Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,489 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
17,506 results · page 5 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-33309 | Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. | CRITICAL 9.9EPSS 13.5% | 24 March 2026 |
| CVE-2026-33634 | Aquasecurity Trivy Embedded Malicious Code Vulnerability | KEVCRITICAL 9.4EPSS 59.7% | 23 March 2026 |
| CVE-2026-3055 | Citrix NetScaler Out-of-Bounds Read Vulnerability | KEVCRITICAL 9.3EPSS 91.5% | 23 March 2026 |
| CVE-2026-33478 | In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. | CRITICAL 10.0EPSS 13.3% | 23 March 2026 |
| CVE-2026-33017 | Langflow Code Injection Vulnerability | KEVEXPLOITCRITICAL 9.3EPSS 96.2% | 20 March 2026 |
| CVE-2026-22557 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account. | CRITICAL 10.0EPSS 28.1% | 19 March 2026 |
| CVE-2025-71260 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. | HIGH 8.7EPSS 34.4% | 19 March 2026 |
| CVE-2025-71259 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. | MEDIUM 5.3EPSS 12.9% | 19 March 2026 |
| CVE-2025-71258 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. | MEDIUM 5.3EPSS 17.4% | 19 March 2026 |
| CVE-2025-71257 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. | MEDIUM 6.9EPSS 44.6% | 19 March 2026 |
| CVE-2026-32255 | An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. | HIGH 8.6EPSS 26.4% | 19 March 2026 |
| CVE-2026-4228 | A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. | LOW 2.1EPSS 12.7% | 16 March 2026 |
| CVE-2026-4197 | A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. | LOW 2.1EPSS 19.0% | 16 March 2026 |
| CVE-2026-3891 | The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. | EXPLOITCRITICAL 9.8EPSS 32.4% | 13 March 2026 |
| CVE-2026-32746 | telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full. | EXPLOITCRITICAL 9.8EPSS 44.8% | 13 March 2026 |
| CVE-2025-67038 | Lantronix EDS5000 Code Injection Vulnerability | KEVCRITICAL 9.3EPSS 20.3% | 11 March 2026 |
| CVE-2026-3943 | A vulnerability was found in H3C ACG1000-AK230 up to 20260227. | MEDIUM 5.5EPSS 40.7% | 11 March 2026 |
| CVE-2026-27825 | An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary content to any path the server process has write access to. | HIGH 8.0EPSS 11.5% | 10 March 2026 |
| CVE-2026-27826 | Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an… | HIGH 8.2EPSS 13.0% | 10 March 2026 |
| CVE-2026-3854 | An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. | HIGH 8.7EPSS 39.8% | 10 March 2026 |
| CVE-2026-31816 | In 3.31.4 and earlier, the Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. | CRITICAL 9.1EPSS 15.7% | 9 March 2026 |
| CVE-2026-3798 | A vulnerability was detected in Comfast CF-AC100 2.6.0.8. | LOW 2.0EPSS 16.0% | 9 March 2026 |
| CVE-2026-3662 | A vulnerability has been found in Wavlink WL-NU516U1 240425. | LOW 2.0EPSS 18.6% | 7 March 2026 |
| CVE-2026-3661 | This manipulation of the argument model causes command injection. | LOW 2.0EPSS 18.1% | 7 March 2026 |
| CVE-2026-30824 | Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints. | HIGH 7.7EPSS 36.9% | 7 March 2026 |
| CVE-2026-30822 | Prior to version 3.0.13, unauthenticated users can inject arbitrary values into internal database fields when creating leads. | HIGH 7.7EPSS 13.4% | 7 March 2026 |
| CVE-2026-30821 | Prior to version 3.0.13, the /api/v1/attachments/:chatflowId/:chatId endpoint is listed in WHITELIST_URLS, allowing unauthenticated access to the file upload API. | HIGH 8.2EPSS 15.2% | 7 March 2026 |
| CVE-2026-3612 | A vulnerability was determined in Wavlink WL-NU516U1 V240425. | HIGH 7.3EPSS 13.2% | 6 March 2026 |
| CVE-2026-27944 | Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. | CRITICAL 9.8EPSS 22.9% | 5 March 2026 |
| CVE-2026-20131 | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 10.0EPSS 44.4% | 4 March 2026 |
| CVE-2026-20079 | Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 10.0EPSS 88.7% | 4 March 2026 |
| CVE-2026-27446 | Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. | CRITICAL 9.3EPSS 11.4% | 4 March 2026 |
| CVE-2026-28289 | A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width… | HIGH 8.1EPSS 35.1% | 3 March 2026 |
| CVE-2026-1492 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to improper privilege management in all versions up to, and including,… | CRITICAL 9.8EPSS 28.9% | 3 March 2026 |
| CVE-2026-28208 | Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. | MEDIUM 5.9EPSS 14.7% | 26 February 2026 |
| CVE-2026-27966 | Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_ast`). | CRITICAL 9.8EPSS 35.2% | 26 February 2026 |
| CVE-2026-27577 | An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. | CRITICAL 9.4EPSS 10.7% | 25 February 2026 |
| CVE-2026-22719 | Broadcom VMware Aria Operations Command Injection Vulnerability | KEVHIGH 8.1EPSS 18.3% | 25 February 2026 |
| CVE-2026-21902 | An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. | CRITICAL 9.3EPSS 18.5% | 25 February 2026 |
| CVE-2026-20133 | Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | KEVHIGH 7.5EPSS 31.5% | 25 February 2026 |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability | KEVCRITICAL 10.0EPSS 89.3% | 25 February 2026 |
| CVE-2026-20122 | Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability | KEVMEDIUM 5.4EPSS 25.8% | 25 February 2026 |
| CVE-2026-27483 | Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote command execution. | EXPLOITHIGH 8.8EPSS 11.0% | 24 February 2026 |
| CVE-2026-3066 | This vulnerability affects the function fixedCommand of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/PlatformUtils.java of the component Cloud Compliance Scanning. | LOW 2.1EPSS 13.4% | 24 February 2026 |
| CVE-2026-3065 | A vulnerability was detected in HummerRisk up to 1.5.0. | LOW 2.1EPSS 33.1% | 24 February 2026 |
| CVE-2026-3064 | A security vulnerability has been detected in HummerRisk up to 1.5.0. | LOW 2.1EPSS 21.9% | 24 February 2026 |
| CVE-2026-3040 | A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. | LOW 2.0EPSS 10.1% | 23 February 2026 |
| CVE-2026-26046 | A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. | HIGH 7.2EPSS 13.8% | 21 February 2026 |
| CVE-2026-2043 | Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. | HIGH 8.8EPSS 75.4% | 20 February 2026 |
| CVE-2026-2041 | Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. | HIGH 8.8EPSS 75.6% | 20 February 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.