Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,598 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
39,238 results · page 3 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-90151 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4_alloc_client() allocates an NFSv4.0 callback identifier before it finishes setting up the client. | CRITICAL 9.8EPSS 0.74% | 17 September 2026 |
| CVE-2026-90110 | In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. | CRITICAL 9.4EPSS 0.60% | 17 September 2026 |
| CVE-2026-90104 | In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized.… | CRITICAL 9.8EPSS 0.52% | 17 September 2026 |
| CVE-2026-91039 | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established through a different connection. | CRITICAL 9.1EPSS 0.40% | 17 September 2026 |
| CVE-2026-86863 | WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE_USER from request.environ and, when that returned nothing, fell back to reading the same name directly from the inbound HTTP request headers via request.headers.get(). | CRITICAL 9.3EPSS 0.36% | 17 September 2026 |
| CVE-2026-76834 | Unauthenticated attackers can submit crafted serialized PHP objects via POST requests to htsrv/call_plugin.php that bypass validation and reach unserialize(), instantiating arbitrary PHP objects with attacker-chosen properties that may enable code… | CRITICAL 9.2EPSS 0.85% | 17 September 2026 |
| CVE-2026-88952 | Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. | CRITICAL 9.1EPSS 0.43% | 17 September 2026 |
| CVE-2026-79752 | An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. | CRITICAL 9.2EPSS 0.46% | 17 September 2026 |
| CVE-2026-63472 | In deployments with a custom external AuthenticationStrategy that forwards an email whose ownership the provider has not verified, an attacker can authenticate with a victim's email and bind the attacker's external identity to the victim's existing… | CRITICAL 9.1EPSS 0.41% | 17 September 2026 |
| CVE-2026-92960 | vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. | CRITICAL 10.0EPSS 0.43% | 17 September 2026 |
| CVE-2026-92957 | Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawning APIs such as execSync and spawn, which is equivalent to host command-execution… | CRITICAL 9.4EPSS 0.49% | 17 September 2026 |
| CVE-2026-92956 | No NodeVM, require permission, host object injection, or otherwise unsafe configuration is required. | CRITICAL 10.0EPSS 0.40% | 17 September 2026 |
| CVE-2026-92955 | vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. | CRITICAL 10.0EPSS 0.62% | 17 September 2026 |
| CVE-2026-92954 | In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handler… | CRITICAL 9.2EPSS 0.34% | 17 September 2026 |
| CVE-2026-92953 | Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns. | CRITICAL 9.3EPSS 0.34% | 17 September 2026 |
| CVE-2026-92951 | vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. | CRITICAL 9.4EPSS 0.37% | 17 September 2026 |
| CVE-2026-92950 | vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. | CRITICAL 9.3EPSS 0.22% | 17 September 2026 |
| CVE-2026-92948 | vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: ['node:test'] }). | CRITICAL 9.4EPSS 0.45% | 17 September 2026 |
| CVE-2026-92947 | vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. | CRITICAL 10.0EPSS 0.43% | 17 September 2026 |
| CVE-2026-92946 | vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. | CRITICAL 10.0EPSS 0.59% | 17 September 2026 |
| CVE-2026-92944 | vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. | CRITICAL 9.3EPSS 0.58% | 17 September 2026 |
| CVE-2026-92941 | vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. | CRITICAL 10.0EPSS 0.27% | 17 September 2026 |
| CVE-2026-92940 | vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). | CRITICAL 10.0EPSS 0.34% | 17 September 2026 |
| CVE-2026-92939 | vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. | CRITICAL 9.4EPSS 0.53% | 17 September 2026 |
| CVE-2026-92938 | vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. | CRITICAL 9.4EPSS 0.42% | 17 September 2026 |
| CVE-2026-92937 | vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. | CRITICAL 10.0EPSS 0.79% | 17 September 2026 |
| CVE-2026-92935 | As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an… | CRITICAL 9.5EPSS 0.50% | 17 September 2026 |
| CVE-2026-92934 | vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. | CRITICAL 9.5EPSS 0.74% | 17 September 2026 |
| CVE-2026-86533 | Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. | CRITICAL 9.1EPSS 0.65% | 17 September 2026 |
| CVE-2026-85500 | Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an unconfirmed user to obtain a session, defeating a mandatory email confirmation requirement. | CRITICAL 9.1EPSS 0.55% | 17 September 2026 |
| CVE-2026-82761 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. | CRITICAL 9.1EPSS 0.40% | 17 September 2026 |
| CVE-2026-62108 | Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. | CRITICAL 9.8EPSS 0.40% | 17 September 2026 |
| CVE-2026-62104 | Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. | CRITICAL 10.0EPSS 0.59% | 17 September 2026 |
| CVE-2026-62101 | Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. | CRITICAL 9.8EPSS 0.40% | 17 September 2026 |
| CVE-2026-92913 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from… | CRITICAL 9.1EPSS 0.51% | 17 September 2026 |
| CVE-2026-92860 | The manipulation of the argument Username results in improper input validation. | CRITICAL 9.4EPSS 0.47% | 17 September 2026 |
| CVE-2026-90823 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. | CRITICAL 9.8EPSS 0.68% | 17 September 2026 |
| CVE-2026-90822 | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. | CRITICAL 9.8EPSS 1.41% | 17 September 2026 |
| CVE-2026-15688 | Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and… | CRITICAL 9.2EPSS 0.12% | 17 September 2026 |
| CVE-2026-88795 | The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing… | CRITICAL 9.0EPSS 0.48% | 17 September 2026 |
| CVE-2026-86710 | The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators. | CRITICAL 9.8EPSS 0.28% | 17 September 2026 |
| CVE-2026-86709 | The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators. | CRITICAL 9.8EPSS 0.34% | 17 September 2026 |
| CVE-2026-86707 | The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including… | CRITICAL 9.8EPSS 0.28% | 17 September 2026 |
| CVE-2026-87796 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. | CRITICAL 9.8EPSS 0.61% | 17 September 2026 |
| CVE-2026-92578 | WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). | CRITICAL 9.2EPSS 0.33% | 16 September 2026 |
| CVE-2026-92576 | HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. | CRITICAL 9.2EPSS 0.40% | 16 September 2026 |
| CVE-2026-61594 | As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name="dispatch")`, and custom `dispatch()` guards — and the djust admin extension's staff gate… | CRITICAL 9.1EPSS 0.43% | 16 September 2026 |
| CVE-2026-92805 | Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance. | CRITICAL 9.3EPSS 0.35% | 16 September 2026 |
| CVE-2026-92787 | Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. | CRITICAL 9.3EPSS 0.38% | 16 September 2026 |
| CVE-2026-92785 | Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. | CRITICAL 9.2EPSS 0.36% | 16 September 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.