Skip to main content
veriom
Menu

Explore Veriom products, resources, and account pages.

Free tool · No sign-in

CVE radar: the latest vulnerabilities, explained.

Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.

Updated 14 Nov, 04:18 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed

368Critical, last 7 days2,453High, last 7 days36Added to CISA KEV, 30 days1,781Exploited CVEs tracked

Patch first

Exploited in the wild, newest first.

CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.

  1. CVE-2026-123039

    Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Vulnerability

    High7.8Exploited, CISA due date 2026-11-16EPSS 1.3%, higher than 70% of scored CVEs

    checkpoint Quantum Security Gateway and 1 moreCVSS 3.1 · 7.8CWE-732, CWE-862

  2. CVE-2026-114713

    UnrealIRCd Improper Neutralization of Delimiters Vulnerability

    High8.6Exploited, CISA due date 2026-11-16EPSS 0.30%, higher than 23% of scored CVEs

    UnrealIRCdCVSS 3.1 · 8.6CWE-140

  3. CVE-2026-124194

    Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

    Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEs

    Microsoft Office and 6 moreCVSS 3.1 · 6.5CWE-356

  4. CVE-2026-125350

    Google Chromium Use-After-Free Vulnerability

    High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEs

    Google Chromium and 1 moreCVSS 3.1 · 8.8CWE-416

  5. CVE-2026-116606

    Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Critical9.3Exploited, CISA due date 2026-11-13EPSS 11%, higher than 96% of scored CVEs

    Barracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 9.3CWE-288

Every exploited CVE

Trends

The last 30 days, by severity.

6,463 CVEs published, 508 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.

CriticalHighMediumLowNot scored16 Oct 2026 to 14 Nov 2026
Show the numbers
DayCriticalHighMediumLowNot scored
16 Oct 202600100
17 Oct 202600000
18 Oct 202600000
19 Oct 202600000
20 Oct 202600000
21 Oct 202620000
22 Oct 202620000
23 Oct 202600000
24 Oct 202600000
25 Oct 202600000
26 Oct 202600000
27 Oct 202600000
28 Oct 202601000
29 Oct 202600000
30 Oct 202600000
31 Oct 202601000
1 Nov 202600000
2 Nov 202611000
3 Nov 202600100
4 Nov 202635158142290
5 Nov 202655213149360
6 Nov 202641148202476
7 Nov 2026541652321013
8 Nov 202623128143260
9 Nov 202632164231421
10 Nov 202611712216236192
11 Nov 2026512852374447
12 Nov 202628172129236
13 Nov 202667327337529
14 Nov 202600000

Exploit likelihood (EPSS), last 30 days

  1. Under 1%5902
  2. 1% to 10%217
  3. 10% to 50%4
  4. 50% or more3
  5. Not scored yet337

Most affected vendors, last 30 days

  1. Microsoft1095
  2. IBM343
  3. Google249
  4. Apache Software Foundation198
  5. openemr140
  6. Red Hat124
  7. FFmpeg121
  8. Adobe112
  9. Mozilla108
  10. Fortinet98

Matching CVEs

2,462 CVEs match these filters, page 3 of 99.

  1. CVE-2026-129143

    itwanger paicoding missing authorization

    High8.7EPSS not scored yet

    itwanger paicodingCVSS 4.0 · 8.7CWE-862

    paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve…

  2. CVE-2026-129139

    itwanger paicoding vulnerability

    High8.8EPSS not scored yet

    itwanger paicodingCVSS 4.0 · 8.8CWE-1391

    paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the…

  3. CVE-2026-126091

    iDentalSoft sensitive data in accessible files

    High8.7EPSS not scored yet

    iDentalSoftCVSS 4.0 · 8.7CWE-538

    Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.

