Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 11 Nov, 10:27 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS not scored yetMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS not scored yetGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 1.6%, higher than 76% of scored CVEsBarracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 1.1%, higher than 65% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.27%, higher than 20% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
4,820 CVEs published, 350 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 13 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 14 Oct 2026 | 2 | 2 | 0 | 0 | 0 |
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 138 | 32 | 1 |
| 5 Nov 2026 | 55 | 213 | 148 | 36 | 1 |
| 6 Nov 2026 | 40 | 146 | 205 | 47 | 6 |
| 7 Nov 2026 | 57 | 161 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 22 | 149 | 218 | 42 | 39 |
| 10 Nov 2026 | 103 | 1151 | 587 | 43 | 233 |
| 11 Nov 2026 | 6 | 40 | 38 | 2 | 72 |
Exploit likelihood (EPSS), last 30 days
- Under 1%713
- 1% to 10%25
- 10% to 50%2
- 50% or more7
- Not scored yet4073
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Heap-based buffer overflow (CWE-122)343
- Cross-site scripting (CWE-79)340
- Use after free (CWE-416)276
- Missing authorization (CWE-862)231
- Out-of-bounds read (CWE-125)173
- Insecure direct object reference (CWE-639)164
- Server-side request forgery (CWE-918)148
- Path traversal (CWE-22)129
- Incorrect authorization (CWE-863)129
- Out-of-bounds write (CWE-787)128
Matching CVEs
2,146 CVEs match these filters, page 49 of 86.
electrovir augment-vir OS command injection
High7.8EPSS not scored yetelectrovir augment-virCVSS 3.1 · 7.8CWE-78
augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep() function exported by @augment-vir/node inserts caller-controlled search patterns directly into a double-quoted shell command string without sanitization (grep.ts:310). When the constructed…
rack uncontrolled resource consumption
High7.5EPSS not scored yetrackCVSS 3.1 · 7.5CWE-400
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small…
julianhille MuhammaraJS null pointer dereference
High7.5EPSS not scored yetjulianhille MuhammaraJSCVSS 3.1 · 7.5CWE-476
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream() in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter…
InternLM lmdeploy server-side request forgery
High7.5EPSS not scored yetInternLM lmdeployCVSS 3.1 · 7.5CWE-918
LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, _is_safe_url validates remote media URLs with urlparse while requests.Session().get interprets backslashes differently when sending the request. An attacker can…
aio-libs aiohttp allocation without limits
High8.7EPSS not scored yetaio-libs aiohttpCVSS 4.0 · 8.7CWE-770
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object…
pyload improper authentication
High8.1EPSS not scored yetpyloadCVSS 3.1 · 8.1CWE-287
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.check_apikey caches successful validation in self._apikey_cache using only the attacker-controlled key_id. After a legitimate key populates the cache, a forged API key with the…
pyload insufficient session expiration
High7.5EPSS not scored yetpyloadCVSS 3.1 · 7.5CWE-613
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/set_user_permission or /api/change_password.…
dynatrace-oss dynatrace-mcp missing authentication
High7.5EPSS not scored yetdynatrace-oss dynatrace-mcpCVSS 3.1 · 7.5CWE-306
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's…
trailbaseio trailbase insecure direct object reference
High8.6EPSS not scored yettrailbaseio trailbaseCVSS 4.0 · 8.6CWE-639
TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers…
Illumio Core Ven uncontrolled search path
High7.8EPSS not scored yetIllumio Core VenCVSS 3.1 · 7.8CWE-427
The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges.
Illumio Core Ven incorrect permission assignment
High7.8EPSS not scored yetIllumio Core VenCVSS 3.1 · 7.8CWE-732
Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer,…
Apple iOS and iPadOS use after free
High8.8EPSS not scored yetApple iOS and iPadOS and 3 moreCVSS 3.1 · 8.8CWE-416
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS…
Apple iOS and iPadOS incorrect authorization
High7.5EPSS not scored yetApple iOS and iPadOS and 3 moreCVSS 3.1 · 7.5CWE-863
An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able…
ronf asyncssh path traversal
High8.8EPSS not scored yetronf asyncsshCVSS 3.1 · 8.8CWE-22, CWE-50
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading…
zizmorcore zizmor sensitive data in logs
High7.0EPSS not scored yetzizmorcore zizmorCVSS 4.0 · 7.0CWE-532
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN,…
FFmpeg double free
High7.3EPSS not scored yetFFmpegCVSS 4.0 · 7.3CWE-415
FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs_sei.c where cbs_sei_delete_message() leaves a stale extension_data reference that ff_cbs_sei_add_message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message…
FFmpeg integer overflow
High8.5EPSS not scored yetFFmpegCVSS 4.0 · 8.5CWE-190
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow,…
FFmpeg out-of-bounds write
High8.5EPSS not scored yetFFmpegCVSS 4.0 · 8.5CWE-787
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/lcevcdec.c because LCEVC output picture dimensions are not validated against the allocated frame. Attackers can embed crafted LCEVC enhancement data with differing global configurations in H.264 or…
FFmpeg heap-based buffer overflow
High7.3EPSS not scored yetFFmpegCVSS 4.0 · 7.3CWE-122
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in libavcodec/exrenc.c that allows attackers to corrupt heap memory when encode_scanline_rle() processes frames taller than the encoder height. Attackers can supply crafted input whose resolution grows…
FFmpeg integer overflow
High8.5EPSS not scored yetFFmpegCVSS 4.0 · 8.5CWE-190
FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_prores_kostya_encode_init() that miscalculates frame_size_upper_bound using 32-bit arithmetic for large frame dimensions. Attackers can supply a high-resolution video transcoded with the prores_ks encoder,…
FFmpeg vulnerability
High7.3EPSS not scored yetFFmpegCVSS 4.0 · 7.3CWE-193
FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerability in get_exponent_dynamic() in libavcodec/nellymoserenc.c that allows writing one element past the opt and path allocations. Attackers can supply crafted audio to applications encoding Nellymoser with trellis…
FFmpeg out-of-bounds write
High7.3EPSS not scored yetFFmpegCVSS 4.0 · 7.3CWE-787
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv…
sipsorcery-org sipsorcery out-of-bounds read
High7.5EPSS not scored yetsipsorcery-org sipsorceryCVSS 3.1 · 7.5CWE-125, CWE-755
SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk…
rConfig missing authorization
High7.1EPSS not scored yetrConfigCVSS 4.0 · 7.1CWE-862
rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing…
Red Hat Fuse 7 vulnerability
High8.8EPSS not scored yetRed Hat Fuse 7 and 4 moreCVSS 3.1 · 8.8CWE-267
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.