Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,631 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
39,241 results · page 17 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-79577 | An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request. | CRITICAL 9.8EPSS 0.27% | 8 September 2026 |
| CVE-2026-79576 | An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password. | CRITICAL 9.8EPSS 0.33% | 8 September 2026 |
| CVE-2026-79571 | Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and… | CRITICAL 9.1EPSS 0.29% | 8 September 2026 |
| CVE-2026-61516 | Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface… | CRITICAL 9.3EPSS 0.38% | 8 September 2026 |
| CVE-2026-12745 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. | CRITICAL 9.8EPSS 2.09% | 8 September 2026 |
| CVE-2026-12744 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server. | CRITICAL 9.8EPSS 2.17% | 8 September 2026 |
| CVE-2026-73312 | XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. | CRITICAL 9.1EPSS 0.35% | 8 September 2026 |
| CVE-2026-73311 | XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. | CRITICAL 9.1EPSS 0.37% | 8 September 2026 |
| CVE-2026-73309 | XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. | CRITICAL 9.1EPSS 0.48% | 8 September 2026 |
| CVE-2026-77089 | Command Center API contained an authentication bypass issue affecting privilege management. | CRITICAL 9.3EPSS 0.33% | 8 September 2026 |
| CVE-2026-78234 | Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. | CRITICAL 9.9EPSS 0.21% | 8 September 2026 |
| CVE-2026-71377 | Command Argument Injection Vulnerability in Cosminexus Component Container. | CRITICAL 9.8EPSS 0.31% | 8 September 2026 |
| CVE-2026-71376 | OS command injection vulnerability in Cosminexus Component Container. | CRITICAL 9.8EPSS 0.98% | 8 September 2026 |
| CVE-2026-67367 | A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7… | CRITICAL 9.2EPSS 0.81% | 8 September 2026 |
| CVE-2026-62647 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). | CRITICAL 9.3EPSS 0.34% | 8 September 2026 |
| CVE-2026-62646 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). | CRITICAL 9.1EPSS 0.32% | 8 September 2026 |
| CVE-2026-62645 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). | CRITICAL 9.3EPSS 0.35% | 8 September 2026 |
| CVE-2026-71374 | Deserialization of untrusted data vulnerability in Cosminexus Component Container. | CRITICAL 9.8EPSS 0.31% | 8 September 2026 |
| CVE-2026-76969 | An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. | CRITICAL 9.4EPSS 0.29% | 8 September 2026 |
| CVE-2026-66768 | A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. | CRITICAL 9.0EPSS 0.32% | 8 September 2026 |
| CVE-2026-58240 | An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the… | CRITICAL 9.8EPSS 0.34% | 8 September 2026 |
| CVE-2026-44756 | A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. | CRITICAL 10.0EPSS 0.32% | 8 September 2026 |
| CVE-2026-86543 | Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address. | CRITICAL 9.3EPSS 0.44% | 7 September 2026 |
| CVE-2026-75650 | Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | KEVCRITICAL 10.0EPSS 2.15% | 7 September 2026 |
| CVE-2026-86480 | In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges | CRITICAL 9.8EPSS 0.29% | 7 September 2026 |
| CVE-2026-86478 | In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address | CRITICAL 9.8EPSS 0.36% | 7 September 2026 |
| CVE-2026-7861 | Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. | CRITICAL 9.8EPSS 0.32% | 7 September 2026 |
| CVE-2026-18922 | An attacker can send a SASL PLAIN bind as cn=Directory Manager with an incorrect password, then complete a SASL ANONYMOUS bind on the same connection, causing the server to grant Directory Manager authority without any valid credentials. | CRITICAL 9.8EPSS 0.56% | 7 September 2026 |
| CVE-2026-80164 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. | CRITICAL 9.1EPSS 0.15% | 7 September 2026 |
| CVE-2026-80131 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. | CRITICAL 9.8EPSS 0.49% | 7 September 2026 |
| CVE-2026-80129 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. | CRITICAL 9.8EPSS 0.43% | 7 September 2026 |
| CVE-2026-86426 | LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. | CRITICAL 9.2EPSS 2.12% | 7 September 2026 |
| CVE-2026-80238 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. | CRITICAL 9.3EPSS 0.14% | 7 September 2026 |
| CVE-2026-76578 | An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators… | CRITICAL 9.8EPSS 0.45% | 7 September 2026 |
| CVE-2026-6223 | Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. | CRITICAL 9.4EPSS 0.44% | 7 September 2026 |
| CVE-2026-61410 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. | CRITICAL 9.4EPSS 1.25% | 7 September 2026 |
| CVE-2026-86296 | A vulnerability was determined in D-Link DIR-822A A_101. | CRITICAL 9.3EPSS 1.35% | 7 September 2026 |
| CVE-2026-16876 | An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. | CRITICAL 9.3EPSS 0.33% | 7 September 2026 |
| CVE-2026-86304 | MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in MojoX::Authentication::Model::SAML2 calls… | CRITICAL 9.8EPSS 0.22% | 6 September 2026 |
| CVE-2026-86219 | An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password. | CRITICAL 9.8EPSS 0.49% | 6 September 2026 |
| CVE-2026-19931 | A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. | CRITICAL 9.8EPSS 1.16% | 6 September 2026 |
| CVE-2026-18924 | A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process. | CRITICAL 9.1EPSS 0.90% | 6 September 2026 |
| CVE-2026-86259 | OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. | CRITICAL 9.0EPSS 0.25% | 6 September 2026 |
| CVE-2026-86218 | N-able N-central Static Code Injection Vulnerability | KEVCRITICAL 10.0EPSS 7.49% | 6 September 2026 |
| CVE-2026-75816 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. | CRITICAL 9.8EPSS 0.50% | 6 September 2026 |
| CVE-2026-16310 | The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. | CRITICAL 9.8EPSS 0.30% | 6 September 2026 |
| CVE-2026-86153 | A vulnerability has been found in Tenda CP3 27.5.57.101. | CRITICAL 9.4EPSS 0.39% | 6 September 2026 |
| CVE-2026-86152 | Executing a manipulation can lead to os command injection. | CRITICAL 10.0EPSS 1.86% | 6 September 2026 |
| CVE-2026-86151 | A vulnerability was detected in Tenda CP3 27.5.57.101. | CRITICAL 9.4EPSS 2.04% | 6 September 2026 |
| CVE-2026-86149 | A weakness has been identified in Tenda CP3 27.5.57.101. | CRITICAL 9.4EPSS 2.04% | 5 September 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.