Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,069 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
41,381 results · page 4 of 828
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-64618 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). | CRITICAL 9.8EPSS 0.62% | 30 October 2026 |
| CVE-2026-82104 | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bypassing validations that might… | CRITICAL 9.4EPSS 0.39% | 30 October 2026 |
| CVE-2026-103039 | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. | CRITICAL 9.8EPSS 0.51% | 30 October 2026 |
| CVE-2026-107249 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. | CRITICAL 9.8EPSS 0.39% | 30 October 2026 |
| CVE-2026-119263 | Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS 0.27% | 30 October 2026 |
| CVE-2026-119261 | Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS 0.28% | 30 October 2026 |
| CVE-2023-22793 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center. | CRITICAL 9.3EPSS 0.53% | 29 October 2026 |
| CVE-2026-61707 | Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. | CRITICAL 9.0EPSS 0.24% | 29 October 2026 |
| CVE-2026-61645 | In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. | CRITICAL 9.1EPSS 0.41% | 29 October 2026 |
| CVE-2026-103093 | This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. | CRITICAL 9.4EPSS 0.43% | 29 October 2026 |
| CVE-2026-51912 | OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46). | CRITICAL 9.8EPSS 0.24% | 29 October 2026 |
| CVE-2026-51863 | DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). | CRITICAL 9.1EPSS 0.81% | 29 October 2026 |
| CVE-2026-118769 | In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select the variable-block-size Lion cipher so that the reported size is truncated, the caller allocates insufficient memory, and later… | CRITICAL 9.2EPSS 0.36% | 29 October 2026 |
| CVE-2026-118762 | Because actions/checkout persists the elevated GITHUB_TOKEN in Git configuration until after untrusted code executes, an external contributor whose pull request receives the format label can run arbitrary code, read or exfiltrate the token, and push… | CRITICAL 9.3EPSS 0.32% | 29 October 2026 |
| CVE-2026-107060 | Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences. | CRITICAL 9.1EPSS 0.28% | 29 October 2026 |
| CVE-2026-107058 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state. | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-107057 | An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip. | CRITICAL 9.8EPSS 0.39% | 29 October 2026 |
| CVE-2026-107056 | Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message. | CRITICAL 9.1EPSS 0.15% | 29 October 2026 |
| CVE-2026-107053 | Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox. | CRITICAL 9.1EPSS 0.15% | 29 October 2026 |
| CVE-2026-107050 | An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution. | CRITICAL 9.8EPSS 0.17% | 29 October 2026 |
| CVE-2026-107048 | An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request. | CRITICAL 9.8EPSS 0.18% | 29 October 2026 |
| CVE-2026-107045 | Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database. | CRITICAL 9.1EPSS 0.17% | 29 October 2026 |
| CVE-2026-107043 | Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism. | CRITICAL 9.1EPSS 0.16% | 29 October 2026 |
| CVE-2026-93680 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | CRITICAL 9.8EPSS 2.18% | 29 October 2026 |
| CVE-2026-90868 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations. | CRITICAL 9.9EPSS 1.49% | 29 October 2026 |
| CVE-2026-90866 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution. | CRITICAL 9.1EPSS 0.73% | 29 October 2026 |
| CVE-2026-90865 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations. | CRITICAL 9.0EPSS 1.14% | 29 October 2026 |
| CVE-2026-90864 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope. | CRITICAL 9.1EPSS 0.48% | 29 October 2026 |
| CVE-2026-90863 | Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary… | CRITICAL 9.1EPSS 0.66% | 29 October 2026 |
| CVE-2026-84295 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials. | CRITICAL 10.0EPSS 0.55% | 29 October 2026 |
| CVE-2026-62131 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | CRITICAL 9.8EPSS 0.31% | 29 October 2026 |
| CVE-2026-62018 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | CRITICAL 9.8EPSS 0.45% | 29 October 2026 |
| CVE-2026-62017 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | CRITICAL 9.8EPSS 0.42% | 29 October 2026 |
| CVE-2026-62016 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62015 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62014 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | CRITICAL 9.8EPSS 0.43% | 29 October 2026 |
| CVE-2026-62013 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | CRITICAL 9.8EPSS 0.45% | 29 October 2026 |
| CVE-2026-62012 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | CRITICAL 9.8EPSS 0.42% | 29 October 2026 |
| CVE-2026-62011 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62010 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62009 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | CRITICAL 9.8EPSS 0.43% | 29 October 2026 |
| CVE-2026-62008 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | CRITICAL 9.8EPSS 0.42% | 29 October 2026 |
| CVE-2026-62006 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | CRITICAL 9.8EPSS 0.42% | 29 October 2026 |
| CVE-2026-62005 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62004 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62003 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | CRITICAL 9.8EPSS 0.40% | 29 October 2026 |
| CVE-2026-62002 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | CRITICAL 9.8EPSS 0.51% | 29 October 2026 |
| CVE-2026-62001 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | CRITICAL 9.8EPSS 0.48% | 29 October 2026 |
| CVE-2026-61998 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | CRITICAL 9.8EPSS 0.48% | 29 October 2026 |
| CVE-2026-61997 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | CRITICAL 9.8EPSS 0.51% | 29 October 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.