Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,801 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
39,255 results · page 81 of 786
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-12761 | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. | CRITICAL 9.8EPSS 0.89% | 10 July 2026 |
| CVE-2026-61459 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and… | EXPLOITCRITICAL 9.3EPSS 2.10% | 10 July 2026 |
| CVE-2026-59151 | An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong… | CRITICAL 9.6EPSS 0.32% | 10 July 2026 |
| CVE-2026-5801 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. | CRITICAL 9.8EPSS 0.58% | 10 July 2026 |
| CVE-2026-2397 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. | CRITICAL 9.8EPSS 0.48% | 10 July 2026 |
| CVE-2026-58492 | Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer… | CRITICAL 9.2EPSS 0.53% | 10 July 2026 |
| CVE-2026-51119 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components | CRITICAL 9.1EPSS 0.54% | 10 July 2026 |
| CVE-2026-55500 | Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the… | CRITICAL 9.9EPSS 0.69% | 10 July 2026 |
| CVE-2026-15143 | This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. | CRITICAL 9.3EPSS 0.43% | 10 July 2026 |
| CVE-2026-61444 | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. | CRITICAL 9.4EPSS 0.57% | 10 July 2026 |
| CVE-2026-59792 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible | CRITICAL 9.8EPSS 0.60% | 10 July 2026 |
| CVE-2026-56765 | Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. | CRITICAL 9.3EPSS 0.51% | 10 July 2026 |
| CVE-2026-56261 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. | CRITICAL 9.2EPSS 0.51% | 10 July 2026 |
| CVE-2026-56688 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | CRITICAL 9.1EPSS 2.00% | 10 July 2026 |
| CVE-2026-53363 | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() transfers paged fragments from one socket buffer to another but fails to propagate the… | CRITICAL 9.8EPSS 0.41% | 10 July 2026 |
| CVE-2026-41880 | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. | CRITICAL 9.0EPSS 1.33% | 10 July 2026 |
| CVE-2026-15378 | This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. | CRITICAL 9.3EPSS 0.53% | 10 July 2026 |
| CVE-2026-40008 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. | CRITICAL 9.8EPSS 0.60% | 10 July 2026 |
| CVE-2026-40005 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. | CRITICAL 9.1EPSS 0.54% | 10 July 2026 |
| CVE-2026-28564 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. | CRITICAL 9.8EPSS 0.68% | 10 July 2026 |
| CVE-2026-15300 | The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. | CRITICAL 9.1EPSS 0.62% | 10 July 2026 |
| CVE-2026-15282 | The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. | CRITICAL 9.8EPSS 1.08% | 10 July 2026 |
| CVE-2026-14894 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. | CRITICAL 9.8EPSS 5.27% | 10 July 2026 |
| CVE-2026-55615 | Prior to version 0.65.5, Neo4jChatAgent passes LLM-generated Cypher queries straight to the Neo4j driver with no validation, no statement-type allowlist, and no opt-out gate. | CRITICAL 9.2EPSS 0.46% | 10 July 2026 |
| CVE-2026-54769 | Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. | CRITICAL 10.0EPSS 0.91% | 10 July 2026 |
| CVE-2026-54760 | Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangerous_operations=False`, combines a raw-text regex blocklist (`_DANGEROUS_SQL_PATTERNS`) with a `sqlglot` SELECT-only statement allowlist. | CRITICAL 9.3EPSS 0.65% | 10 July 2026 |
| CVE-2026-58123 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. | CRITICAL 9.3EPSS 4.65% | 9 July 2026 |
| CVE-2026-58122 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback… | CRITICAL 9.3EPSS 0.37% | 9 July 2026 |
| CVE-2026-53963 | Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. | CRITICAL 9.0EPSS 0.73% | 9 July 2026 |
| CVE-2026-54003 | Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel… | CRITICAL 9.1EPSS 0.74% | 9 July 2026 |
| CVE-2026-59826 | From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute… | CRITICAL 9.1EPSS 0.54% | 9 July 2026 |
| CVE-2026-59726 | Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminal_execute, obtain a shell in… | CRITICAL 10.0EPSS 16.4% | 9 July 2026 |
| CVE-2026-59216 | Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through… | CRITICAL 9.0EPSS 0.31% | 9 July 2026 |
| CVE-2026-59214 | Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a… | CRITICAL 9.0EPSS 0.29% | 9 July 2026 |
| CVE-2026-51599 | An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with… | CRITICAL 9.8EPSS 0.63% | 9 July 2026 |
| CVE-2026-51597 | An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live… | CRITICAL 9.1EPSS 0.53% | 9 July 2026 |
| CVE-2026-13461 | When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. | CRITICAL 9.6EPSS 0.50% | 9 July 2026 |
| CVE-2026-42486 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. | CRITICAL 9.4EPSS 0.17% | 9 July 2026 |
| CVE-2026-23562 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. | CRITICAL 9.4EPSS 0.17% | 9 July 2026 |
| CVE-2026-23561 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. | CRITICAL 9.4EPSS 0.17% | 9 July 2026 |
| CVE-2026-23560 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. | CRITICAL 9.4EPSS 0.17% | 9 July 2026 |
| CVE-2026-23559 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. | CRITICAL 9.4EPSS 0.17% | 9 July 2026 |
| CVE-2026-23556 | When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. | CRITICAL 9.4EPSS 0.14% | 9 July 2026 |
| CVE-2025-58151 | The exact vulnerable behaviour depends on the code generated by the compiler. | CRITICAL 9.4EPSS 0.14% | 9 July 2026 |
| CVE-2025-58146 | There are multiple issues. | CRITICAL 9.4EPSS 0.18% | 9 July 2026 |
| CVE-2025-27464 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. | CRITICAL 9.4EPSS 0.16% | 9 July 2026 |
| CVE-2025-27463 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. | CRITICAL 9.4EPSS 0.16% | 9 July 2026 |
| CVE-2025-27462 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. | CRITICAL 9.4EPSS 0.16% | 9 July 2026 |
| CVE-2026-56292 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. | CRITICAL 9.2EPSS 1.38% | 9 July 2026 |
| CVE-2026-14261 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control. | CRITICAL 9.1EPSS 1.03% | 9 July 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.