Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 13 Nov, 15:14 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEsMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEsGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 11%, higher than 96% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 9.1%, higher than 95% of scored CVEsBarracuda Email Security Gateway (ESG) and 9 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.64%, higher than 51% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
6,173 CVEs published, 473 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 142 | 29 | 0 |
| 5 Nov 2026 | 55 | 213 | 149 | 36 | 0 |
| 6 Nov 2026 | 40 | 148 | 203 | 47 | 6 |
| 7 Nov 2026 | 54 | 164 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 31 | 165 | 231 | 42 | 1 |
| 10 Nov 2026 | 110 | 1199 | 601 | 45 | 159 |
| 11 Nov 2026 | 51 | 284 | 237 | 44 | 48 |
| 12 Nov 2026 | 28 | 172 | 129 | 23 | 6 |
| 13 Nov 2026 | 40 | 191 | 204 | 39 | 25 |
Exploit likelihood (EPSS), last 30 days
- Under 1%5904
- 1% to 10%217
- 10% to 50%4
- 50% or more4
- Not scored yet44
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)475
- Missing authorization (CWE-862)359
- Heap-based buffer overflow (CWE-122)358
- Use after free (CWE-416)338
- Insecure direct object reference (CWE-639)221
- Out-of-bounds read (CWE-125)192
- Incorrect authorization (CWE-863)191
- Server-side request forgery (CWE-918)177
- Path traversal (CWE-22)174
- SQL injection (CWE-89)172
Matching CVEs
203 CVEs match these filters, page 1 of 9.
openemr SQL injection
High7.1EPSS 0.32%, higher than 26% of scored CVEsopenemrCVSS 4.0 · 7.1CWE-89
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which…
openemr SQL injection
High8.3EPSS 0.35%, higher than 29% of scored CVEsopenemrCVSS 4.0 · 8.3CWE-89
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options field_id values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious field_id, allowing any…
openemr SQL injection
High8.6EPSS 0.47%, higher than 42% of scored CVEsopenemrCVSS 4.0 · 8.6CWE-89
OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious…
openemr SQL injection
High8.3EPSS 0.38%, higher than 32% of scored CVEsopenemrCVSS 4.0 · 8.3CWE-89
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL…
openemr SQL injection
High7.1EPSS 0.38%, higher than 32% of scored CVEsopenemrCVSS 4.0 · 7.1CWE-89
OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause…
openemr SQL injection
High8.7EPSS 0.46%, higher than 40% of scored CVEsopenemrCVSS 4.0 · 8.7CWE-89
OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing…
openemr SQL injection
High8.6EPSS 0.40%, higher than 35% of scored CVEsopenemrCVSS 4.0 · 8.6CWE-89
OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove…
openemr SQL injection
High7.2EPSS 0.34%, higher than 27% of scored CVEsopenemrCVSS 4.0 · 7.2CWE-89
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that…
openemr SQL injection
High7.1EPSS 0.44%, higher than 39% of scored CVEsopenemrCVSS 4.0 · 7.1CWE-89
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR…
openemr SQL injection
High7.1EPSS 0.32%, higher than 26% of scored CVEsopenemrCVSS 4.0 · 7.1CWE-89
OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure…
openemr SQL injection
High7.1EPSS 0.32%, higher than 26% of scored CVEsopenemrCVSS 4.0 · 7.1CWE-89
OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file…
openemr SQL injection
High7.6EPSS 0.36%, higher than 31% of scored CVEsopenemrCVSS 4.0 · 7.6CWE-89
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA…
openemr SQL injection
High8.6EPSS 0.40%, higher than 35% of scored CVEsopenemrCVSS 4.0 · 8.6CWE-89
OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to…
openemr SQL injection
Medium4.6EPSS 0.29%, higher than 22% of scored CVEsopenemrCVSS 4.0 · 4.6CWE-89
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row.…
n8n-io n8n SQL injection
Medium4.9EPSS 0.34%, higher than 28% of scored CVEsn8n-io n8nCVSS 4.0 · 4.9CWE-89
n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted…
givanz Vvveb SQL injection
Medium5.3EPSS 0.28%, higher than 21% of scored CVEsgivanz VvvebCVSS 4.0 · 5.3CWE-89
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard.…
givanz Vvveb SQL injection
Medium5.3EPSS 0.26%, higher than 17% of scored CVEsgivanz VvvebCVSS 4.0 · 5.3CWE-89
Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit…
nocodb SQL injection
High8.7EPSS 0.46%, higher than 40% of scored CVEsnocodbCVSS 4.0 · 8.7CWE-89
NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local…
nocodb SQL injection
High8.3EPSS 0.38%, higher than 32% of scored CVEsnocodbCVSS 4.0 · 8.3CWE-89
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values…
mervb1 Easy Property Listings SQL injection
Medium6.5EPSS 0.47%, higher than 41% of scored CVEsmervb1 Easy Property ListingsCVSS 3.1 · 6.5CWE-89
The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…
contrid Newsletters SQL injection
Medium6.5EPSS 0.54%, higher than 46% of scored CVEscontrid NewslettersCVSS 3.1 · 6.5CWE-89
The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This…
aukejomm WPMR Google Feed Manager for WooCommerce SQL injection
Medium4.9EPSS 0.48%, higher than 42% of scored CVEsaukejomm WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & ShoppingCVSS 3.1 · 4.9CWE-89
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied…
expresstech Quiz and Survey Master (QSM) SQL injection
Medium6.5EPSS 0.46%, higher than 41% of scored CVEsexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey MakerCVSS 3.1 · 6.5CWE-89
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient…
SourceCodester Food Ordering System SQL injection
Medium5.5EPSS 0.26%, higher than 18% of scored CVEsSourceCodester Food Ordering SystemCVSS 4.0 · 5.5CWE-74, CWE-89
A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument…
pgEdge pgedge-postgres-mcp SQL injection
High8.8EPSS 0.37%, higher than 31% of scored CVEspgEdge pgedge-postgres-mcpCVSS 3.1 · 8.8CWE-89
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.