{
  "day": "2026-10-17",
  "boundary": "UTC calendar day",
  "published_count": 100,
  "by_severity": {
    "CRITICAL": 3,
    "HIGH": 42,
    "MEDIUM": 40,
    "LOW": 3
  },
  "kev_count": 0,
  "exploit_reference_count": 0,
  "awaiting_enrichment_count": 12,
  "ranking": "Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.",
  "results": [
    {
      "rank": 1,
      "cve_id": "CVE-2026-111853",
      "cvss_base": 8.8,
      "cvss_severity": "HIGH",
      "epss_score": 0.00857,
      "epss_percentile": 0.57672,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tektronix",
      "product": "3 Series MDO",
      "cwe": "CWE-78",
      "title": "An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111853"
    },
    {
      "rank": 2,
      "cve_id": "CVE-2026-110268",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00766,
      "epss_percentile": 0.54648,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpazleen",
      "product": "Post Export Import with Media",
      "cwe": "CWE-22",
      "title": "Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110268"
    },
    {
      "rank": 3,
      "cve_id": "CVE-2026-111855",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00492,
      "epss_percentile": 0.40952,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tektronix",
      "product": "3 Series MDO",
      "cwe": "CWE-22",
      "title": "An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111855"
    },
    {
      "rank": 4,
      "cve_id": "CVE-2026-104734",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00466,
      "epss_percentile": 0.38904,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeum",
      "product": "Kirki – Freeform Page Builder, Website Builder & Customizer",
      "cwe": "CWE-502",
      "title": "Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104734"
    },
    {
      "rank": 5,
      "cve_id": "CVE-2026-104736",
      "cvss_base": 9.8,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00438,
      "epss_percentile": 0.36594,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thimpress",
      "product": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
      "cwe": "CWE-502",
      "title": "LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104736"
    },
    {
      "rank": 6,
      "cve_id": "CVE-2026-110653",
      "cvss_base": 9.1,
      "cvss_severity": "CRITICAL",
      "epss_score": 0.00403,
      "epss_percentile": 0.33011,
      "kev": false,
      "kev_due_at": null,
      "vendor": "latepoint",
      "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
      "cwe": "CWE-287",
      "title": "Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110653"
    },
    {
      "rank": 7,
      "cve_id": "CVE-2026-107762",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00396,
      "epss_percentile": 0.32214,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeum",
      "product": "Kirki – Freeform Page Builder, Website Builder & Customizer",
      "cwe": "CWE-639",
      "title": "Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107762"
    },
    {
      "rank": 8,
      "cve_id": "CVE-2026-111854",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00391,
      "epss_percentile": 0.31646,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Tektronix",
      "product": "3 Series MDO",
      "cwe": "CWE-22",
      "title": "An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111854"
    },
    {
      "rank": 9,
      "cve_id": "CVE-2026-92798",
      "cvss_base": 8.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.00369,
      "epss_percentile": 0.2924,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpeverest",
      "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
      "cwe": "CWE-94",
      "title": "User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92798"
    },
    {
      "rank": 10,
      "cve_id": "CVE-2026-108123",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": 0.00318,
      "epss_percentile": 0.23131,
      "kev": false,
      "kev_due_at": null,
      "vendor": "murgroland",
      "product": "WP Booking System – Booking Calendar",
      "cwe": "CWE-862",
      "title": "WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108123"
    },
    {
      "rank": 11,
      "cve_id": "CVE-2026-107752",
      "cvss_base": 4.9,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00301,
      "epss_percentile": 0.21386,
      "kev": false,
      "kev_due_at": null,
      "vendor": "uscnanbu",
      "product": "Welcart e-Commerce",
      "cwe": "CWE-89",
      "title": "Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107752"
    },
    {
      "rank": 12,
      "cve_id": "CVE-2026-111602",
      "cvss_base": 3.7,
      "cvss_severity": "LOW",
      "epss_score": 0.00289,
      "epss_percentile": 0.20096,
      "kev": false,
      "kev_due_at": null,
      "vendor": "latepoint",
      "product": "Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress",
      "cwe": "CWE-200",
      "title": "Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111602"
    },
    {
      "rank": 13,
      "cve_id": "CVE-2026-109208",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00285,
      "epss_percentile": 0.19631,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thimpress",
      "product": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
      "cwe": "CWE-79",
      "title": "LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109208"
    },
    {
      "rank": 14,
      "cve_id": "CVE-2026-110253",
      "cvss_base": 5.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00279,
      "epss_percentile": 0.19014,
      "kev": false,
      "kev_due_at": null,
      "vendor": "boldgrid",
      "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress",
      "cwe": "CWE-22",
      "title": "weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110253"
    },
    {
      "rank": 15,
      "cve_id": "CVE-2026-111110",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00278,
      "epss_percentile": 0.18934,
      "kev": false,
      "kev_due_at": null,
      "vendor": "stiofansisland",
