Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,487 CVEs1,766 in CISA KEV17,504 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
17,504 results · page 1 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-111497 | Google Brotli Unchecked Return Value Vulnerability | KEVCRITICAL 9.2EPSS 82.6% | 22 October 2026 |
| CVE-2026-109619 | PHP Stale Internal Request-State Vulnerability | KEVCRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2026-109618 | PHP Memory Corruption Vulnerability | KEVEXPLOIT ✓CRITICAL 9.2EPSS 100.0% | 21 October 2026 |
| CVE-2026-102764 | BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability | KEVCRITICAL 9.3EPSS 18.9% | 15 October 2026 |
| CVE-2026-111214 | Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. | HIGH 8.6EPSS 10.8% | 15 October 2026 |
| CVE-2026-59774 | An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. | CRITICAL 9.8EPSS 28.3% | 14 October 2026 |
| CVE-2026-110447 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | KEVCRITICAL 9.2EPSS 73.3% | 14 October 2026 |
| CVE-2026-104935 | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | KEVHIGH 8.6EPSS 86.8% | 13 October 2026 |
| CVE-2026-97229 | GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | KEVCRITICAL 10.0EPSS 18.4% | 13 October 2026 |
| CVE-2026-93674 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | CRITICAL 9.8EPSS 15.3% | 7 October 2026 |
| CVE-2026-21589 | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | KEVCRITICAL 9.3EPSS 99.5% | 5 October 2026 |
| CVE-2026-105134 | Ahsay AhsayCBS Command Injection Vulnerability | KEVCRITICAL 10.0EPSS 81.8% | 4 October 2026 |
| CVE-2026-105133 | Ahsay AhsayCBS Improper Authentication Vulnerability | KEVMEDIUM 6.9EPSS 79.5% | 4 October 2026 |
| CVE-2026-88779 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | KEVHIGH 8.7EPSS 11.4% | 4 October 2026 |
| CVE-2026-90970 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated… | CRITICAL 9.9EPSS 17.5% | 2 October 2026 |
| CVE-2026-102490 | Zammad GmbH Zammad Improper Privilege Management Vulnerability | KEVCRITICAL 9.4EPSS 10.9% | 30 September 2026 |
| CVE-2026-102489 | Zammad GmbH Zammad Session Fixation Vulnerability | KEVCRITICAL 9.4EPSS 22.5% | 30 September 2026 |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability | KEVCRITICAL 9.8EPSS 38.9% | 30 September 2026 |
| CVE-2026-86950 | Apple Multiple Products Out-of-Bounds Write Vulnerability | KEVHIGH 8.8EPSS 26.2% | 28 September 2026 |
| CVE-2026-88772 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | KEVCRITICAL 9.5EPSS 78.2% | 27 September 2026 |
| CVE-2026-88771 | Citrix NetScaler Improper Input Validation Vulnerability | KEVCRITICAL 9.5EPSS 82.2% | 27 September 2026 |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability | KEVEXPLOITHIGH 8.1EPSS 95.8% | 22 September 2026 |
| CVE-2026-94127 | F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability | KEVCRITICAL 9.3EPSS 24.9% | 22 September 2026 |
| CVE-2026-93616 | Check Point Multiple Products Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 91.6% | 22 September 2026 |
| CVE-2026-76460 | Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability | KEVCRITICAL 10.0EPSS 75.6% | 16 September 2026 |
| CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 29.5% | 14 September 2026 |
| CVE-2026-85706 | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | KEVCRITICAL 10.0EPSS 97.4% | 12 September 2026 |
| CVE-2026-17176 | An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. | HIGH 7.7EPSS 15.0% | 11 September 2026 |
| CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation Vulnerability | KEVCRITICAL 9.8EPSS 54.1% | 9 September 2026 |
| CVE-2026-86218 | N-able N-central Static Code Injection Vulnerability | KEVCRITICAL 10.0EPSS 15.4% | 6 September 2026 |
| CVE-2026-82329 | JFrog Artifactory Improper Authentication Vulnerability | KEVCRITICAL 9.8EPSS 14.4% | 28 August 2026 |
| CVE-2026-82078 | PaperCut NG/MF Unsafe Reflection Vulnerability | KEVCRITICAL 9.4EPSS 60.9% | 28 August 2026 |
| CVE-2026-81578 | PaperCut NG/MF Missing Authentication for Critical Function Vulnerability | KEVHIGH 8.8EPSS 83.7% | 28 August 2026 |
| CVE-2026-60004 | Gitea Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 24.0% | 26 August 2026 |
| CVE-2026-19490 | Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 9.3EPSS 32.7% | 19 August 2026 |
| CVE-2026-64849 | MLflow Server-Side Request Forgery Vulnerability | KEVCRITICAL 9.3EPSS 10.0% | 17 August 2026 |
| CVE-2026-73570 | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | KEVHIGH 8.9EPSS 71.7% | 13 August 2026 |
| CVE-2026-71362 | Adobe Commerce and Magento Incorrect Authorization Vulnerability | KEVCRITICAL 9.1EPSS 90.5% | 11 August 2026 |
| CVE-2026-72898 | Metabase SQL Injection Vulnerability | KEVCRITICAL 10.0EPSS 98.6% | 10 August 2026 |
| CVE-2026-15733 | A Remote Code Execution (RCE) vulnerability exist in WGDashboard version 4.2.3 and earlier. | CRITICAL 9.8EPSS 10.0% | 6 August 2026 |
| CVE-2026-5430 | WSO2 Multiple Products Path Traversal Vulnerability | KEVCRITICAL 10.0EPSS 22.4% | 6 August 2026 |
| CVE-2026-18577 | N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVHIGH 8.2EPSS 14.6% | 2 August 2026 |
| CVE-2026-66066 | In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. | CRITICAL 9.5EPSS 30.1% | 30 July 2026 |
| CVE-2026-20316 | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability | KEVMEDIUM 5.3EPSS 35.1% | 29 July 2026 |
| CVE-2026-63077 | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 93.6% | 27 July 2026 |
| CVE-2026-63030 | WordPress Core Interpretation Conflict Vulnerability | KEVCRITICAL 9.8EPSS 10.6% | 17 July 2026 |
| CVE-2026-9198 | IBM Langflow Code Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 28.7% | 17 July 2026 |
| CVE-2026-9586 | Sangoma Switchvox SQL Injection Vulnerability | KEVCRITICAL 9.3EPSS 19.0% | 17 July 2026 |
| CVE-2026-48356 | Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 9.3EPSS 44.6% | 14 July 2026 |
| CVE-2026-15410 | SonicWall SMA1000 Appliances Code Injection Vulnerability | KEVHIGH 7.2EPSS 11.8% | 14 July 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.