Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,687 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
39,246 results · page 56 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-71248 | Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing… | CRITICAL 9.8EPSS 0.40% | 5 August 2026 |
| CVE-2026-71238 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. | CRITICAL 9.1EPSS 0.41% | 5 August 2026 |
| CVE-2026-71237 | An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database. | CRITICAL 9.8EPSS 0.42% | 5 August 2026 |
| CVE-2026-71231 | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64… | CRITICAL 9.8EPSS 0.36% | 5 August 2026 |
| CVE-2026-66747 | Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. | CRITICAL 9.3EPSS 0.66% | 5 August 2026 |
| CVE-2026-44945 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). | CRITICAL 9.1EPSS 0.38% | 5 August 2026 |
| CVE-2026-10090 | This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the "cluster-admin" ClusterRole. | CRITICAL 9.0EPSS 0.36% | 5 August 2026 |
| CVE-2026-10059 | A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. | CRITICAL 9.1EPSS 0.34% | 5 August 2026 |
| CVE-2026-71214 | The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request… | CRITICAL 9.8EPSS 0.31% | 5 August 2026 |
| CVE-2026-71213 | An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. | CRITICAL 9.1EPSS 0.32% | 5 August 2026 |
| CVE-2026-71207 | The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path. | CRITICAL 9.8EPSS 0.53% | 5 August 2026 |
| CVE-2026-70376 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. | CRITICAL 9.6EPSS 0.17% | 5 August 2026 |
| CVE-2026-64566 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page… | CRITICAL 9.8EPSS 0.35% | 5 August 2026 |
| CVE-2026-61486 | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. | CRITICAL 9.8EPSS 0.63% | 5 August 2026 |
| CVE-2026-61484 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. | CRITICAL 9.8EPSS 0.62% | 5 August 2026 |
| CVE-2026-5581 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. | CRITICAL 9.1EPSS 0.46% | 5 August 2026 |
| CVE-2026-4431 | The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` function in all versions up to, and including, 2.3.0. | CRITICAL 9.1EPSS 0.33% | 5 August 2026 |
| CVE-2026-16940 | The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover. | CRITICAL 10.0EPSS 0.40% | 5 August 2026 |
| CVE-2026-15360 | The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database. | CRITICAL 9.1EPSS 0.32% | 5 August 2026 |
| CVE-2026-15210 | Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's. | CRITICAL 9.1EPSS 0.30% | 5 August 2026 |
| CVE-2026-9273 | The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. | CRITICAL 9.3EPSS 0.28% | 5 August 2026 |
| CVE-2026-45537 | When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. | CRITICAL 9.1EPSS 0.35% | 4 August 2026 |
| CVE-2026-45100 | Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. | CRITICAL 9.1EPSS 0.67% | 4 August 2026 |
| CVE-2026-70554 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class… | CRITICAL 9.3EPSS 0.85% | 4 August 2026 |
| CVE-2026-67979 | Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage. | CRITICAL 9.1EPSS 0.29% | 4 August 2026 |
| CVE-2026-66902 | The Pluggable subclass reads credential_source.executable.command from the credentials JSON and runs it as `system($command)`, a single argument call that passes the whole string to /bin/sh -c. | CRITICAL 9.8EPSS 0.44% | 4 August 2026 |
| CVE-2026-45538 | In versions 4.0.0 and prior, processing a SIP message with a header name longer than 255 bytes causes a stack buffer overflow when sip_to_json() is called in the routing script. | CRITICAL 9.8EPSS 0.58% | 4 August 2026 |
| CVE-2026-70553 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is… | CRITICAL 9.3EPSS 1.20% | 4 August 2026 |
| CVE-2026-70552 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path… | CRITICAL 9.3EPSS 0.57% | 4 August 2026 |
| CVE-2026-70478 | An attacker with a credential ID can use the token to access the victim's connected service and can also exhaust refresh-token quota. | CRITICAL 9.2EPSS 0.53% | 4 August 2026 |
| CVE-2026-70477 | Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed Pyodide environment. | CRITICAL 9.5EPSS 0.83% | 4 August 2026 |
| CVE-2026-69703 | Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. | CRITICAL 9.3EPSS 0.46% | 4 August 2026 |
| CVE-2026-49435 | Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. | CRITICAL 9.3EPSS 0.77% | 4 August 2026 |
| CVE-2026-0163 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. | CRITICAL 9.8EPSS 0.52% | 4 August 2026 |
| CVE-2017-20242 | Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. | CRITICAL 9.3EPSS 0.72% | 4 August 2026 |
| CVE-2017-20241 | Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. | CRITICAL 9.3EPSS 0.72% | 4 August 2026 |
| CVE-2026-70470 | Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise… | CRITICAL 9.5EPSS 0.87% | 4 August 2026 |
| CVE-2026-69264 | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. | CRITICAL 9.4EPSS 1.16% | 4 August 2026 |
| CVE-2026-24254 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. | CRITICAL 9.8EPSS 0.54% | 4 August 2026 |
| CVE-2026-69259 | Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended database setting, allowing… | CRITICAL 9.4EPSS 0.69% | 4 August 2026 |
| CVE-2026-69256 | Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.read_pickle() could deserialize a pickled payload and achieve code execution without… | CRITICAL 9.4EPSS 0.77% | 4 August 2026 |
| CVE-2026-69255 | Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split(',').pop() and interpolated it directly into executable Python as base64_string = "${base64String}" before… | CRITICAL 9.2EPSS 0.60% | 4 August 2026 |
| CVE-2026-64633 | A vulnerability allowing remote unauthenticated code execution on the agent host. | CRITICAL 10.0EPSS 0.46% | 4 August 2026 |
| CVE-2026-63456 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. | CRITICAL 9.8EPSS 0.43% | 4 August 2026 |
| CVE-2026-63455 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. | CRITICAL 9.8EPSS 0.46% | 4 August 2026 |
| CVE-2026-58073 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. | CRITICAL 9.5EPSS 0.32% | 4 August 2026 |
| CVE-2026-58072 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. | CRITICAL 9.0EPSS 0.47% | 4 August 2026 |
| CVE-2025-29296 | H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection… | CRITICAL 9.8EPSS 2.24% | 4 August 2026 |
| CVE-2026-69254 | Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. | CRITICAL 9.4EPSS 0.65% | 4 August 2026 |
| CVE-2026-69253 | Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. | CRITICAL 9.0EPSS 0.63% | 4 August 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.