Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,069 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
41,381 results · page 1 of 828
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-114425 | An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. | CRITICAL 9.2EPSS — | 4 November 2026 |
| CVE-2026-114424 | SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacement rules. | CRITICAL 9.2EPSS — | 4 November 2026 |
| CVE-2026-121802 | @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. | CRITICAL 9.1EPSS — | 4 November 2026 |
| CVE-2026-121615 | A vulnerability was determined in Linksys E5600 1.1.0.26. | CRITICAL 9.3EPSS — | 4 November 2026 |
| CVE-2026-121609 | A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. | CRITICAL 9.3EPSS — | 4 November 2026 |
| CVE-2026-121607 | A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. | CRITICAL 9.3EPSS — | 4 November 2026 |
| CVE-2026-121606 | A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. | CRITICAL 9.3EPSS — | 4 November 2026 |
| CVE-2026-92190 | Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS — | 4 November 2026 |
| CVE-2026-92189 | Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS — | 4 November 2026 |
| CVE-2026-92188 | Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS — | 4 November 2026 |
| CVE-2026-114549 | NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS — | 4 November 2026 |
| CVE-2022-29966 | Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition. | CRITICAL 9.3EPSS — | 3 November 2026 |
| CVE-2026-22058 | StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests. | CRITICAL 9.1EPSS — | 3 November 2026 |
| CVE-2026-120931 | Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-119084 | Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the… | CRITICAL 9.2EPSS — | 3 November 2026 |
| CVE-2026-112354 | Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the… | CRITICAL 9.3EPSS — | 3 November 2026 |
| CVE-2026-95860 | SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. | CRITICAL 9.1EPSS — | 3 November 2026 |
| CVE-2026-82158 | Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. | CRITICAL 9.0EPSS — | 3 November 2026 |
| CVE-2026-121249 | Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121247 | Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121246 | Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121241 | Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121234 | Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121229 | Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121214 | Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121202 | Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121200 | Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121189 | Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121185 | Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121156 | Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121148 | Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121126 | Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121114 | Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121104 | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121089 | Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121086 | Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121077 | Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121076 | Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121074 | Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121071 | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121060 | Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121037 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121035 | Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121034 | Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-121030 | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-115732 | Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be… | CRITICAL 9.0EPSS — | 3 November 2026 |
| CVE-2026-115731 | Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user… | CRITICAL 9.4EPSS — | 3 November 2026 |
| CVE-2026-95733 | A vulnerability exists in a component of HPE Networking Fabric Composer. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-95732 | An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. | CRITICAL 9.6EPSS — | 3 November 2026 |
| CVE-2026-95731 | Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. | CRITICAL 9.8EPSS — | 3 November 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.