{ "day": "2026-10-16", "boundary": "UTC calendar day", "published_count": 458, "by_severity": { "CRITICAL": 44, "HIGH": 164, "MEDIUM": 210, "LOW": 14 }, "kev_count": 0, "exploit_reference_count": 0, "awaiting_enrichment_count": 26, "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.", "results": [ { "rank": 1, "cve_id": "CVE-2026-92115", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.01475, "epss_percentile": 0.73386, "kev": false, "kev_due_at": null, "vendor": "opajaap", "product": "WP Photo Album Plus", "cwe": "CWE-77", "title": "WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92115" }, { "rank": 2, "cve_id": "CVE-2026-94169", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": 0.00985, "epss_percentile": 0.61672, "kev": false, "kev_due_at": null, "vendor": "Theme-one", "product": "The Grid", "cwe": "CWE-94", "title": "WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-94169" }, { "rank": 3, "cve_id": "CVE-2026-104798", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00891, "epss_percentile": 0.58638, "kev": false, "kev_due_at": null, "vendor": "joedolson", "product": "My Calendar – Accessible Event Manager", "cwe": "CWE-269", "title": "My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104798" }, { "rank": 4, "cve_id": "CVE-2026-109221", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.0079, "epss_percentile": 0.55388, "kev": false, "kev_due_at": null, "vendor": "trainingbusinesspros", "product": "Groundhogg — CRM, Newsletters, and Marketing Automation", "cwe": "CWE-22", "title": "Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109221" }, { "rank": 5, "cve_id": "CVE-2026-104769", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00767, "epss_percentile": 0.54654, "kev": false, "kev_due_at": null, "vendor": "asadkn", "product": "Debloat – Remove Unused CSS, Optimize JS", "cwe": "CWE-22", "title": "Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed ", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104769" }, { "rank": 6, "cve_id": "CVE-2026-109219", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00685, "epss_percentile": 0.51645, "kev": false, "kev_due_at": null, "vendor": "kitae-park", "product": "Mang Board", "cwe": "CWE-434", "title": "Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109219" }, { "rank": 7, "cve_id": "CVE-2026-93767", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00584, "epss_percentile": 0.46764, "kev": false, "kev_due_at": null, "vendor": "tainacan", "product": "Tainacan", "cwe": "CWE-22", "title": "Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93767" }, { "rank": 8, "cve_id": "CVE-2026-103768", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00578, "epss_percentile": 0.46405, "kev": false, "kev_due_at": null, "vendor": "elextensions", "product": "ELEX WordPress HelpDesk & Customer Ticketing System", "cwe": "CWE-434", "title": "ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103768" }, { "rank": 9, "cve_id": "CVE-2026-92553", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00575, "epss_percentile": 0.46275, "kev": false, "kev_due_at": null, "vendor": "yaycommerce", "product": "YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports", "cwe": "CWE-434", "title": "YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92553" }, { "rank": 10, "cve_id": "CVE-2026-104745", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00518, "epss_percentile": 0.42766, "kev": false, "kev_due_at": null, "vendor": "wpcodefactory", "product": "Customer Email Verification for WooCommerce", "cwe": "CWE-269", "title": "Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104745" }, { "rank": 11, "cve_id": "CVE-2026-111311", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00516, "epss_percentile": 0.42596, "kev": false, "kev_due_at": null, "vendor": "samuelgallegos", "product": "DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More", "cwe": "CWE-434", "title": "DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111311" }, { "rank": 12, "cve_id": "CVE-2026-104730", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00512, "epss_percentile": 0.42323, "kev": false, "kev_due_at": null, "vendor": "sunshinephotocart", "product": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers", "cwe": "CWE-502", "title": "Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104730" }, { "rank": 13, "cve_id": "CVE-2026-75903", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00503, "epss_percentile": 0.41669, "kev": false, "kev_due_at": null, "vendor": "manuelgalan", "product": "Vulnity Security", "cwe": "CWE-287", "title": "Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-75903" }, { "rank": 14, "cve_id": "CVE-2026-103896", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00464, "epss_percentile": 0.38752, "kev": false, "kev_due_at": null, "vendor": "10web", "product": "10Web Booster – Website speed optimization, Cache & Page Speed optimizer", "cwe": "CWE-22", "title": "10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103896" }, { "rank": 15, "cve_id": "CVE-2026-107770", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00459, "epss_percentile": 0.38352, "kev": false, "kev_due_at": null, "vendor": "tigroumeow", "product": "Photo Engine (Media Organizer & Lightroom)", "cwe": "CWE-862", "title": "Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107770" }, { "rank": 16, "cve_id": "CVE-2026-109515", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00439, "epss_percentile": 0.36702, "kev": false, "kev_due_at": null, "vendor": "properfraction", "product": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.", "cwe": "CWE-269", "title": "MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109515" }, { "rank": 17, "cve_id": "CVE-2026-103895", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00427, "epss_percentile": 0.35475, "kev": false, "kev_due_at": null, "vendor": "cyberlord92", "product": "miniOrange OTP Login, Verification and SMS Notifications", "cwe": "CWE-287", "title": "miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103895" }, { "rank": 18, "cve_id": "CVE-2026-14452", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00406, "epss_percentile": 0.33284, "kev": false, "kev_due_at": null, "vendor": "Checkmk GmbH", "product": "Checkmk", "cwe": "CWE-601", "title": "Open redirect and XSS via reset_url parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14452" }, { "rank": 19, "cve_id": "CVE-2026-103518", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00377, "epss_percentile": 0.30066, "kev": false, "kev_due_at": null, "vendor": "wpmanageninja", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "cwe": "CWE-89", "title": "FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103518" }, { "rank": 20, "cve_id": "CVE-2026-103525", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00375, "epss_percentile": 0.29845, "kev": false, "kev_due_at": null, "vendor": "wpmanageninja", "product": "FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler", "cwe": "CWE-639", "title": "FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103525" }, { "rank": 21, "cve_id": "CVE-2026-110703", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00375, "epss_percentile": 0.29853, "kev": false, "kev_due_at": null, "vendor": "paoltaia", "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory", "cwe": "CWE-79", "title": "GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110703" }, { "rank": 22, "cve_id": "CVE-2026-85659", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00367, "epss_percentile": 0.28985, "kev": false, "kev_due_at": null, "vendor": "ontraport", "product": "PilotPress", "cwe": "CWE-269", "title": "PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85659" }, { "rank": 23, "cve_id": "CVE-2026-109193", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00362, "epss_percentile": 0.28501, "kev": false, "kev_due_at": null, "vendor": "hivepress", "product": "HivePress – Business Directory, Listings & Classified Ads Plugin", "cwe": "CWE-79", "title": "HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109193" }, { "rank": 24, "cve_id": "CVE-2026-107758", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00356, "epss_percentile": 0.27787, "kev": false, "kev_due_at": null, "vendor": "extendthemes", "product": "Colibri Page Builder", "cwe": "CWE-79", "title": "Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107758" }, { "rank": 25, "cve_id": "CVE-2026-107649", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00356, "epss_percentile": 0.27772, "kev": false, "kev_due_at": null, "vendor": "liedekef", "product": "Events Made Easy", "cwe": "CWE-79", "title": "Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107649" }, { "rank": 26, "cve_id": "CVE-2026-109400", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0035, "epss_percentile": 0.27093, "kev": false, "kev_due_at": null, "vendor": "instawp", "product": "InstaWP Connect – 1-click WP Staging & Migration", "cwe": "CWE-269", "title": "InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109400" }, { "rank": 27, "cve_id": "CVE-2026-107646", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00348, "epss_percentile": 0.26778, "kev": false, "kev_due_at": null, "vendor": "realmag777", "product": "HUSKY – Products Filter for WooCommerce Professional", "cwe": "CWE-200", "title": "HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107646" }, { "rank": 28, "cve_id": "CVE-2026-109382", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00346, "epss_percentile": 0.26561, "kev": false, "kev_due_at": null, "vendor": "bilalnaseer", "product": "WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents", "cwe": "CWE-863", "title": "WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109382" }, { "rank": 29, "cve_id": "CVE-2026-93953", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.0034, "epss_percentile": 0.2583, "kev": false, "kev_due_at": null, "vendor": "softaculous", "product": "Backuply – Backup, Restore, Migrate and Clone", "cwe": "CWE-89", "title": "Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93953" }, { "rank": 30, "cve_id": "CVE-2026-109447", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00335, "epss_percentile": 0.25291, "kev": false, "kev_due_at": null, "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "cwe": "CWE-269", "title": "User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109447" }, { "rank": 31, "cve_id": "CVE-2026-109990", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00331, "epss_percentile": 0.24766, "kev": false, "kev_due_at": null, "vendor": "gijo", "product": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance", "cwe": "CWE-79", "title": "Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109990" }, { "rank": 32, "cve_id": "CVE-2026-92766", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.0033, "epss_percentile": 0.24489, "kev": false, "kev_due_at": null, "vendor": "appsbd", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "cwe": "CWE-89", "title": "Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92766" }, { "rank": 33, "cve_id": "CVE-2026-111378", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00328, "epss_percentile": 0.24304, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-400", "title": "FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111378" }, { "rank": 34, "cve_id": "CVE-2026-110590", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00325, "epss_percentile": 0.23966, "kev": false, "kev_due_at": null, "vendor": "klarnaplugin", "product": "Klarna for WooCommerce", "cwe": "CWE-862", "title": "Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110590" }, { "rank": 35, "cve_id": "CVE-2026-109401", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00324, "epss_percentile": 0.23849, "kev": false, "kev_due_at": null, "vendor": "smub", "product": "WP Mail Logging", "cwe": "CWE-200", "title": "WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109401" }, { "rank": 36, "cve_id": "CVE-2026-107746", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00318, "epss_percentile": 0.23101, "kev": false, "kev_due_at": null, "vendor": "teamfunnelkit", "product": "FunnelKit – Funnel Builder Plugin for WooCommerce Checkout", "cwe": "CWE-862", "title": "FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107746" }, { "rank": 37, "cve_id": "CVE-2026-96768", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00318, "epss_percentile": 0.23149, "kev": false, "kev_due_at": null, "vendor": "softaculous", "product": "GoSMTP Pro", "cwe": "CWE-79", "title": "GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96768" }, { "rank": 38, "cve_id": "CVE-2026-96570", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00314, "epss_percentile": 0.22729, "kev": false, "kev_due_at": null, "vendor": "magazine3", "product": "Schema & Structured Data for WP & AMP", "cwe": "CWE-79", "title": "Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96570" }, { "rank": 39, "cve_id": "CVE-2026-104755", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.0031, "epss_percentile": 0.22254, "kev": false, "kev_due_at": null, "vendor": "aresit", "product": "WP Compress – Instant Performance & Speed Optimization", "cwe": "CWE-269", "title": "WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104755" }, { "rank": 40, "cve_id": "CVE-2026-105227", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00308, "epss_percentile": 0.22045, "kev": false, "kev_due_at": null, "vendor": "Deltaww", "product": "ISPSoft", "cwe": "CWE-125", "title": "ISPSoft Out-of-Bounds Read Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105227" }, { "rank": 41, "cve_id": "CVE-2026-105228", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00308, "epss_percentile": 0.22045, "kev": false, "kev_due_at": null, "vendor": "Deltaww", "product": "ISPSoft", "cwe": "CWE-125", "title": "ISPSoft Out-of-Bounds Read Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105228" }, { "rank": 42, "cve_id": "CVE-2026-109207", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00307, "epss_percentile": 0.21944, "kev": false, "kev_due_at": null, "vendor": "themeisle", "product": "RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator", "cwe": "CWE-79", "title": "RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109207" }, { "rank": 43, "cve_id": "CVE-2026-107659", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00302, "epss_percentile": 0.21481, "kev": false, "kev_due_at": null, "vendor": "wpchill", "product": "Modula Image Gallery – Photo Grid & Video Gallery", "cwe": "CWE-862", "title": "Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107659" }, { "rank": 44, "cve_id": "CVE-2026-107768", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00297, "epss_percentile": 0.20927, "kev": false, "kev_due_at": null, "vendor": "cozmoslabs", "product": "TranslatePress – Translate Multilingual sites with AI Translation", "cwe": "CWE-79", "title": "TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107768" }, { "rank": 45, "cve_id": "CVE-2026-111383", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00295, "epss_percentile": 0.20708, "kev": false, "kev_due_at": null, "vendor": "nezhahq", "product": "nezha", "cwe": "CWE-770", "title": "Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111383" }, { "rank": 46, "cve_id": "CVE-2026-111384", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00295, "epss_percentile": 0.20709, "kev": false, "kev_due_at": null, "vendor": "nezhahq", "product": "nezha", "cwe": "CWE-770", "title": "Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111384" }, { "rank": 47, "cve_id": "CVE-2026-89079", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.00294, "epss_percentile": 0.2053, "kev": false, "kev_due_at": null, "vendor": "jfarthing84", "product": "Theme My Login", "cwe": "CWE-269", "title": "Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89079" }, { "rank": 48, "cve_id": "CVE-2026-111178", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00294, "epss_percentile": 0.2063, "kev": false, "kev_due_at": null, "vendor": "murgroland", "product": "WP Booking System – Booking Calendar", "cwe": "CWE-89", "title": "WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111178" }, { "rank": 49, "cve_id": "CVE-2026-111382", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00293, "epss_percentile": 0.20486, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-787", "title": "FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111382" }, { "rank": 50, "cve_id": "CVE-2026-104932", "cvss_base": 8, "cvss_severity": "HIGH", "epss_score": 0.00291, "epss_percentile": 0.20237, "kev": false, "kev_due_at": null, "vendor": "johnny5", "product": "Search Regex", "cwe": "CWE-502", "title": "Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104932" }, { "rank": 51, "cve_id": "CVE-2026-111210", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": 0.00291, "epss_percentile": 0.20254, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "bitcoinj", "cwe": "CWE-918", "title": "bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111210" }, { "rank": 52, "cve_id": "CVE-2026-111114", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00289, "epss_percentile": 