in Hex via unneutralized server-supplied output",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81856"
    },
    {
      "rank": 625,
      "cve_id": "CVE-2026-109240",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-617",
      "title": "FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109240"
    },
    {
      "rank": 626,
      "cve_id": "CVE-2026-109241",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-476",
      "title": "FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109241"
    },
    {
      "rank": 627,
      "cve_id": "CVE-2026-109285",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "open-webui",
      "product": "open-webui",
      "cwe": "CWE-863",
      "title": "Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109285"
    },
    {
      "rank": 628,
      "cve_id": "CVE-2026-109332",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Jovancoding",
      "product": "Network-AI",
      "cwe": "CWE-346",
      "title": "Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109332"
    },
    {
      "rank": 629,
      "cve_id": "CVE-2026-109396",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": "CWE-1236",
      "title": "Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109396"
    },
    {
      "rank": 630,
      "cve_id": "CVE-2026-109561",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "aaif-goose",
      "product": "goose",
      "cwe": "CWE-863",
      "title": "goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109561"
    },
    {
      "rank": 631,
      "cve_id": "CVE-2026-109564",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "learnhouse",
      "product": "LearnHouse",
      "cwe": "CWE-862",
      "title": "LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109564"
    },
    {
      "rank": 632,
      "cve_id": "CVE-2026-109571",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Fire-Boltt",
      "product": "BSW013",
      "cwe": "CWE-306",
      "title": "Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109571"
    },
    {
      "rank": 633,
      "cve_id": "CVE-2026-96618",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hexpm",
      "product": "hex",
      "cwe": "CWE-409",
      "title": "Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96618"
    },
    {
      "rank": 634,
      "cve_id": "CVE-2026-105274",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "erlang",
      "product": "rebar3",
      "cwe": "CWE-409",
      "title": "hex_core decompresses registry and Erlang term API responses without size limits",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105274"
    },
    {
      "rank": 635,
      "cve_id": "CVE-2026-108824",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "DataEase",
      "cwe": "CWE-74",
      "title": "DataEase Utils.java Utils.buildCalcField sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108824"
    },
    {
      "rank": 636,
      "cve_id": "CVE-2026-108825",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "yangzongzhuan",
      "product": "RuoYi",
      "cwe": "CWE-266",
      "title": "yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108825"
    },
    {
      "rank": 637,
      "cve_id": "CVE-2026-108831",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "meetecho",
      "product": "janus-gateway",
      "cwe": "CWE-259",
      "title": "meetecho janus-gateway Admin API admin.js hard-coded credentials",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108831"
    },
    {
      "rank": 638,
      "cve_id": "CVE-2026-108834",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cairo-dock",
      "product": "Glx-Dock",
      "cwe": "CWE-79",
      "title": "Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108834"
    },
    {
      "rank": 639,
      "cve_id": "CVE-2026-108890",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "BlackBeltTechnology",
      "product": "pi-agent-dashboard",
      "cwe": "CWE-266",
      "title": "BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108890"
    },
    {
      "rank": 640,
      "cve_id": "CVE-2026-108909",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-352",
      "title": "Netcore NR268 CGI Endpoint cross-site request forgery",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108909"
    },
    {
      "rank": 641,
      "cve_id": "CVE-2026-108919",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Drug Recommendation System",
      "cwe": "CWE-79",
      "title": "SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108919"
    },
    {
      "rank": 642,
      "cve_id": "CVE-2026-108920",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "SourceCodester",
      "product": "Drug Recommendation System",
      "cwe": "CWE-79",
      "title": "SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108920"
    },
    {
      "rank": 643,
      "cve_id": "CVE-2026-108922",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "KusalkaSilva",
      "product": "Learning-Management-System",
      "cwe": "CWE-284",
      "title": "KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108922"
    },
    {
      "rank": 644,
      "cve_id": "CVE-2026-108923",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "1024-lab",
      "product": "smart-admin",
      "cwe": "CWE-266",
      "title": "1024-lab smart-admin Support Config Query queryByKey access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108923"
    },
    {
      "rank": 645,
      "cve_id": "CVE-2026-108926",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Baptism Information Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Baptism Information Management System ebaptism.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108926"
    },
    {
      "rank": 646,
      "cve_id": "CVE-2026-108927",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Baptism Information Management System",
      "cwe": "CWE-74",
      "title": "itsourcecode Baptism Information Management System pbaptism.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108927"
    },
    {
      "rank": 647,
      "cve_id": "CVE-2026-108928",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "itsourcecode",
      "product": "Online Admission System",
      "cwe": "CWE-74",
      "title": "itsourcecode Online Admission System sum.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108928"
    },
    {
      "rank": 648,
      "cve_id": "CVE-2026-108931",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-79",
      "title": "Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108931"
