Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 11 Nov, 02:49 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS not scored yetMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS not scored yetGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 1.6%, higher than 76% of scored CVEsBarracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 1.1%, higher than 65% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.27%, higher than 20% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
4,675 CVEs published, 346 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 13 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 14 Oct 2026 | 2 | 2 | 0 | 0 | 0 |
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 138 | 32 | 1 |
| 5 Nov 2026 | 55 | 213 | 148 | 36 | 1 |
| 6 Nov 2026 | 40 | 146 | 205 | 47 | 6 |
| 7 Nov 2026 | 57 | 161 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 22 | 149 | 218 | 42 | 39 |
| 10 Nov 2026 | 103 | 1151 | 587 | 43 | 233 |
| 11 Nov 2026 | 2 | 4 | 6 | 1 | 0 |
Exploit likelihood (EPSS), last 30 days
- Under 1%713
- 1% to 10%25
- 10% to 50%2
- 50% or more7
- Not scored yet3928
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Heap-based buffer overflow (CWE-122)343
- Cross-site scripting (CWE-79)323
- Use after free (CWE-416)276
- Missing authorization (CWE-862)229
- Out-of-bounds read (CWE-125)172
- Insecure direct object reference (CWE-639)164
- Server-side request forgery (CWE-918)147
- Path traversal (CWE-22)127
- Out-of-bounds write (CWE-787)126
- Incorrect authorization (CWE-863)126
Matching CVEs
148 CVEs match these filters, page 1 of 6.
Adobe Content Credentials Rust SDK incorrect authorization
Low2.9EPSS not scored yetAdobe Content Credentials Rust SDK and 1 moreCVSS 3.1 · 2.9CWE-863
CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depends on conditions…
Adobe Connect incorrect authorization
High8.8EPSS not scored yetAdobe ConnectCVSS 3.1 · 8.8CWE-863
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not…
Adobe Connect incorrect authorization
Critical9.1EPSS not scored yetAdobe ConnectCVSS 3.1 · 9.1CWE-863
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated access to sensitive information or functionality. Exploitation of this issue does not require user…
Adobe Connect incorrect authorization
Critical10.0EPSS not scored yetAdobe ConnectCVSS 3.1 · 10.0CWE-863
Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access to sensitive resources. Exploitation of this issue does not require user interaction. Scope…
Adobe Experience Manager 6.5 incorrect authorization
Critical9.9EPSS not scored yetAdobe Experience Manager 6.5CVSS 3.1 · 9.9CWE-863
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue…
Adobe Experience Manager as a Cloud Service incorrect authorization
Critical9.9EPSS not scored yetAdobe Experience Manager as a Cloud Service and 2 moreCVSS 3.1 · 9.9CWE-863
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue…
Adobe Media Encoder incorrect authorization
High7.7EPSS not scored yetAdobe Media EncoderCVSS 3.1 · 7.7CWE-863
Media Encoder is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a…
MongoDB Server incorrect authorization
High7.1EPSS not scored yetMongoDB ServerCVSS 4.0 · 7.1CWE-863
An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding only basic read-write privileges on a single database to define a view whose underlying processing is not fully subjected to privilege checking. Reading that…
MongoDB Server incorrect authorization
High8.6EPSS not scored yetMongoDB ServerCVSS 4.0 · 8.6CWE-863
MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read…
MongoDB Server incorrect authorization
Low2.3EPSS not scored yetMongoDB ServerCVSS 4.0 · 2.3CWE-863
A user with basic read-tier database privileges can use an option on a server-side data-change notification feature to receive the contents of certain restricted internal collections that the same user is refused on a direct read. The privilege check for the notification…
Adobe Audition incorrect authorization
High7.7EPSS not scored yetAdobe AuditionCVSS 3.1 · 7.7CWE-863
Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's…
Auth0 auth0-ai-langchain incorrect authorization
Not scoredEPSS not scored yetAuth0 auth0-ai-langchain and 1 moreNot scored yetCWE-863
The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and…
Auth0 AI JS incorrect authorization
Not scoredEPSS not scored yetAuth0 AI JSNot scored yetCWE-863
The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated…
Kong Gateway Enterprise incorrect authorization
High8.7EPSS not scored yetKong Gateway Enterprise and 1 moreCVSS 4.0 · 8.7CWE-863
Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role.
wintercms winter missing authorization
High8.3EPSS not scored yetwintercms winterCVSS 3.1 · 8.3CWE-862, CWE-863
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(),…
MongoDB Server incorrect authorization
High8.6EPSS not scored yetMongoDB ServerCVSS 4.0 · 8.6CWE-863
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data…
Microsoft Windows 10 incorrect authorization
High7.8EPSS not scored yetMicrosoft Windows 10 Version 1607 and 9 moreCVSS 3.1 · 7.8CWE-863
Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.
Microsoft Windows 11 incorrect authorization
High7.8EPSS not scored yetMicrosoft Windows 11 Version 24H2 and 3 moreCVSS 3.1 · 7.8CWE-863
Incorrect authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
harnessrouter missing authorization
Critical9.1EPSS not scored yetharnessrouterCVSS 3.1 · 9.1CWE-862, CWE-863
HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header…
Microsoft SharePoint Server Subscription Edition incorrect authorization
High8.8EPSS not scored yetMicrosoft SharePoint Server Subscription EditionCVSS 3.1 · 8.8CWE-863
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft Visual Studio Code code injection
High7.8EPSS not scored yetMicrosoft Visual Studio CodeCVSS 3.1 · 7.8CWE-94, CWE-863
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Microsoft SharePoint Server Subscription Edition incorrect authorization
Critical9.9EPSS not scored yetMicrosoft SharePoint Server Subscription EditionCVSS 3.1 · 9.9CWE-863
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft Visual Studio Code incorrect authorization
High8.3EPSS not scored yetMicrosoft Visual Studio CodeCVSS 3.1 · 8.3CWE-863
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Microsoft Visual Studio Code incorrect authorization
Medium6.5EPSS not scored yetMicrosoft Visual Studio CodeCVSS 3.1 · 6.5CWE-863
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Microsoft Windows 10 incorrect authorization
High7.8EPSS not scored yetMicrosoft Windows 10 Version 1607 and 9 moreCVSS 3.1 · 7.8CWE-863
Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.