Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,914 CVEs1,717 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
39,282 results · page 91 of 786
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-53046 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return… | CRITICAL 9.8EPSS 0.52% | 24 June 2026 |
| CVE-2026-53045 | In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. | CRITICAL 9.8EPSS 0.51% | 24 June 2026 |
| CVE-2026-53043 | In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". | CRITICAL 9.1EPSS 0.51% | 24 June 2026 |
| CVE-2026-53010 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the… | CRITICAL 9.8EPSS 0.44% | 24 June 2026 |
| CVE-2026-53006 | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. | CRITICAL 9.8EPSS 0.40% | 24 June 2026 |
| CVE-2026-53002 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. | CRITICAL 9.8EPSS 0.37% | 24 June 2026 |
| CVE-2026-52999 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for… | CRITICAL 9.1EPSS 0.58% | 24 June 2026 |
| CVE-2026-52993 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. | CRITICAL 9.8EPSS 0.37% | 24 June 2026 |
| CVE-2026-52989 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers… | CRITICAL 9.8EPSS 0.36% | 24 June 2026 |
| CVE-2026-52986 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port()… | CRITICAL 9.8EPSS 0.62% | 24 June 2026 |
| CVE-2026-52982 | In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after… | CRITICAL 9.8EPSS 0.54% | 24 June 2026 |
| CVE-2026-52958 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e.,… | CRITICAL 9.1EPSS 0.54% | 24 June 2026 |
| CVE-2026-52955 | In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket… | CRITICAL 9.8EPSS 0.38% | 24 June 2026 |
| CVE-2026-56121 | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. | CRITICAL 9.3EPSS 1.41% | 24 June 2026 |
| CVE-2026-12537 | Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve… | CRITICAL 10.0EPSS 0.21% | 24 June 2026 |
| CVE-2026-56237 | Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. | CRITICAL 9.3EPSS 0.52% | 24 June 2026 |
| CVE-2026-56223 | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. | CRITICAL 9.3EPSS 0.30% | 24 June 2026 |
| CVE-2026-52931 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. | CRITICAL 9.8EPSS 0.40% | 24 June 2026 |
| CVE-2026-52924 | In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. | CRITICAL 9.8EPSS 0.44% | 24 June 2026 |
| CVE-2026-52914 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. | CRITICAL 9.8EPSS 0.51% | 24 June 2026 |
| CVE-2026-12417 | The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. | CRITICAL 9.8EPSS 0.82% | 24 June 2026 |
| CVE-2026-12416 | The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. | CRITICAL 9.8EPSS 0.67% | 24 June 2026 |
| CVE-2026-12851 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. | CRITICAL 9.1EPSS 2.70% | 24 June 2026 |
| CVE-2026-12850 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. | CRITICAL 9.1EPSS 2.70% | 24 June 2026 |
| CVE-2026-12849 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. | CRITICAL 9.1EPSS 2.70% | 24 June 2026 |
| CVE-2026-12848 | Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### DNS field stack overflow The following code is vulnerable to a stack overflow that is… | CRITICAL 10.0EPSS 0.60% | 24 June 2026 |
| CVE-2026-12847 | Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### Gateway field stack overflow The following code is vulnerable to a stack overflow that is… | CRITICAL 10.0EPSS 0.60% | 24 June 2026 |
| CVE-2026-12846 | Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### Net Mask field stack overflow The following code is vulnerable to a stack overflow that is… | CRITICAL 10.0EPSS 0.60% | 24 June 2026 |
| CVE-2026-12486 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. | CRITICAL 9.1EPSS 2.70% | 24 June 2026 |
| CVE-2026-12485 | Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a pointer to the buffer is stored in a global variable: #### IP field stack overflow The following code is vulnerable to a stack overflow that is… | CRITICAL 10.0EPSS 0.60% | 24 June 2026 |
| CVE-2026-54588 | Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. | CRITICAL 9.6EPSS 0.54% | 23 June 2026 |
| CVE-2026-11807 | A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. | CRITICAL 9.6EPSS 0.53% | 23 June 2026 |
| CVE-2026-53753 | Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. | CRITICAL 10.0EPSS 2.90% | 23 June 2026 |
| CVE-2026-54257 | From 42.3.1 until 42.3.3, Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. | CRITICAL 9.3EPSS 0.43% | 23 June 2026 |
| CVE-2026-54157 | An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. | CRITICAL 9.0EPSS 1.83% | 23 June 2026 |
| CVE-2026-53662 | From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. | CRITICAL 9.6EPSS 0.43% | 23 June 2026 |
| CVE-2026-44726 | A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed… | CRITICAL 9.1EPSS 0.23% | 23 June 2026 |
| CVE-2026-55450 | In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. | CRITICAL 9.3EPSS 1.19% | 23 June 2026 |
| CVE-2026-55447 | Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. | CRITICAL 9.6EPSS 0.66% | 23 June 2026 |
| CVE-2026-50574 | Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. | CRITICAL 9.6EPSS 0.46% | 23 June 2026 |
| CVE-2026-50023 | Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. | CRITICAL 9.6EPSS 0.66% | 23 June 2026 |
| CVE-2026-48519 | Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. | CRITICAL 9.6EPSS 0.78% | 23 June 2026 |
| CVE-2026-44791 | Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could bypass the patch for CVE-2026-42232 in the XML node. | CRITICAL 9.4EPSS 0.54% | 23 June 2026 |
| CVE-2026-44790 | Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leading to… | CRITICAL 9.4EPSS 0.53% | 23 June 2026 |
| CVE-2026-44789 | Combined with other techniques this could lead to RCE on the instance. | CRITICAL 9.4EPSS 0.53% | 23 June 2026 |
| CVE-2026-35019 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the… | CRITICAL 9.2EPSS 0.81% | 23 June 2026 |
| CVE-2026-28496 | Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering system. | CRITICAL 9.4EPSS 1.91% | 23 June 2026 |
| CVE-2026-27604 | Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged `/api/system/*` endpoints. | CRITICAL 10.0EPSS 0.51% | 23 June 2026 |
| CVE-2026-56379 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. | CRITICAL 9.2EPSS 0.88% | 23 June 2026 |
| CVE-2026-56315 | picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. | CRITICAL 9.3EPSS 1.15% | 23 June 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.