Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,069 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
41,381 results · page 5 of 828
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-61992 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | CRITICAL 9.8EPSS 0.39% | 29 October 2026 |
| CVE-2026-61991 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | CRITICAL 10.0EPSS 0.75% | 29 October 2026 |
| CVE-2026-54860 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-54859 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | CRITICAL 9.8EPSS 0.53% | 29 October 2026 |
| CVE-2026-54858 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-54857 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-54856 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | CRITICAL 9.8EPSS 0.49% | 29 October 2026 |
| CVE-2026-18894 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. | CRITICAL 9.8EPSS 0.52% | 29 October 2026 |
| CVE-2026-119145 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. | CRITICAL 9.4EPSS 0.76% | 29 October 2026 |
| CVE-2026-119128 | ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. | CRITICAL 9.1EPSS 0.29% | 29 October 2026 |
| CVE-2026-112256 | Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. | CRITICAL 9.2EPSS 0.24% | 29 October 2026 |
| CVE-2026-111732 | A crafted Connect request causes an out-of-bounds write. | CRITICAL 9.3EPSS 0.40% | 29 October 2026 |
| CVE-2026-110186 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | CRITICAL 9.8EPSS 0.62% | 29 October 2026 |
| CVE-2026-107040 | Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | CRITICAL 9.1EPSS 0.17% | 29 October 2026 |
| CVE-2026-107038 | Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data. | CRITICAL 9.1EPSS 0.17% | 29 October 2026 |
| CVE-2026-107034 | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data. | CRITICAL 9.1EPSS 0.37% | 29 October 2026 |
| CVE-2026-107032 | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. | CRITICAL 9.1EPSS 0.50% | 29 October 2026 |
| CVE-2026-107029 | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | CRITICAL 9.1EPSS 0.37% | 29 October 2026 |
| CVE-2026-107028 | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data. | CRITICAL 9.1EPSS 0.34% | 29 October 2026 |
| CVE-2026-107027 | Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | CRITICAL 9.1EPSS 0.17% | 29 October 2026 |
| CVE-2026-104339 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | CRITICAL 9.8EPSS 0.75% | 29 October 2026 |
| CVE-2026-104317 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data. | CRITICAL 9.8EPSS 0.59% | 29 October 2026 |
| CVE-2026-107021 | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database. | CRITICAL 9.1EPSS 0.17% | 29 October 2026 |
| CVE-2026-107017 | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions. | CRITICAL 9.1EPSS 0.34% | 29 October 2026 |
| CVE-2026-107015 | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. | CRITICAL 9.1EPSS 0.50% | 29 October 2026 |
| CVE-2026-107014 | Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database. | CRITICAL 9.1EPSS 0.30% | 29 October 2026 |
| CVE-2026-79589 | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. | CRITICAL 9.8EPSS 0.34% | 29 October 2026 |
| CVE-2026-119050 | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). | CRITICAL 9.2EPSS 0.43% | 29 October 2026 |
| CVE-2026-97854 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. | CRITICAL 9.3EPSS 1.37% | 29 October 2026 |
| CVE-2026-115964 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126. | CRITICAL 9.3EPSS 0.32% | 29 October 2026 |
| CVE-2026-114358 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. | CRITICAL 9.3EPSS 0.50% | 29 October 2026 |
| CVE-2026-115245 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to… | CRITICAL 9.8EPSS 0.46% | 29 October 2026 |
| CVE-2026-113617 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including… | CRITICAL 9.9EPSS 0.34% | 29 October 2026 |
| CVE-2026-113616 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any… | CRITICAL 9.8EPSS 0.34% | 29 October 2026 |
| CVE-2026-103693 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing… | CRITICAL 9.0EPSS 0.47% | 29 October 2026 |
| CVE-2026-42922 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). | CRITICAL 9.8EPSS 0.53% | 29 October 2026 |
| CVE-2026-109516 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. | CRITICAL 9.8EPSS 0.57% | 29 October 2026 |
| CVE-2026-66088 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. | CRITICAL 9.4EPSS 0.69% | 29 October 2026 |
| CVE-2026-61567 | Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. | CRITICAL 10.0EPSS 0.53% | 28 October 2026 |
| CVE-2026-61564 | An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. | CRITICAL 10.0EPSS 0.54% | 28 October 2026 |
| CVE-2026-118690 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. | CRITICAL 9.3EPSS 0.69% | 28 October 2026 |
| CVE-2026-63190 | Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. | CRITICAL 9.4EPSS 0.54% | 28 October 2026 |
| CVE-2026-117574 | An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. | CRITICAL 9.1EPSS 0.24% | 28 October 2026 |
| CVE-2026-118633 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with… | CRITICAL 9.2EPSS 0.60% | 28 October 2026 |
| CVE-2026-118264 | This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. | CRITICAL 9.1EPSS 0.43% | 28 October 2026 |
| CVE-2026-103409 | A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running… | CRITICAL 9.8EPSS 0.35% | 28 October 2026 |
| CVE-2026-103406 | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion… | CRITICAL 9.8EPSS 0.52% | 28 October 2026 |
| CVE-2026-44179 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. | CRITICAL 9.9EPSS 0.69% | 28 October 2026 |
| CVE-2026-115968 | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1. | CRITICAL 9.8EPSS 0.41% | 28 October 2026 |
| CVE-2026-105420 | An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. | CRITICAL 9.4EPSS 0.52% | 28 October 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.