Skip to main content
veriom
Menu

Explore Veriom products, resources, and account pages.

Free tool · No sign-in

CVE radar: the latest vulnerabilities, explained.

Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.

Updated 11 Nov, 02:49 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed

332Critical, last 7 days2,103High, last 7 days40Added to CISA KEV, 30 days1,779Exploited CVEs tracked

Patch first

Exploited in the wild, newest first.

CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.

  1. CVE-2026-124194

    Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

    Medium6.5Exploited, CISA due date 2026-11-24EPSS not scored yet

    Microsoft Office and 6 moreCVSS 3.1 · 6.5CWE-356

  2. CVE-2026-125350

    Google Chromium Use-After-Free Vulnerability

    High8.8Exploited, CISA due date 2026-11-24EPSS not scored yet

    Google Chromium and 1 moreCVSS 3.1 · 8.8CWE-416

  3. CVE-2026-116606

    Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Critical9.3Exploited, CISA due date 2026-11-13EPSS 1.6%, higher than 76% of scored CVEs

    Barracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288

  4. CVE-2026-111560

    Barracuda Networks Multiple Products OS Command Injection Vulnerability

    High8.6Exploited, CISA due date 2026-11-13EPSS 1.1%, higher than 65% of scored CVEs

    Barracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78

  5. CVE-2026-111793

    Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

    Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.27%, higher than 20% of scored CVEs

    Openwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669

Every exploited CVE

Trends

The last 30 days, by severity.

4,675 CVEs published, 346 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.

CriticalHighMediumLowNot scored13 Oct 2026 to 11 Nov 2026
Show the numbers
DayCriticalHighMediumLowNot scored
13 Oct 202612000
14 Oct 202622000
15 Oct 202612000
16 Oct 202600100
17 Oct 202600000
18 Oct 202600000
19 Oct 202600000
20 Oct 202600000
21 Oct 202620000
22 Oct 202620000
23 Oct 202600000
24 Oct 202600000
25 Oct 202600000
26 Oct 202600000
27 Oct 202600000
28 Oct 202601000
29 Oct 202600000
30 Oct 202600000
31 Oct 202601000
1 Nov 202600000
2 Nov 202611000
3 Nov 202600100
4 Nov 202635158138321
5 Nov 202655213148361
6 Nov 202640146205476
7 Nov 2026571612321113
8 Nov 202623128143260
9 Nov 2026221492184239
10 Nov 2026103115158743233
11 Nov 202624610

Exploit likelihood (EPSS), last 30 days

  1. Under 1%713
  2. 1% to 10%25
  3. 10% to 50%2
  4. 50% or more7
  5. Not scored yet3928

Most affected vendors, last 30 days

  1. Microsoft1096
  2. IBM322
  3. Google168
  4. Apache Software Foundation157
  5. FFmpeg121
  6. Adobe112
  7. Mozilla108
  8. JetBrains89
  9. Red Hat77
  10. openemr60

Matching CVEs

165 CVEs match these filters, page 6 of 7.

  1. CVE-2026-102940

    openemr insecure direct object reference

    Critical9.6EPSS 0.44%, higher than 39% of scored CVEs

    openemr and 1 moreCVSS 3.1 · 9.6CWE-639

    OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient…

  2. CVE-2026-69144

    SuiteCRM insecure direct object reference

    Medium6.5EPSS 0.31%, higher than 25% of scored CVEs

    SuiteCRMCVSS 3.1 · 6.5CWE-639, CWE-863

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a…

  3. CVE-2026-63218

    SuiteCRM insecure direct object reference

    Medium6.5EPSS 0.37%, higher than 31% of scored CVEs

    SuiteCRMCVSS 3.1 · 6.5CWE-639, CWE-863

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by DetailView. The…

  4. CVE-2026-63217

    SuiteCRM insecure direct object reference

    Medium6.5EPSS 0.30%, higher than 23% of scored CVEs

    SuiteCRMCVSS 3.1 · 6.5CWE-639

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's record access. The…

  5. CVE-2026-100364

    SuiteCRM insecure direct object reference

    High7.1EPSS 0.24%, higher than 16% of scored CVEs

    SuiteCRMCVSS 3.1 · 7.1CWE-639

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins…

  6. CVE-2026-77439

    immich-app immich improper privilege management

    High8.8EPSS 0.60%, higher than 49% of scored CVEs

    immich-app immichCVSS 3.1 · 8.8CWE-269, CWE-639

    Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoting the owner and…

  7. CVE-2026-107130

    balbooa.com Gridbox extension for Joomla insecure direct object reference

    Medium6.9EPSS 0.38%, higher than 32% of scored CVEs

    balbooa.com Gridbox extension for JoomlaCVSS 4.0 · 6.9CWE-639, CWE-862

    Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0

  8. CVE-2026-104867

    immich-app immich insecure direct object reference

    Medium4.3EPSS 0.31%, higher than 24% of scored CVEs

    immich-app immichCVSS 3.1 · 4.3CWE-284, CWE-639

    Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission without an admin-route…