    },
    {
      "rank": 649,
      "cve_id": "CVE-2026-108932",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-79",
      "title": "Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108932"
    },
    {
      "rank": 650,
      "cve_id": "CVE-2026-109247",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-22",
      "title": "FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109247"
    },
    {
      "rank": 651,
      "cve_id": "CVE-2026-109307",
      "cvss_base": 2.1,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "craftcms",
      "product": "cms",
      "cwe": "CWE-79",
      "title": "Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109307"
    },
    {
      "rank": 652,
      "cve_id": "CVE-2026-105081",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-59",
      "title": "ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105081"
    },
    {
      "rank": 653,
      "cve_id": "CVE-2026-108829",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Zen Cart",
      "cwe": "CWE-74",
      "title": "Zen Cart Module Configuration modules.php sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108829"
    },
    {
      "rank": 654,
      "cve_id": "CVE-2026-108898",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netis",
      "product": "WF2409E",
      "cwe": "CWE-79",
      "title": "Netis WF2409E Wireless Settings cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108898"
    },
    {
      "rank": 655,
      "cve_id": "CVE-2026-108901",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Shenzhen HCC Technology",
      "product": "MPOS M6 PLUS",
      "cwe": "CWE-1021",
      "title": "Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108901"
    },
    {
      "rank": 656,
      "cve_id": "CVE-2026-108930",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-200",
      "title": "Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108930"
    },
    {
      "rank": 657,
      "cve_id": "CVE-2026-109258",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-476",
      "title": "ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109258"
    },
    {
      "rank": 658,
      "cve_id": "CVE-2026-109274",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-59",
      "title": "ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109274"
    },
    {
      "rank": 659,
      "cve_id": "CVE-2026-109279",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-362",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109279"
    },
    {
      "rank": 660,
      "cve_id": "CVE-2026-109280",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-476",
      "title": "ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109280"
    },
    {
      "rank": 661,
      "cve_id": "CVE-2026-109282",
      "cvss_base": 2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "ImageMagick",
      "product": "ImageMagick",
      "cwe": "CWE-843",
      "title": "ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109282"
    },
    {
      "rank": 662,
      "cve_id": "CVE-2026-108889",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Yungengxin",
      "product": "Cloud Billing",
      "cwe": "CWE-782",
      "title": "Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_14000443C exposed ioctl with insufficient access control",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108889"
    },
    {
      "rank": 663,
      "cve_id": "CVE-2026-108908",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Netcore",
      "product": "NR268",
      "cwe": "CWE-79",
      "title": "Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108908"
    },
    {
      "rank": 664,
      "cve_id": "CVE-2026-108933",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-79",
      "title": "Edimax BR-6208AC formFilter cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108933"
    },
    {
      "rank": 665,
      "cve_id": "CVE-2026-108934",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-79",
      "title": "Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108934"
    },
    {
      "rank": 666,
      "cve_id": "CVE-2026-108935",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-79",
      "title": "Edimax BR-6208AC Port Forwarding formPortFw cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108935"
    },
    {
      "rank": 667,
      "cve_id": "CVE-2026-108936",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Edimax",
      "product": "BR-6208AC",
      "cwe": "CWE-79",
      "title": "Edimax BR-6208AC QoS Page formQoS cross site scripting",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108936"
    },
    {
      "rank": 668,
      "cve_id": "CVE-2026-108830",
      "cvss_base": 1.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "meetecho",
      "product": "janus-gateway",
      "cwe": "CWE-362",
      "title": "meetecho janus-gateway VideoRoom janus_videoroom.c race condition",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108830"
    },
    {
      "rank": 669,
      "cve_id": "CVE-2026-108827",
      "cvss_base": 1.2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Zen Cart",
      "cwe": "CWE-74",
      "title": "Zen Cart Administrative Module Management general.php zen_call_function code injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108827"
    },
    {
      "rank": 670,
      "cve_id": "CVE-2026-108828",
      "cvss_base": 1.2,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "n/a",
      "product": "Zen Cart",
      "cwe": "CWE-74",
      "title": "Zen Cart Admin Panel configuration.php eval sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108828"
    },
    {
      "rank": 671,
      "cve_id": "CVE-2026-84286",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Turboderp-org",
      "product": "ExLlamaV3",
      "cwe": null,
      "title": "OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84286"
    },
    {
      "rank": 672,
      "cve_id": "CVE-2026-85499",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache SkyWalking BanyanDB",
      "cwe": "CWE-863",
      "title": "Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85499"
    },
    {
      "rank": 673,
      "cve_id": "CVE-2026-92116",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Allura",
      "cwe": "CWE-601",
      "title": "Apache Allura: OAuth1 missing callback validation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92116"
    },
    {
      "rank": 674,
      "cve_id": "CVE-2026-92119",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Allura",
