Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,598 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
39,238 results · page 5 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-90049 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skb_zerocopy() copies frags from @from into @to. | CRITICAL 9.3EPSS 0.17% | 16 September 2026 |
| CVE-2026-90048 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every… | CRITICAL 9.8EPSS 0.51% | 16 September 2026 |
| CVE-2026-90042 | In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. | CRITICAL 9.8EPSS 0.49% | 16 September 2026 |
| CVE-2026-90038 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4_revoke_export_states() has the same use-after-free as nfsd4_revoke_states(): it drops nn->client_lock across… | CRITICAL 9.8EPSS 0.42% | 16 September 2026 |
| CVE-2026-90037 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding… | CRITICAL 9.8EPSS 0.46% | 16 September 2026 |
| CVE-2026-90036 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its… | CRITICAL 9.8EPSS 0.46% | 16 September 2026 |
| CVE-2026-90012 | In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps TX but leaves tx_sg_mapped set. | CRITICAL 9.8EPSS 0.63% | 16 September 2026 |
| CVE-2026-90011 | In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the… | CRITICAL 9.1EPSS 0.83% | 16 September 2026 |
| CVE-2026-89990 | In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access()… | CRITICAL 9.8EPSS 0.61% | 16 September 2026 |
| CVE-2026-89972 | In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does… | CRITICAL 9.8EPSS 0.60% | 16 September 2026 |
| CVE-2026-89970 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). | CRITICAL 9.8EPSS 0.78% | 16 September 2026 |
| CVE-2026-89969 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining… | CRITICAL 9.8EPSS 0.69% | 16 September 2026 |
| CVE-2026-89930 | In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Service local TLB flushes on failed nested VM-Enter KVM services local TLB flushes on "full" nested VM-Exits (through __nested_vmx_vmexit()), but not if a nested VM-Enter… | CRITICAL 9.3EPSS 0.18% | 16 September 2026 |
| CVE-2026-89918 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly handle end of VA space TLBI invalidation Our TLB invalidation by VA code is based on comparing two ranges, one defined by the TLB, and one defined by the TLBI… | CRITICAL 9.3EPSS 0.18% | 16 September 2026 |
| CVE-2026-89916 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry A VNCR TLB invalidation can occur on one vcpu while another vcpu is faulting in this same page. | CRITICAL 9.3EPSS 0.18% | 16 September 2026 |
| CVE-2026-89915 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Remove VM-wide VNCR mapping counter The global VNCR mapping counter is used to decide whether an L1 provided VNCR page is mapped in L0 on any CPU at the point of dealing… | CRITICAL 9.3EPSS 0.18% | 16 September 2026 |
| CVE-2026-89914 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. | CRITICAL 9.3EPSS 0.18% | 16 September 2026 |
| CVE-2026-89857 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject qla_nvme_ls_reject_iocb() allocates from and advances the request ring through __qla2x00_alloc_iocbs() (which assumes the… | CRITICAL 9.8EPSS 0.62% | 16 September 2026 |
| CVE-2026-89847 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid double completion in async IOCB timeout qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. | CRITICAL 9.8EPSS 0.68% | 16 September 2026 |
| CVE-2026-89846 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if… | CRITICAL 9.1EPSS 0.69% | 16 September 2026 |
| CVE-2026-76187 | No allowlist restricts which client ids may authenticate, so the credentials of an unrelated application that happens to share the realm are valid Airflow login credentials, and Airflow mints a signed session token for that application's service account. | CRITICAL 9.8EPSS 0.95% | 16 September 2026 |
| CVE-2026-76186 | A user who holds any valid Airflow login of their own, together with another subject's Keycloak access or refresh token obtained out of band, can pair the two: Airflow then authorizes requests with the foreign token's privileges while the session… | CRITICAL 9.1EPSS 0.79% | 16 September 2026 |
| CVE-2026-73453 | An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. | CRITICAL 9.5EPSS 0.75% | 16 September 2026 |
| CVE-2026-89788 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect() publishes a new tree connection in sess->tree_conns with a single reference and returns its… | CRITICAL 9.8EPSS 0.52% | 16 September 2026 |
| CVE-2026-89786 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during… | CRITICAL 9.1EPSS 0.69% | 16 September 2026 |
| CVE-2026-89783 | In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check in xfrm6_input_addr() is off by one: if (1 + sp->len == XFRM_MAX_DEPTH) goto drop; ...… | CRITICAL 9.8EPSS 0.70% | 16 September 2026 |
| CVE-2026-89779 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer… | CRITICAL 9.1EPSS 0.69% | 16 September 2026 |
| CVE-2026-89778 | In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike… | CRITICAL 9.8EPSS 0.69% | 16 September 2026 |
| CVE-2026-89775 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. | CRITICAL 9.3EPSS 0.17% | 16 September 2026 |
| CVE-2026-86462 | An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so the password reset does not evict them. | CRITICAL 9.1EPSS 0.80% | 16 September 2026 |
| CVE-2026-82311 | An attacker who already holds a copy of the victim's session cookie keeps access as that user after the password change, so the reset does not evict them. | CRITICAL 9.8EPSS 0.95% | 16 September 2026 |
| CVE-2026-81642 | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code execution as a result of digesting DNSKEYs. | CRITICAL 9.1EPSS 0.52% | 16 September 2026 |
| CVE-2026-73461 | On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. | CRITICAL 9.4EPSS 0.30% | 16 September 2026 |
| CVE-2026-27565 | An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. | CRITICAL 9.8EPSS 0.94% | 16 September 2026 |
| CVE-2026-27546 | An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured. | CRITICAL 9.8EPSS 0.95% | 16 September 2026 |
| CVE-2026-73447 | A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. | CRITICAL 9.4EPSS 0.76% | 16 September 2026 |
| CVE-2026-14349 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. | CRITICAL 9.8EPSS 0.42% | 16 September 2026 |
| CVE-2026-12793 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. | CRITICAL 9.8EPSS 0.39% | 16 September 2026 |
| CVE-2026-15640 | Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. | CRITICAL 9.5EPSS 0.28% | 16 September 2026 |
| CVE-2026-15639 | An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. | CRITICAL 9.3EPSS 0.39% | 16 September 2026 |
| CVE-2026-15638 | The key itself is not exposed. | CRITICAL 9.1EPSS 0.20% | 16 September 2026 |
| CVE-2026-81855 | A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard. | CRITICAL 9.3EPSS 0.48% | 15 September 2026 |
| CVE-2026-78225 | A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. | CRITICAL 9.5EPSS 0.41% | 15 September 2026 |
| CVE-2026-73807 | An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions. | CRITICAL 9.3EPSS 0.65% | 15 September 2026 |
| CVE-2026-61560 | Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. | CRITICAL 9.8EPSS 0.70% | 15 September 2026 |
| CVE-2026-91939 | Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. | CRITICAL 9.3EPSS 0.59% | 15 September 2026 |
| CVE-2026-91749 | Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS 0.33% | 15 September 2026 |
| CVE-2026-91738 | Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS 0.34% | 15 September 2026 |
| CVE-2026-91729 | Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS 0.34% | 15 September 2026 |
| CVE-2026-91728 | Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS 0.41% | 15 September 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.