Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,487 CVEs1,766 in CISA KEV17,504 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
17,504 results · page 2 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-55040 | Microsoft SharePoint Weak Authentication Vulnerability | KEVCRITICAL 9.1EPSS 69.5% | 14 July 2026 |
| CVE-2026-58644 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 15.9% | 14 July 2026 |
| CVE-2026-61447 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. | EXPLOITCRITICAL 10.0EPSS 15.2% | 11 July 2026 |
| CVE-2026-56291 | Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 10.0EPSS 14.9% | 9 July 2026 |
| CVE-2026-43825 | Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm document categorization module; introduced in OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream)… | HIGH 7.3EPSS 13.9% | 6 July 2026 |
| CVE-2026-48282 | Adobe ColdFusion Path Traversal Vulnerability | KEVCRITICAL 10.0EPSS 42.4% | 30 June 2026 |
| CVE-2026-56290 | Joomlack Page Builder Improper Access Control Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 30.9% | 29 June 2026 |
| CVE-2026-48939 | iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 10.0EPSS 20.1% | 20 June 2026 |
| CVE-2026-48908 | JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 10.0EPSS 88.5% | 20 June 2026 |
| CVE-2026-12569 | PTC Windchill and FlexPLM Improper Input Validation Vulnerability | KEVCRITICAL 9.3EPSS 46.0% | 18 June 2026 |
| CVE-2026-50656 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". | HIGH 7.0EPSS 11.2% | 16 June 2026 |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | KEVMEDIUM 6.5EPSS 29.1% | 15 June 2026 |
| CVE-2026-48558 | SimpleHelp Authentication Bypass Vulnerability | KEVCRITICAL 9.5EPSS 77.7% | 12 June 2026 |
| CVE-2026-44492 | This vulnerability is fixed in 0.32.0 and 1.16.0. | HIGH 8.6EPSS 12.3% | 11 June 2026 |
| CVE-2026-35273 | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.8EPSS 96.7% | 11 June 2026 |
| CVE-2026-20253 | Splunk Enterprise Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.8EPSS 96.9% | 10 June 2026 |
| CVE-2026-20251 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a… | HIGH 8.8EPSS 32.2% | 10 June 2026 |
| CVE-2026-53435 | In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle… | HIGH 8.8EPSS 53.1% | 10 June 2026 |
| CVE-2026-50508 | Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | HIGH 7.5EPSS 12.1% | 9 June 2026 |
| CVE-2026-49160 | Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network. | HIGH 7.5EPSS 56.6% | 9 June 2026 |
| CVE-2026-47291 | Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 25.3% | 9 June 2026 |
| CVE-2026-45657 | Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 15.5% | 9 June 2026 |
| CVE-2026-45502 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. | MEDIUM 5.0EPSS 20.3% | 9 June 2026 |
| CVE-2026-45484 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | HIGH 8.8EPSS 35.2% | 9 June 2026 |
| CVE-2026-25089 | Fortinet FortiSandbox OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 76.1% | 9 June 2026 |
| CVE-2026-10727 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root | HIGH 7.2EPSS 13.6% | 9 June 2026 |
| CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access | CRITICAL 9.8EPSS 53.1% | 9 June 2026 |
| CVE-2026-10520 | Ivanti Sentry OS Command Injection Vulnerability | KEVCRITICAL 10.0EPSS 99.9% | 9 June 2026 |
| CVE-2026-49975 | Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. | HIGH 7.5EPSS 33.0% | 8 June 2026 |
| CVE-2026-46442 | Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. | CRITICAL 9.4EPSS 36.3% | 8 June 2026 |
| CVE-2026-50751 | Check Point Security Gateway Improper Authentication Vulnerability | KEVCRITICAL 9.3EPSS 85.3% | 8 June 2026 |
| CVE-2026-48907 | Widget Factory Joomla Content Editor Improper Access Control Vulnerability | KEVEXPLOIT ×2CRITICAL 10.0EPSS 85.4% | 5 June 2026 |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | KEVHIGH 7.8EPSS 25.3% | 4 June 2026 |
| CVE-2026-28318 | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | KEVHIGH 7.5EPSS 43.7% | 4 June 2026 |
| CVE-2026-8037 | Progress LoadMaster Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 99.8% | 4 June 2026 |
| CVE-2026-20230 | Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | KEVHIGH 8.6EPSS 88.2% | 3 June 2026 |
| CVE-2026-0826 | In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform. | CRITICAL 9.2EPSS 32.2% | 1 June 2026 |
| CVE-2026-49373 | In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings | HIGH 8.8EPSS 24.9% | 29 May 2026 |
| CVE-2026-8732 | The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. | CRITICAL 9.8EPSS 20.4% | 29 May 2026 |
| CVE-2026-46817 | Oracle E-Business Suite Improper Privilege Management Vulnerability | KEVCRITICAL 9.8EPSS 12.3% | 28 May 2026 |
| CVE-2026-48710 | Kludex Starlette HTTP Request/Response Smuggling Vulnerability | KEVMEDIUM 6.5EPSS 70.3% | 26 May 2026 |
| CVE-2026-40383 | An improper validation of user-supplied input leads to a local file inclusion vulnerability. | HIGH 7.5EPSS 12.5% | 26 May 2026 |
| CVE-2026-35223 | An improper access check allows unauthorized access to com_config webservice endpoints. | HIGH 8.6EPSS 12.8% | 26 May 2026 |
| CVE-2026-4480 | A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. | CRITICAL 9.0EPSS 13.9% | 26 May 2026 |
| CVE-2026-45247 | Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.3EPSS 26.2% | 26 May 2026 |
| CVE-2026-9534 | Executing a manipulation of the argument PIN can lead to os command injection. | LOW 2.1EPSS 10.4% | 26 May 2026 |
| CVE-2026-9533 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. | LOW 2.1EPSS 10.4% | 26 May 2026 |
| CVE-2026-9532 | A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. | LOW 2.1EPSS 10.4% | 26 May 2026 |
| CVE-2026-9531 | A weakness has been identified in Totolink CA750-PoE 6.2c.510. | LOW 2.1EPSS 10.4% | 26 May 2026 |
| CVE-2026-9515 | A vulnerability was detected in Totolink CA750-PoE 6.2c.510. | LOW 2.1EPSS 10.4% | 26 May 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.