      "cwe": "CWE-915",
      "title": "Apache Allura: REST API Mass Assignment",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92119"
    },
    {
      "rank": 675,
      "cve_id": "CVE-2026-92120",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Apache Software Foundation",
      "product": "Apache Allura",
      "cwe": "CWE-294",
      "title": "Apache Allura: Oauth1 Replay Attack",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92120"
    },
    {
      "rank": 676,
      "cve_id": "CVE-2026-103523",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103523"
    },
    {
      "rank": 677,
      "cve_id": "CVE-2026-103524",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103524"
    },
    {
      "rank": 678,
      "cve_id": "CVE-2026-103527",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103527"
    },
    {
      "rank": 679,
      "cve_id": "CVE-2026-103528",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103528"
    },
    {
      "rank": 680,
      "cve_id": "CVE-2026-103529",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103529"
    },
    {
      "rank": 681,
      "cve_id": "CVE-2026-103535",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103535"
    },
    {
      "rank": 682,
      "cve_id": "CVE-2026-103537",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-103537",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103537"
    },
    {
      "rank": 683,
      "cve_id": "CVE-2026-107248",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Thelia",
      "product": "Thelia",
      "cwe": null,
      "title": "CVE-2026-107248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107248"
    }
  ],
  "transactions": [
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-5914",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-5914 (libarchive). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2025-6021",
      "detail": "EXPLOIT PUBLISHED — CVE-2025-6021 (libxml2). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104077",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104077 (Obsidian Desktop). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104078",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104078 (Obsidian Desktop). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104082",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104082 (Smartertools Smartermail). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104083",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104083 (Smartertools Smartermail). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-104084",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-104084 (Smartertools Smartermail). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108110",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108110 (himovo MOVO). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108111",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108111 (ageerle ruoyi-ai). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108112",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108112 (ageerle ruoyi-ai). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108115",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108115 (kortix-ai suna). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108158",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108158 (mynaparrot plugNmeet-server). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108598",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108598 (floci-io floci). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108609",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108609 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108614",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108614 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108619",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108619 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108624",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108624 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108629",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108629 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108634",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108634 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108639",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108639 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108644",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108644 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108649",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108649 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108654",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108654 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108659",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108659 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108664",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108664 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108669",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108669 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-108679",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-108679 (JeecgBoot). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-12780",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-12780 (AOMEI Backupper). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-55653",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-55653 (Red Hat Enterprise Linux 10). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-58380",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-58380 (Red Hat Enterprise Linux 8). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-58384",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-58384 (Red Hat Enterprise Linux 9). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-59090",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-59090 (gimp). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-66758",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-66758 (GNOME GIMP). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-78675",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-78675 (gitpython-developers GitPython). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-78676",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-78676 (gitpython-developers GitPython). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-78677",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-78677 (gitpython-developers GitPython). Public exploit reference added."