0.20093, "kev": false, "kev_due_at": null, "vendor": "posimyththemes", "product": "Nexter Extension – Security, Performance, Code Snippets & Site Toolkit", "cwe": "CWE-269", "title": "Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111114" }, { "rank": 53, "cve_id": "CVE-2026-110252", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00288, "epss_percentile": 0.19981, "kev": false, "kev_due_at": null, "vendor": "etruel", "product": "WPeMatico RSS Feed Fetcher", "cwe": "CWE-79", "title": "WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110252" }, { "rank": 54, "cve_id": "CVE-2026-111106", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00281, "epss_percentile": 0.19272, "kev": false, "kev_due_at": null, "vendor": "getwpfunnels", "product": "Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance", "cwe": "CWE-89", "title": "Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111106" }, { "rank": 55, "cve_id": "CVE-2026-109224", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.0028, "epss_percentile": 0.19142, "kev": false, "kev_due_at": null, "vendor": "surecart", "product": "SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments", "cwe": "CWE-79", "title": "SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109224" }, { "rank": 56, "cve_id": "CVE-2026-16251", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0028, "epss_percentile": 0.19107, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-770", "title": "Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16251" }, { "rank": 57, "cve_id": "CVE-2026-96562", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0028, "epss_percentile": 0.19141, "kev": false, "kev_due_at": null, "vendor": "wpmudev", "product": "Broken Link Checker", "cwe": "CWE-94", "title": "Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96562" }, { "rank": 58, "cve_id": "CVE-2026-101335", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0028, "epss_percentile": 0.19142, "kev": false, "kev_due_at": null, "vendor": "wpmudev", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "cwe": "CWE-94", "title": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101335" }, { "rank": 59, "cve_id": "CVE-2026-111445", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00278, "epss_percentile": 0.18899, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-669", "title": "Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant authorization can therefore load and subsequently modify or delete another user's or tenant's record when the key comes from a request. The 4.2.0 fix combines key conditions with incoming scope, query-builder or where conditions in findByKey(), exists(key=), updateByKey() and deleteByKey(). Other scope-aware finders, aggregates, updateAll() and deleteAll() are not affected.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111445" }, { "rank": 60, "cve_id": "CVE-2026-111447", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00278, "epss_percentile": 0.18898, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-472", "title": "Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested belongsTo records can also be edited by posting another associated record's key. New child rows with composite primary keys not made up of foreign keys retain posted key values, allowing the request to choose their identity. This is fixed in 4.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111447" }, { "rank": 61, "cve_id": "CVE-2026-95686", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00278, "epss_percentile": 0.18925, "kev": false, "kev_due_at": null, "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "cwe": "CWE-79", "title": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95686" }, { "rank": 62, "cve_id": "CVE-2026-109191", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00277, "epss_percentile": 0.18865, "kev": false, "kev_due_at": null, "vendor": "extendthemes", "product": "Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy", "cwe": "CWE-200", "title": "Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109191" }, { "rank": 63, "cve_id": "CVE-2026-103911", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00275, "epss_percentile": 0.18563, "kev": false, "kev_due_at": null, "vendor": "wpmudev", "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder", "cwe": "CWE-94", "title": "Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103911" }, { "rank": 64, "cve_id": "CVE-2026-109414", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00275, "epss_percentile": 0.18583, "kev": false, "kev_due_at": null, "vendor": "appsbd", "product": "Vitepos – Point of Sale (POS) for WooCommerce", "cwe": "CWE-89", "title": "Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109414" }, { "rank": 65, "cve_id": "CVE-2026-109998", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00272, "epss_percentile": 0.18251, "kev": false, "kev_due_at": null, "vendor": "kitae-park", "product": "Mang Board", "cwe": "CWE-79", "title": "Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109998" }, { "rank": 66, "cve_id": "CVE-2026-111387", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00264, "epss_percentile": 0.17137, "kev": false, "kev_due_at": null, "vendor": "nezhahq", "product": "nezha", "cwe": "CWE-212", "title": "Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111387" }, { "rank": 67, "cve_id": "CVE-2026-111446", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00261, "epss_percentile": 0.16674, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-863", "title": "Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111446" }, { "rank": 68, "cve_id": "CVE-2026-111444", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": 0.0026, "epss_percentile": 0.16566, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-89", "title": "Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111444" }, { "rank": 69, "cve_id": "CVE-2026-103999", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00259, "epss_percentile": 0.1639, "kev": false, "kev_due_at": null, "vendor": "themefic", "product": "Ultra Addons for Contact Form 7", "cwe": "CWE-79", "title": "Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103999" }, { "rank": 70, "cve_id": "CVE-2026-100159", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00258, "epss_percentile": 0.16312, "kev": false, "kev_due_at": null, "vendor": "ays-pro", "product": "Popup Box – Create Countdown, Coupon, Video, Contact Form Popups", "cwe": "CWE-94", "title": "Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100159" }, { "rank": 71, "cve_id": "CVE-2026-97296", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": 0.00257, "epss_percentile": 0.16238, "kev": false, "kev_due_at": null, "vendor": "Rocketgenius, Inc", "product": "Gravity Forms", "cwe": "CWE-502", "title": "WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97296" }, { "rank": 72, "cve_id": "CVE-2026-111380", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": 0.00256, "epss_percentile": 0.16166, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-190", "title": "FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111380" }, { "rank": 73, "cve_id": "CVE-2026-109388", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00256, "epss_percentile": 0.16064, "kev": false, "kev_due_at": null, "vendor": "hivepress", "product": "HivePress – Business Directory, Listings & Classified Ads Plugin", "cwe": "CWE-79", "title": "HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109388" }, { "rank": 74, "cve_id": "CVE-2026-97339", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00254, "epss_percentile": 0.15894, "kev": false, "kev_due_at": null, "vendor": "complianz", "product": "Complianz GDPR/CCPA Cookie Consent Banner", "cwe": "CWE-79", "title": "Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97339" }, { "rank": 75, "cve_id": "CVE-2026-111377", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00249, "epss_percentile": 0.1507, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-400", "title": "FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111377" }, { "rank": 76, "cve_id": "CVE-2026-19621", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00249, "epss_percentile": 0.15145, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-200", "title": "Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19621" }, { "rank": 77, "cve_id": "CVE-2026-95809", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00247, "epss_percentile": 0.14852, "kev": false, "kev_due_at": null, "vendor": "optiuser", "product": "Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights", "cwe": "CWE-79", "title": "Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95809" }, { "rank": 78, "cve_id": "CVE-2026-109232", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00247, "epss_percentile": 0.14852, "kev": false, "kev_due_at": null, "vendor": "wordpresschef", "product": "Salon Booking System – Appointment Booking for Salons, Barbershops & Spas", "cwe": "CWE-79", "title": "Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109232" }, { "rank": 79, "cve_id": "CVE-2026-110701", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00247, "epss_percentile": 0.14853, "kev": false, "kev_due_at": null, "vendor": "codepeople", "product": "CP Multi View Events Calendar", "cwe": "CWE-79", "title": "CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110701" }, { "rank": 80, "cve_id": "CVE-2026-111373", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00247, "epss_percentile": 0.14874, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-476", "title": "FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111373" }, { "rank": 81, "cve_id": "CVE-2026-14177", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": 0.00245, "epss_percentile": 0.14653, "kev": false, "kev_due_at": null, "vendor": "IKAS Technology Inc.", "product": "ikas E-Commerce Infrastructure", "cwe": "CWE-204", "title": "User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-14177" }, { "rank": 82, "cve_id": "CVE-2026-110721", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00245, "epss_percentile": 0.14651, "kev": false, "kev_due_at": null, "vendor": "wpdevteam", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "cwe": "CWE-862", "title": "NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110721" }, { "rank": 83, "cve_id": "CVE-2026-97640", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00243, "epss_percentile": 0.14388, "kev": false, "kev_due_at": null, "vendor": "smub", "product": "WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)", "cwe": "CWE-79", "title": "WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97640" }, { "rank": 84, "cve_id": "CVE-2026-77829", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00243, "epss_percentile": 0.1442, "kev": false, "kev_due_at": null, "vendor": "goratech", "product": "Cooked – Recipe Management", "cwe": "CWE-79", "title": "Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77829" }, { "rank": 85, "cve_id": "CVE-2026-100186", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00241, "epss_percentile": 0.14183, "kev": false, "kev_due_at": null, "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "cwe": "CWE-79", "title": "User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100186" }, { "rank": 86, "cve_id": "CVE-2026-109513", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00241, "epss_percentile": 0.14181, "kev": false, "kev_due_at": null, "vendor": "wpdevteam", "product": "NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar", "cwe": "CWE-79", "title": "NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109513" }, { "rank": 87, "cve_id": "CVE-2026-111374", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": 0.00238, "epss_percentile": 0.13826, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-20", "title": "FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111374" }, { "rank": 88, "cve_id": "CVE-2026-94388", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00236, "epss_percentile": 0.13606, "kev": false, "kev_due_at": null, "vendor": "halfdata", "product": "Green Popups", "cwe": "CWE-89", "title": "WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-94388" }, { "rank": 89, "cve_id": "CVE-2026-104000", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00236, "epss_percentile": 0.13602, "kev": false, "kev_due_at": null, "vendor": "croixhaug", "product": "Simply Schedule Appointments", "cwe": "CWE-79", "title": "Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104000" }, { "rank": 90, "cve_id": "CVE-2026-107764", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00236, "epss_percentile": 0.13601, "kev": false, "kev_due_at": null, "vendor": "gpriday", "product": "SiteOrigin CSS", "cwe": "CWE-79", "title": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107764" }, { "rank": 91, "cve_id": "CVE-2026-111122", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.00236, "epss_percentile": 0.13602, "kev": false, "kev_due_at": null, "vendor": "gpriday", "product": "SiteOrigin CSS", "cwe": "CWE-79", "title": "SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111122" }, { "rank": 92, "cve_id": "CVE-2026-19600", "cvss_base": 4.5, "cvss_severity": "MEDIUM", "epss_score": 0.00236, "epss_percentile": 0.13626, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-532", "title": "Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19600" }, { "rank": 93, "cve_id": "CVE-2026-100106", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00235, "epss_percentile": 0.13391, "kev": false, "kev_due_at": null, "vendor": "damian-gora", "product": "FiboSearch – Ajax Search for WooCommerce", "cwe": "CWE-79", "title": "FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100106" }, { "rank": 94, "cve_id": "CVE-2026-104001", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00234, "epss_percentile": 0.13238, "kev": false, "kev_due_at": null, "vendor": "rilwis", "product": "Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated", "cwe": "CWE-94", "title": "Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104001" }, { "rank": 95, "cve_id": "CVE-2026-104003", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00234, "epss_percentile": 0.13239, "kev": false, "kev_due_at": null, "vendor": "properfraction", "product": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress", "cwe": "CWE-94", "title": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104003" }, { "rank": 96, "cve_id": "CVE-2026-111442", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00234, "epss_percentile": 0.13291, "kev": false, "kev_due_at": null, "vendor": "BackdropCMS", "product": "Backdrop", "cwe": "CWE-79", "title": "Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111442" }, { "rank": 97, "cve_id": "CVE-2026-19601", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": 0.00234, "epss_percentile": 0.13329, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-201", "title": "Disclosure of AD/LDAP bind password via Test Connection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19601" }, { "rank": 98, "cve_id": "CVE-2026-111472", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": 0.00228, "epss_percentile": 0.12587, "kev": false, "kev_due_at": null, "vendor": "TSG", "product": "Profleet", "cwe": "CWE-89", "title": "SQL injection in TSG Profleet", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111472" }, { "rank": 99, "cve_id": "CVE-2026-111389", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": 0.00224, "epss_percentile": 0.12073, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "hrms", "cwe": "CWE-89", "title": "Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111389" }, { "rank": 100, "cve_id": "CVE-2026-18551", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.11895, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-863", "title": "Mattermost guest account privilege escalation via member roles API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18551" }, { "rank": 101, "cve_id": "CVE-2026-110019", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00222, "epss_percentile": 0.11841, "kev": false, "kev_due_at": null, "vendor": "niklaslindemann", "product": "Bulk Page Generator – LPagery", "cwe": "CWE-862", "title": "Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110019" }, { "rank": 102, "cve_id": "CVE-2026-111069", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00221, "epss_percentile": 0.1175, "kev": false, "kev_due_at": null, "vendor": "paoltaia", "product": "GeoDirectory – WP Business Directory Plugin and Classified Listings Directory", "cwe": "CWE-79", "title": "GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111069" }, { "rank": 103, "cve_id": "CVE-2026-19541", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00219, "epss_percentile": 0.11497, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-201", "title": "Outgoing OAuth connection client secret exposure during connection validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19541" }, { "rank": 104, "cve_id": "CVE-2026-109512", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00216, "epss_percentile": 0.1119, "kev": false, "kev_due_at": null, "vendor": "kitae-park", "product": "Mang Board", "cwe": "CWE-79", "title": "Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109512" }, { "rank": 105, "cve_id": "CVE-2026-110664", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00216, "epss_percentile": 0.1119, "kev": false, "kev_due_at": null, "vendor": "codename065", "product": "Premium Packages – Sell Digital Products Securely", "cwe": "CWE-79", "title": "Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110664" }, { "rank": 106, "cve_id": "CVE-2026-12272", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00214, "epss_percentile": 0.10988, "kev": false, "kev_due_at": null, "vendor": "daext", "product": "Lightweight Cookie Notice – Cookie Banner for Cookie Consent", "cwe": "CWE-330", "title": "Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant", "url": "https://www.cve.org/CVERecord?id=CVE-2026-12272" }, { "rank": 107, "cve_id": "CVE-2026-89280", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00213, "epss_percentile": 0.10892, "kev": false, "kev_due_at": null, "vendor": "dokaninc", "product": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy", "cwe": "CWE-639", "title": "Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89280" }, { "rank": 108, "cve_id": "CVE-2026-19867", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00212, "epss_percentile": 0.10758, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-770", "title": "Uncapped mention keys in user notification properties allow CPU exhaustion during post processing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19867" }, { "rank": 109, "cve_id": "CVE-2026-103481", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00211, "epss_percentile": 0.10615, "kev": false, "kev_due_at": null, "vendor": "mpol", "product": "Gwolle Guestbook", "cwe": "CWE-79", "title": "Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103481" }, { "rank": 110, "cve_id": "CVE-2026-111449", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.0021, "epss_percentile": 0.10561, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-362", "title": "Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full exception details, including tag context or a serialized exception, and any sensitive data they contain. This race does not bypass the production gate protecting developer tools. This is fixed in 4.1.2.