Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,487 CVEs1,766 in CISA KEV17,504 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
1,766 results · page 2 of 36
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-83549 | SonicWall SMA1000 Appliances OS Command Injection Vulnerability | KEVHIGH 7.8EPSS 9.89% | 1 September 2026 |
| CVE-2026-83548 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | KEVCRITICAL 10.0EPSS 8.04% | 1 September 2026 |
| CVE-2026-82329 | JFrog Artifactory Improper Authentication Vulnerability | KEVCRITICAL 9.8EPSS 14.4% | 28 August 2026 |
| CVE-2026-82078 | PaperCut NG/MF Unsafe Reflection Vulnerability | KEVCRITICAL 9.4EPSS 60.9% | 28 August 2026 |
| CVE-2026-81578 | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | KEVHIGH 8.8EPSS 83.7% | 28 August 2026 |
| CVE-2026-60004 | Gitea Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 24.0% | 26 August 2026 |
| CVE-2026-72530 | TrueConf Server Code Injection Vulnerability | KEVCRITICAL 9.5EPSS 1.69% | 19 August 2026 |
| CVE-2026-72529 | TrueConf Server Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.3EPSS 1.46% | 19 August 2026 |
| CVE-2026-19490 | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 9.3EPSS 32.7% | 19 August 2026 |
| CVE-2026-64849 | MLflow Server-Side Request Forgery Vulnerability | KEVCRITICAL 9.3EPSS 10.0% | 17 August 2026 |
| CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | KEVHIGH 8.9EPSS 71.7% | 13 August 2026 |
| CVE-2026-42018 | JFrog Artifactory Improper Authentication Vulnerability | KEVHIGH 7.5EPSS 9.80% | 12 August 2026 |
| CVE-2026-66384 | JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability | KEVMEDIUM 5.3EPSS 0.66% | 12 August 2026 |
| CVE-2026-71362 | Adobe Commerce and Magento Incorrect Authorization Vulnerability | KEVCRITICAL 9.1EPSS 90.5% | 11 August 2026 |
| CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | KEVHIGH 7.0EPSS 0.33% | 11 August 2026 |
| CVE-2026-65660 | Microsoft SharePoint Code Injection Vulnerability | KEVHIGH 8.8EPSS 8.19% | 11 August 2026 |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability | KEVHIGH 8.6EPSS 1.01% | 11 August 2026 |
| CVE-2026-72898 | Metabase SQL Injection Vulnerability | KEVCRITICAL 10.0EPSS 98.6% | 10 August 2026 |
| CVE-2026-65400 | Apple macOS Improper Authentication Vulnerability | KEVCRITICAL 9.8EPSS 1.72% | 6 August 2026 |
| CVE-2026-5430 | WSO2 Multiple Products Path Traversal Vulnerability | KEVCRITICAL 10.0EPSS 22.4% | 6 August 2026 |
| CVE-2026-18577 | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVHIGH 8.2EPSS 14.6% | 2 August 2026 |
| CVE-2026-18556 | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVHIGH 8.2EPSS 7.88% | 1 August 2026 |
| CVE-2026-41709 | Broadcom VMWare ESX Insufficient Logging Vulnerability | KEVLOW 2.7EPSS 0.76% | 30 July 2026 |
| CVE-2026-59310 | Broadcom VMware vCenter Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 2.56% | 30 July 2026 |
| CVE-2026-20316 | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | KEVMEDIUM 5.3EPSS 35.1% | 29 July 2026 |
| CVE-2026-42016 | JFrog Artifactory Incorrect Authorization Vulnerability | KEVHIGH 8.8EPSS 8.64% | 27 July 2026 |
| CVE-2026-63077 | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 93.6% | 27 July 2026 |
| CVE-2026-16812 | Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | KEVCRITICAL 10.0EPSS 1.76% | 27 July 2026 |
| CVE-2026-16232 | Check Point SmartConsole Improper Authentication Vulnerability | KEVCRITICAL 9.3EPSS 3.52% | 22 July 2026 |
| CVE-2026-63030 | WordPress Core Interpretation Conflict Vulnerability | KEVCRITICAL 9.8EPSS 10.6% | 17 July 2026 |
| CVE-2026-60137 | WordPress Core SQL Injection Vulnerability | KEVMEDIUM 5.9EPSS 5.32% | 17 July 2026 |
| CVE-2026-9198 | IBM Langflow Code Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 28.7% | 17 July 2026 |
| CVE-2026-9586 | Sangoma Switchvox SQL Injection Vulnerability | KEVCRITICAL 9.3EPSS 19.0% | 17 July 2026 |
| CVE-2021-27137 | DD-WRT Stack-Based Buffer Overflow Vulnerability | KEVHIGH 8.1EPSS 4.00% | 16 July 2026 |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 9.3EPSS 44.6% | 14 July 2026 |
| CVE-2026-15410 | SonicWall SMA1000 Appliances Code Injection Vulnerability | KEVHIGH 7.2EPSS 11.8% | 14 July 2026 |
| CVE-2026-15409 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | KEVCRITICAL 10.0EPSS 6.79% | 14 July 2026 |
| CVE-2026-55040 | Microsoft SharePoint Weak Authentication Vulnerability | KEVCRITICAL 9.1EPSS 69.5% | 14 July 2026 |
| CVE-2026-58644 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 15.9% | 14 July 2026 |
| CVE-2026-56164 | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.8EPSS 1.01% | 14 July 2026 |
| CVE-2026-56155 | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | KEVHIGH 7.8EPSS 0.35% | 14 July 2026 |
| CVE-2026-50522 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 3.04% | 14 July 2026 |
| CVE-2026-56291 | Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 10.0EPSS 14.9% | 9 July 2026 |
| CVE-2026-59822 | BerriAI LiteLLM Improper Authentication Vulnerability | KEVHIGH 8.8EPSS 0.84% | 8 July 2026 |
| CVE-2026-53362 | Linux Kernel Unspecified Vulnerability | KEVHIGH 7.8EPSS 0.71% | 4 July 2026 |
| CVE-2026-48282 | Adobe ColdFusion Path Traversal Vulnerability | KEVCRITICAL 10.0EPSS 42.4% | 30 June 2026 |
| CVE-2026-8452 | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | KEVHIGH 8.8EPSS 1.01% | 30 June 2026 |
| CVE-2026-56290 | Joomlack Page Builder Improper Access Control Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 30.9% | 29 June 2026 |
| CVE-2026-49869 | Kestra OSS OS Command Injection Vulnerability | KEVCRITICAL 10.0EPSS 2.10% | 26 June 2026 |
| CVE-2026-53266 | Linux Kernel Out-of-Bounds Write Vulnerability | KEVHIGH 8.8EPSS 0.93% | 25 June 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.