Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,669 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
39,246 results · page 49 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-16860 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element. | CRITICAL 9.9EPSS 0.52% | 12 August 2026 |
| CVE-2026-16627 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of… | CRITICAL 9.0EPSS 0.36% | 12 August 2026 |
| CVE-2026-73296 | Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated… | CRITICAL 9.4EPSS 2.92% | 12 August 2026 |
| CVE-2026-73240 | Specifically crafted inputs may lead to git argument injection in Apache Allura. | CRITICAL 9.8EPSS 0.54% | 12 August 2026 |
| CVE-2026-18847 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. | CRITICAL 9.8EPSS 0.18% | 12 August 2026 |
| CVE-2026-73294 | Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project… | CRITICAL 9.9EPSS 0.57% | 12 August 2026 |
| CVE-2026-64639 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator. | CRITICAL 9.3EPSS 0.35% | 12 August 2026 |
| CVE-2026-73263 | Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked… | CRITICAL 9.9EPSS 0.35% | 12 August 2026 |
| CVE-2026-50561 | This allows an administrator token generated in another deployment instance or local testing environment to be used to access the backend management interfaces of a different affected instance. | CRITICAL 9.4EPSS 0.37% | 12 August 2026 |
| CVE-2025-59324 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped. | CRITICAL 9.1EPSS 0.15% | 12 August 2026 |
| CVE-2025-59321 | This allows the TPM to be unsealed via an unintended execution path or from another hardware platform. | CRITICAL 9.8EPSS 0.53% | 12 August 2026 |
| CVE-2026-67285 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system. | CRITICAL 9.2EPSS 0.38% | 12 August 2026 |
| CVE-2025-59326 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to enforce IMA policy protections across temporary file systems, allowing for unsigned code to be executed from these locations. | CRITICAL 9.8EPSS 0.45% | 12 August 2026 |
| CVE-2026-57858 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID… | CRITICAL 9.3EPSS 0.37% | 12 August 2026 |
| CVE-2026-26035 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote… | CRITICAL 9.8EPSS 0.65% | 12 August 2026 |
| CVE-2026-67282 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model. | CRITICAL 10.0EPSS 0.58% | 12 August 2026 |
| CVE-2025-41769 | The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. | CRITICAL 9.3EPSS 0.64% | 12 August 2026 |
| CVE-2026-66659 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. | CRITICAL 9.3EPSS 0.29% | 12 August 2026 |
| CVE-2026-18391 | The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to… | CRITICAL 9.8EPSS 0.61% | 12 August 2026 |
| CVE-2026-18366 | The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password… | CRITICAL 9.8EPSS 0.39% | 12 August 2026 |
| CVE-2026-16538 | The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value. | CRITICAL 9.1EPSS 0.23% | 12 August 2026 |
| CVE-2026-16051 | The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed… | CRITICAL 9.8EPSS 0.59% | 12 August 2026 |
| CVE-2026-15039 | The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution. | CRITICAL 9.8EPSS 0.57% | 12 August 2026 |
| CVE-2026-72526 | A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. | CRITICAL 9.9EPSS 0.42% | 12 August 2026 |
| CVE-2026-70398 | This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. | CRITICAL 9.6EPSS 0.32% | 12 August 2026 |
| CVE-2026-68431 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. | CRITICAL 9.1EPSS 0.37% | 12 August 2026 |
| CVE-2026-68067 | An attacker could use an email address to control cloud accounts and access hormone record information and account settings. | CRITICAL 9.3EPSS 0.31% | 11 August 2026 |
| CVE-2026-67568 | The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information. | CRITICAL 9.3EPSS 0.27% | 11 August 2026 |
| CVE-2026-71290 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. | CRITICAL 9.1EPSS 0.24% | 11 August 2026 |
| CVE-2026-66147 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests. | CRITICAL 9.4EPSS 2.00% | 11 August 2026 |
| CVE-2026-48765 | Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an… | CRITICAL 9.9EPSS 0.32% | 11 August 2026 |
| CVE-2026-73034 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload… | CRITICAL 9.3EPSS 5.12% | 11 August 2026 |
| CVE-2026-73032 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. | CRITICAL 9.4EPSS 0.44% | 11 August 2026 |
| CVE-2026-66145 | An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip. | CRITICAL 9.1EPSS 0.56% | 11 August 2026 |
| CVE-2026-45618 | Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. | CRITICAL 10.0EPSS 0.92% | 11 August 2026 |
| CVE-2026-16230 | The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. | CRITICAL 9.8EPSS 0.50% | 11 August 2026 |
| CVE-2026-72742 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a… | CRITICAL 9.2EPSS 0.37% | 11 August 2026 |
| CVE-2026-18691 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. | CRITICAL 9.0EPSS 0.23% | 11 August 2026 |
| CVE-2026-73211 | Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and… | CRITICAL 9.8EPSS 0.39% | 11 August 2026 |
| CVE-2026-73090 | Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another… | CRITICAL 9.3EPSS 0.22% | 11 August 2026 |
| CVE-2026-71398 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 10.0EPSS 0.79% | 11 August 2026 |
| CVE-2026-71362 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. | CRITICAL 9.1EPSS 24.5% | 11 August 2026 |
| CVE-2026-69102 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped… | CRITICAL 9.3EPSS 0.44% | 11 August 2026 |
| CVE-2026-48381 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.0EPSS 0.58% | 11 August 2026 |
| CVE-2026-47705 | Version 3.16.1 has a CSV injection vulnerability in the result export functionality. | CRITICAL 9.6EPSS 0.48% | 11 August 2026 |
| CVE-2026-27302 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 10.0EPSS 0.71% | 11 August 2026 |
| CVE-2026-71384 | is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. | CRITICAL 9.6EPSS 0.39% | 11 August 2026 |
| CVE-2026-70306 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | CRITICAL 9.3EPSS 0.75% | 11 August 2026 |
| CVE-2026-69223 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). | CRITICAL 9.1EPSS 0.73% | 11 August 2026 |
| CVE-2026-65791 | Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.60% | 11 August 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.