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111449" }, { "rank": 111, "cve_id": "CVE-2026-111386", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.0021, "epss_percentile": 0.10534, "kev": false, "kev_due_at": null, "vendor": "nezhahq", "product": "nezha", "cwe": "CWE-204", "title": "Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111386" }, { "rank": 112, "cve_id": "CVE-2026-111448", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": 0.00208, "epss_percentile": 0.1021, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-178", "title": "Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory, allowing access outside the intended root, including limited file disclosure. Separately, the CLI database-dump output check can write outside the application root to an existing writable case-distinct sibling directory; that action requires the CLI POST, loopback and password gate. This is fixed in 4.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111448" }, { "rank": 113, "cve_id": "CVE-2026-101300", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00207, "epss_percentile": 0.10108, "kev": false, "kev_due_at": null, "vendor": "Wegow Technologies", "product": "Wegow", "cwe": "CWE-918", "title": "Server-Side Request Forgery in Wegow PDF export", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101300" }, { "rank": 114, "cve_id": "CVE-2026-96870", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.09891, "kev": false, "kev_due_at": null, "vendor": "brainstormforce", "product": "SureDash – Community, Courses & Member Dashboard", "cwe": "CWE-79", "title": "SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96870" }, { "rank": 115, "cve_id": "CVE-2026-110290", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00206, "epss_percentile": 0.09891, "kev": false, "kev_due_at": null, "vendor": "ajay", "product": "WebberZone Top 10 — Popular Posts", "cwe": "CWE-79", "title": "WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110290" }, { "rank": 116, "cve_id": "CVE-2026-19798", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00204, "epss_percentile": 0.09667, "kev": false, "kev_due_at": null, "vendor": "tusharimran", "product": "WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters", "cwe": "CWE-862", "title": "WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19798" }, { "rank": 117, "cve_id": "CVE-2026-111375", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00203, "epss_percentile": 0.09615, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-125", "title": "FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111375" }, { "rank": 118, "cve_id": "CVE-2026-93681", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.09308, "kev": false, "kev_due_at": null, "vendor": "themeum", "product": "Tutor LMS – eLearning and online course solution", "cwe": "CWE-79", "title": "Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93681" }, { "rank": 119, "cve_id": "CVE-2026-100108", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.09304, "kev": false, "kev_due_at": null, "vendor": "maxfoundry", "product": "Social Share Buttons", "cwe": "CWE-79", "title": "Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100108" }, { "rank": 120, "cve_id": "CVE-2026-100158", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.09306, "kev": false, "kev_due_at": null, "vendor": "elvinhaci", "product": "SQL Chart Builder", "cwe": "CWE-79", "title": "SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100158" }, { "rank": 121, "cve_id": "CVE-2026-107748", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.09303, "kev": false, "kev_due_at": null, "vendor": "cozmoslabs", "product": "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor", "cwe": "CWE-79", "title": "User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107748" }, { "rank": 122, "cve_id": "CVE-2026-110017", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00201, "epss_percentile": 0.09309, "kev": false, "kev_due_at": null, "vendor": "fullworks", "product": "Quick PayPal Payments: Payment Button & Form", "cwe": "CWE-79", "title": "Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110017" }, { "rank": 123, "cve_id": "CVE-2026-15575", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00197, "epss_percentile": 0.08838, "kev": false, "kev_due_at": null, "vendor": "SFM Software Technologies Inc.", "product": "Costifier", "cwe": "CWE-489", "title": "Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15575" }, { "rank": 124, "cve_id": "CVE-2026-19076", "cvss_base": 4.4, "cvss_severity": "MEDIUM", "epss_score": 0.00197, "epss_percentile": 0.08856, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-863", "title": "Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19076" }, { "rank": 125, "cve_id": "CVE-2026-15219", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00195, "epss_percentile": 0.08575, "kev": false, "kev_due_at": null, "vendor": "SFM Software Technologies Inc.", "product": "Costifier", "cwe": "CWE-639", "title": "IDOR in SFM Software's Costifier", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15219" }, { "rank": 126, "cve_id": "CVE-2026-111385", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": 0.00194, "epss_percentile": 0.08486, "kev": false, "kev_due_at": null, "vendor": "nezhahq", "product": "nezha", "cwe": "CWE-601", "title": "Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111385" }, { "rank": 127, "cve_id": "CVE-2026-88963", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": 0.00194, "epss_percentile": 0.08525, "kev": false, "kev_due_at": null, "vendor": "themeum", "product": "Tutor LMS – eLearning and online course solution", "cwe": "CWE-79", "title": "Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88963" }, { "rank": 128, "cve_id": "CVE-2026-103480", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00193, "epss_percentile": 0.08401, "kev": false, "kev_due_at": null, "vendor": "themefic", "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental", "cwe": "CWE-79", "title": "Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103480" }, { "rank": 129, "cve_id": "CVE-2026-104726", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00193, "epss_percentile": 0.08404, "kev": false, "kev_due_at": null, "vendor": "jeroenpeters1986", "product": "Name Directory", "cwe": "CWE-79", "title": "Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104726" }, { "rank": 130, "cve_id": "CVE-2026-87111", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.0019, "epss_percentile": 0.08113, "kev": false, "kev_due_at": null, "vendor": "WPEverest", "product": "User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin", "cwe": "CWE-79", "title": "User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-87111" }, { "rank": 131, "cve_id": "CVE-2026-89051", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": 0.0019, "epss_percentile": 0.08112, "kev": false, "kev_due_at": null, "vendor": "johndarrel", "product": "Hide My WP Ghost – Security & Firewall", "cwe": "CWE-79", "title": "Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89051" }, { "rank": 132, "cve_id": "CVE-2026-103696", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.0019, "epss_percentile": 0.08063, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Mobile builder", "cwe": "CWE-89", "title": "Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-103696" }, { "rank": 133, "cve_id": "CVE-2026-16453", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00186, "epss_percentile": 0.07699, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-472", "title": "Mattermost SAML RelayState forgery allows unauthorized team membership", "url": "https://www.cve.org/CVERecord?id=CVE-2026-16453" }, { "rank": 134, "cve_id": "CVE-2026-15222", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": 0.00184, "epss_percentile": 0.07488, "kev": false, "kev_due_at": null, "vendor": "wpeverest", "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "cwe": "CWE-94", "title": "User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name", "url": "https://www.cve.org/CVERecord?id=CVE-2026-15222" }, { "rank": 135, "cve_id": "CVE-2026-91833", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00177, "epss_percentile": 0.06775, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "WX Subscribe 微信支付付费订阅", "cwe": "CWE-89", "title": "WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-91833" }, { "rank": 136, "cve_id": "CVE-2026-110366", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.06663, "kev": false, "kev_due_at": null, "vendor": "Gemini Labs", "product": "Site Reviews", "cwe": "CWE-862", "title": "WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110366" }, { "rank": 137, "cve_id": "CVE-2026-18560", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.06699, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-203", "title": "Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18560" }, { "rank": 138, "cve_id": "CVE-2026-19603", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00176, "epss_percentile": 0.06701, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-201", "title": "Private channel ID disclosure via user status endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-19603" }, { "rank": 139, "cve_id": "CVE-2026-111388", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00174, "epss_percentile": 0.06417, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "frappe", "cwe": "CWE-284", "title": "Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111388" }, { "rank": 140, "cve_id": "CVE-2026-110179", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00168, "epss_percentile": 0.05613, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "affiliate-toolkit", "cwe": "CWE-89", "title": "affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110179" }, { "rank": 141, "cve_id": "CVE-2026-18256", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00162, "epss_percentile": 0.04931, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-863", "title": "Private team metadata disclosure via the team search API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18256" }, { "rank": 142, "cve_id": "CVE-2026-18223", "cvss_base": 5, "cvss_severity": "MEDIUM", "epss_score": 0.00161, "epss_percentile": 0.04814, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-863", "title": "Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18223" }, { "rank": 143, "cve_id": "CVE-2026-111443", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.0016, "epss_percentile": 0.04775, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-348", "title": "Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The alternate application uses the same configuration, environment, datasource and debug settings: this is not an authentication bypass or data/debug escalation. It can bypass maintenance mode enabled only at runtime, provide a second set of in-memory rate-limit counters, and trigger additional application-startup side effects and memory use. This is fixed in 4.2.0.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111443" }, { "rank": 144, "cve_id": "CVE-2026-93535", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.00156, "epss_percentile": 0.04307, "kev": false, "kev_due_at": null, "vendor": "wppool", "product": "Dark Mode – Improve Accessibility with AI Powered Dark Theme", "cwe": "CWE-79", "title": "WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93535" }, { "rank": 145, "cve_id": "CVE-2026-110135", "cvss_base": 7.4, "cvss_severity": "HIGH", "epss_score": 0.00155, "epss_percentile": 0.0423, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "OTP Login & Register Woocommerce", "cwe": "CWE-287", "title": "OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110135" }, { "rank": 146, "cve_id": "CVE-2026-109813", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": 0.00153, "epss_percentile": 0.04033, "kev": false, "kev_due_at": null, "vendor": "Moxa", "product": "AIG-302 Series", "cwe": "CWE-321", "title": "Shared Hard-coded Root CA Private Key", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109813" }, { "rank": 147, "cve_id": "CVE-2026-18799", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00152, "epss_percentile": 0.03942, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-862", "title": "Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18799" }, { "rank": 148, "cve_id": "CVE-2026-18795", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": 0.0015, "epss_percentile": 0.03799, "kev": false, "kev_due_at": null, "vendor": "Mattermost", "product": "Mattermost", "cwe": "CWE-862", "title": "Missing server side validation allowed user to quarantine a DM and GM post", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18795" }, { "rank": 149, "cve_id": "CVE-2026-105974", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00149, "epss_percentile": 0.03737, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Visual Form Builder", "cwe": "CWE-200", "title": "Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105974" }, { "rank": 150, "cve_id": "CVE-2026-110012", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00149, "epss_percentile": 0.03737, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Salon Booking System", "cwe": "CWE-200", "title": "Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110012" }, { "rank": 151, "cve_id": "CVE-2026-110191", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00149, "epss_percentile": 0.03736, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Product Delivery Date for WooCommerce", "cwe": "CWE-200", "title": "Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110191" }, { "rank": 152, "cve_id": "CVE-2026-96339", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": 0.00146, "epss_percentile": 0.03453, "kev": false, "kev_due_at": null, "vendor": "Houzez.co", "product": "Houzez", "cwe": "CWE-79", "title": "WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96339" }, { "rank": 153, "cve_id": "CVE-2026-110014", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00146, "epss_percentile": 0.03474, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Salon Booking System", "cwe": "CWE-862", "title": "Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110014" }, { "rank": 154, "cve_id": "CVE-2026-91830", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": 0.00145, "epss_percentile": 0.03402, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Subscribe to Comments", "cwe": "CWE-200", "title": "Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie", "url": "https://www.cve.org/CVERecord?id=CVE-2026-91830" }, { "rank": 155, "cve_id": "CVE-2026-74923", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00145, "epss_percentile": 0.03402, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Document Gallery", "cwe": "CWE-200", "title": "Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74923" }, { "rank": 156, "cve_id": "CVE-2026-92427", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": 0.00145, "epss_percentile": 0.03402, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Coinsnap Bitcoin Crowdfunding", "cwe": "CWE-200", "title": "Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92427" }, { "rank": 157, "cve_id": "CVE-2026-110013", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.03107, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Salon Booking System", "cwe": "CWE-287", "title": "Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110013" }, { "rank": 158, "cve_id": "CVE-2026-105973", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.03108, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Visual Form Builder", "cwe": "CWE-862", "title": "Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105973" }, { "rank": 159, "cve_id": "CVE-2026-109982", "cvss_base": 4.2, "cvss_severity": "MEDIUM", "epss_score": 0.00142, "epss_percentile": 0.03107, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "MB Custom Post Types & Custom Taxonomies", "cwe": "CWE-862", "title": "MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109982" }, { "rank": 160, "cve_id": "CVE-2026-110039", "cvss_base": 2.7, "cvss_severity": "LOW", "epss_score": 0.00142, "epss_percentile": 0.03108, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Smush", "cwe": "CWE-863", "title": "Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110039" }, { "rank": 161, "cve_id": "CVE-2026-111451", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00141, "epss_percentile": 0.03095, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels CLI", "cwe": "CWE-78", "title": "Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package extraction can overwrite other vendor files; generator names can write outside the project or inject executable CFML into generated code. Inputs may originate from CI variables, branch names, packages or an AI agent using the CLI's MCP tools. Also relevant are unencoded display properties in generated scaffold show views since 4.1.0 and in generated admin views, permitting stored XSS, and stale process-ID handling in RustCFML server commands that can terminate an unrelated process. This is fixed in 4.1.2; existing affected generated views also require the documented edit.