    },
    {
      "type": "EXPLOIT_PUBLISHED",
      "cve_id": "CVE-2026-78678",
      "detail": "EXPLOIT PUBLISHED — CVE-2026-78678 (gitpython-developers GitPython). Public exploit reference added."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2015-3306",
      "detail": "DUE DATE PASSED — CVE-2015-3306. CISA remediation deadline was October 11, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2015-5477",
      "detail": "DUE DATE PASSED — CVE-2015-5477. CISA remediation deadline was October 11, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2016-3081",
      "detail": "DUE DATE PASSED — CVE-2016-3081. CISA remediation deadline was October 11, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2021-3199",
      "detail": "DUE DATE PASSED — CVE-2021-3199. CISA remediation deadline was October 11, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2023-22894",
      "detail": "DUE DATE PASSED — CVE-2023-22894. CISA remediation deadline was October 11, 2026; still in catalog."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-108774",
      "detail": "RESCORED — CVE-2026-108774 (erzhongxmu JEEWMS). CVSS 5.3 → 2.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-108775",
      "detail": "RESCORED — CVE-2026-108775 (erzhongxmu JEEWMS). CVSS 5.3 → 2.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-108777",
      "detail": "RESCORED — CVE-2026-108777 (erzhongxmu JEEWMS). CVSS 5.3 → 2.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-108778",
      "detail": "RESCORED — CVE-2026-108778 (erzhongxmu JEEWMS). CVSS 5.3 → 2.1 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-66787",
      "detail": "RESCORED — CVE-2026-66787 (Red Hat Advanced Cluster Management for Kubernetes 2.17). CVSS 5.4 → 8.7 (NVD)."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2026-66788",
      "detail": "RESCORED — CVE-2026-66788 (Red Hat Advanced Cluster Management for Kubernetes 2.17). CVSS 3.7 → 9.9 (NVD)."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-66588",
      "detail": "REJECTED — CVE-2026-66588 (Dream-Theme The7). Record withdrawn by the CNA."
    },
    {
      "type": "REJECTED",
      "cve_id": "CVE-2026-97058",
      "detail": "REJECTED — CVE-2026-97058 (alexei sprintf-js). Record withdrawn by the CNA."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-107655",
      "detail": "PATCH SHIPPED — CVE-2026-107655 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 2.4.19-4.4.hum1."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-108119",
      "detail": "PATCH SHIPPED — CVE-2026-108119 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 1.37.0-9.4.hum1."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-18378",
      "detail": "PATCH SHIPPED — CVE-2026-18378 (Red Hat Cost Management 4). Fixed in Cost Management 4 1790844333."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-18381",
      "detail": "PATCH SHIPPED — CVE-2026-18381 (Red Hat Cost Management 4). Fixed in Cost Management 4 1790844333."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-18382",
      "detail": "PATCH SHIPPED — CVE-2026-18382 (Red Hat Cost Management 4). Fixed in Cost Management 4 1790844333."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-42696",
      "detail": "PATCH SHIPPED — CVE-2026-42696 (Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning). Fixed in SiteVault – Backup, Restore, Migration &amp; Cloning 1.5.20."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-42697",
      "detail": "PATCH SHIPPED — CVE-2026-42697 (Inisev Social Share Icons & Social Share Buttons). Fixed in Social Share Icons & Social Share Buttons 3.7.6."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}