  9. CVE-2026-122326

    Chevereto insecure direct object reference

    Medium6.9EPSS 0.52%, higher than 45% of scored CVEs

    CheveretoCVSS 4.0 · 6.9CWE-639

    Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and…

  10. CVE-2026-122325

    fossasia eventyay-exhibition insecure direct object reference

    Low2.3EPSS 0.22%, higher than 13% of scored CVEs

    fossasia eventyay-exhibitionCVSS 4.0 · 2.3CWE-639

    fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's…

  11. CVE-2026-122324

    oss-apps SplitPro insecure direct object reference

    Low2.3EPSS 0.22%, higher than 13% of scored CVEs

    oss-apps SplitProCVSS 4.0 · 2.3CWE-639

    SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants,…

  12. CVE-2026-122317

    oss-apps SplitPro insecure direct object reference

    Medium5.3EPSS 0.23%, higher than 14% of scored CVEs

    oss-apps SplitProCVSS 4.0 · 5.3CWE-639

    SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email,…

  13. CVE-2026-119751

    keywordrush Content Egg insecure direct object reference

    Medium6.9EPSS 0.26%, higher than 18% of scored CVEs

    keywordrush Content Egg – Affiliate Product Importer & Price ComparisonCVSS 4.0 · 6.9CWE-639, CWE-862

    Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose…

  14. CVE-2026-114272

    Apache OFBiz insecure direct object reference

    Medium6.5EPSS 0.19%, higher than 9% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 6.5CWE-639

    Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a…

  15. CVE-2026-114271

    Apache OFBiz insecure direct object reference

    Medium6.5EPSS 0.19%, higher than 9% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 6.5CWE-639

    Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take…

  16. CVE-2026-109837

    Apache OFBiz insecure direct object reference

    Medium5.4EPSS 0.19%, higher than 9% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 5.4CWE-639

    Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they…

  17. CVE-2026-109129

    Apache OFBiz insecure direct object reference

    Medium5.4EPSS 0.19%, higher than 9% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 5.4CWE-639

    Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their…

  18. CVE-2026-90967

    Essential Real Estate insecure direct object reference

    Medium4.3EPSS 0.16%, higher than 5% of scored CVEs

    Essential Real EstateCVSS 3.1 · 4.3CWE-639

    The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address…

  19. CVE-2026-86442

    WP Event Manager insecure direct object reference

    High8.2EPSS 0.19%, higher than 9% of scored CVEs

    WP Event ManagerCVSS 3.1 · 8.2CWE-639

    The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and…

  20. CVE-2026-16304

    WP Event Manager insecure direct object reference

    High8.1EPSS 0.20%, higher than 10% of scored CVEs

    WP Event ManagerCVSS 3.1 · 8.1CWE-639

    The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts…

  21. CVE-2026-122308

    kyverno insecure direct object reference

    High8.4EPSS 0.23%, higher than 14% of scored CVEs

    kyvernoCVSS 4.0 · 8.4CWE-639

    Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as…

  22. CVE-2026-57562

    readest insecure direct object reference

    Medium6.5EPSS 0.43%, higher than 37% of scored CVEs

    readestCVSS 3.1 · 6.5CWE-639

    Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the…

  23. CVE-2026-54377

    Shenzhen Shine Industrial Co., Ltd. VitaFit insecure direct object reference

    Medium6.9EPSS 0.18%, higher than 8% of scored CVEs

    Shenzhen Shine Industrial Co., Ltd. VitaFitCVSS 4.0 · 6.9CWE-639

    VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id}/report/ and GET…

  24. CVE-2026-122019

    6amTech 6valley improper authorization

    Medium5.5EPSS 0.29%, higher than 22% of scored CVEs

    6amTech 6valleyCVSS 4.0 · 5.5CWE-285, CWE-639

    A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization bypass. The attack…

  25. CVE-2026-103002

    gpustack insecure direct object reference

    High8.8EPSS 0.36%, higher than 30% of scored CVEs

    gpustackCVSS 3.1 · 8.8CWE-639, CWE-862

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization…

Reading the radar

CVSS, KEV and EPSS, briefly.

What is a CVE?

A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.

What does the CVSS score tell me?

CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.

What is EPSS?

FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.

How should I prioritise?

Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.

Where do the explanations come from?

Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.

How fresh is the data?

New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.

Know where a vulnerable component would sit in your systems.

A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.

See how Veriom maps an architectureTake the interactive tour

Sources

  • CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
  • Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
  • Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
  • Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.