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111451" }, { "rank": 162, "cve_id": "CVE-2026-104715", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": 0.00139, "epss_percentile": 0.02907, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-88", "title": "Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104715" }, { "rank": 163, "cve_id": "CVE-2026-111450", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": 0.00136, "epss_percentile": 0.02728, "kev": false, "kev_due_at": null, "vendor": "Wheels", "product": "Wheels", "cwe": "CWE-348", "title": "Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111450" }, { "rank": 164, "cve_id": "CVE-2026-111376", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": 0.00136, "epss_percentile": 0.02733, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-125", "title": "FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111376" }, { "rank": 165, "cve_id": "CVE-2026-106030", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00135, "epss_percentile": 0.02643, "kev": false, "kev_due_at": null, "vendor": "Nord Security", "product": "NordVPN", "cwe": "CWE-863", "title": "Missing Authorization in NordVPN for Windows", "url": "https://www.cve.org/CVERecord?id=CVE-2026-106030" }, { "rank": 166, "cve_id": "CVE-2026-109812", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": 0.00125, "epss_percentile": 0.02015, "kev": false, "kev_due_at": null, "vendor": "Moxa", "product": "AIG-302 Series", "cwe": "CWE-862", "title": "Missing Authorization on Secret Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109812" }, { "rank": 167, "cve_id": "CVE-2026-111379", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00124, "epss_percentile": 0.01924, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-122", "title": "FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111379" }, { "rank": 168, "cve_id": "CVE-2026-111381", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": 0.00124, "epss_percentile": 0.01924, "kev": false, "kev_due_at": null, "vendor": "FreeRDP", "product": "FreeRDP", "cwe": "CWE-122", "title": "FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111381" }, { "rank": 169, "cve_id": "CVE-2026-111237", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": 0.00122, "epss_percentile": 0.01813, "kev": false, "kev_due_at": null, "vendor": "Ultralytics", "product": "FastSAM", "cwe": "CWE-94", "title": "Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111237" }, { "rank": 170, "cve_id": "CVE-2026-111212", "cvss_base": 0.9, "cvss_severity": "LOW", "epss_score": 0.00115, "epss_percentile": 0.01456, "kev": false, "kev_due_at": null, "vendor": "ImprintLab", "product": "Medical-SAM-Adapter", "cwe": "CWE-94", "title": "ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111212" }, { "rank": 171, "cve_id": "CVE-2026-110015", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": 0.00106, "epss_percentile": 0.01038, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Salon Booking System", "cwe": "CWE-352", "title": "Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110015" }, { "rank": 172, "cve_id": "CVE-2026-111458", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": 0.00094, "epss_percentile": 0.00567, "kev": false, "kev_due_at": null, "vendor": "adulau", "product": "ssldump", "cwe": "CWE-122", "title": "ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111458" }, { "rank": 173, "cve_id": "CVE-2026-95182", "cvss_base": 10, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-426", "title": "An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95182" }, { "rank": 174, "cve_id": "CVE-2026-85746", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-787", "title": "MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85746" }, { "rank": 175, "cve_id": "CVE-2026-85748", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-416", "title": "MariaDB: Use-after-free with a large number of SYS_REFCURSOR's", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85748" }, { "rank": 176, "cve_id": "CVE-2026-92262", "cvss_base": 9.9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-706", "title": "MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92262" }, { "rank": 177, "cve_id": "CVE-2026-49868", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "RIOT-OS", "product": "RIOT", "cwe": "CWE-125", "title": "RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49868" }, { "rank": 178, "cve_id": "CVE-2026-111823", "cvss_base": 9.8, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Mage", "product": "mage-ai", "cwe": "CWE-390", "title": "Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111823" }, { "rank": 179, "cve_id": "CVE-2026-18516", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Arcadia Technology, LLC", "product": "Crafty Controller", "cwe": "CWE-116", "title": "Improper Encoding or Escaping of Output in Crafty Controller", "url": "https://www.cve.org/CVERecord?id=CVE-2026-18516" }, { "rank": 180, "cve_id": "CVE-2026-57169", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Finsys", "product": "dockhand", "cwe": "CWE-306", "title": "Dockhand: Unauthenticated container exec via WebSocket upgrade", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57169" }, { "rank": 181, "cve_id": "CVE-2026-102693", "cvss_base": 9.6, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "RIOT-OS", "product": "RIOT", "cwe": "CWE-120", "title": "RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102693" }, { "rank": 182, "cve_id": "CVE-2026-105279", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "J4Care", "product": "dcm4chee-arc-light", "cwe": "CWE-306", "title": "J4Care dcm4che Missing Authentication for Critical Function", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105279" }, { "rank": 183, "cve_id": "CVE-2026-107617", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Guangzhou Juan IoT Technology Co., Ltd.", "product": "EseeCloud App", "cwe": "CWE-798", "title": "Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107617" }, { "rank": 184, "cve_id": "CVE-2026-109587", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FreeRTOS", "product": "FreeRTOS-Kernel", "cwe": "CWE-863", "title": "Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109587" }, { "rank": 185, "cve_id": "CVE-2026-109588", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FreeRTOS", "product": "FreeRTOS-Kernel", "cwe": "CWE-125", "title": "Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109588" }, { "rank": 186, "cve_id": "CVE-2026-111626", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Webreaper", "product": "Damselfly", "cwe": "CWE-306", "title": "Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111626" }, { "rank": 187, "cve_id": "CVE-2026-111641", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "fastapiadmin", "product": "FastapiAdmin", "cwe": "CWE-306", "title": "FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111641" }, { "rank": 188, "cve_id": "CVE-2026-111643", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "l429609201", "product": "misaka_danmu_server", "cwe": "CWE-306", "title": "Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111643" }, { "rank": 189, "cve_id": "CVE-2026-111673", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Thecosy", "product": "IceCMS", "cwe": "CWE-306", "title": "IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111673" }, { "rank": 190, "cve_id": "CVE-2026-111687", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "rachelos", "product": "we-mp-rss", "cwe": "CWE-95", "title": "WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111687" }, { "rank": 191, "cve_id": "CVE-2026-111690", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "suyuan32", "product": "simple-admin-core", "cwe": "CWE-321", "title": "Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111690" }, { "rank": 192, "cve_id": "CVE-2026-111692", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "databufflabs", "product": "databuff", "cwe": "CWE-321", "title": "DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111692" }, { "rank": 193, "cve_id": "CVE-2026-111693", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "databufflabs", "product": "databuff", "cwe": "CWE-1392", "title": "DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111693" }, { "rank": 194, "cve_id": "CVE-2026-111704", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "LangChat", "product": "langchat", "cwe": "CWE-306", "title": "LangChat through commit 2a6285a Missing Authentication on REST API Controllers", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111704" }, { "rank": 195, "cve_id": "CVE-2026-111708", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "canove", "product": "whaticket-community", "cwe": "CWE-269", "title": "WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111708" }, { "rank": 196, "cve_id": "CVE-2026-111711", "cvss_base": 9.3, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Netcore", "product": "NR256CN", "cwe": "CWE-121", "title": "Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111711" }, { "rank": 197, "cve_id": "CVE-2026-96620", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "anthropics", "product": "claude-agent-sdk-python", "cwe": "CWE-20", "title": "Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96620" }, { "rank": 198, "cve_id": "CVE-2026-102551", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FreeRTOS", "product": "FreeRTOS-Plus-TCP", "cwe": "CWE-940", "title": "Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102551" }, { "rank": 199, "cve_id": "CVE-2026-111391", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "sgl-project", "product": "sglang", "cwe": "CWE-95", "title": "SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111391" }, { "rank": 200, "cve_id": "CVE-2026-111636", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "OpenBMB", "product": "StaffDeck", "cwe": "CWE-321", "title": "OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111636" }, { "rank": 201, "cve_id": "CVE-2026-111663", "cvss_base": 9.2, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "chaskiq", "product": "chaskiq", "cwe": "CWE-918", "title": "Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111663" }, { "rank": 202, "cve_id": "CVE-2026-102692", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "RIOT-OS", "product": "RIOT", "cwe": "CWE-190", "title": "RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102692" }, { "rank": 203, "cve_id": "CVE-2026-111675", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "xiaochong0302", "product": "course-tencent-cloud", "cwe": "CWE-307", "title": "Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111675" }, { "rank": 204, "cve_id": "CVE-2026-111691", "cvss_base": 9.1, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "wimoor-erp", "product": "wimoor", "cwe": "CWE-290", "title": "WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111691" }, { "rank": 205, "cve_id": "CVE-2026-44977", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Countly", "product": "countly-server", "cwe": "CWE-79", "title": "countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44977" }, { "rank": 206, "cve_id": "CVE-2026-102608", "cvss_base": 9, "cvss_severity": "CRITICAL", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ZoneMinder", "product": "zoneminder", "cwe": "CWE-78", "title": "ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102608" }, { "rank": 207, "cve_id": "CVE-2026-30971", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ZoneMinder", "product": "zoneminder", "cwe": "CWE-78", "title": "ZoneMinder: Authenticated RCE via command injection in monitor Device Path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-30971" }, { "rank": 208, "cve_id": "CVE-2026-96627", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "getarcaneapp", "product": "arcane", "cwe": "CWE-266", "title": "Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96627" }, { "rank": 209, "cve_id": "CVE-2026-97380", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-620", "title": "MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97380" }, { "rank": 210, "cve_id": "CVE-2026-97851", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "J4Care", "product": "dcm4chee-arc-light", "cwe": "CWE-862", "title": "J4Care dcm4che Missing Authorization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97851" }, { "rank": 211, "cve_id": "CVE-2026-102607", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ZoneMinder", "product": "zoneminder", "cwe": "CWE-78", "title": "ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102607" }, { "rank": 212, "cve_id": "CVE-2026-106705", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-284", "title": "ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the granted menu set nor prevents a caller from modifying its own role. A logged-in non-admin user whose role holds the delegated `roles:edit` permission can submit its own role id together with an arbitrary list of menu ids.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-106705" }, { "rank": 213, "cve_id": "CVE-2026-109119", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ikus-soft", "product": "rdiffweb", "cwe": "CWE-862", "title": "Missing Authorization in rdiffweb", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109119" }, { "rank": 214, "cve_id": "CVE-2026-111413", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "aThemeArt", "product": "aThemeArt Theme Helper", "cwe": "CWE-352", "title": "WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111413" }, { "rank": 215, "cve_id": "CVE-2026-111633", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "SeriaWei", "product": "ZKEACMS", "cwe": "CWE-321", "title": "ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111633" }, { "rank": 216, "cve_id": "CVE-2026-111650", "cvss_base": 8.