      "product": "Payment forms, Buy now buttons, and Invoicing System | GetPaid",
      "cwe": "CWE-79",
      "title": "Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111110"
    },
    {
      "rank": 16,
      "cve_id": "CVE-2026-100316",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00272,
      "epss_percentile": 0.18258,
      "kev": false,
      "kev_due_at": null,
      "vendor": "davidanderson",
      "product": "European VAT Compliance Assistant for WooCommerce",
      "cwe": "CWE-79",
      "title": "European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-100316"
    },
    {
      "rank": 17,
      "cve_id": "CVE-2026-109368",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00263,
      "epss_percentile": 0.16987,
      "kev": false,
      "kev_due_at": null,
      "vendor": "murgroland",
      "product": "WP Booking System – Booking Calendar",
      "cwe": "CWE-862",
      "title": "WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109368"
    },
    {
      "rank": 18,
      "cve_id": "CVE-2026-109369",
      "cvss_base": 6.8,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00255,
      "epss_percentile": 0.15938,
      "kev": false,
      "kev_due_at": null,
      "vendor": "murgroland",
      "product": "WP Booking System – Booking Calendar",
      "cwe": "CWE-862",
      "title": "WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109369"
    },
    {
      "rank": 19,
      "cve_id": "CVE-2026-107744",
      "cvss_base": 6.5,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.0025,
      "epss_percentile": 0.15252,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thimpress",
      "product": "LearnPress – WordPress LMS Plugin for Create and Sell Online Courses",
      "cwe": "CWE-862",
      "title": "LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107744"
    },
    {
      "rank": 20,
      "cve_id": "CVE-2026-103899",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.00241,
      "epss_percentile": 0.14178,
      "kev": false,
      "kev_due_at": null,
      "vendor": "daigo75",
      "product": "EU VAT Assistant for WooCommerce",
      "cwe": "CWE-79",
      "title": "EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103899"
    },
    {
      "rank": 21,
      "cve_id": "CVE-2026-96660",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": 0.0023,
      "epss_percentile": 0.12804,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpeverest",
      "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
      "cwe": "CWE-79",
      "title": "User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96660"
    },
    {
      "rank": 22,
      "cve_id": "CVE-2026-111601",
      "cvss_base": 6.1,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00226,
      "epss_percentile": 0.12428,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hippooo",
      "product": "Hippoo Mobile App for WooCommerce",
      "cwe": "CWE-79",
      "title": "Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111601"
    },
    {
      "rank": 23,
      "cve_id": "CVE-2026-109983",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00215,
      "epss_percentile": 0.11149,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wssoffice21",
      "product": "YMC Filter",
      "cwe": "CWE-79",
      "title": "YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109983"
    },
    {
      "rank": 24,
      "cve_id": "CVE-2026-107763",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00213,
      "epss_percentile": 0.10856,
      "kev": false,
      "kev_due_at": null,
      "vendor": "hostspa",
      "product": "Fastcache by Host.it",
      "cwe": "CWE-862",
      "title": "Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107763"
    },
    {
      "rank": 25,
      "cve_id": "CVE-2026-92715",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00204,
      "epss_percentile": 0.09664,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themeum",
      "product": "Tutor LMS – eLearning and online course solution",
      "cwe": "CWE-639",
      "title": "Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92715"
    },
    {
      "rank": 26,
      "cve_id": "CVE-2026-109985",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00201,
      "epss_percentile": 0.09302,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpdevteam",
      "product": "xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN",
      "cwe": "CWE-79",
      "title": "xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109985"
    },
    {
      "rank": 27,
      "cve_id": "CVE-2026-81344",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00198,
      "epss_percentile": 0.08931,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ACF Frontend Admin by DynamiApps",
      "cwe": null,
      "title": "Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81344"
    },
    {
      "rank": 28,
      "cve_id": "CVE-2026-109989",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08392,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themifyme",
      "product": "Themify Popup",
      "cwe": "CWE-79",
      "title": "Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109989"
    },
    {
      "rank": 29,
      "cve_id": "CVE-2026-111726",
      "cvss_base": 6.4,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00193,
      "epss_percentile": 0.08392,
      "kev": false,
      "kev_due_at": null,
      "vendor": "themifyme",
      "product": "Themify Builder",
      "cwe": "CWE-79",
      "title": "Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111726"
    },
    {
      "rank": 30,
      "cve_id": "CVE-2026-110384",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": 0.0019,
      "epss_percentile": 0.08078,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Heateor Support",
      "product": "Fancy Comments WordPress",
      "cwe": "CWE-79",
      "title": "WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110384"
    },
    {
      "rank": 31,
      "cve_id": "CVE-2026-104246",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00164,
