{
  "critical_count": 134,
  "critical_cves": [
    {
      "cvss_score": 9.9,
      "description": "Unrestricted upload of file with dangerous type vulnerability in Ba\u015farsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server.\n\nThis issue affects Rotaban: from V2026.06.0",
      "epss_score": 0.00335,
      "id": "CVE-2026-11839"
    },
    {
      "cvss_score": 9.1,
      "description": "The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA\u2019s permitted ",
      "epss_score": 0.00196,
      "id": "CVE-2026-9648"
    },
    {
      "cvss_score": 10.0,
      "description": "MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_c",
      "epss_score": 0.00698,
      "id": "CVE-2026-49261"
    },
    {
      "cvss_score": 9.4,
      "description": "Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to",
      "epss_score": 0.00543,
      "id": "CVE-2026-49973"
    },
    {
      "cvss_score": 9.0,
      "description": "Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth",
      "epss_score": 0.00122,
      "id": "CVE-2026-41005"
    }
  ],
  "high_count": 416,
  "high_risk_cves": [
    {
      "cvss_score": 7.5,
      "description": "The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process m",
      "epss_score": 0.99999,
      "id": "CVE-2014-0160",
      "is_kev": true,
      "severity": "HIGH"
    },
    {
      "cvss_score": 9.8,
      "description": "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as",
      "epss_score": 0.99999,
      "id": "CVE-2014-6271",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.8,
      "description": "HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests",
      "epss_score": 0.99999,
      "id": "CVE-2015-1635",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.8,
      "description": "The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows re",
      "epss_score": 0.99999,
      "id": "CVE-2017-5638",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.8,
      "description": "Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \"<?php \" substring, as demonstrated by a",
      "epss_score": 0.99999,
      "id": "CVE-2017-9841",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 10.0,
      "description": "In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary ",
      "epss_score": 0.99999,
      "id": "CVE-2019-11510",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.8,
      "description": "A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially",
      "epss_score": 0.99999,
      "id": "CVE-2019-0708",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.1,
      "description": "An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to ",
      "epss_score": 0.99999,
      "id": "CVE-2018-13379",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.8,
      "description": "An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.",
      "epss_score": 0.99999,
      "id": "CVE-2019-19781",
      "is_kev": true,
      "severity": "CRITICAL"
    },
    {
      "cvss_score": 9.8,
      "description": "In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility,",
      "epss_score": 0.99999,
      "id": "CVE-2020-5902",
      "is_kev": true,
      "severity": "CRITICAL"
    }
  ],
  "kev_added": 5,
  "last_sync": "2026-06-18T15:30:38.169810",
  "low_count": 16,
  "medium_count": 322,
  "news_articles": 79,
  "news_sources": 3,
  "period_end": "2026-06-18",
  "period_start": "2026-06-11",
  "severity_breakdown": {
    "CRITICAL": 134,
    "HIGH": 416,
    "LOW": 16,
    "MEDIUM": 322,
    "Unknown": 188
  },
  "total_new_cves": 1076
}