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "HoshinoSuzumi", "product": "chronoframe", "cwe": "CWE-306", "title": "ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111650" }, { "rank": 217, "cve_id": "CVE-2026-68906", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mz-automation", "product": "libiec61850", "cwe": "CWE-125", "title": "libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68906" }, { "rank": 218, "cve_id": "CVE-2026-95859", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "libp2p", "product": "rust-libp2p", "cwe": "CWE-770", "title": "libp2p-rust: Gossipsub GRAFT topics unbounded growth", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95859" }, { "rank": 219, "cve_id": "CVE-2026-101021", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "J4Care", "product": "dcm4chee-arc-light", "cwe": "CWE-407", "title": "J4Care dcm4che Inefficient Algorithmic Complexity", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101021" }, { "rank": 220, "cve_id": "CVE-2026-105273", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "J4Care", "product": "dcm4chee-arc-light", "cwe": "CWE-835", "title": "J4Care dcm4che Loop with Unreachable Exit Condition", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105273" }, { "rank": 221, "cve_id": "CVE-2026-105667", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "J4Care", "product": "dcm4chee-arc-light", "cwe": "CWE-306", "title": "J4Care dcm4che Missing Authentication for Critical Function", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105667" }, { "rank": 222, "cve_id": "CVE-2026-107564", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "gocsaf Development Community", "product": "csaf_provider", "cwe": "CWE-770", "title": "gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107564" }, { "rank": 223, "cve_id": "CVE-2026-107621", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "J4Care", "product": "dcm4chee-arc-light", "cwe": "CWE-835", "title": "J4Care dcm4che Loop with Unreachable Exit Condition", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107621" }, { "rank": 224, "cve_id": "CVE-2026-111612", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "qaiu", "product": "netdisk-fast-download", "cwe": "CWE-321", "title": "netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111612" }, { "rank": 225, "cve_id": "CVE-2026-111613", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "alldatacenter", "product": "alldata", "cwe": "CWE-306", "title": "AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111613" }, { "rank": 226, "cve_id": "CVE-2026-111642", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "fastapiadmin", "product": "FastapiAdmin", "cwe": "CWE-321", "title": "FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111642" }, { "rank": 227, "cve_id": "CVE-2026-111681", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "smartloli", "product": "EFAK", "cwe": "CWE-862", "title": "EFAK through 5.1.0 Privilege Escalation via /api/users REST API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111681" }, { "rank": 228, "cve_id": "CVE-2026-111685", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Thecosy", "product": "IceCMS", "cwe": "CWE-89", "title": "IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111685" }, { "rank": 229, "cve_id": "CVE-2026-111686", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Thecosy", "product": "IceCMS", "cwe": "CWE-89", "title": "IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111686" }, { "rank": 230, "cve_id": "CVE-2026-111702", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "sugarforever", "product": "chat-ollama", "cwe": "CWE-639", "title": "ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111702" }, { "rank": 231, "cve_id": "CVE-2026-111706", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "vastxie", "product": "99AI", "cwe": "CWE-306", "title": "99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111706" }, { "rank": 232, "cve_id": "CVE-2026-111710", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Netcore", "product": "NR256CN", "cwe": "CWE-476", "title": "Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111710" }, { "rank": 233, "cve_id": "CVE-2026-111723", "cvss_base": 8.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "LingGuoAI", "product": "LingGuo-Drama", "cwe": "CWE-862", "title": "LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111723" }, { "rank": 234, "cve_id": "CVE-2026-111605", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "dromara", "product": "Jpom", "cwe": "CWE-639", "title": "Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111605" }, { "rank": 235, "cve_id": "CVE-2026-111606", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "hcengineering", "product": "Huly Platform", "cwe": "CWE-862", "title": "Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111606" }, { "rank": 236, "cve_id": "CVE-2026-111627", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "hestiacp", "product": "hestiacp", "cwe": "CWE-863", "title": "HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111627" }, { "rank": 237, "cve_id": "CVE-2026-111634", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "helicalinsight", "product": "helicalinsight", "cwe": "CWE-89", "title": "Helical Insight through 7.0.0 SQL Injection via /executeDatasource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111634" }, { "rank": 238, "cve_id": "CVE-2026-111639", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mlogclub", "product": "bbs-go", "cwe": "CWE-287", "title": "bbs-go through 4.4.6 Account Takeover via Google One Tap Login", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111639" }, { "rank": 239, "cve_id": "CVE-2026-111722", "cvss_base": 8.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "LingGuoAI", "product": "LingGuo-Drama", "cwe": "CWE-639", "title": "LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111722" }, { "rank": 240, "cve_id": "CVE-2026-55543", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "helge17", "product": "tuxguitar", "cwe": "CWE-94", "title": "TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55543" }, { "rank": 241, "cve_id": "CVE-2026-96626", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "getarcaneapp", "product": "arcane", "cwe": "CWE-200", "title": "Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96626" }, { "rank": 242, "cve_id": "CVE-2026-111399", "cvss_base": 8.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PT Norther Lights Production", "product": "MapSVG", "cwe": "CWE-89", "title": "WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111399" }, { "rank": 243, "cve_id": "CVE-2026-111638", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "moul", "product": "sshportal", "cwe": "CWE-862", "title": "sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111638" }, { "rank": 244, "cve_id": "CVE-2026-111701", "cvss_base": 8.3, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "OtterMind", "product": "Nubase", "cwe": "CWE-306", "title": "OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111701" }, { "rank": 245, "cve_id": "CVE-2026-68907", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mz-automation", "product": "libiec61850", "cwe": "CWE-125", "title": "libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68907" }, { "rank": 246, "cve_id": "CVE-2026-86009", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Mailu", "product": "Mailu", "cwe": "CWE-285", "title": "Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86009" }, { "rank": 247, "cve_id": "CVE-2026-102552", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FreeRTOS", "product": "FreeRTOS-Plus-TCP", "cwe": "CWE-940", "title": "Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102552" }, { "rank": 248, "cve_id": "CVE-2026-111646", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "javahuang", "product": "SurveyKing", "cwe": "CWE-862", "title": "SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111646" }, { "rank": 249, "cve_id": "CVE-2026-111719", "cvss_base": 8.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "roncoo", "product": "roncoo-pay", "cwe": "CWE-306", "title": "Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111719" }, { "rank": 250, "cve_id": "CVE-2026-42269", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Countly", "product": "countly-server", "cwe": "CWE-22", "title": "countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42269" }, { "rank": 251, "cve_id": "CVE-2026-49410", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "tinyhumansai", "product": "openhuman", "cwe": "CWE-352", "title": "OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-49410" }, { "rank": 252, "cve_id": "CVE-2026-61726", "cvss_base": 8.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TandoorRecipes", "product": "recipes", "cwe": "CWE-284", "title": "Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content", "url": "https://www.cve.org/CVERecord?id=CVE-2026-61726" }, { "rank": 253, "cve_id": "CVE-2026-88755", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-78", "title": "Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-88755" }, { "rank": 254, "cve_id": "CVE-2026-96424", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "UBports", "product": "lomiri-download-manager", "cwe": "CWE-732", "title": "Incorrect Permission Assignment for Critical Resource in lomiri-download-manager", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96424" }, { "rank": 255, "cve_id": "CVE-2026-102917", "cvss_base": 7.8, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-269", "title": "IBM i is Affected By An Improper Privilege Management Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102917" }, { "rank": 256, "cve_id": "CVE-2026-59970", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TandoorRecipes", "product": "recipes", "cwe": "CWE-918", "title": "Tandoor Recipes: Blind SSRF via AI provider URL (api_base)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59970" }, { "rank": 257, "cve_id": "CVE-2026-86047", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-89", "title": "MariaDB: Insufficient quoting in mariadb-dump and SHOW commands", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86047" }, { "rank": 258, "cve_id": "CVE-2026-108374", "cvss_base": 7.7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "erpnext", "cwe": "CWE-862", "title": "ERPNext: Unauthorised status modification due to missing validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-108374" }, { "rank": 259, "cve_id": "CVE-2026-111044", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "LizardByte", "product": "Sunshine", "cwe": "CWE-863", "title": "Disabled Sunshine clients can bypass revocation with a derived client certificate", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111044" }, { "rank": 260, "cve_id": "CVE-2026-111622", "cvss_base": 7.6, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "a466350665", "product": "smart-sso", "cwe": "CWE-601", "title": "smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111622" }, { "rank": 261, "cve_id": "CVE-2026-41582", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Countly", "product": "countly-server", "cwe": "CWE-22", "title": "countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41582" }, { "rank": 262, "cve_id": "CVE-2026-42270", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Countly", "product": "countly-server", "cwe": "CWE-248", "title": "countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception", "url": "https://www.cve.org/CVERecord?id=CVE-2026-42270" }, { "rank": 263, "cve_id": "CVE-2026-46472", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": "CWE-125", "title": "An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46472" }, { "rank": 264, "cve_id": "CVE-2026-48503", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mz-automation", "product": "libiec61850", "cwe": "CWE-191", "title": "libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48503" }, { "rank": 265, "cve_id": "CVE-2026-48741", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mz-automation", "product": "libiec61850", "cwe": "CWE-129", "title": "libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-48741" }, { "rank": 266, "cve_id": "CVE-2026-57486", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "pupnp", "product": "pupnp", "cwe": "CWE-476", "title": "pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57486" }, { "rank": 267, "cve_id": "CVE-2026-57487", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "pupnp", "product": "pupnp", "cwe": "CWE-770", "title": "libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57487" }, { "rank": 268, "cve_id": "CVE-2026-63618", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-200", "title": "Apache Kylin: Low-Privilege Config Exposure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63618" }, { "rank": 269, "cve_id": "CVE-2026-68498", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "FasterXML", "product": "jackson-core", "cwe": "CWE-400", "title": "jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68498" }, { "rank": 270, "cve_id": "CVE-2026-77630", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "pupnp", "product": "pupnp", "cwe": "CWE-400", "title": "pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77630" }, { "rank": 271, "cve_id": "CVE-2026-102834", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "bytedeco", "product": "javacv", "cwe": "CWE-190", "title": "JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102834" }, { "rank": 272, "cve_id": "CVE-2026-102941", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "gomarkdown", "product": "markdown", "cwe": "CWE-125", "title": "gomarkdown/markdown IsSafeURL panics on short URLs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102941" }, { "rank": 273, "cve_id": "CVE-2026-105958", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "cwe": "CWE-787", "title": "Spice-server: spice: heap oob read/write via unchecked migration data offsets", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105958" }, { "rank": 274, "cve_id": "CVE-2026-105959", "cvss_base": 7.5, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "cwe": "CWE-190", "title": "Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105959" }, { "rank": 275, "cve_id": "CVE-2026-86008", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Mailu", "product": "Mailu", "cwe": "CWE-269", "title": "Mailu domain managers can take over higher-privileged accounts", "url": "https://www.cve.org/CVERecord?id=CVE-2026-86008" }, { "rank": 276, "cve_id": "CVE-2026-92263", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "CodeWithCJ", "product": "SparkyFitness", "cwe": "CWE-78", "title": "SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92263" }, { "rank": 277, "cve_id": "CVE-2026-107648", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "switcorp", "product": "WP Sessions Time Monitoring Full Automatic", "cwe": "CWE-79", "title": "WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107648" }, { "rank": 278, "cve_id": "CVE-2026-111680", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "APIParkLab", "product": "APIPark", "cwe": "CWE-639", "title": "APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111680" }, { "rank": 279, "cve_id": "CVE-2026-111684", "cvss_base": 7.2, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "absmach", "product": "magistrala", "cwe": "CWE-639", "title": "Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111684" }, { "rank": 280, "cve_id": "CVE-2026-57488", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "pupnp", "product": "pupnp", "cwe": "CWE-190", "title": "pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57488" }, { "rank": 281, "cve_id": "CVE-2026-59963", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TandoorRecipes", "product": "recipes", "cwe": "CWE-639", "title": "Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59963" }, { "rank": 282, "cve_id": "CVE-2026-77474", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Dicklesworthstone", "product": "destructive_command_guard", "cwe": "CWE-400", "title": "dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open", "url": "https://www.cve.org/CVERecord?id=CVE-2026-77474" }, { "rank": 283, "cve_id": "CVE-2026-107777", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Thermo Fisher", "product": "Torrent Suite Software", "cwe": "CWE-22", "title": "Thermo Fisher Torrent Suite Software Path Traversal", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107777" }, { "rank": 284, "cve_id": "CVE-2026-108372", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "huangruiteng", "product": "loopx", "cwe": "CWE-346", "title": "LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files", "url": "https://www.cve.org/CVERecord?id=CVE-2026-108372" }, { "rank": 285, "cve_id": "CVE-2026-111396", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Liquid Web / StellarWP", "product": "Advanced Post Manager", "cwe": "CWE-862", "title": "WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111396" }, { "rank": 286, "cve_id": "CVE-2026-111607", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "jeequan", "product": "jeepay", "cwe": "CWE-639", "title": "Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111607" }, { "rank": 287, "cve_id": "CVE-2026-111614", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "devlive-community", "product": "DataCap", "cwe": "CWE-639", "title": "DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111614" }, { "rank": 288, "cve_id": "CVE-2026-111615", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "gz-yami", "product": "mall4cloud", "cwe": "CWE-639", "title": "Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111615" }, { "rank": 289, "cve_id": "CVE-2026-111619", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "zyx0814", "product": "FilePress", "cwe": "CWE-89", "title": "FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111619" }, { "rank": 290, "cve_id": "CVE-2026-111649", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "rocboss", "product": "paopao-ce", "cwe": "CWE-639", "title": "Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111649" }, { "rank": 291, "cve_id": "CVE-2026-111651", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "risesoft-y9", "product": "Digital-Infrastructure", "cwe": "CWE-639", "title": "Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111651" }, { "rank": 