Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,487 CVEs1,766 in CISA KEV17,504 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
1,766 results · page 1 of 36
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-76418 | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | KEVHIGH 8.6EPSS 0.57% | 28 October 2026 |
| CVE-2026-114625 | Arista VeloCloud Orchestrator SQL Injection Vulnerability | KEVCRITICAL 9.4EPSS 1.03% | 22 October 2026 |
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | KEVCRITICAL 9.2EPSS 82.6% | 22 October 2026 |
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability | KEVCRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability | KEVEXPLOIT ✓CRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | KEVHIGH 7.0EPSS 0.25% | 15 October 2026 |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | KEVCRITICAL 9.3EPSS 18.9% | 15 October 2026 |
| CVE-2026-110936 | Siemens Software Center Uncontrolled Search Path Element Vulnerability | KEVHIGH 8.4EPSS 0.97% | 15 October 2026 |
| CVE-2026-0322 | Palo Alto Networks PAN-OS Code Injection Vulnerability | KEVHIGH 8.6EPSS 1.74% | 14 October 2026 |
| CVE-2026-76519 | Cisco Secure Email Gateway Relative Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 2.15% | 14 October 2026 |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | KEVHIGH 8.5EPSS 2.53% | 14 October 2026 |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | KEVCRITICAL 9.2EPSS 73.3% | 14 October 2026 |
| CVE-2026-96951 | Microsoft Windows Command Injection Vulnerability | KEVHIGH 8.8EPSS 9.81% | 13 October 2026 |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | KEVHIGH 8.6EPSS 86.8% | 13 October 2026 |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | KEVCRITICAL 10.0EPSS 18.4% | 13 October 2026 |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | KEVCRITICAL 9.3EPSS 99.5% | 5 October 2026 |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability | KEVCRITICAL 10.0EPSS 81.8% | 4 October 2026 |
| CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability | KEVMEDIUM 6.9EPSS 79.5% | 4 October 2026 |
| CVE-2026-88779 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | KEVHIGH 8.7EPSS 11.4% | 4 October 2026 |
| CVE-2026-104286 | Fortinet FortiMail Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 4.57% | 1 October 2026 |
| CVE-2026-102490 | Zammad GmbH Zammad Improper Privilege Management Vulnerability | KEVCRITICAL 9.4EPSS 10.9% | 30 September 2026 |
| CVE-2026-102489 | Zammad GmbH Zammad Session Fixation Vulnerability | KEVCRITICAL 9.4EPSS 22.5% | 30 September 2026 |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | KEVCRITICAL 9.8EPSS 38.9% | 30 September 2026 |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write Vulnerability | KEVHIGH 8.8EPSS 26.2% | 28 September 2026 |
| CVE-2026-88772 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | KEVCRITICAL 9.5EPSS 78.2% | 27 September 2026 |
| CVE-2026-88771 | Citrix NetScaler Improper Input Validation Vulnerability | KEVCRITICAL 9.5EPSS 82.2% | 27 September 2026 |
| CVE-2026-96656 | Plex Media Server External Control of File Name or Path Vulnerability | KEVHIGH 8.6EPSS 1.79% | 23 September 2026 |
| CVE-2026-96655 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | KEVMEDIUM 5.3EPSS 1.64% | 23 September 2026 |
| CVE-2026-96654 | Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability | KEVMEDIUM 6.9EPSS 1.95% | 23 September 2026 |
| CVE-2026-96652 | Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | KEVMEDIUM 5.3EPSS 1.82% | 23 September 2026 |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability | KEVEXPLOITHIGH 8.1EPSS 95.8% | 22 September 2026 |
| CVE-2026-94127 | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | KEVCRITICAL 9.3EPSS 24.9% | 22 September 2026 |
| CVE-2026-93616 | Check Point Multiple Products Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 91.6% | 22 September 2026 |
| CVE-2026-93952 | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | KEVCRITICAL 9.5EPSS 1.38% | 22 September 2026 |
| CVE-2026-87886 | Acronis Backup Incorrect Default Permissions Vulnerability | KEVHIGH 7.8EPSS 0.23% | 17 September 2026 |
| CVE-2026-76460 | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | KEVCRITICAL 10.0EPSS 75.6% | 16 September 2026 |
| CVE-2026-58704 | Google Pixel Improper Authorization Vulnerability | KEVHIGH 8.8EPSS 0.63% | 15 September 2026 |
| CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 29.5% | 14 September 2026 |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | KEVCRITICAL 10.0EPSS 97.4% | 12 September 2026 |
| CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation Vulnerability | KEVCRITICAL 9.8EPSS 54.1% | 9 September 2026 |
| CVE-2026-87491 | Google Chromium V8 Out of Bounds Write Vulnerability | KEVHIGH 8.8EPSS 3.51% | 9 September 2026 |
| CVE-2026-84869 | ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability | KEVCRITICAL 9.9EPSS 0.92% | 8 September 2026 |
| CVE-2026-85880 | Microsoft Windows Heap-Based Buffer Overflow Vulnerability | KEVHIGH 7.8EPSS 0.39% | 8 September 2026 |
| CVE-2026-81963 | Microsoft Windows Link Following Vulnerability | KEVHIGH 7.8EPSS 0.39% | 8 September 2026 |
| CVE-2026-75650 | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | KEVCRITICAL 10.0EPSS 3.95% | 7 September 2026 |
| CVE-2026-86218 | N-able N-central Static Code Injection Vulnerability | KEVCRITICAL 10.0EPSS 15.4% | 6 September 2026 |
| CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | KEVEXPLOITCRITICAL 9.2EPSS 6.39% | 5 September 2026 |
| CVE-2026-67279 | Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability | KEVMEDIUM 6.9EPSS 2.28% | 5 September 2026 |
| CVE-2026-67277 | MikroTik RouterOS Missing Authentication for Critical Function Vulnerability | KEVHIGH 8.8EPSS 1.56% | 5 September 2026 |
| CVE-2026-85046 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 1.81% | 3 September 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.