Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,466 CVEs1,766 in CISA KEV17,504 with EPSS ≥ 10%25,055 with a public exploitUpdated 30 October 2026
Known exploited — most recently added
All KEV entries →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | KEVHIGH 7.0EPSS 0.25% | 15 October 2026 |
| CVE-2026-118527 | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | KEVUnscoredEPSS — | |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | KEVCRITICAL 10.0EPSS 18.4% | 13 October 2026 |
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | KEVHIGH 8.6EPSS 0.57% | 28 October 2026 |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability | KEVLOW 2.7EPSS 0.76% | 30 July 2026 |
| CVE-2026-46300 | Linux Kernel Missing Initialization of a Variable Vulnerability | KEVEXPLOITHIGH 7.8EPSS 15.7% | 23 May 2026 |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | KEVCRITICAL 9.2EPSS 82.6% | 22 October 2026 |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 9.3EPSS 44.6% | 14 July 2026 |
Newest public exploits
All with a public exploit →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-109618 | PHP Memory Corruption Vulnerability | KEVEXPLOIT ✓CRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2026-18963 | The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. | EXPLOITCRITICAL 9.1EPSS 4.68% | 18 August 2026 |
| CVE-2024-26503 | Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint. | EXPLOITCRITICAL 9.1EPSS 2.96% | 14 March 2024 |
| CVE-2026-100885 | A vulnerability was found in Krayin laravel-crm up to 2.2.4. | EXPLOITMEDIUM 5.5EPSS 1.42% | 27 September 2026 |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability | KEVEXPLOITHIGH 8.1EPSS 95.8% | 22 September 2026 |
| CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | KEVEXPLOITCRITICAL 9.2EPSS 6.39% | 5 September 2026 |
| CVE-2026-80428 | ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and… | EXPLOITCRITICAL 9.3EPSS 4.67% | 26 August 2026 |
| CVE-2025-57819 | Sangoma FreePBX Authentication Bypass Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 95.2% | 28 August 2025 |
Most likely to be exploited this month
All with EPSS ≥ 10% →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability | KEVCRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability | KEVEXPLOIT ✓CRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2025-53770 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 20 July 2025 |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 13 August 2024 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 100.0% | 12 April 2024 |
| CVE-2024-23897 | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 24 January 2024 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | KEVHIGH 8.2EPSS 100.0% | 31 January 2024 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | KEVCRITICAL 9.1EPSS 100.0% | 12 January 2024 |
Newest CVEs
Browse everything →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-63224 | OpenRemote is an open-source internet-of-things platform. | HIGH 7.2EPSS — | 30 October 2026 |
| CVE-2026-63201 | In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. | HIGH 7.1EPSS — | 30 October 2026 |
| CVE-2026-63184 | Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. | HIGH 7.1EPSS — | 30 October 2026 |
| CVE-2026-63182 | LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. | HIGH 8.1EPSS — | 30 October 2026 |
| CVE-2026-63121 | For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. | MEDIUM 6.3EPSS — | 30 October 2026 |
| CVE-2026-63115 | From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. | MEDIUM 5.3EPSS — | 30 October 2026 |
| CVE-2026-62347 | Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. | MEDIUM 5.9EPSS — | 30 October 2026 |
| CVE-2026-62277 | Returned information includes descriptions, costs, notes, mileage, extra fields and file attachment metadata, allowing cross-user disclosure of vehicle maintenance records. | MEDIUM 6.5EPSS — | 30 October 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.