292, "cve_id": "CVE-2026-111669", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "izhaorui", "product": "Zr.Admin.NET", "cwe": "CWE-89", "title": "ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111669" }, { "rank": 293, "cve_id": "CVE-2026-111671", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "data-infra", "product": "cube-studio", "cwe": "CWE-639", "title": "Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111671" }, { "rank": 294, "cve_id": "CVE-2026-111682", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "smartloli", "product": "EFAK", "cwe": "CWE-862", "title": "EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111682" }, { "rank": 295, "cve_id": "CVE-2026-111695", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "shaiwz", "product": "data-platform-open", "cwe": "CWE-639", "title": "Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111695" }, { "rank": 296, "cve_id": "CVE-2026-111696", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "shaiwz", "product": "data-platform-open", "cwe": "CWE-321", "title": "data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111696" }, { "rank": 297, "cve_id": "CVE-2026-111697", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "roinli", "product": "HUIZHI-ChargeOS-cloud", "cwe": "CWE-639", "title": "HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111697" }, { "rank": 298, "cve_id": "CVE-2026-111698", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "roinli", "product": "HUIZHI-ChargeOS-cloud", "cwe": "CWE-639", "title": "HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111698" }, { "rank": 299, "cve_id": "CVE-2026-111700", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WebVella", "product": "WebVella-ERP", "cwe": "CWE-89", "title": "WebVella ERP through 1.8.8 SQL Injection via EQL Query API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111700" }, { "rank": 300, "cve_id": "CVE-2026-111718", "cvss_base": 7.1, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "kuafuai", "product": "aipexbase", "cwe": "CWE-89", "title": "AipexBase through commit 690adb9 SQL Injection via /api/data/invoke", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111718" }, { "rank": 301, "cve_id": "CVE-2026-62439", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-190", "title": "Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62439" }, { "rank": 302, "cve_id": "CVE-2026-81452", "cvss_base": 7, "cvss_severity": "HIGH", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Dell", "product": "Alienware Command Center (AWCC)", "cwe": "CWE-272", "title": "Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81452" }, { "rank": 303, "cve_id": "CVE-2026-97858", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Guangzhou Juan IoT Technology Co., Ltd.", "product": "EseeCloud App", "cwe": "CWE-915", "title": "Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97858" }, { "rank": 304, "cve_id": "CVE-2026-105664", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Guangzhou Juan IoT Technology Co., Ltd.", "product": "EseeCloud App", "cwe": "CWE-204", "title": "Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-105664" }, { "rank": 305, "cve_id": "CVE-2026-111616", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Oqtane", "product": "Oqtane Framework", "cwe": "CWE-639", "title": "Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111616" }, { "rank": 306, "cve_id": "CVE-2026-111617", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MGdaasLab", "product": "WHartTest", "cwe": "CWE-306", "title": "WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111617" }, { "rank": 307, "cve_id": "CVE-2026-111618", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "coaidev", "product": "CoAI", "cwe": "CWE-22", "title": "CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111618" }, { "rank": 308, "cve_id": "CVE-2026-111637", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Blair2004", "product": "NexoPOS", "cwe": "CWE-306", "title": "NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111637" }, { "rank": 309, "cve_id": "CVE-2026-111644", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "l429609201", "product": "misaka_danmu_server", "cwe": "CWE-306", "title": "Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111644" }, { "rank": 310, "cve_id": "CVE-2026-111652", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "3xxx", "product": "engineercms", "cwe": "CWE-862", "title": "Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111652" }, { "rank": 311, "cve_id": "CVE-2026-111653", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "53AI", "product": "53AIHub", "cwe": "CWE-306", "title": "53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111653" }, { "rank": 312, "cve_id": "CVE-2026-111659", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "wayn111", "product": "waynboot-mall", "cwe": "CWE-306", "title": "Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111659" }, { "rank": 313, "cve_id": "CVE-2026-111660", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "wayn111", "product": "waynboot-mall", "cwe": "CWE-306", "title": "waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111660" }, { "rank": 314, "cve_id": "CVE-2026-111661", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "wayn111", "product": "waynboot-mall", "cwe": "CWE-306", "title": "waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111661" }, { "rank": 315, "cve_id": "CVE-2026-111662", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "chaskiq", "product": "chaskiq", "cwe": "CWE-918", "title": "Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111662" }, { "rank": 316, "cve_id": "CVE-2026-111694", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "qiantongtech", "product": "qKnow", "cwe": "CWE-306", "title": "qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111694" }, { "rank": 317, "cve_id": "CVE-2026-111707", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "vastxie", "product": "99AI", "cwe": "CWE-639", "title": "99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111707" }, { "rank": 318, "cve_id": "CVE-2026-111712", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Netcore", "product": "NR256CN", "cwe": "CWE-288", "title": "Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111712" }, { "rank": 319, "cve_id": "CVE-2026-111720", "cvss_base": 6.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "lhccong", "product": "fish-island-backend", "cwe": "CWE-918", "title": "fish-island-backend through commit 7c61b78 SSRF via /api/web/parse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111720" }, { "rank": 320, "cve_id": "CVE-2026-55836", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "open-zaak", "product": "open-zaak", "cwe": "CWE-200", "title": "Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55836" }, { "rank": 321, "cve_id": "CVE-2026-111677", "cvss_base": 6.8, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Adri van Os", "product": "antiword", "cwe": "CWE-125", "title": "Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111677" }, { "rank": 322, "cve_id": "CVE-2026-89085", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89085" }, { "rank": 323, "cve_id": "CVE-2026-111802", "cvss_base": 6.6, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-59", "title": "Nautilus: nautilus: arbitrary file deletion via trash symlink", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111802" }, { "rank": 324, "cve_id": "CVE-2026-54657", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "open-zaak", "product": "open-zaak", "cwe": "CWE-285", "title": "Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token", "url": "https://www.cve.org/CVERecord?id=CVE-2026-54657" }, { "rank": 325, "cve_id": "CVE-2026-55796", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "hrms", "cwe": "CWE-89", "title": "Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55796" }, { "rank": 326, "cve_id": "CVE-2026-55862", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "pupnp", "product": "pupnp", "cwe": "CWE-674", "title": "pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow", "url": "https://www.cve.org/CVERecord?id=CVE-2026-55862" }, { "rank": 327, "cve_id": "CVE-2026-59962", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TandoorRecipes", "product": "recipes", "cwe": "CWE-943", "title": "Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59962" }, { "rank": 328, "cve_id": "CVE-2026-64862", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "hrms", "cwe": "CWE-862", "title": "Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64862" }, { "rank": 329, "cve_id": "CVE-2026-85231", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-770", "title": "Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85231" }, { "rank": 330, "cve_id": "CVE-2026-108373", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "frappe", "product": "erpnext", "cwe": "CWE-862", "title": "ERPNext: Unauthorised access to financial data due to missing validation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-108373" }, { "rank": 331, "cve_id": "CVE-2026-110806", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Devolutions", "product": "Server", "cwe": "CWE-863", "title": "Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110806" }, { "rank": 332, "cve_id": "CVE-2026-110903", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Liquid Web / StellarWP", "product": "The Events Calendar", "cwe": "CWE-79", "title": "WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110903" }, { "rank": 333, "cve_id": "CVE-2026-111400", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IdeaBox Creations", "product": "PowerPack Addons for Elementor", "cwe": "CWE-79", "title": "WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111400" }, { "rank": 334, "cve_id": "CVE-2026-111405", "cvss_base": 6.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PT Norther Lights Production", "product": "MapSVG", "cwe": "CWE-79", "title": "WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111405" }, { "rank": 335, "cve_id": "CVE-2026-97470", "cvss_base": 6.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "themefic", "product": "Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental", "cwe": "CWE-79", "title": "Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97470" }, { "rank": 336, "cve_id": "CVE-2026-111392", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "sgl-project", "product": "sglang", "cwe": "CWE-345", "title": "SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111392" }, { "rank": 337, "cve_id": "CVE-2026-111623", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "joey-zhou", "product": "xiaozhi-esp32-server-java", "cwe": "CWE-290", "title": "Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111623" }, { "rank": 338, "cve_id": "CVE-2026-111624", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "umbraco", "product": "Umbraco-CMS", "cwe": "CWE-306", "title": "Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111624" }, { "rank": 339, "cve_id": "CVE-2026-111699", "cvss_base": 6.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "niefy", "product": "wx-api", "cwe": "CWE-306", "title": "Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111699" }, { "rank": 340, "cve_id": "CVE-2026-62438", "cvss_base": 6.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-190", "title": "Gimp: gimp: paa integer overflow out-of-bounds read", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62438" }, { "rank": 341, "cve_id": "CVE-2026-111390", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "erupts", "product": "erupt", "cwe": "CWE-564", "title": "Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111390" }, { "rank": 342, "cve_id": "CVE-2026-111555", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-1285", "title": "Luksmeta: missing slot-range validation permits out-of-gap device i/o", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111555" }, { "rank": 343, "cve_id": "CVE-2026-111620", "cvss_base": 6, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "O2OA", "product": "O2OA", "cwe": "CWE-639", "title": "O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111620" }, { "rank": 344, "cve_id": "CVE-2026-89096", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-772", "title": "Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89096" }, { "rank": 345, "cve_id": "CVE-2026-109461", "cvss_base": 5.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "Microsoft Identity Client for NodeJS", "cwe": "CWE-346", "title": "Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109461" }, { "rank": 346, "cve_id": "CVE-2026-59966", "cvss_base": 5.7, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TandoorRecipes", "product": "recipes", "cwe": "CWE-1333", "title": "Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59966" }, { "rank": 347, "cve_id": "CVE-2026-89088", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-787", "title": "Parted: parted: denial of service via heap buffer overflow during fat16 resize", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89088" }, { "rank": 348, "cve_id": "CVE-2026-89098", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-617", "title": "Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89098" }, { "rank": 349, "cve_id": "CVE-2026-96425", "cvss_base": 5.5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "UBports", "product": "lomiri-download-manager", "cwe": "CWE-732", "title": "Incorrect Permission Assignment for Critical Resource in lomiri-download-manager", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96425" }, { "rank": 350, "cve_id": "CVE-2026-17068", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-285", "title": "IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17068" }, { "rank": 351, "cve_id": "CVE-2026-17073", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-284", "title": "IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17073" }, { "rank": 352, "cve_id": "CVE-2026-17491", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-269", "title": "IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17491" }, { "rank": 353, "cve_id": "CVE-2026-59967", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TandoorRecipes", "product": "recipes", "cwe": "CWE-639", "title": "Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59967" }, { "rank": 354, "cve_id": "CVE-2026-85985", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-862", "title": "MariaDB: Unauthorized file access via CONNECT engine UDFs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85985" }, { "rank": 355, "cve_id": "CVE-2026-90821", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Arcadia Technology, LLC", "product": "Crafty Controller", "cwe": "CWE-79", "title": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90821" }, { "rank": 356, "cve_id": "CVE-2026-102923", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "CodeWithCJ", "product": "SparkyFitness", "cwe": "CWE-918", "title": "SparkyFitness: SSRF via unvalidated custom_url in AI service settings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-102923" }, { "rank": 357, "cve_id": "CVE-2026-110029", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "Squeeze", "cwe": "CWE-862", "title": "Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110029" }, { "rank": 358, "cve_id": "CVE-2026-110901", "cvss_base": 5.4, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WPMU DEV", "product": "SmartCrawl", "cwe": "CWE-639", "title": "WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110901" }, { "rank": 359, "cve_id": "CVE-2026-57446", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mz-automation", "product": "libiec61850", "cwe": "CWE-415", "title": "libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57446" }, { "rank": 360, "cve_id": "CVE-2026-68908", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "mz-automation", "product": "libiec61850", "cwe": "CWE-590", "title": "libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68908" }, { "rank": 361, "cve_id": "CVE-2026-80092", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Microsoft", "product": "microsoft-identity-web", "cwe": "CWE-302", "title": "Microsoft Identity Web Elevation of Privilege Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80092" }, { "rank": 362, "cve_id": "CVE-2026-85977", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-1050", "title": "Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85977" }, { "rank": 363, "cve_id": "CVE-2026-109930", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Unknown", "product": "MAIO", "cwe": "CWE-200", "title": "MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109930" }, { "rank": 364, "cve_id": "CVE-2026-110380", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Arraytics", "product": "WP Event Solution", "cwe": "CWE-862", "title": "WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110380" }, { "rank": 365, "cve_id": "CVE-2026-110896", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "WP Chill", "product": "Passster", "cwe": "CWE-862", "title": "WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110896" }, { "rank": 