Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,739 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
39,248 results · page 78 of 785
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-48319 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.1EPSS 32.3% | 14 July 2026 |
| CVE-2026-48318 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. | CRITICAL 9.9EPSS 1.10% | 14 July 2026 |
| CVE-2026-48284 | ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.6EPSS 4.90% | 14 July 2026 |
| CVE-2026-24227 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. | CRITICAL 9.8EPSS 1.02% | 14 July 2026 |
| CVE-2026-15773 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. | CRITICAL 9.6EPSS 0.37% | 14 July 2026 |
| CVE-2026-15643 | A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an arbitrary endpoint via… | CRITICAL 9.2EPSS 0.39% | 14 July 2026 |
| CVE-2026-53633 | From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to… | CRITICAL 9.8EPSS 0.90% | 14 July 2026 |
| CVE-2026-48359 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.6EPSS 1.00% | 14 July 2026 |
| CVE-2026-48358 | Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.1EPSS 1.49% | 14 July 2026 |
| CVE-2026-48356 | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or… | CRITICAL 9.3EPSS 1.00% | 14 July 2026 |
| CVE-2026-48259 | Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.6EPSS 0.90% | 14 July 2026 |
| CVE-2026-47428 | From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the… | CRITICAL 9.6EPSS 0.61% | 14 July 2026 |
| CVE-2026-15409 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | KEVCRITICAL 10.0EPSS 84.5% | 14 July 2026 |
| CVE-2026-13001 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. | CRITICAL 9.8EPSS 3.76% | 14 July 2026 |
| CVE-2026-47304 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. | CRITICAL 9.8EPSS 0.22% | 14 July 2026 |
| CVE-2026-45063 | Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted… | CRITICAL 9.1EPSS 0.37% | 14 July 2026 |
| CVE-2026-58617 | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. | CRITICAL 9.8EPSS 0.79% | 14 July 2026 |
| CVE-2026-58594 | Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.82% | 14 July 2026 |
| CVE-2026-57092 | Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. | CRITICAL 9.9EPSS 0.91% | 14 July 2026 |
| CVE-2026-57090 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.82% | 14 July 2026 |
| CVE-2026-57089 | Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.66% | 14 July 2026 |
| CVE-2026-56190 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-56159 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-55944 | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 1.53% | 14 July 2026 |
| CVE-2026-55040 | Microsoft SharePoint Weak Authentication Vulnerability | KEVCRITICAL 9.1EPSS 50.6% | 14 July 2026 |
| CVE-2026-55010 | Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-50518 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-50487 | Use after free in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network. | CRITICAL 9.8EPSS 0.79% | 14 July 2026 |
| CVE-2026-50447 | Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-50439 | Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.79% | 14 July 2026 |
| CVE-2026-50380 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. | CRITICAL 9.6EPSS 0.82% | 14 July 2026 |
| CVE-2026-50330 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network. | CRITICAL 9.8EPSS 1.25% | 14 July 2026 |
| CVE-2026-15747 | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field… | CRITICAL 9.1EPSS 0.26% | 14 July 2026 |
| CVE-2026-59891 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. | CRITICAL 9.6EPSS 0.47% | 14 July 2026 |
| CVE-2026-58644 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 15.9% | 14 July 2026 |
| CVE-2026-56164 | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.8EPSS 26.6% | 14 July 2026 |
| CVE-2026-55008 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | CRITICAL 9.6EPSS 0.86% | 14 July 2026 |
| CVE-2026-54995 | Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.79% | 14 July 2026 |
| CVE-2026-54433 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. | CRITICAL 10.0EPSS 0.31% | 14 July 2026 |
| CVE-2026-54118 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 1.16% | 14 July 2026 |
| CVE-2026-54117 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 1.16% | 14 July 2026 |
| CVE-2026-50694 | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.79% | 14 July 2026 |
| CVE-2026-50522 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 85.4% | 14 July 2026 |
| CVE-2026-49798 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. | CRITICAL 9.3EPSS 0.36% | 14 July 2026 |
| CVE-2026-49181 | Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network. | CRITICAL 9.8EPSS 1.17% | 14 July 2026 |
| CVE-2026-49172 | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-49164 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.79% | 14 July 2026 |
| CVE-2026-48561 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network. | CRITICAL 9.6EPSS 0.86% | 14 July 2026 |
| CVE-2026-42990 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network. | CRITICAL 9.8EPSS 0.97% | 14 July 2026 |
| CVE-2026-62644 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover. | CRITICAL 9.8EPSS 0.50% | 14 July 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.