Skip to main content
veriom
Menu

Explore Veriom products, resources, and account pages.

Free tool · No sign-in

CVE radar: the latest vulnerabilities, explained.

Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.

Updated 14 Nov, 05:18 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed

328Critical, last 7 days2,350High, last 7 days36Added to CISA KEV, 30 days1,781Exploited CVEs tracked

Patch first

Exploited in the wild, newest first.

CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.

  1. CVE-2026-123039

    Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

    High7.8Exploited, CISA due date 2026-11-16EPSS 1.3%, higher than 70% of scored CVEs

    checkpoint Quantum Security Gateway and 1 moreCVSS 3.1 · 7.8CWE-732, CWE-862

  2. CVE-2026-114713

    UnrealIRCd Improper Neutralization of Delimiters Vulnerability

    High8.6Exploited, CISA due date 2026-11-16EPSS 0.30%, higher than 23% of scored CVEs

    UnrealIRCdCVSS 3.1 · 8.6CWE-140

  3. CVE-2026-124194

    Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

    Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEs

    Microsoft Office and 6 moreCVSS 3.1 · 6.5CWE-356

  4. CVE-2026-125350

    Google Chromium Use-After-Free Vulnerability

    High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEs

    Google Chromium and 1 moreCVSS 3.1 · 8.8CWE-416

  5. CVE-2026-116606

    Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Critical9.3Exploited, CISA due date 2026-11-13EPSS 11%, higher than 96% of scored CVEs

    Barracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 9.3CWE-288

Every exploited CVE

Trends

The last 30 days, by severity.

6,463 CVEs published, 508 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.

CriticalHighMediumLowNot scored16 Oct 2026 to 14 Nov 2026
Show the numbers
DayCriticalHighMediumLowNot scored
16 Oct 202600100
17 Oct 202600000
18 Oct 202600000
19 Oct 202600000
20 Oct 202600000
21 Oct 202620000
22 Oct 202620000
23 Oct 202600000
24 Oct 202600000
25 Oct 202600000
26 Oct 202600000
27 Oct 202600000
28 Oct 202601000
29 Oct 202600000
30 Oct 202600000
31 Oct 202601000
1 Nov 202600000
2 Nov 202611000
3 Nov 202600100
4 Nov 202635158142290
5 Nov 202655213149360
6 Nov 202641148202476
7 Nov 2026541652321013
8 Nov 202623128143260
9 Nov 202632164231421
10 Nov 202611712216236192
11 Nov 2026512852374447
12 Nov 202628172129236
13 Nov 202667327337529
14 Nov 202600000

Exploit likelihood (EPSS), last 30 days

  1. Under 1%5902
  2. 1% to 10%217
  3. 10% to 50%4
  4. 50% or more3
  5. Not scored yet337

Most affected vendors, last 30 days

  1. Microsoft1095
  2. IBM343
  3. Google249
  4. Apache Software Foundation198
  5. openemr140
  6. Red Hat124
  7. FFmpeg121
  8. Adobe112
  9. Mozilla108
  10. Fortinet98

Matching CVEs

2,462 CVEs match these filters, page 11 of 99.

  1. CVE-2026-126320

    Finsys dockhand improper authorization

    High7.1EPSS 0.35%, higher than 30% of scored CVEs

    Finsys dockhandCVSS 4.0 · 7.1CWE-285

    Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view download arbitrary container files instead of requiring containers:exec. Authenticated Enterprise RBAC users can request any path from the files/download…

