Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,489 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
1,766 results · page 4 of 36
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-39808 | Fortinet FortiSandbox OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 93.2% | 14 April 2026 |
| CVE-2025-61624 | Fortinet Multiple Products Path Traversal Vulnerability | KEVMEDIUM 6.5EPSS 1.34% | 14 April 2026 |
| CVE-2026-34621 | Adobe Acrobat and Reader Prototype Pollution Vulnerability | KEVHIGH 8.6EPSS 7.23% | 11 April 2026 |
| CVE-2026-34486 | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | KEVHIGH 7.5EPSS 98.5% | 9 April 2026 |
| CVE-2026-39987 | Marimo Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.3EPSS 99.6% | 9 April 2026 |
| CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability | KEVHIGH 8.8EPSS 98.3% | 7 April 2026 |
| CVE-2026-35616 | Fortinet FortiClient EMS Improper Access Control Vulnerability | KEVCRITICAL 9.8EPSS 94.0% | 4 April 2026 |
| CVE-2026-5281 | Google Dawn Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 13.7% | 1 April 2026 |
| CVE-2026-3502 | TrueConf Client Download of Code Without Integrity Check Vulnerability | KEVHIGH 7.8EPSS 5.85% | 30 March 2026 |
| CVE-2026-33634 | Aquasecurity Trivy Embedded Malicious Code Vulnerability | KEVCRITICAL 9.4EPSS 59.7% | 23 March 2026 |
| CVE-2026-3055 | Citrix NetScaler Out-of-Bounds Read Vulnerability | KEVCRITICAL 9.3EPSS 91.5% | 23 March 2026 |
| CVE-2026-33017 | Langflow Code Injection Vulnerability | KEVEXPLOITCRITICAL 9.3EPSS 96.2% | 20 March 2026 |
| CVE-2026-3910 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | KEVHIGH 8.8EPSS 2.69% | 13 March 2026 |
| CVE-2026-3909 | Google Skia Out-of-Bounds Write Vulnerability | KEVHIGH 8.8EPSS 2.34% | 13 March 2026 |
| CVE-2025-67038 | Lantronix EDS5000 Code Injection Vulnerability | KEVCRITICAL 9.3EPSS 20.3% | 11 March 2026 |
| CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 10.0EPSS 44.4% | 4 March 2026 |
| CVE-2026-20079 | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 10.0EPSS 88.7% | 4 March 2026 |
| CVE-2026-21385 | Qualcomm Multiple Chipsets Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 1.32% | 2 March 2026 |
| CVE-2026-22719 | Broadcom VMware Aria Operations Command Injection Vulnerability | KEVHIGH 8.1EPSS 18.3% | 25 February 2026 |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | KEVHIGH 7.5EPSS 31.5% | 25 February 2026 |
| CVE-2026-20128 | Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability | KEVHIGH 7.5EPSS 7.32% | 25 February 2026 |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | KEVCRITICAL 10.0EPSS 89.3% | 25 February 2026 |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | KEVMEDIUM 5.4EPSS 25.8% | 25 February 2026 |
| CVE-2026-22769 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability | KEVCRITICAL 10.0EPSS 13.5% | 17 February 2026 |
| CVE-2026-2441 | Google Chromium CSS Use-After-Free Vulnerability | KEVEXPLOITHIGH 8.8EPSS 55.0% | 13 February 2026 |
| CVE-2026-25108 | Soliton Systems K.K FileZen OS Command Injection Vulnerability | KEVHIGH 8.7EPSS 5.25% | 13 February 2026 |
| CVE-2026-20700 | Apple Multiple Buffer Overflow Vulnerability | KEVHIGH 7.8EPSS 1.68% | 11 February 2026 |
| CVE-2026-21533 | Microsoft Windows Improper Privilege Management Vulnerability | KEVHIGH 7.8EPSS 4.18% | 10 February 2026 |
| CVE-2026-21525 | Microsoft Windows NULL Pointer Dereference Vulnerability | KEVMEDIUM 6.2EPSS 4.87% | 10 February 2026 |
| CVE-2026-21519 | Microsoft Windows Type Confusion Vulnerability | KEVHIGH 7.8EPSS 2.48% | 10 February 2026 |
| CVE-2026-21514 | Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | KEVHIGH 7.8EPSS 1.59% | 10 February 2026 |
| CVE-2026-21513 | Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | KEVHIGH 8.8EPSS 15.9% | 10 February 2026 |
| CVE-2026-21510 | Microsoft Windows Shell Protection Mechanism Failure Vulnerability | KEVHIGH 8.8EPSS 61.2% | 10 February 2026 |
| CVE-2026-1603 | Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability | KEVHIGH 7.5EPSS 88.3% | 10 February 2026 |
| CVE-2025-68686 | Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | KEVMEDIUM 5.9EPSS 29.5% | 10 February 2026 |
| CVE-2026-1731 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability | KEVCRITICAL 9.9EPSS 93.1% | 6 February 2026 |
| CVE-2026-21643 | Fortinet FortiClient EMS SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 97.7% | 6 February 2026 |
| CVE-2025-15556 | Notepad++ Download of Code Without Integrity Check Vulnerability | KEVHIGH 7.7EPSS 1.75% | 3 February 2026 |
| CVE-2026-1340 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.6% | 29 January 2026 |
| CVE-2026-1281 | Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.7% | 29 January 2026 |
| CVE-2025-40551 | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 84.2% | 28 January 2026 |
| CVE-2025-40536 | SolarWinds Web Help Desk Security Control Bypass Vulnerability | KEVCRITICAL 9.8EPSS 73.6% | 28 January 2026 |
| CVE-2026-24858 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 9.8EPSS 86.6% | 27 January 2026 |
| CVE-2026-21509 | Microsoft Office Security Feature Bypass Vulnerability | KEVHIGH 7.8EPSS 70.8% | 26 January 2026 |
| CVE-2026-24423 | SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.3EPSS 88.2% | 23 January 2026 |
| CVE-2026-0770 | Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 62.6% | 23 January 2026 |
| CVE-2026-23760 | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 9.3EPSS 96.4% | 22 January 2026 |
| CVE-2026-20045 | Cisco Unified Communications Products Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 4.54% | 21 January 2026 |
| CVE-2026-24061 | GNU InetUtils Argument Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.0% | 21 January 2026 |
| CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | KEVCRITICAL 10.0EPSS 73.2% | 20 January 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.