Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 13 Nov, 05:11 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEsMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEsGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 8.9%, higher than 95% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 6.2%, higher than 94% of scored CVEsBarracuda Email Security Gateway (ESG) and 9 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.64%, higher than 51% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
5,735 CVEs published, 438 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 142 | 29 | 0 |
| 5 Nov 2026 | 55 | 213 | 149 | 36 | 0 |
| 6 Nov 2026 | 40 | 148 | 203 | 47 | 6 |
| 7 Nov 2026 | 54 | 164 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 31 | 165 | 231 | 42 | 1 |
| 10 Nov 2026 | 106 | 1189 | 596 | 45 | 178 |
| 11 Nov 2026 | 51 | 284 | 237 | 44 | 48 |
| 12 Nov 2026 | 28 | 172 | 129 | 23 | 6 |
| 13 Nov 2026 | 9 | 10 | 21 | 17 | 4 |
Exploit likelihood (EPSS), last 30 days
- Under 1%5232
- 1% to 10%188
- 10% to 50%2
- 50% or more4
- Not scored yet309
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)428
- Heap-based buffer overflow (CWE-122)357
- Use after free (CWE-416)327
- Missing authorization (CWE-862)314
- Insecure direct object reference (CWE-639)202
- Out-of-bounds read (CWE-125)192
- Incorrect authorization (CWE-863)172
- Server-side request forgery (CWE-918)169
- Out-of-bounds write (CWE-787)161
- Path traversal (CWE-22)158
Matching CVEs
2,260 CVEs match these filters, page 18 of 91.
Progressive Robot Ltd hMailServer allocation without limits
High7.5EPSS 0.47%, higher than 41% of scored CVEsProgressive Robot Ltd hMailServerCVSS 3.1 · 7.5CWE-770
Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree…
Progressive Robot Ltd hMailServer link following
High7.8EPSS 0.16%, higher than 5% of scored CVEsProgressive Robot Ltd hMailServerCVSS 3.1 · 7.8CWE-59
Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a…
Progressive Robot Ltd hMailServer improper certificate validation
High7.0EPSS 0.08%, higher than 0% of scored CVEsProgressive Robot Ltd hMailServerCVSS 3.1 · 7.0CWE-295
Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to…
Progressive Robot Ltd hMailServer improper certificate validation
High7.4EPSS 0.17%, higher than 6% of scored CVEsProgressive Robot Ltd hMailServerCVSS 3.1 · 7.4CWE-295
Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which…
Progressive Robot Ltd hMailServer improper certificate validation
High7.5EPSS 0.17%, higher than 7% of scored CVEsProgressive Robot Ltd hMailServerCVSS 3.1 · 7.5CWE-295
Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert (from 6.2.25) or, with TlsMode=verify-full and neither PostgreSQL…
Progressive Robot Ltd hMailServer uncontrolled search path
High7.8EPSS 0.17%, higher than 6% of scored CVEsProgressive Robot Ltd hMailServerCVSS 3.1 · 7.8CWE-427
Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation's Bin folder) as Latin-1 bytes, which the client reads in the…
Octopus Server incorrect authorization
High7.1EPSS 0.27%, higher than 20% of scored CVEsOctopus ServerCVSS 4.0 · 7.1CWE-863
In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform.
Zohocorp ADAudit Plus SQL injection
High8.8EPSS 2.9%, higher than 87% of scored CVEsZohocorp ADAudit PlusCVSS 3.1 · 8.8CWE-89
Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.
ARforms cross-site scripting
High7.2EPSS 0.25%, higher than 17% of scored CVEsARformsCVSS 3.1 · 7.2CWE-79
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
ARforms cross-site scripting
High7.2EPSS 0.29%, higher than 22% of scored CVEsARformsCVSS 3.1 · 7.2CWE-79
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Zohocorp ADAudit Plus SQL injection
High8.8EPSS 2.9%, higher than 87% of scored CVEsZohocorp ADAudit PlusCVSS 3.1 · 8.8CWE-89
Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.
ARforms unrestricted file upload
High8.1EPSS 0.56%, higher than 47% of scored CVEsARformsCVSS 3.1 · 8.1CWE-434
The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file…
Octopus Server incorrect authorization
High7.7EPSS 0.36%, higher than 31% of scored CVEsOctopus ServerCVSS 4.0 · 7.7CWE-863
In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login identities could result in that user being granted elevated permissions, up to and including system administrator access. This issue…
Octopus Server vulnerability
High8.7EPSS 0.22%, higher than 13% of scored CVEsOctopus ServerCVSS 4.0 · 8.7CWE-649
In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to…
Security For WooCommerce missing authorization
High7.5EPSS 0.27%, higher than 20% of scored CVEsSecurity For WooCommerceCVSS 3.1 · 7.5CWE-862
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before running several of its comment cleanup actions, allowing unauthenticated users to permanently delete all comments on the site, including approved ones and…
Security For WooCommerce missing authorization
High7.5EPSS 0.27%, higher than 19% of scored CVEsSecurity For WooCommerceCVSS 3.1 · 7.5CWE-862
The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current two-factor code or two-factor secret, allowing unauthenticated users to obtain them for any account and bypass the second factor on sites where its one-time password…
Security For WooCommerce missing authorization
High7.5EPSS 0.33%, higher than 26% of scored CVEsSecurity For WooCommerceCVSS 3.1 · 7.5CWE-862
The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before resetting two-factor authentication enrolment, allowing unauthenticated users to remove the second factor from any account, or from every account at once.
Smoove abandoned cart trigger for WooCommerce cross-site scripting
High8.8EPSS 0.41%, higher than 36% of scored CVEsSmoove abandoned cart trigger for WooCommerceCVSS 3.1 · 8.8CWE-79
The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted by visitors before outputting it in the admin dashboard, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks…
iChart insecure direct object reference
High8.8EPSS 0.34%, higher than 28% of scored CVEsiChartCVSS 3.1 · 8.8CWE-639
The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJAX actions, relying only on a nonce that any logged-in user can obtain, allowing users with a role as low as Subscriber to read, modify and permanently delete arbitrary…
Simpler Checkout improper privilege management
High7.5EPSS 0.26%, higher than 18% of scored CVEsSimpler CheckoutCVSS 3.1 · 7.5CWE-269
The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on…
Knowledge Building cross-site scripting
High7.1EPSS 0.23%, higher than 14% of scored CVEsKnowledge BuildingCVSS 3.1 · 7.1CWE-79
The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoing them back in the response of an AJAX action available to unauthenticated users, and serves that response as HTML, leading to a Reflected Cross-Site Scripting.
Knowledge Building cross-site scripting
High8.8EPSS 0.41%, higher than 36% of scored CVEsKnowledge BuildingCVSS 3.1 · 8.8CWE-79
The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through its reply feature, and publishes them without moderation, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against any visitor of the…
Contest Gallery unrestricted file upload
High8.8EPSS 0.73%, higher than 55% of scored CVEsContest GalleryCVSS 3.1 · 8.8CWE-434
The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a…
Forminator Forms improper privilege management
High8.1EPSS 0.37%, higher than 32% of scored CVEsForminator FormsCVSS 3.1 · 8.1CWE-269
The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the…
User Registration & Membership improper privilege management
High8.1EPSS 0.38%, higher than 33% of scored CVEsUser Registration & MembershipCVSS 3.1 · 8.1CWE-269
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.