  2. CVE-2026-126319

    Finsys dockhand path traversal

    High7.1EPSS 0.29%, higher than 22% of scored CVEs

    Finsys dockhandCVSS 4.0 · 7.1CWE-22

    Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the encryption key,…

  3. CVE-2026-126317

    frappe hrms missing authorization

    High8.7EPSS 0.44%, higher than 39% of scored CVEs

    frappe hrmsCVSS 4.0 · 8.7CWE-862

    Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected…

  4. CVE-2026-126314

    frappe hrms missing authorization

    High8.7EPSS 0.44%, higher than 39% of scored CVEs

    frappe hrmsCVSS 4.0 · 8.7CWE-862

    Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for…

  5. CVE-2026-126312

    openbao case-sensitivity mistake

    High7.6EPSS 0.42%, higher than 37% of scored CVEs

    openbaoCVSS 4.0 · 7.6CWE-178

    OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical…

  6. CVE-2026-126310

    openbao improper authentication

    High7.0EPSS 0.50%, higher than 43% of scored CVEs

    openbaoCVSS 4.0 · 7.0CWE-287

    OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the…

  7. CVE-2026-126309

    openbao external control of a file name

    High7.6EPSS 0.42%, higher than 37% of scored CVEs

    openbaoCVSS 4.0 · 7.6CWE-73

    OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import…

  8. CVE-2026-126308

    coder sensitive data in a response

    High8.7EPSS 0.31%, higher than 24% of scored CVEs

    coderCVSS 4.0 · 8.7CWE-201

    The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a…

  9. CVE-2026-126307

    nezhahq nezha incorrect authorization

    High8.7EPSS 0.60%, higher than 49% of scored CVEs

    nezhahq nezhaCVSS 4.0 · 8.7CWE-863

    Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclared Dashboard…

  10. CVE-2026-126306

    espocrm cross-site scripting

    High8.6EPSS 0.43%, higher than 38% of scored CVEs

    espocrmCVSS 4.0 · 8.6CWE-79

    EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into…

  11. CVE-2026-126305

    espocrm cross-site scripting

    High8.5EPSS 0.37%, higher than 31% of scored CVEs

    espocrmCVSS 4.0 · 8.5CWE-79

    EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator…

  12. CVE-2026-126304

    nltk link following

    High8.7EPSS 0.52%, higher than 45% of scored CVEs

    nltkCVSS 4.0 · 8.7CWE-59

    NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words()…

  13. CVE-2026-126303

    nltk uncontrolled resource consumption

    High8.7EPSS 0.49%, higher than 43% of scored CVEs

    nltkCVSS 4.0 · 8.7CWE-400

    NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to…

  14. CVE-2026-126299

    nltk uncontrolled resource consumption

    High8.7EPSS 0.58%, higher than 48% of scored CVEs

    nltkCVSS 4.0 · 8.7CWE-400

    NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic…

  15. CVE-2026-126298

    nltk uncontrolled resource consumption

    High8.7EPSS 0.58%, higher than 48% of scored CVEs

    nltkCVSS 4.0 · 8.7CWE-400

    NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to…

  16. CVE-2026-126297

    nltk uncontrolled resource consumption

    High8.7EPSS 0.58%, higher than 48% of scored CVEs

    nltkCVSS 4.0 · 8.7CWE-400

    NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns,…

  17. CVE-2026-126295

    nltk path traversal

    High7.0EPSS 0.20%, higher than 10% of scored CVEs

    nltkCVSS 4.0 · 7.0CWE-22

    NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or…

  18. CVE-2026-126294

    getgrav grav improper authentication

    High8.7EPSS 0.53%, higher than 46% of scored CVEs

    getgrav gravCVSS 4.0 · 8.7CWE-287

    Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or…

  19. CVE-2026-126293

    nocodb allocation without limits

    High7.1EPSS 0.48%, higher than 42% of scored CVEs

    nocodbCVSS 4.0 · 7.1CWE-770

    NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversized files because data-attachment-v3.service.ts trusts the remote server's advertised content length. Attackers can point the v3 upload-by-URL endpoint at a…

  20. CVE-2026-126291

    nocodb SQL injection

    High8.7EPSS 0.46%, higher than 40% of scored CVEs

    nocodbCVSS 4.0 · 8.7CWE-89

    NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local…

  21. CVE-2026-126290

    nocodb information exposure

    High7.1EPSS 0.42%, higher than 36% of scored CVEs

    nocodbCVSS 4.0 · 7.1CWE-200

    NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without…

  22. CVE-2026-126286

    nocodb cross-site scripting

    High8.6EPSS 0.46%, higher than 41% of scored CVEs

    nocodbCVSS 4.0 · 8.6CWE-79

    NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted link that bypasses…

  23. CVE-2026-126285

    nocodb SQL injection

    High8.3EPSS 0.38%, higher than 32% of scored CVEs

    nocodbCVSS 4.0 · 8.3CWE-89

    NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values…

  24. CVE-2026-126283

    nocodb incorrect authorization

    High8.7EPSS 0.44%, higher than 39% of scored CVEs

    nocodbCVSS 4.0 · 8.7CWE-863

    NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete records on every base…

  25. CVE-2026-126282

    nocodb improper privilege management

    High8.6EPSS 0.35%, higher than 29% of scored CVEs

    nocodbCVSS 4.0 · 8.6CWE-269

    NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read, write and schema…

Reading the radar

CVSS, KEV and EPSS, briefly.

What is a CVE?

A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.

What does the CVSS score tell me?

CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.

What is EPSS?

FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.

How should I prioritise?

Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.

Where do the explanations come from?

Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.

How fresh is the data?

New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.

Know where a vulnerable component would sit in your systems.

A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.

See how Veriom maps an architectureTake the interactive tour

Sources

  • CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
  • Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
  • Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
  • Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.