Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,069 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
41,381 results · page 3 of 828
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-118636 | **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. | CRITICAL 9.8EPSS 0.57% | 31 October 2026 |
| CVE-2026-120209 | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. | CRITICAL 9.3EPSS 0.54% | 31 October 2026 |
| CVE-2026-120201 | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. | CRITICAL 9.3EPSS 0.60% | 31 October 2026 |
| CVE-2026-118235 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. | CRITICAL 9.8EPSS 0.74% | 31 October 2026 |
| CVE-2026-103882 | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to,… | CRITICAL 9.1EPSS 0.79% | 31 October 2026 |
| CVE-2026-119096 | The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. | CRITICAL 9.8EPSS 0.46% | 31 October 2026 |
| CVE-2026-116512 | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. | CRITICAL 9.8EPSS 0.58% | 31 October 2026 |
| CVE-2026-89270 | The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properly verifying that a user is… | CRITICAL 9.1EPSS 0.39% | 31 October 2026 |
| CVE-2026-116557 | The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up to, and including, 2.1.0.5 This… | CRITICAL 9.1EPSS 0.35% | 31 October 2026 |
| CVE-2026-109220 | The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. | CRITICAL 9.8EPSS 0.52% | 31 October 2026 |
| CVE-2026-117656 | Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. | CRITICAL 9.3EPSS 0.23% | 31 October 2026 |
| CVE-2026-63377 | Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticated network attacker to create the first administrator account before the legitimate owner completes initial setup. | CRITICAL 9.8EPSS 0.40% | 30 October 2026 |
| CVE-2026-62863 | Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. | CRITICAL 9.6EPSS 0.31% | 30 October 2026 |
| CVE-2026-62853 | An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. | CRITICAL 9.9EPSS 0.41% | 30 October 2026 |
| CVE-2026-62849 | Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. | CRITICAL 9.1EPSS 0.50% | 30 October 2026 |
| CVE-2026-117666 | Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in… | CRITICAL 9.1EPSS 0.19% | 30 October 2026 |
| CVE-2026-78403 | Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. | CRITICAL 9.3EPSS 0.58% | 30 October 2026 |
| CVE-2026-61850 | This permits escalation to Project-administrator access, disclosure of `Project Secrets` and credentials, and modification or deletion of Project resources. | CRITICAL 9.3EPSS 0.36% | 30 October 2026 |
| CVE-2026-61620 | From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. | CRITICAL 9.8EPSS 0.39% | 30 October 2026 |
| CVE-2026-55598 | Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts.rs`. `get_podcast_values` and `add_episodes` in `rust-api/src/database.rs` parse the feed with… | CRITICAL 9.1EPSS 0.33% | 30 October 2026 |
| CVE-2026-116241 | The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote… | CRITICAL 9.4EPSS 0.32% | 30 October 2026 |
| CVE-2026-116238 | The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. | CRITICAL 9.2EPSS 0.40% | 30 October 2026 |
| CVE-2026-90888 | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | CRITICAL 9.8EPSS 0.32% | 30 October 2026 |
| CVE-2026-39738 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1. | CRITICAL 9.8EPSS 0.41% | 30 October 2026 |
| CVE-2026-39732 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | CRITICAL 9.3EPSS 0.32% | 30 October 2026 |
| CVE-2026-119526 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. | CRITICAL 9.8EPSS 0.41% | 30 October 2026 |
| CVE-2026-116852 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | CRITICAL 9.1EPSS 0.60% | 30 October 2026 |
| CVE-2026-116386 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | CRITICAL 9.8EPSS 0.35% | 30 October 2026 |
| CVE-2026-119978 | Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. | CRITICAL 9.0EPSS 0.34% | 30 October 2026 |
| CVE-2026-118697 | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and… | CRITICAL 9.0EPSS 0.29% | 30 October 2026 |
| CVE-2026-61826 | Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and… | CRITICAL 10.0EPSS 0.26% | 30 October 2026 |
| CVE-2026-112816 | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and… | CRITICAL 10.0EPSS 0.30% | 30 October 2026 |
| CVE-2025-49602 | An issue was discovered in Keyfactor EJBCA 9. | CRITICAL 9.8EPSS 0.19% | 30 October 2026 |
| CVE-2026-119716 | pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. | CRITICAL 9.3EPSS 0.46% | 30 October 2026 |
| CVE-2026-119706 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. | CRITICAL 9.3EPSS 1.03% | 30 October 2026 |
| CVE-2026-93327 | A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously… | CRITICAL 9.4EPSS 0.39% | 30 October 2026 |
| CVE-2026-61738 | A traversal filename therefore writes the supplied JSON outside the intended report directory. | CRITICAL 10.0EPSS 0.56% | 30 October 2026 |
| CVE-2026-61737 | Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. | CRITICAL 9.8EPSS 0.51% | 30 October 2026 |
| CVE-2026-61730 | In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. | CRITICAL 9.3EPSS 0.37% | 30 October 2026 |
| CVE-2026-61729 | Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and… | CRITICAL 9.4EPSS 0.38% | 30 October 2026 |
| CVE-2026-61728 | When another user views the poisoned alert, stored script executes on the application origin; the same unsanitized rendering pattern affects server-stored SOC case, asset and health-check fields in `SocCaseNote.vue`, `SocCaseItem.vue`,… | CRITICAL 9.9EPSS 0.46% | 30 October 2026 |
| CVE-2026-119660 | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. | CRITICAL 9.3EPSS 0.52% | 30 October 2026 |
| CVE-2026-112905 | Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. | CRITICAL 9.0EPSS 0.50% | 30 October 2026 |
| CVE-2026-110799 | Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. | CRITICAL 9.8EPSS 0.71% | 30 October 2026 |
| CVE-2026-119597 | OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. | CRITICAL 9.3EPSS 0.37% | 30 October 2026 |
| CVE-2026-119568 | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. | CRITICAL 9.1EPSS 0.40% | 30 October 2026 |
| CVE-2026-119419 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. | CRITICAL 9.2EPSS 0.39% | 30 October 2026 |
| CVE-2026-119418 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). | CRITICAL 9.2EPSS 0.48% | 30 October 2026 |
| CVE-2026-116366 | An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. | CRITICAL 9.5EPSS 0.96% | 30 October 2026 |
| CVE-2025-31704 | A vulnerability has been found in the Dahua Intelligent Connection Center. | CRITICAL 9.8EPSS 1.36% | 30 October 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.