Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,489 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
17,506 results · page 4 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-31431 | Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability | KEVHIGH 7.8EPSS 98.1% | 22 April 2026 |
| CVE-2026-40933 | Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. | CRITICAL 9.9EPSS 12.0% | 21 April 2026 |
| CVE-2026-40372 | Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | CRITICAL 9.1EPSS 11.2% | 21 April 2026 |
| CVE-2026-33626 | Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. | HIGH 7.5EPSS 45.3% | 20 April 2026 |
| CVE-2026-3518 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “All” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the… | HIGH 7.2EPSS 16.9% | 20 April 2026 |
| CVE-2026-3517 | OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in… | HIGH 7.2EPSS 15.5% | 20 April 2026 |
| CVE-2026-6483 | A vulnerability was found in Wavlink WL-WN530H4 20220721. | HIGH 7.3EPSS 13.4% | 17 April 2026 |
| CVE-2026-20147 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. | CRITICAL 9.9EPSS 10.4% | 15 April 2026 |
| CVE-2026-27305 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. | HIGH 8.6EPSS 26.3% | 14 April 2026 |
| CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | KEVCRITICAL 9.8EPSS 77.1% | 14 April 2026 |
| CVE-2026-32202 | Microsoft Windows Protection Mechanism Failure Vulnerability | KEVEXPLOITMEDIUM 4.3EPSS 70.9% | 14 April 2026 |
| CVE-2026-32201 | Microsoft SharePoint Server Improper Input Validation Vulnerability | KEVMEDIUM 6.5EPSS 43.4% | 14 April 2026 |
| CVE-2026-20945 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | MEDIUM 5.4EPSS 19.1% | 14 April 2026 |
| CVE-2026-39813 | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests. | CRITICAL 9.8EPSS 22.2% | 14 April 2026 |
| CVE-2026-39808 | Fortinet FortiSandbox OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 93.2% | 14 April 2026 |
| CVE-2026-6195 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. | HIGH 8.9EPSS 13.5% | 13 April 2026 |
| CVE-2026-40217 | LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. | HIGH 8.8EPSS 15.5% | 10 April 2026 |
| CVE-2026-34486 | Apache Tomcat Missing Encryption of Sensitive Data Vulnerability | KEVHIGH 7.5EPSS 98.5% | 9 April 2026 |
| CVE-2026-39987 | Marimo Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.3EPSS 99.6% | 9 April 2026 |
| CVE-2026-5854 | A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. | HIGH 8.9EPSS 16.6% | 9 April 2026 |
| CVE-2026-5853 | A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. | HIGH 8.9EPSS 13.5% | 9 April 2026 |
| CVE-2026-5852 | A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. | HIGH 8.9EPSS 13.5% | 9 April 2026 |
| CVE-2026-5851 | The manipulation of the argument enable results in os command injection. | HIGH 8.9EPSS 13.4% | 9 April 2026 |
| CVE-2026-5850 | A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. | HIGH 8.9EPSS 15.1% | 9 April 2026 |
| CVE-2026-4631 | Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. | EXPLOITCRITICAL 9.8EPSS 15.5% | 7 April 2026 |
| CVE-2026-23696 | Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. | CRITICAL 9.4EPSS 13.6% | 7 April 2026 |
| CVE-2026-22679 | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking… | CRITICAL 9.3EPSS 20.4% | 7 April 2026 |
| CVE-2026-22666 | Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. | HIGH 8.6EPSS 15.5% | 7 April 2026 |
| CVE-2026-34197 | Apache ActiveMQ Improper Input Validation Vulnerability | KEVHIGH 8.8EPSS 98.3% | 7 April 2026 |
| CVE-2026-0740 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. | EXPLOITCRITICAL 9.8EPSS 62.9% | 7 April 2026 |
| CVE-2026-35029 | A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code… | HIGH 8.7EPSS 38.6% | 6 April 2026 |
| CVE-2026-26026 | From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. | HIGH 7.2EPSS 11.5% | 6 April 2026 |
| CVE-2026-35616 | Fortinet FortiClient EMS Improper Access Control Vulnerability | KEVCRITICAL 9.8EPSS 94.0% | 4 April 2026 |
| CVE-2026-34938 | Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving… | CRITICAL 10.0EPSS 13.2% | 3 April 2026 |
| CVE-2026-35216 | Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. | CRITICAL 9.0EPSS 10.7% | 3 April 2026 |
| CVE-2026-2701 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution. | HIGH 8.8EPSS 54.5% | 2 April 2026 |
| CVE-2026-2699 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. | CRITICAL 9.8EPSS 58.4% | 2 April 2026 |
| CVE-2026-29014 | MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. | CRITICAL 9.3EPSS 39.5% | 1 April 2026 |
| CVE-2026-5281 | Google Dawn Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 13.7% | 1 April 2026 |
| CVE-2026-34156 | Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). | EXPLOITCRITICAL 9.9EPSS 35.0% | 31 March 2026 |
| CVE-2026-4020 | The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. | HIGH 7.5EPSS 73.8% | 31 March 2026 |
| CVE-2026-3300 | The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. | CRITICAL 9.8EPSS 39.2% | 31 March 2026 |
| CVE-2026-4257 | The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. | EXPLOITCRITICAL 9.8EPSS 41.5% | 30 March 2026 |
| CVE-2026-21710 | This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all… | HIGH 7.5EPSS 25.4% | 30 March 2026 |
| CVE-2026-33032 | In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. | CRITICAL 9.8EPSS 35.3% | 30 March 2026 |
| CVE-2026-5027 | The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../'). | EXPLOITHIGH 8.8EPSS 40.0% | 27 March 2026 |
| CVE-2026-4840 | Performing a manipulation of the argument IpAddr results in os command injection. | HIGH 7.4EPSS 10.7% | 26 March 2026 |
| CVE-2026-33340 | A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. | CRITICAL 9.1EPSS 21.6% | 24 March 2026 |
| CVE-2026-27654 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or… | HIGH 8.8EPSS 25.9% | 24 March 2026 |
| CVE-2026-33497 | Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. | HIGH 8.7EPSS 19.6% | 24 March 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.