366, "cve_id": "CVE-2026-110900", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Liquid Web / StellarWP", "product": "BookIt", "cwe": "CWE-862", "title": "WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110900" }, { "rank": 367, "cve_id": "CVE-2026-111397", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PT Norther Lights Production", "product": "MapSVG", "cwe": "CWE-862", "title": "WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111397" }, { "rank": 368, "cve_id": "CVE-2026-111409", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "YITH", "product": "YITH PayPal Express Checkout for WooCommerce", "cwe": "CWE-862", "title": "WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111409" }, { "rank": 369, "cve_id": "CVE-2026-111603", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PlayEdu", "product": "PlayEdu", "cwe": "CWE-639", "title": "PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111603" }, { "rank": 370, "cve_id": "CVE-2026-111610", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "b3log", "product": "Solo", "cwe": "CWE-639", "title": "B3log Solo through 4.4.0 Missing Authorization in ArticleConsole", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111610" }, { "rank": 371, "cve_id": "CVE-2026-111611", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "roncoo", "product": "roncoo-education", "cwe": "CWE-639", "title": "roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111611" }, { "rank": 372, "cve_id": "CVE-2026-111621", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "TDuckCloud", "product": "tduck-survey-form", "cwe": "CWE-639", "title": "TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111621" }, { "rank": 373, "cve_id": "CVE-2026-111625", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "10up", "product": "Distributor", "cwe": "CWE-862", "title": "10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111625" }, { "rank": 374, "cve_id": "CVE-2026-111629", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IoTSharp", "product": "IoTSharp", "cwe": "CWE-639", "title": "IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111629" }, { "rank": 375, "cve_id": "CVE-2026-111630", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "colinin", "product": "abp-next-admin", "cwe": "CWE-639", "title": "abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111630" }, { "rank": 376, "cve_id": "CVE-2026-111631", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "10up", "product": "Distributor", "cwe": "CWE-862", "title": "Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111631" }, { "rank": 377, "cve_id": "CVE-2026-111632", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "aureuserp", "product": "aureuserp", "cwe": "CWE-639", "title": "Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111632" }, { "rank": 378, "cve_id": "CVE-2026-111635", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "helicalinsight", "product": "helicalinsight", "cwe": "CWE-22", "title": "Helical Insight through 7.0.0 Path Traversal via /getExternalResource", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111635" }, { "rank": 379, "cve_id": "CVE-2026-111640", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "kuaifan", "product": "dootask", "cwe": "CWE-639", "title": "DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111640" }, { "rank": 380, "cve_id": "CVE-2026-111645", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "zmister2016", "product": "MrDoc", "cwe": "CWE-639", "title": "MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111645" }, { "rank": 381, "cve_id": "CVE-2026-111647", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PickMall", "product": "lilishop", "cwe": "CWE-639", "title": "PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111647" }, { "rank": 382, "cve_id": "CVE-2026-111654", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "kerwincui", "product": "FastBee", "cwe": "CWE-639", "title": "FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111654" }, { "rank": 383, "cve_id": "CVE-2026-111656", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "zhimaAi", "product": "chatwiki", "cwe": "CWE-639", "title": "ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111656" }, { "rank": 384, "cve_id": "CVE-2026-111657", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "beikeshop", "product": "beikeshop", "cwe": "CWE-639", "title": "BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111657" }, { "rank": 385, "cve_id": "CVE-2026-111665", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PiranhaCMS", "product": "Piranha CMS", "cwe": "CWE-862", "title": "Piranha CMS through 12.2 Missing Authorization in Manager Language API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111665" }, { "rank": 386, "cve_id": "CVE-2026-111666", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "steedos", "product": "steedos-platform", "cwe": "CWE-863", "title": "Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111666" }, { "rank": 387, "cve_id": "CVE-2026-111667", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "getrebuild", "product": "rebuild", "cwe": "CWE-639", "title": "REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111667" }, { "rank": 388, "cve_id": "CVE-2026-111668", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "beizhu-1209", "product": "AIHelms", "cwe": "CWE-862", "title": "AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111668" }, { "rank": 389, "cve_id": "CVE-2026-111670", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "clickvisual", "product": "clickvisual", "cwe": "CWE-862", "title": "ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111670" }, { "rank": 390, "cve_id": "CVE-2026-111672", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "data-infra", "product": "cube-studio", "cwe": "CWE-639", "title": "Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111672" }, { "rank": 391, "cve_id": "CVE-2026-111674", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Hello-hao", "product": "Tbed", "cwe": "CWE-639", "title": "Tbed through 20240319 Missing Authorization via setImgFileName Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111674" }, { "rank": 392, "cve_id": "CVE-2026-111676", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "faveosuite", "product": "faveo-helpdesk", "cwe": "CWE-639", "title": "Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111676" }, { "rank": 393, "cve_id": "CVE-2026-111679", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "EKKOLearnAI", "product": "ekko-studio", "cwe": "CWE-862", "title": "Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111679" }, { "rank": 394, "cve_id": "CVE-2026-111683", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "allegro", "product": "ralph", "cwe": "CWE-862", "title": "Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111683" }, { "rank": 395, "cve_id": "CVE-2026-111688", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Exrick", "product": "xboot", "cwe": "CWE-863", "title": "Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111688" }, { "rank": 396, "cve_id": "CVE-2026-111689", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Exrick", "product": "xboot", "cwe": "CWE-639", "title": "XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111689" }, { "rank": 397, "cve_id": "CVE-2026-111703", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "guchengwuyue", "product": "yshop-crm", "cwe": "CWE-639", "title": "yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111703" }, { "rank": 398, "cve_id": "CVE-2026-111705", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "fushengqian", "product": "fuint", "cwe": "CWE-639", "title": "Fuint through commit 57ec018 IDOR via bookId in myBookDetail", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111705" }, { "rank": 399, "cve_id": "CVE-2026-111709", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "canove", "product": "whaticket-community", "cwe": "CWE-639", "title": "WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111709" }, { "rank": 400, "cve_id": "CVE-2026-111715", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "nduckmink", "product": "arkon", "cwe": "CWE-639", "title": "Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111715" }, { "rank": 401, "cve_id": "CVE-2026-111716", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "nduckmink", "product": "arkon", "cwe": "CWE-639", "title": "Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111716" }, { "rank": 402, "cve_id": "CVE-2026-111717", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "nduckmink", "product": "arkon", "cwe": "CWE-639", "title": "Arkon through 0.9.2 Missing Authorization via Skills Versions API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111717" }, { "rank": 403, "cve_id": "CVE-2026-111721", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "jingsewu", "product": "open-wes", "cwe": "CWE-639", "title": "Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111721" }, { "rank": 404, "cve_id": "CVE-2026-111728", "cvss_base": 5.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "5rahim", "product": "Seanime", "cwe": "CWE-88", "title": "Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111728" }, { "rank": 405, "cve_id": "CVE-2026-107674", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-667", "title": "IBM i is Affected by a Denial of Service in Digital Certificate Manager", "url": "https://www.cve.org/CVERecord?id=CVE-2026-107674" }, { "rank": 406, "cve_id": "CVE-2026-109838", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Db2 Genius Hub", "cwe": "CWE-347", "title": "IBM Db2 Genius Hub Improper verification of cryptographic signature", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109838" }, { "rank": 407, "cve_id": "CVE-2026-111604", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "elunez", "product": "eladmin", "cwe": "CWE-639", "title": "eladmin through 2.7 Broken Access Control via /api/users Update and Delete", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111604" }, { "rank": 408, "cve_id": "CVE-2026-111609", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PKP", "product": "Open Journal Systems", "cwe": "CWE-639", "title": "PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111609" }, { "rank": 409, "cve_id": "CVE-2026-111648", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "build-admin", "product": "buildadmin", "cwe": "CWE-639", "title": "BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111648" }, { "rank": 410, "cve_id": "CVE-2026-111655", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "zoujingli", "product": "think-plugs-admin", "cwe": "CWE-639", "title": "ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111655" }, { "rank": 411, "cve_id": "CVE-2026-111658", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "SiteServer", "product": "SSCMS", "cwe": "CWE-639", "title": "SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111658" }, { "rank": 412, "cve_id": "CVE-2026-111713", "cvss_base": 5.1, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "AmauriC", "product": "tarteaucitron.js", "cwe": "CWE-79", "title": "tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111713" }, { "rank": 413, "cve_id": "CVE-2026-96542", "cvss_base": 5, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Electronic Arts", "product": "EA Javelin Anticheat (EA Javelin Anticheat Installer)", "cwe": "CWE-732", "title": "EA Javelin Anticheat Installer Local Privilege Escalation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96542" }, { "rank": 414, "cve_id": "CVE-2026-62362", "cvss_base": 4.9, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "PBH-BTN", "product": "PeerBanHelper", "cwe": "CWE-89", "title": "PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint", "url": "https://www.cve.org/CVERecord?id=CVE-2026-62362" }, { "rank": 415, "cve_id": "CVE-2026-111664", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "safing", "product": "portmaster", "cwe": "CWE-306", "title": "Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111664" }, { "rank": 416, "cve_id": "CVE-2026-111678", "cvss_base": 4.8, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Adri van Os", "product": "antiword", "cwe": "CWE-125", "title": "Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111678" }, { "rank": 417, "cve_id": "CVE-2026-109118", "cvss_base": 4.6, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "ikus-soft", "product": "rdiffweb", "cwe": "CWE-22", "title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109118" }, { "rank": 418, "cve_id": "CVE-2026-17488", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-287", "title": "IBM i is Affected By An Improper Authentication Vulnerability in SST / DST", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17488" }, { "rank": 419, "cve_id": "CVE-2026-57447", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "discourse", "product": "discourse-doc-categories", "cwe": "CWE-200", "title": "Discourse Doc Categories: Doc category index refresh leaks private topic titles", "url": "https://www.cve.org/CVERecord?id=CVE-2026-57447" }, { "rank": 420, "cve_id": "CVE-2026-85745", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "MariaDB", "product": "server", "cwe": "CWE-126", "title": "MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-85745" }, { "rank": 421, "cve_id": "CVE-2026-96628", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "getarcaneapp", "product": "arcane", "cwe": "CWE-863", "title": "Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`", "url": "https://www.cve.org/CVERecord?id=CVE-2026-96628" }, { "rank": 422, "cve_id": "CVE-2026-110287", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Devolutions", "product": "Server", "cwe": "CWE-863", "title": "Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110287" }, { "rank": 423, "cve_id": "CVE-2026-110804", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Devolutions", "product": "Server", "cwe": "CWE-915", "title": "Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110804" }, { "rank": 424, "cve_id": "CVE-2026-111793", "cvss_base": 4.3, "cvss_severity": "MEDIUM", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Openwave Messaging (Ireland) Limited", "product": "Webtop Media Transcoder", "cwe": "CWE-669", "title": "Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111793" }, { "rank": 425, "cve_id": "CVE-2026-17275", "cvss_base": 3.7, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "i", "cwe": "CWE-285", "title": "IBM i is Affected by an Improper Validation Vulnerability", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17275" }, { "rank": 426, "cve_id": "CVE-2026-17591", "cvss_base": 3.6, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-416", "title": "Libarchive: libarchive: use-after-free via aliased mac metadata copy", "url": "https://www.cve.org/CVERecord?id=CVE-2026-17591" }, { "rank": 427, "cve_id": "CVE-2026-111581", "cvss_base": 3.3, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "cwe": "CWE-88", "title": "Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111581" }, { "rank": 428, "cve_id": "CVE-2026-109839", "cvss_base": 3.1, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "IBM", "product": "Db2 Genius Hub", "cwe": "CWE-325", "title": "IBM Db2 Genius Hub Missing Cryptographic Step", "url": "https://www.cve.org/CVERecord?id=CVE-2026-109839" }, { "rank": 429, "cve_id": "CVE-2026-110805", "cvss_base": 2.6, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Devolutions", "product": "Server", "cwe": "CWE-918", "title": "Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110805" }, { "rank": 430, "cve_id": "CVE-2026-111608", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "jeequan", "product": "jeepay", "cwe": "CWE-639", "title": "Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111608" }, { "rank": 431, "cve_id": "CVE-2026-111628", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "10up", "product": "Distributor", "cwe": "CWE-502", "title": "10up Distributor before 2.3.2 PHP Object Injection via set_meta()", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111628" }, { "rank": 432, "cve_id": "CVE-2026-111714", "cvss_base": 2.3, "cvss_severity": "LOW", "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "AmauriC", "product": "tarteaucitron.js", "cwe": "CWE-1333", "title": "tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111714" }, { "rank": 433, "cve_id": "CVE-2025-52097", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52097" }, { "rank": 434, "cve_id": "CVE-2025-55640", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55640" }, { "rank": 435, "cve_id": "CVE-2025-55653", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55653" }, { "rank": 436, "cve_id": "CVE-2025-66969", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "Integer overflow in OpenModSim (<=1.11.0), leading to denial of service", "url": "https://www.cve.org/CVERecord?id=CVE-2025-66969" }, { "rank": 437, "cve_id": "CVE-2026-26846", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component", "url": "https://www.cve.org/CVERecord?id=CVE-2026-26846" }, { "rank": 438, "cve_id": "CVE-2026-46471", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46471" }, { "rank": 