Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 14 Nov, 05:18 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability
High7.8Exploited, CISA due date 2026-11-16EPSS 1.3%, higher than 70% of scored CVEscheckpoint Quantum Security Gateway and 1 moreCVSS 3.1 · 7.8CWE-732, CWE-862
UnrealIRCd Improper Neutralization of Delimiters Vulnerability
High8.6Exploited, CISA due date 2026-11-16EPSS 0.30%, higher than 23% of scored CVEsUnrealIRCdCVSS 3.1 · 8.6CWE-140
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEsMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEsGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 11%, higher than 96% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 9.3CWE-288
Trends
The last 30 days, by severity.
6,463 CVEs published, 508 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 142 | 29 | 0 |
| 5 Nov 2026 | 55 | 213 | 149 | 36 | 0 |
| 6 Nov 2026 | 41 | 148 | 202 | 47 | 6 |
| 7 Nov 2026 | 54 | 165 | 232 | 10 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 32 | 164 | 231 | 42 | 1 |
| 10 Nov 2026 | 117 | 1221 | 623 | 61 | 92 |
| 11 Nov 2026 | 51 | 285 | 237 | 44 | 47 |
| 12 Nov 2026 | 28 | 172 | 129 | 23 | 6 |
| 13 Nov 2026 | 67 | 327 | 337 | 52 | 9 |
| 14 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
Exploit likelihood (EPSS), last 30 days
- Under 1%5902
- 1% to 10%217
- 10% to 50%4
- 50% or more3
- Not scored yet337
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)514
- Missing authorization (CWE-862)382
- Heap-based buffer overflow (CWE-122)363
- Use after free (CWE-416)340
- Insecure direct object reference (CWE-639)228
- Incorrect authorization (CWE-863)212
- Out-of-bounds read (CWE-125)206
- SQL injection (CWE-89)184
- Server-side request forgery (CWE-918)183
- Out-of-bounds write (CWE-787)181
Matching CVEs
2,463 CVEs match these filters, page 13 of 99.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in HTTP/3 (QUIC) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Dell PowerScale InsightIQ weak password requirements
High8.1EPSS 0.19%, higher than 8% of scored CVEsDell PowerScale InsightIQCVSS 3.1 · 8.1CWE-521
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access.
Edito CMS deserialization of untrusted data
High8.4EPSS 0.14%, higher than 3% of scored CVEsEdito CMSCVSS 4.0 · 8.4CWE-502
Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue…
Edito CMS unrestricted file upload
High7.1EPSS 0.24%, higher than 14% of scored CVEsEdito CMSCVSS 4.0 · 7.1CWE-434
Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions…
Edito CMS expression language injection
High7.1EPSS 0.24%, higher than 16% of scored CVEsEdito CMSCVSS 4.0 · 7.1CWE-917
Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract…
Edito CMS improper signature verification
High8.7EPSS 0.19%, higher than 8% of scored CVEsEdito CMSCVSS 4.0 · 8.7CWE-347
Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted JWT containing an existing user identifier and, due to the lack of signature validation, obtain a valid,…
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.25%, higher than 17% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.27%, higher than 19% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.3EPSS 0.27%, higher than 19% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.3
Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
WP Ultimate CSV Importer code injection
High7.2EPSS 0.15%, higher than 4% of scored CVEsWP Ultimate CSV ImporterCVSS 3.1 · 7.2CWE-94
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the…
WPCOM Member improper authentication
High8.1EPSS 0.14%, higher than 3% of scored CVEsWPCOM MemberCVSS 3.1 · 8.1CWE-287
The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing unauthenticated attackers to brute-force a code issued to another user and log in as that user, including administrators, when WeChat official-account keyword…
WooCommerce Vindi Pagamento cross-site scripting
High7.5EPSS 0.17%, higher than 7% of scored CVEsWooCommerce Vindi PagamentoCVSS 3.1 · 7.5CWE-79
The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored…
WP Remote Users Sync improper privilege management
High7.5EPSS 0.17%, higher than 6% of scored CVEsWP Remote Users SyncCVSS 3.1 · 7.5CWE-269
The WP Remote Users Sync WordPress plugin before 2.2.1 does not restrict which account fields a synchronised site may set when it creates or updates users, allowing a site holding the shared synchronisation keys to assign the administrator role, modify any existing account and…
Advance Guest Post missing authorization
High7.5EPSS 0.14%, higher than 3% of scored CVEsAdvance Guest PostCVSS 3.1 · 7.5CWE-862
The Advance Guest Post WordPress plugin through 1.9 does not perform any authorization or ownership check when deleting media attachments, relying only on a nonce exposed to every site visitor, allowing unauthenticated users to permanently delete arbitrary Media Library…
LetsRecover SQL injection
High8.6EPSS 0.17%, higher than 7% of scored CVEsLetsRecoverCVSS 3.1 · 8.6CWE-89
The LetsRecover WordPress plugin through 1.2.0 does not sanitize a user-supplied value that is used as a database column name in one of its unauthenticated AJAX actions, allowing unauthenticated attackers to append SQL to the query and read arbitrary data from the database,…
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.22%, higher than 12% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.33%, higher than 27% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.31%, higher than 24% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Citrix NetScaler ADC vulnerability
High8.7EPSS 0.25%, higher than 17% of scored CVEsCitrix NetScaler ADC and 1 moreCVSS 4.0 · 8.7
Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
python-pillow Pillow out-of-bounds write
High8.4EPSS 0.45%, higher than 40% of scored CVEspython-pillow PillowCVSS 4.0 · 8.4CWE-787
Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.