  4. CVE-2026-124680

    Apache APISIX interpretation conflict

    High7.0EPSS not scored yet

    Apache APISIXCVSS 4.0 · 7.0CWE-436

    Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream does not collapse…

  5. CVE-2026-124679

    Apache APISIX authentication bypass by spoofing

    High7.8EPSS not scored yet

    Apache APISIXCVSS 4.0 · 7.8CWE-290

    Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can…

  6. CVE-2026-123177

    Red Hat Hardened Images missing authorization

    High8.4EPSS not scored yet

    Red Hat Hardened ImagesCVSS 3.1 · 8.4CWE-862

    A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root,…

  7. CVE-2026-107398

    indico relative path traversal

    High7.1EPSS not scored yet

    indicoCVSS 4.0 · 7.1CWE-23

    Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running…

  8. CVE-2026-63167

    Omnispace Agora Project SQL injection

    High8.5EPSS not scored yet

    Omnispace Agora ProjectCVSS 4.0 · 8.5CWE-89

    Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and…

  9. CVE-2026-63164

    Omnispace Agora Project insecure direct object reference

    High7.1EPSS not scored yet

    Omnispace Agora ProjectCVSS 4.0 · 7.1CWE-639

    Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership…

  10. CVE-2026-63151

    Omnispace Agora Project vulnerability

    High8.7EPSS not scored yet

    Omnispace Agora ProjectCVSS 4.0 · 8.7CWE-330

    Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both…

  11. CVE-2026-63150

    Omnispace Agora Project cross-site request forgery

    High8.6EPSS not scored yet

    Omnispace Agora ProjectCVSS 4.0 · 8.6CWE-352

    Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can…

  12. CVE-2026-129134

    meeting-room-booking-system mrbs-code weak password recovery

    High8.6EPSS not scored yet

    meeting-room-booking-system mrbs-codeCVSS 4.0 · 8.6CWE-640

    MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to…

  13. CVE-2026-129130

    callstack agent-device external control of a file name

    High7.1EPSS not scored yet

    callstack agent-deviceCVSS 4.0 · 7.1CWE-73

    agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read…

  14. CVE-2026-129128

    aaif-goose goose OS command injection

    High8.4EPSS not scored yet

    aaif-goose gooseCVSS 4.0 · 8.4CWE-78

    Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without…

  15. CVE-2026-129123

    OpenKermit C-Kermit classic buffer overflow

    High8.7EPSS not scored yet

    OpenKermit C-KermitCVSS 4.0 · 8.7CWE-120

    C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies…

  16. CVE-2026-129122

    OpenKermit C-Kermit out-of-bounds write

    High7.7EPSS not scored yet

    OpenKermit C-KermitCVSS 4.0 · 7.7CWE-787

    C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable…

  17. CVE-2026-129119

    OpenKermit C-Kermit incorrect authorization

    High7.1EPSS not scored yet

    OpenKermit C-KermitCVSS 4.0 · 7.1CWE-863

    C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a…

  18. CVE-2026-129118

    OpenKermit C-Kermit vulnerability

    High7.6EPSS not scored yet

    OpenKermit C-KermitCVSS 4.0 · 7.6CWE-297

    C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing…

  19. CVE-2026-129117

    OpenKermit C-Kermit vulnerability

    High7.6EPSS not scored yet

    OpenKermit C-KermitCVSS 4.0 · 7.6CWE-297

    C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet…

  20. CVE-2026-129116

    OpenKermit C-Kermit improper authentication

    High7.7EPSS not scored yet

    OpenKermit C-KermitCVSS 4.0 · 7.7CWE-287

    C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as…

  21. CVE-2026-124279

    elixir-grpc grpc_server allocation without limits

    High8.2EPSS not scored yet

    elixir-grpc grpc_serverCVSS 4.0 · 8.2CWE-770

    Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of…

  22. CVE-2026-121809

    elixir-grpc grpc_server uncontrolled resource consumption

    High8.2EPSS not scored yet

    elixir-grpc grpc_server and 1 moreCVSS 4.0 · 8.2CWE-400, CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.…

  23. CVE-2026-95615

    Zenitel Connect OS command injection

    High8.7EPSS not scored yet

    Zenitel ConnectCVSS 4.0 · 8.7CWE-78

    OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.

  24. CVE-2026-95613

    Zenitel Connect unnecessary privileges

    High8.6EPSS not scored yet

    Zenitel ConnectCVSS 4.0 · 8.6CWE-250, CWE-266

    The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while…

  25. CVE-2026-95379

    Zenitel VSFF6 relative path traversal

    High7.0EPSS not scored yet

    Zenitel VSFF6 and 4 moreCVSS 4.0 · 7.0CWE-23

    Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete…

Reading the radar

CVSS, KEV and EPSS, briefly.

What is a CVE?

A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.

What does the CVSS score tell me?

CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.

What is EPSS?

FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.

How should I prioritise?

Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.

Where do the explanations come from?

Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.

How fresh is the data?

New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.

Know where a vulnerable component would sit in your systems.

A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.

See how Veriom maps an architectureTake the interactive tour

Sources

  • CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
  • Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
  • Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
  • Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.