439, "cve_id": "CVE-2026-63619", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-862", "title": "Apache Kylin: Missing authorization and path-confinement on system meta dump", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63619" }, { "rank": 440, "cve_id": "CVE-2026-64610", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-502", "title": "Apache Kylin: Redis unsafe Java deserialization", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64610" }, { "rank": 441, "cve_id": "CVE-2026-64959", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-89", "title": "Apache Kylin: Missing authentication on certain cache API endpoints", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64959" }, { "rank": 442, "cve_id": "CVE-2026-68571", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-94", "title": "Apache Kylin: JDBC URL Whitelist Verification Bypass", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68571" }, { "rank": 443, "cve_id": "CVE-2026-68572", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-200", "title": "Apache Kylin: Unauthorized SQL execution to Spark SQL env", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68572" }, { "rank": 444, "cve_id": "CVE-2026-68573", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-287", "title": "Apache Kylin: Unauthenticated Metastore Cleanup", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68573" }, { "rank": 445, "cve_id": "CVE-2026-69076", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-200", "title": "Apache Kylin: Unauthorized cross-project job discard", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69076" }, { "rank": 446, "cve_id": "CVE-2026-69077", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-200", "title": "Apache Kylin: JobController allows unauthorized cross-project manipulation", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69077" }, { "rank": 447, "cve_id": "CVE-2026-69080", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-200", "title": "Apache Kylin: Broken Access Control in QuerySQLBlacklistController", "url": "https://www.cve.org/CVERecord?id=CVE-2026-69080" }, { "rank": 448, "cve_id": "CVE-2026-95183", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "n/a", "product": "n/a", "cwe": null, "title": "An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.", "url": "https://www.cve.org/CVERecord?id=CVE-2026-95183" }, { "rank": 449, "cve_id": "CVE-2026-108709", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": null, "title": "Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)", "url": "https://www.cve.org/CVERecord?id=CVE-2026-108709" }, { "rank": 450, "cve_id": "CVE-2026-108743", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": "Apache Software Foundation", "product": "Apache Kylin", "cwe": "CWE-78", "title": "Apache Kylin: spark job OS command injection", "url": "https://www.cve.org/CVERecord?id=CVE-2026-108743" }, { "rank": 451, "cve_id": "CVE-2026-110752", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-770", "title": "Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110752" }, { "rank": 452, "cve_id": "CVE-2026-110753", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-416", "title": "Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110753" }, { "rank": 453, "cve_id": "CVE-2026-110754", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-401", "title": "Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110754" }, { "rank": 454, "cve_id": "CVE-2026-110755", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-407", "title": "Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110755" }, { "rank": 455, "cve_id": "CVE-2026-110756", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-116", "title": "Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110756" }, { "rank": 456, "cve_id": "CVE-2026-110757", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-116", "title": "Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110757" }, { "rank": 457, "cve_id": "CVE-2026-110758", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-127", "title": "Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110758" }, { "rank": 458, "cve_id": "CVE-2026-110759", "cvss_base": null, "cvss_severity": null, "epss_score": null, "epss_percentile": null, "kev": false, "kev_due_at": null, "vendor": null, "product": "Text-CSV_XS", "cwe": "CWE-1286", "title": "Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse", "url": "https://www.cve.org/CVERecord?id=CVE-2026-110759" } ], "transactions": [ { "type": "KEV_ADDED", "cve_id": "CVE-2025-61624", "detail": "ADDED TO KEV — CVE-2025-61624 (Fortinet FortiOS). Remediation due October 19, 2026." }, { "type": "KEV_ADDED", "cve_id": "CVE-2026-102764", "detail": "ADDED TO KEV — CVE-2026-102764 (BeyondTrust Remote Support). Remediation due October 19, 2026." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2024-58397", "detail": "EXPLOIT PUBLISHED — CVE-2024-58397 (enzo1982 mp4v2). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-104040", "detail": "EXPLOIT PUBLISHED — CVE-2026-104040 (Red Hat Enterprise Linux 10). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-104085", "detail": "EXPLOIT PUBLISHED — CVE-2026-104085 (odt2spip). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-105751", "detail": "EXPLOIT PUBLISHED — CVE-2026-105751 (docling-project docling). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-105759", "detail": "EXPLOIT PUBLISHED — CVE-2026-105759 (vllm-project vllm). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-10813", "detail": "EXPLOIT PUBLISHED — CVE-2026-10813 (LMCache). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-108376", "detail": "EXPLOIT PUBLISHED — CVE-2026-108376 (marcosschroh dataclasses-avroschema). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-108674", "detail": "EXPLOIT PUBLISHED — CVE-2026-108674 (JeecgBoot). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-108933", "detail": "EXPLOIT PUBLISHED — CVE-2026-108933 (Edimax BR-6208AC). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-108966", "detail": "EXPLOIT PUBLISHED — CVE-2026-108966 (SourceCodester Performance Indicator System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-108970", "detail": "EXPLOIT PUBLISHED — CVE-2026-108970 (itsmeravitejak Online-Examination-System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-108974", "detail": "EXPLOIT PUBLISHED — CVE-2026-108974 (SourceCodester E-Learning System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109108", "detail": "EXPLOIT PUBLISHED — CVE-2026-109108 (Wavlink WL-WN530BE1-A). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109115", "detail": "EXPLOIT PUBLISHED — CVE-2026-109115 (AdithyaYelloju Restaurant-Management-System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109143", "detail": "EXPLOIT PUBLISHED — CVE-2026-109143 (calcom cal.com). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109522", "detail": "EXPLOIT PUBLISHED — CVE-2026-109522 (girishsaraf Online-Appointment-Booking-System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109526", "detail": "EXPLOIT PUBLISHED — CVE-2026-109526 (HBAI-Ltd Toonflow-app). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109607", "detail": "EXPLOIT PUBLISHED — CVE-2026-109607 (SourceCodester Online Exam System). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-109967", "detail": "EXPLOIT PUBLISHED — CVE-2026-109967 (marcopiovanello yt-dlp-web-ui). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110106", "detail": "EXPLOIT PUBLISHED — CVE-2026-110106 (dromara RuoYi-Vue-Plus). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110113", "detail": "EXPLOIT PUBLISHED — CVE-2026-110113 (Sanluan PublicCMS). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110206", "detail": "EXPLOIT PUBLISHED — CVE-2026-110206 (RooCodeInc Roo-Code). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110592", "detail": "EXPLOIT PUBLISHED — CVE-2026-110592 (MicroPyramid BottleCRM). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110593", "detail": "EXPLOIT PUBLISHED — CVE-2026-110593 (MicroPyramid BottleCRM). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110594", "detail": "EXPLOIT PUBLISHED — CVE-2026-110594 (MicroPyramid BottleCRM). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110595", "detail": "EXPLOIT PUBLISHED — CVE-2026-110595 (MicroPyramid BottleCRM). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110775", "detail": "EXPLOIT PUBLISHED — CVE-2026-110775 (ModelEngine-Group nexent). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-110878", "detail": "EXPLOIT PUBLISHED — CVE-2026-110878 (aureuserp). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111137", "detail": "EXPLOIT PUBLISHED — CVE-2026-111137 (amartin755 libsmi). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111147", "detail": "EXPLOIT PUBLISHED — CVE-2026-111147 (libyal libesedb). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111152", "detail": "EXPLOIT PUBLISHED — CVE-2026-111152 (libgme game-music-emu). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111157", "detail": "EXPLOIT PUBLISHED — CVE-2026-111157 (sox). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111214", "detail": "EXPLOIT PUBLISHED — CVE-2026-111214 (Netgate pfSense CE). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111219", "detail": "EXPLOIT PUBLISHED — CVE-2026-111219 (Netgate pfSense CE). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111224", "detail": "EXPLOIT PUBLISHED — CVE-2026-111224 (Netgate pfSense CE). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111229", "detail": "EXPLOIT PUBLISHED — CVE-2026-111229 (Netgate pfSense CE). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111234", "detail": "EXPLOIT PUBLISHED — CVE-2026-111234 (simplepie). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111273", "detail": "EXPLOIT PUBLISHED — CVE-2026-111273 (selmf unarr). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111284", "detail": "EXPLOIT PUBLISHED — CVE-2026-111284 (Webkul Aureus ERP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-111379", "detail": "EXPLOIT PUBLISHED — CVE-2026-111379 (FreeRDP). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-11819", "detail": "EXPLOIT PUBLISHED — CVE-2026-11819 (Red Hat Enterprise Linux 10). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-18807", "detail": "EXPLOIT PUBLISHED — CVE-2026-18807 (Unknown ECS). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-32316", "detail": "EXPLOIT PUBLISHED — CVE-2026-32316 (jqlang jq). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-43494", "detail": "EXPLOIT PUBLISHED — CVE-2026-43494 (Linux). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-49950", "detail": "EXPLOIT PUBLISHED — CVE-2026-49950 (xorbitsai xoscar). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-64600", "detail": "EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-67406", "detail": "EXPLOIT PUBLISHED — CVE-2026-67406 (rabbitmq-server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-67407", "detail": "EXPLOIT PUBLISHED — CVE-2026-67407 (rabbitmq-server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-67413", "detail": "EXPLOIT PUBLISHED — CVE-2026-67413 (rabbitmq-server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-67415", "detail": "EXPLOIT PUBLISHED — CVE-2026-67415 (rabbitmq-server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-67419", "detail": "EXPLOIT PUBLISHED — CVE-2026-67419 (rabbitmq-server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-67420", "detail": "EXPLOIT PUBLISHED — CVE-2026-67420 (rabbitmq-server). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-78335", "detail": "EXPLOIT PUBLISHED — CVE-2026-78335 (GitLab). Public exploit reference added." }, { "type": "EXPLOIT_PUBLISHED", "cve_id": "CVE-2026-82632", "detail": "EXPLOIT PUBLISHED — CVE-2026-82632 (GitLab). Public exploit reference added." }, { "type": "RESCORED", "cve_id": "CVE-2026-102560", "detail": "RESCORED — CVE-2026-102560 (Red Hat Enterprise Linux 10). CVSS 8.6 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-104040", "detail": "RESCORED — CVE-2026-104040 (Red Hat Enterprise Linux 10). CVSS 4.4 → 6.1 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-105759", "detail": "RESCORED — CVE-2026-105759 (vllm-project vllm). CVSS 5.9 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-106496", "detail": "RESCORED — CVE-2026-106496 (backstage). CVSS 3.1 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-106559", "detail": "RESCORED — CVE-2026-106559 (backstage). CVSS 6.3 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-106560", "detail": "RESCORED — CVE-2026-106560 (backstage). CVSS 7.1 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-106563", "detail": "RESCORED — CVE-2026-106563 (backstage). CVSS 5.3 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-107635", "detail": "RESCORED — CVE-2026-107635 (Aorimn dislocker). CVSS 6.8 → 6.9 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-111094", "detail": "RESCORED — CVE-2026-111094 (JetBrains TeamCity). CVSS 8.1 → 9.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-111095", "detail": "RESCORED — CVE-2026-111095 (JetBrains TeamCity). CVSS 8 → 5.4 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-111096", "detail": "RESCORED — CVE-2026-111096 (JetBrains TeamCity). CVSS 6.7 → 5.4 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-12542", "detail": "RESCORED — CVE-2026-12542 (Red Hat Satellite 6.16 for RHEL 8). CVSS 5.3 → 7.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23004", "detail": "RESCORED — CVE-2026-23004 (Linux). CVSS 7.8 → 4.7 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23013", "detail": "RESCORED — CVE-2026-23013 (Linux). CVSS 7 → 7.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23136", "detail": "RESCORED — CVE-2026-23136 (Linux). CVSS 7.5 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23148", "detail": "RESCORED — CVE-2026-23148 (Linux). CVSS 7.5 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23172", "detail": "RESCORED — CVE-2026-23172 (Linux). CVSS 8.4 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23230", "detail": "RESCORED — CVE-2026-23230 (Linux). CVSS 8.8 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23428", "detail": "RESCORED — CVE-2026-23428 (Linux). CVSS 9.8 → 7.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23437", "detail": "RESCORED — CVE-2026-23437 (Linux). CVSS 7.8 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23440", "detail": "RESCORED — CVE-2026-23440 (Linux). CVSS 7.5 → 4.7 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-23445", "detail": "RESCORED — CVE-2026-23445 (Linux). CVSS 7.8 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-32316", "detail": "RESCORED — CVE-2026-32316 (jqlang jq). CVSS 8.2 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-69918", "detail": "RESCORED — CVE-2026-69918 (Microsoft Windows 10 Version 1607). CVSS 8.8 → 7.8 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-70025", "detail": "RESCORED — CVE-2026-70025 (Microsoft Windows 10 Version 1607). CVSS 5.3 → 6.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-85333", "detail": "RESCORED — CVE-2026-85333 (Microsoft Windows 10 Version 1607). CVSS 6.7 → 7 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-85797", "detail": "RESCORED — CVE-2026-85797 (Microsoft Windows 10 Version 1607). CVSS 6.5 → 7.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-85916", "detail": "RESCORED — CVE-2026-85916 (Microsoft Windows 11 version 23H2). CVSS 6.2 → 5.5 (NVD)." }, { "type": "RESCORED", "cve_id": "CVE-2026-88073", "detail": "RESCORED — CVE-2026-88073 (Microsoft Windows 10 Version 21H2). CVSS 8.8 → 7.8 (NVD)." }, { "type": "REJECTED", "cve_id": "CVE-2026-108749", "detail": "REJECTED — CVE-2026-108749 (docling-project docling-serve). Record withdrawn by the CNA." }, { "type": "REJECTED", "cve_id": "CVE-2026-15354", "detail": "REJECTED — CVE-2026-15354 (Mauro Cassani ACPT (Premium)). Record withdrawn by the CNA." }, { "type": "REJECTED", "cve_id": "CVE-2026-15398", "detail": "REJECTED — CVE-2026-15398 (arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce). Record withdrawn by the CNA." }, { "type": "REJECTED", "cve_id": "CVE-2026-21589", "detail": "REJECTED — CVE-2026-21589 (Atlassian Bamboo Data Center). Record withdrawn by the CNA." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-10813", "detail": "PATCH SHIPPED — CVE-2026-10813 (LMCache). Fixed in LMCache 0.5.5." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-108794", "detail": "PATCH SHIPPED — CVE-2026-108794 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-108795", "detail": "PATCH SHIPPED — CVE-2026-108795 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-108796", "detail": "PATCH SHIPPED — CVE-2026-108796 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-108797", "detail": "PATCH SHIPPED — CVE-2026-108797 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-108798", "detail": "PATCH SHIPPED — CVE-2026-108798 (ZKTeco BioTime). Fixed in BioTime 9.5.6 Build 3623." }, { "type": "PATCH_SHIPPED", "cve_id": "CVE-2026-27433", "detail": "PATCH SHIPPED — CVE-2026-27433 (StylemixThemes Motors). Fixed in Motors 5.6.85." } ], "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/." }