      "epss_percentile": 0.0528,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Contact Form 7 Signature Addon",
      "cwe": null,
      "title": "Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104246"
    },
    {
      "rank": 32,
      "cve_id": "CVE-2026-91074",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00162,
      "epss_percentile": 0.05038,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "BSK PDF Manager",
      "cwe": null,
      "title": "BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91074"
    },
    {
      "rank": 33,
      "cve_id": "CVE-2026-104122",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00156,
      "epss_percentile": 0.04318,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Ukr-To-Lat",
      "cwe": null,
      "title": "Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104122"
    },
    {
      "rank": 34,
      "cve_id": "CVE-2026-92978",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": 0.00154,
      "epss_percentile": 0.04102,
      "kev": false,
      "kev_due_at": null,
      "vendor": "wpeverest",
      "product": "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder",
      "cwe": "CWE-352",
      "title": "User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92978"
    },
    {
      "rank": 35,
      "cve_id": "CVE-2026-97314",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00145,
      "epss_percentile": 0.03405,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ThirstyAffiliates",
      "cwe": null,
      "title": "ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97314"
    },
    {
      "rank": 36,
      "cve_id": "CVE-2026-103376",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00139,
      "epss_percentile": 0.02946,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)",
      "cwe": null,
      "title": "PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103376"
    },
    {
      "rank": 37,
      "cve_id": "CVE-2026-92431",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00136,
      "epss_percentile": 0.02726,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Patreon WordPress",
      "cwe": null,
      "title": "Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92431"
    },
    {
      "rank": 38,
      "cve_id": "CVE-2026-92432",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00136,
      "epss_percentile": 0.02726,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Patreon WordPress",
      "cwe": null,
      "title": "Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92432"
    },
    {
      "rank": 39,
      "cve_id": "CVE-2026-110527",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00136,
      "epss_percentile": 0.02726,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP User Manager",
      "cwe": null,
      "title": "WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110527"
    },
    {
      "rank": 40,
      "cve_id": "CVE-2026-81343",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00132,
      "epss_percentile": 0.02467,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "ACF Frontend Admin by DynamiApps",
      "cwe": null,
      "title": "Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81343"
    },
    {
      "rank": 41,
      "cve_id": "CVE-2026-92433",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00115,
      "epss_percentile": 0.01416,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "Patreon WordPress",
      "cwe": null,
      "title": "Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92433"
    },
    {
      "rank": 42,
      "cve_id": "CVE-2026-106470",
      "cvss_base": null,
      "cvss_severity": null,
      "epss_score": 0.00097,
      "epss_percentile": 0.00694,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Unknown",
      "product": "WP Data Access",
      "cwe": null,
      "title": "WP Data Access < 5.5.88 - Subscriber+ SSRF",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106470"
    },
    {
      "rank": 43,
      "cve_id": "CVE-2026-111911",
      "cvss_base": 9.3,
      "cvss_severity": "CRITICAL",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-287",
      "title": "phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111911"
    },
    {
      "rank": 44,
      "cve_id": "CVE-2026-111884",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-308",
      "title": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111884"
    },
    {
      "rank": 45,
      "cve_id": "CVE-2026-111901",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-400",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111901"
    },
    {
      "rank": 46,
      "cve_id": "CVE-2026-111908",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-639",
      "title": "phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111908"
    },
    {
      "rank": 47,
      "cve_id": "CVE-2026-111923",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fleetdm",
      "product": "fleet",
      "cwe": "CWE-674",
      "title": "Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111923"
    },
    {
      "rank": 48,
      "cve_id": "CVE-2026-111924",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "fleetdm",
      "product": "fleet",
      "cwe": "CWE-409",
      "title": "Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111924"
    },
    {
      "rank": 49,
      "cve_id": "CVE-2026-111927",
      "cvss_base": 8.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-522",
      "title": "Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111927"
    },
    {
      "rank": 50,
      "cve_id": "CVE-2026-111882",
      "cvss_base": 8.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-287",
      "title": "phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111882"
    },
    {
      "rank": 51,
      "cve_id": "CVE-2026-111893",
      "cvss_base": 8.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-269",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111893"
    },
    {
      "rank": 52,
      "cve_id": "CVE-2026-111880",
      "cvss_base": 8.3,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-787",
