Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,069 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
41,381 results · page 2 of 828
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-63471 | An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. | CRITICAL 9.3EPSS — | 3 November 2026 |
| CVE-2026-63470 | An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. | CRITICAL 9.3EPSS — | 3 November 2026 |
| CVE-2026-63469 | A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. | CRITICAL 9.3EPSS — | 3 November 2026 |
| CVE-2026-112917 | In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. | CRITICAL 9.2EPSS — | 3 November 2026 |
| CVE-2026-44267 | The resulting generated JavaScript executes attacker-selected code in the host runtime. | CRITICAL 9.8EPSS — | 3 November 2026 |
| CVE-2026-44266 | Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become… | CRITICAL 9.8EPSS — | 3 November 2026 |
| CVE-2026-38600 | A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive. | CRITICAL 9.8EPSS — | 3 November 2026 |
| CVE-2026-28336 | SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. | CRITICAL 9.9EPSS — | 3 November 2026 |
| CVE-2026-109593 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. | CRITICAL 9.1EPSS — | 3 November 2026 |
| CVE-2026-121392 | FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. | CRITICAL 9.1EPSS — | 3 November 2026 |
| CVE-2026-89292 | In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures. | CRITICAL 9.2EPSS 0.45% | 3 November 2026 |
| CVE-2026-121022 | Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system,… | CRITICAL 9.2EPSS 0.38% | 3 November 2026 |
| CVE-2026-4052 | This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. | CRITICAL 9.8EPSS 0.36% | 3 November 2026 |
| CVE-2026-13594 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product. | CRITICAL 9.1EPSS 1.14% | 3 November 2026 |
| CVE-2026-120534 | The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. | CRITICAL 9.8EPSS 0.31% | 3 November 2026 |
| CVE-2026-120518 | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. | CRITICAL 9.1EPSS 0.78% | 3 November 2026 |
| CVE-2026-86596 | The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. | CRITICAL 9.8EPSS 1.49% | 2 November 2026 |
| CVE-2026-97718 | CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. | CRITICAL 9.4EPSS 0.36% | 2 November 2026 |
| CVE-2026-116769 | CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. | CRITICAL 9.3EPSS 0.40% | 2 November 2026 |
| CVE-2026-102435 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. | CRITICAL 9.8EPSS 0.59% | 2 November 2026 |
| CVE-2026-105606 | Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that… | CRITICAL 9.5EPSS 0.36% | 2 November 2026 |
| CVE-2026-105604 | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search. | CRITICAL 9.3EPSS 0.35% | 2 November 2026 |
| CVE-2026-105603 | Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE. | CRITICAL 9.4EPSS 0.30% | 2 November 2026 |
| CVE-2026-119085 | Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing… | CRITICAL 9.4EPSS 0.48% | 2 November 2026 |
| CVE-2026-88811 | Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. | CRITICAL 9.1EPSS 0.43% | 2 November 2026 |
| CVE-2026-106803 | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. | CRITICAL 9.8EPSS 0.29% | 2 November 2026 |
| CVE-2026-105769 | kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env,… | CRITICAL 9.3EPSS 0.20% | 2 November 2026 |
| CVE-2026-94290 | The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. | CRITICAL 9.1EPSS 0.50% | 2 November 2026 |
| CVE-2026-120459 | python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. | CRITICAL 9.1EPSS 0.25% | 2 November 2026 |
| CVE-2026-120447 | HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. | CRITICAL 9.2EPSS 0.53% | 2 November 2026 |
| CVE-2026-120442 | ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. | CRITICAL 9.3EPSS 0.48% | 2 November 2026 |
| CVE-2026-116606 | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized… | CRITICAL 9.3EPSS 0.73% | 2 November 2026 |
| CVE-2026-120213 | A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to… | CRITICAL 9.1EPSS 0.69% | 2 November 2026 |
| CVE-2026-120345 | A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2025-11969 | The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. | CRITICAL 9.4EPSS 0.32% | 2 November 2026 |
| CVE-2026-120344 | A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120283 | A vulnerability was identified in Linksys E8450 1.2.00.360516. | CRITICAL 9.3EPSS 0.58% | 2 November 2026 |
| CVE-2026-120281 | A vulnerability was found in WAVLINK WN536AX6-A V260507. | CRITICAL 9.3EPSS 0.58% | 2 November 2026 |
| CVE-2026-120280 | A vulnerability has been found in WAVLINK WN536AX6-A V260507. | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120279 | Executing a manipulation of the argument file_id can lead to os command injection. | CRITICAL 9.3EPSS 1.99% | 2 November 2026 |
| CVE-2026-120277 | A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. | CRITICAL 9.3EPSS 2.45% | 2 November 2026 |
| CVE-2026-120276 | A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. | CRITICAL 9.3EPSS 3.21% | 2 November 2026 |
| CVE-2026-62048 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6. | CRITICAL 9.3EPSS 0.34% | 1 November 2026 |
| CVE-2026-120338 | From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. | CRITICAL 10.0EPSS 0.77% | 1 November 2026 |
| CVE-2026-120308 | A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. | CRITICAL 9.9EPSS 0.53% | 1 November 2026 |
| CVE-2026-120307 | In the shipped remote-node manifests that service account is bound to cluster-admin. | CRITICAL 9.9EPSS 0.48% | 1 November 2026 |
| CVE-2026-120306 | Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. | CRITICAL 9.9EPSS 0.36% | 1 November 2026 |
| CVE-2026-120198 | A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. | CRITICAL 9.3EPSS 2.07% | 1 November 2026 |
| CVE-2026-120195 | A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. | CRITICAL 9.3EPSS 2.07% | 1 November 2026 |
| CVE-2026-120189 | A vulnerability was identified in D-Link DIR-505 1.10B02. | CRITICAL 9.3EPSS 1.35% | 1 November 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.