2097
CVEs
364
Critical
1086
High
1
KEV
24
PoC
1413
Unpatched C/H
5.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
364
HIGH
1086
MEDIUM
541
LOW
106
Monthly CVE Trend
Affected Products (30)
MySQL
1197
Java
1024
Debian Linux
906
Oncommand Insight
757
Jre
747
Jdk
739
Ubuntu Linux
726
Fedora
595
Oncommand Workflow Automation
590
Active Iq Unified Manager
543
Solaris
496
Snapcenter
495
Opensuse
484
Enterprise Linux Server
413
Enterprise Linux Workstation
413
Enterprise Linux Desktop
410
Vm Virtualbox
404
Enterprise Linux Server Aus
394
Enterprise Linux Eus
363
Enterprise Linux Server Tus
348
Leap
333
Peoplesoft Enterprise Peopletools
329
MariaDB
327
Weblogic Server
288
E Business Suite
284
Mysql Server
283
Fusion Middleware
249
Enterprise Linux
233
Database Server
209
Outside In Technology
190
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-55255 | Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing the victim's flow UUID as the `model` value to the `/api/v1/responses` endpoint, exposing data the victim's flow processes and consuming their resources. The flaw is an Insecure Direct Object Reference (CWE-639) in the `get_flow_by_id_or_endpoint_name` helper, which skipped ownership checks on the UUID lookup path. Publicly available exploit code exists (a working curl PoC), and the input lists it as confirmed actively exploited (CISA KEV), though the SSVC exploitation status of 'poc' and a low 0.24% EPSS complicate that claim (see risk_assessment). | HIGH | 8.4 | 0.2% | 112 |
KEV
PoC
|
| CVE-2026-69240 | SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
|
| CVE-2026-45623 | Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile). | CRITICAL | 9.1 | 0.5% | 66 |
PoC
|
| CVE-2026-53727 | Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV. | HIGH | 8.9 | 0.5% | 65 |
PoC
|
| CVE-2025-30156 | Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-55509 | Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly. | HIGH | 8.8 | 0.4% | 64 |
PoC
|
| CVE-2026-69247 | PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure. | HIGH | 8.2 | 0.2% | 61 |
PoC
|
| CVE-2026-52770 | Boolean-based blind SQL injection in YesWiki's public Bazar entry-listing API allows unauthenticated attackers to read arbitrary database contents by abusing numeric query/queries filters. Because numeric field values are escaped with mysqli_real_escape_string but inserted into the SQL statement without quotes or numeric validation, injected boolean expressions (e.g. '100 OR (SELECT COUNT(*) FROM yeswiki_users)>0') are evaluated by the database, turning the public endpoints into a data-exfiltration oracle. A detailed, self-contained proof-of-concept is published in the advisory; a vendor patch (commit f3b0dd0) is available, though the issue is not listed in CISA KEV. | HIGH | 7.5 | 0.3% | 58 |
PoC
|
| CVE-2026-49989 | Unauthorized blob read, write, and delete operations in CrateDB's HTTP API allow any authenticated user to bypass privilege grants on blob tables. The HttpBlobHandler endpoint fails to enforce access control, enabling authenticated users to read, delete, or plant arbitrary blobs via crafted HTTP requests, regardless of their SQL-level permissions. Public proof-of-concept exploit code exists; a vendor patch is available, but active exploitation has not been confirmed through CISA KEV. | HIGH | 7.1 | 0.3% | 56 |
PoC
|
| CVE-2026-54659 | Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary | MEDIUM | 6.9 | 0.4% | 55 |
PoC
|
| CVE-2026-57897 | Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier. | MEDIUM | 6.5 | 0.3% | 53 |
PoC
|
| CVE-2026-67620 | Server-side request forgery in Flowise through 3.1.4 allows attackers to reach Oracle Cloud Infrastructure (OCI) and Alibaba Cloud instance metadata services by exploiting an incomplete deny-list in the SSRF guard (`httpSecurity.ts`). The DEFAULT_DENY_LIST omits the OCI metadata IP 192.0.0.192 and the Alibaba Cloud metadata IP 100.100.100.200, enabling credential theft from the cloud metadata layer. No public exploit identified at time of analysis in CISA KEV, but publicly available exploit code exists on GitHub, and the vendor's website now resolves to a sunset page, suggesting no official patch will be issued. | MEDIUM | 6.3 | 0.4% | 52 |
PoC
No patch
|
| CVE-2026-63642 | Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported. | MEDIUM | 6.3 | 0.4% | 52 |
PoC
|
| CVE-2026-60366 | Complete takeover of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the 'Centralized Thirdparty Jars' component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can significantly impact products beyond OPSS itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the perfect CVSS score and 'easily exploitable' vendor language make this a top-priority patch. | CRITICAL | 10.0 | 0.5% | 51 |
No patch
|
| CVE-2026-60217 | Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core component of this Oracle Fusion Middleware in-memory data grid affected in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The maximum-severity CVSS 10.0 rating reflects a scope-changing flaw whose exploitation can pivot beyond Coherence to impact other co-deployed products. There is no public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make this a top-priority patch. | CRITICAL | 10.0 | 0.5% | 50 |
No patch
|