      "title": "FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111880"
    },
    {
      "rank": 53,
      "cve_id": "CVE-2026-111898",
      "cvss_base": 7.7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-287",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111898"
    },
    {
      "rank": 54,
      "cve_id": "CVE-2026-111895",
      "cvss_base": 7.6,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-287",
      "title": "phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111895"
    },
    {
      "rank": 55,
      "cve_id": "CVE-2026-110889",
      "cvss_base": 7.5,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Gantry",
      "product": "Gantry 5 Framework",
      "cwe": "CWE-209",
      "title": "WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110889"
    },
    {
      "rank": 56,
      "cve_id": "CVE-2026-111881",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "FreeRDP",
      "product": "FreeRDP",
      "cwe": "CWE-191",
      "title": "FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111881"
    },
    {
      "rank": 57,
      "cve_id": "CVE-2026-111909",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-269",
      "title": "phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111909"
    },
    {
      "rank": 58,
      "cve_id": "CVE-2026-111922",
      "cvss_base": 7.2,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-942",
      "title": "Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111922"
    },
    {
      "rank": 59,
      "cve_id": "CVE-2026-109701",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "PAYCOMET",
      "product": "PAYCOMET for WooCommerce",
      "cwe": "CWE-79",
      "title": "WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109701"
    },
    {
      "rank": 60,
      "cve_id": "CVE-2026-111886",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-307",
      "title": "phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111886"
    },
    {
      "rank": 61,
      "cve_id": "CVE-2026-111897",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-862",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111897"
    },
    {
      "rank": 62,
      "cve_id": "CVE-2026-111906",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-352",
      "title": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111906"
    },
    {
      "rank": 63,
      "cve_id": "CVE-2026-111907",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-352",
      "title": "phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111907"
    },
    {
      "rank": 64,
      "cve_id": "CVE-2026-111910",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-862",
      "title": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111910"
    },
    {
      "rank": 65,
      "cve_id": "CVE-2026-111912",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-639",
      "title": "Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111912"
    },
    {
      "rank": 66,
      "cve_id": "CVE-2026-111914",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-862",
      "title": "Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111914"
    },
    {
      "rank": 67,
      "cve_id": "CVE-2026-111917",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-613",
      "title": "Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111917"
    },
    {
      "rank": 68,
      "cve_id": "CVE-2026-111919",
      "cvss_base": 7.1,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-613",
      "title": "Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111919"
    },
    {
      "rank": 69,
      "cve_id": "CVE-2026-111885",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-1220",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111885"
    },
    {
      "rank": 70,
      "cve_id": "CVE-2026-111890",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-269",
      "title": "phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111890"
    },
    {
      "rank": 71,
      "cve_id": "CVE-2026-111891",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-269",
      "title": "phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111891"
    },
    {
      "rank": 72,
      "cve_id": "CVE-2026-111905",
      "cvss_base": 7,
      "cvss_severity": "HIGH",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-639",
      "title": "phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111905"
    },
    {
      "rank": 73,
      "cve_id": "CVE-2026-111866",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "nemoTyrant",
      "product": "manong",
      "cwe": "CWE-89",
      "title": "nemoTyrant manong func.php arr2sql sql injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111866"
    },
    {
      "rank": 74,
      "cve_id": "CVE-2026-111887",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-204",
      "title": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111887"
    },
    {
      "rank": 75,
      "cve_id": "CVE-2026-111892",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-307",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111892"
    },
    {
      "rank": 76,
      "cve_id": "CVE-2026-111902",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-639",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111902"
    },
    {
      "rank": 77,
      "cve_id": "CVE-2026-111904",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-200",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111904"
    },
    {
      "rank": 78,
      "cve_id": "CVE-2026-111916",
      "cvss_base": 6.9,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-862",
      "title": "Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111916"
    },
    {
      "rank": 79,
      "cve_id": "CVE-2026-111933",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-203",
      "title": "Coder before 2.34.2 User Enumeration via Login Placeholder Hash",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111933"
    },
    {
      "rank": 80,
      "cve_id": "CVE-2026-111934",
      "cvss_base": 6.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-348",
