1148
CVEs
105
Critical
327
High
1
KEV
31
PoC
48
Unpatched C/H
92.3%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
105
HIGH
327
MEDIUM
460
LOW
30
Monthly CVE Trend
Affected Products (30)
Iphone Os
2995
Mac Os X
2043
macOS
1995
Tvos
1710
Watchos
1524
Ipados
1375
Safari
931
Itunes
619
iOS
554
Ios Xe
465
Visionos
351
Icloud
342
Ios And Ipados
336
Debian Linux
246
Fedora
193
Ios Xr
160
Ubuntu Linux
152
Chrome
123
Opensuse
97
Webkitgtk
92
Windows
90
Xcode
83
Enterprise Linux Server
80
Enterprise Linux Workstation
79
Enterprise Linux Desktop
77
Quicktime
73
Webkit
68
Leap
66
Ipad Os
63
Acrobat Reader
55
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65400 | Authentication bypass in Apple's macOS Screen Sharing service allows a network-adjacent attacker to establish a Screen Sharing session without supplying valid credentials, granting interactive remote control of the target Mac. The flaw affects macOS Sequoia before 15.7.9, macOS Sonoma before 14.8.9, and macOS Tahoe before 26.6.1, and was reported by Apple Product Security itself. There is no public exploit identified at time of analysis and it is not in CISA KEV, though the state-management defect underlying it can be reached over the network with low complexity. | CRITICAL | 9.8 | 0.3% | 119 |
KEV
PoC
|
| CVE-2026-52806 | Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-configured instances with open registration) to execute arbitrary commands as the Gogs server process by crafting a pull request whose base branch name injects a `--exec` flag into the underlying `git rebase` invocation. A working Python proof-of-concept exists and has been validated end-to-end against Docker, Linux binary, and Windows installations, yielding shell access as the `git` user. No CISA KEV listing or EPSS data is provided, so this is treated as publicly available exploit code rather than confirmed active exploitation. | CRITICAL | 9.9 | 1.0% | 86 |
PoC
|
| CVE-2026-33439 | Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue | CRITICAL | 9.3 | 0.1% | 67 |
PoC
|
| CVE-2026-50289 | OS command injection in the systeminformation Node.js library (npm, versions <= 5.31.6) lets an attacker who can influence a `source`d path in Debian/Ubuntu `interfaces(5)` files run arbitrary shell commands with the privileges of any process that calls `networkInterfaces()`. The unsanitized path token parsed from `/etc/network/interfaces` (and files it recursively sources) is interpolated into a `cat ... | grep` shell string executed via `execSync()`, so metacharacters in the path break out and execute commands. Publicly available exploit code exists (working PoC in the advisory); no public exploit is identified as being used in active exploitation. Fixed in 5.31.7. | HIGH | 8.7 | 2.1% | 66 |
PoC
|
| CVE-2026-48801 | Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by submitting tens of KB of repeated email/link-like text. The core public API LinkifyIt.prototype.match runs an O(N²) scan loop that re-slices the input and re-runs unanchored fuzzy regex searches once per match, so 64 KB of "a@b.com" burns ~2.5 s of single-threaded CPU and 128 KB ~10 s. The flaw is inherited by markdown-it (~21.6M weekly npm downloads) whenever linkify:true is set, exposing forums, chat, wikis and AI chat UIs; publicly available exploit code (a PoC in the GHSA advisory) exists, but there is no evidence of active exploitation. | HIGH | 8.7 | 0.4% | 64 |
PoC
|
| CVE-2021-47973 | Sticky Notes Widget 3.0.6 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.0% | 64 |
PoC
No patch
|
| CVE-2021-47944 | memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character buffers into note fields. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.0% | 64 |
PoC
No patch
|
| CVE-2026-52776 | URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%. | HIGH | 8.6 | 0.4% | 63 |
PoC
|
| CVE-2026-47114 | Arbitrary command execution in IINA media player for macOS versions prior to 1.4.3 allows remote attackers to run shell commands as the logged-in user by tricking the victim into approving an iina://open URL containing malicious mpv_-prefixed parameters. Publicly available exploit code exists and a vendor patch has been released; exploitation requires a single browser protocol prompt approval (UI:A) but no authentication and no valid media file. | HIGH | 8.6 | 0.2% | 63 |
PoC
|
| CVE-2026-43760 | Information disclosure in Apple macOS (Sonoma before 14.8.8 and Tahoe before 26.6) allows an app to bypass access restrictions and reach user-sensitive data due to a CWE-284 improper access control flaw. Apple has shipped fixes and the CVSS 8.6 rating reflects high confidentiality impact, but EPSS is low (0.14%, 4th percentile) and CISA SSVC shows no observed exploitation. No public exploit is confirmed in the intelligence, though a referenced 'it's a pre-auth' writeup and 'Authentication Bypass' tag hint at a bypass primitive worth verifying. | HIGH | 8.6 | 0.1% | 63 |
PoC
|
| CVE-2026-39860 | Local privilege escalation in Nix package manager daemon (versions prior to 2.34.5/2.33.4/2.32.7/2.31.4/2.30.4/2.29.3/2.28.6) allows unprivileged users to gain root access in multi-user Linux installations. Incomplete fix for CVE-2024-27297 permits symlink attacks during fixed-output derivation registration, enabling arbitrary file overwrites as root. Attackers exploit sandboxed build registration by placing symlinks in temporary output paths, causing the daemon to follow symlinks and overwrite sensitive system files with controlled content. Affects default configurations where all users can submit builds. No public exploit identified at time of analysis. | HIGH | 8.4 | 0.0% | 62 |
PoC
|
| CVE-2026-43723 | Local privilege escalation in Apple operating systems allows a malicious app to gain root privileges. The vulnerability, a path handling flaw in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, enables a low-privileged application to traverse directories and elevate its permissions. No user interaction is required, and no active exploitation or public proof-of-concept has been identified at the time of analysis. | HIGH | 7.8 | 0.1% | 59 |
PoC
|
| CVE-2026-53503 | Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible. | HIGH | 7.5 | 0.4% | 58 |
PoC
|
| CVE-2026-54567 | Extension-denylist bypass in the Flask-Reuploaded (flask_uploads) Python library allows an attacker who controls the name override passed to UploadSet.save() to store dangerous script files by varying letter case (e.g. shell.PHP, evil.pHp), defeating the very script-blocking denylist the library documents. This is an incomplete-fix variant of CVE-2026-27641: the v1.5.0 fix re-validated overridden names through the case-preserving extension() helper instead of the case-normalizing lowercase_ext() used by the default path, so uppercase extensions slip past a lowercase-tokened denylist. Publicly available exploit code exists (a self-contained PoC verified against Flask-Reuploaded==1.5.0), though there is no evidence of active exploitation and no EPSS score was provided. | HIGH | 7.5 | – | 58 |
PoC
|
| CVE-2026-54550 | Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources. | HIGH | 7.4 | 0.4% | 57 |
PoC
|