711
CVEs
85
Critical
145
High
1
KEV
21
PoC
28
Unpatched C/H
94.2%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
85
HIGH
145
MEDIUM
243
LOW
14
Monthly CVE Trend
Affected Products (30)
Iphone Os
2995
Mac Os X
2043
macOS
1995
Tvos
1710
Watchos
1524
Ipados
1375
Safari
931
Itunes
619
iOS
554
Ios Xe
465
Visionos
351
Icloud
342
Ios And Ipados
336
Debian Linux
246
Fedora
193
Ios Xr
160
Ubuntu Linux
152
Chrome
123
Opensuse
97
Webkitgtk
92
Windows
90
Xcode
83
Enterprise Linux Server
80
Enterprise Linux Workstation
79
Enterprise Linux Desktop
77
Quicktime
73
Webkit
68
Leap
66
Ipad Os
63
Acrobat Reader
55
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65400 | Authentication bypass in Apple's macOS Screen Sharing service allows a network-adjacent attacker to establish a Screen Sharing session without supplying valid credentials, granting interactive remote control of the target Mac. The flaw affects macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, and macOS Tahoe before 26.6.1, and was reported by Apple Product Security itself. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the state-management defect underlying it can be reached over the network with low complexity. | CRITICAL | 9.8 | 0.3% | 119 |
KEV
PoC
|
| CVE-2026-52806 | Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-configured instances with open registration) to execute arbitrary commands as the Gogs server process by crafting a pull request whose base branch name injects a `--exec` flag into the underlying `git rebase` invocation. A working Python proof-of-concept exists and has been validated end-to-end against Docker, Linux binary, and Windows installations, yielding shell access as the `git` user. No CISA KEV listing or EPSS data is provided, so this is treated as publicly available exploit code rather than confirmed active exploitation. | CRITICAL | 9.9 | 1.0% | 86 |
PoC
|
| CVE-2026-50289 | OS command injection in the systeminformation Node.js library (npm, versions <= 5.31.6) lets an attacker who can influence a `source`d path in Debian/Ubuntu `interfaces(5)` files run arbitrary shell commands with the privileges of any process that calls `networkInterfaces()`. The unsanitized path token parsed from `/etc/network/interfaces` (and files it recursively sources) is interpolated into a `cat ... | grep` shell string executed via `execSync()`, so metacharacters in the path break out and execute commands. Publicly available exploit code exists (working PoC in the advisory); no public exploit is identified as being used in active exploitation. Fixed in 5.31.7. | HIGH | 8.7 | 2.1% | 66 |
PoC
|
| CVE-2026-48801 | Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by submitting tens of KB of repeated email/link-like text. The core public API LinkifyIt.prototype.match runs an O(N²) scan loop that re-slices the input and re-runs unanchored fuzzy regex searches once per match, so 64 KB of "a@b.com" burns ~2.5 s of single-threaded CPU and 128 KB ~10 s. The flaw is inherited by markdown-it (~21.6M weekly npm downloads) whenever linkify:true is set, exposing forums, chat, wikis and AI chat UIs; publicly available exploit code (a PoC in the GHSA advisory) exists, but there is no evidence of active exploitation. | HIGH | 8.7 | 0.4% | 64 |
PoC
|
| CVE-2026-52776 | URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%. | HIGH | 8.6 | 0.4% | 63 |
PoC
|
| CVE-2026-43760 | Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying. | HIGH | 8.6 | 0.1% | 63 |
PoC
|
| CVE-2026-43723 | Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability, a path handling flaw in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, enables a low-privileged application to traverse directories and elevate its permissions. No user interaction is required, and no active exploitation or public proof-of-concept has been identified at the time of analysis. | HIGH | 7.8 | 0.1% | 59 |
PoC
|
| CVE-2026-53503 | Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-54567 | Extension-denylist bypass in the Flask-Reuploaded (flask_uploads) Python library allows an attacker who controls the name override passed to UploadSet.save() to store dangerous script files by varying letter case (e.g. shell.PHP, evil.pHp), defeating the very script-blocking denylist the library documents. This is an incomplete-fix variant of CVE-2026-27641: the v1.5.0 fix re-validated overridden names through the case-preserving extension() helper instead of the case-normalizing lowercase_ext() used by the default path, so uppercase extensions slip past a lowercase-tokened denylist. Publicly available exploit code exists (a self-contained PoC verified against Flask-Reuploaded==1.5.0), though there is no evidence of active exploitation and no EPSS score was provided. | HIGH | 7.5 | – | 58 |
PoC
|
| CVE-2026-54550 | Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources. | HIGH | 7.4 | 0.4% | 57 |
PoC
|
| CVE-2026-53965 | Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV. | MEDIUM | 6.9 | 0.4% | 55 |
PoC
|
| CVE-2026-55593 | Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
|
| CVE-2026-51376 | Unauthenticated BLE packet injection in BitChat for iOS v1.5.0 (reported in the CVE as v1.15.0) allows any device within Bluetooth adjacency range to inject crafted MESSAGE packets into the mesh gossip cache, causing denial of service for all mesh participants. The attack exploits a TTL=0 validation bypass in BLEService.swift that accepted packets as anonymous without full sender authentication. A public proof-of-concept is available at a named GitHub repository; no active exploitation has been confirmed by CISA KEV. | MEDIUM | 6.5 | 0.2% | 53 |
PoC
No patch
|
| CVE-2026-59941 | Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis. | MEDIUM | 6.3 | 0.5% | 52 |
PoC
|
| CVE-2026-58617 | Elevation of privilege in Microsoft 365 Copilot for iOS (versions 1.0 through builds prior to 2.111.4) lets a network-based attacker bypass improper access controls (CWE-284) to gain unauthorized elevated privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical with total confidentiality, integrity and availability impact, though SSVC records exploitation status as none and there is no public exploit identified at time of analysis. EPSS is modest at 0.67% (48th percentile), indicating no observed exploitation activity despite the high theoretical severity. | CRITICAL | 9.8 | 0.7% | 50 |
|