      "title": "Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111934"
    },
    {
      "rank": 81,
      "cve_id": "CVE-2026-111929",
      "cvss_base": 6,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-863",
      "title": "Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111929"
    },
    {
      "rank": 82,
      "cve_id": "CVE-2024-58398",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-601",
      "title": "Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58398"
    },
    {
      "rank": 83,
      "cve_id": "CVE-2026-111889",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-862",
      "title": "phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111889"
    },
    {
      "rank": 84,
      "cve_id": "CVE-2026-111900",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-863",
      "title": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111900"
    },
    {
      "rank": 85,
      "cve_id": "CVE-2026-111913",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Admidio",
      "product": "admidio",
      "cwe": "CWE-285",
      "title": "Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111913"
    },
    {
      "rank": 86,
      "cve_id": "CVE-2026-111918",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-863",
      "title": "Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111918"
    },
    {
      "rank": 87,
      "cve_id": "CVE-2026-111920",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-269",
      "title": "Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111920"
    },
    {
      "rank": 88,
      "cve_id": "CVE-2026-111921",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "go-vikunja",
      "product": "vikunja",
      "cwe": "CWE-863",
      "title": "Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111921"
    },
    {
      "rank": 89,
      "cve_id": "CVE-2026-111928",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-863",
      "title": "Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111928"
    },
    {
      "rank": 90,
      "cve_id": "CVE-2026-111930",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-200",
      "title": "Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111930"
    },
    {
      "rank": 91,
      "cve_id": "CVE-2026-111931",
      "cvss_base": 5.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-601",
      "title": "Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111931"
    },
    {
      "rank": 92,
      "cve_id": "CVE-2026-111888",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-863",
      "title": "phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111888"
    },
    {
      "rank": 93,
      "cve_id": "CVE-2026-111894",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-79",
      "title": "phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111894"
    },
    {
      "rank": 94,
      "cve_id": "CVE-2026-111896",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-182",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111896"
    },
    {
      "rank": 95,
      "cve_id": "CVE-2026-111903",
      "cvss_base": 5.1,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "thorsten",
      "product": "phpMyFAQ",
      "cwe": "CWE-79",
      "title": "phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111903"
    },
    {
      "rank": 96,
      "cve_id": "CVE-2026-111926",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-200",
      "title": "Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111926"
    },
    {
      "rank": 97,
      "cve_id": "CVE-2026-111932",
      "cvss_base": 4.8,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-79",
      "title": "Coder before 2.34.2 Stored HTML Injection via Appearance Settings",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111932"
    },
    {
      "rank": 98,
      "cve_id": "CVE-2026-110882",
      "cvss_base": 4.3,
      "cvss_severity": "MEDIUM",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "Cozy Vision Technologies Pvt. Ltd.",
      "product": "SMS Alert Order Notifications",
      "cwe": "CWE-862",
      "title": "WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110882"
    },
    {
      "rank": 99,
      "cve_id": "CVE-2025-71435",
      "cvss_base": 2.3,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "coder",
      "product": "coder",
      "cwe": "CWE-613",
      "title": "Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71435"
    },
    {
      "rank": 100,
      "cve_id": "CVE-2026-111865",
      "cvss_base": 1.9,
      "cvss_severity": "LOW",
      "epss_score": null,
      "epss_percentile": null,
      "kev": false,
      "kev_due_at": null,
      "vendor": "THU-MIG",
      "product": "yoloe",
      "cwe": "CWE-94",
      "title": "THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111865"
    }
  ],
  "transactions": [
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-104935",
      "detail": "DUE DATE PASSED — CVE-2026-104935 (Ivanti Connect Secure). CISA remediation deadline was October 16, 2026; still in catalog."
    },
    {
      "type": "DUE_DATE_PASSED",
      "cve_id": "CVE-2026-96951",
      "detail": "DUE DATE PASSED — CVE-2026-96951 (Microsoft Outlook.com). CISA remediation deadline was October 16, 2026; still in catalog."
    },
    {
      "type": "RESCORED",
      "cve_id": "CVE-2025-61624",
      "detail": "RESCORED — CVE-2025-61624 (Fortinet FortiOS). CVSS 5.4 → 6.5 (NVD)."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-108334",
      "detail": "PATCH SHIPPED — CVE-2026-108334 (Red Hat Connectivity Link 1.4). Fixed in Red Hat Connectivity Link 1.4 1791975888."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-17591",
      "detail": "PATCH SHIPPED — CVE-2026-17591 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 3.8.9-2.1.hum1."
    },
    {
      "type": "PATCH_SHIPPED",
      "cve_id": "CVE-2026-85977",
      "detail": "PATCH SHIPPED — CVE-2026-85977 (Red Hat Hardened Images). Fixed in Red Hat Hardened Images 1.3.8-0.1.hum1."
    }
  ],
  "attribution": "CVE Program, NVD (NIST), CISA KEV, FIRST EPSS, OSV. See /security/methodology/."
}