Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 11 Nov, 19:27 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS not scored yetMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS not scored yetGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 1.6%, higher than 76% of scored CVEsBarracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 1.1%, higher than 65% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.27%, higher than 20% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
5,074 CVEs published, 367 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 13 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 14 Oct 2026 | 2 | 2 | 0 | 0 | 0 |
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 138 | 32 | 1 |
| 5 Nov 2026 | 55 | 213 | 148 | 36 | 1 |
| 6 Nov 2026 | 40 | 146 | 205 | 47 | 6 |
| 7 Nov 2026 | 57 | 161 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 22 | 149 | 218 | 42 | 39 |
| 10 Nov 2026 | 103 | 1150 | 590 | 43 | 230 |
| 11 Nov 2026 | 23 | 130 | 192 | 24 | 44 |
Exploit likelihood (EPSS), last 30 days
- Under 1%713
- 1% to 10%25
- 10% to 50%2
- 50% or more7
- Not scored yet4327
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)393
- Heap-based buffer overflow (CWE-122)344
- Missing authorization (CWE-862)281
- Use after free (CWE-416)280
- Insecure direct object reference (CWE-639)179
- Out-of-bounds read (CWE-125)173
- Server-side request forgery (CWE-918)154
- Incorrect authorization (CWE-863)140
- Path traversal (CWE-22)136
- Out-of-bounds write (CWE-787)131
Matching CVEs
6,826 CVEs match these filters, page 118 of 274.
Apache Airflow insufficiently protected credentials
Not scoredEPSS not scored yetApache AirflowNot scored yetCWE-522
The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credentials. A user with permission to read connections could retrieve it in cleartext, although Airflow 3 treats connection credentials as…
Apache Airflow OS command injection
Not scoredEPSS not scored yetApache AirflowNot scored yetCWE-78
The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with Python's `ipaddress` module and then placed it into a shell command. `ipaddress` accepts IPv6 zone identifiers containing arbitrary characters, so when example…
TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk missing authorization
High8.1EPSS not scored yetTÜBİTAK BİLGEM Software Technologies Research Institute LiderahenkCVSS 3.1 · 8.1CWE-862
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3.
TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer time-of-check to time-of-use race
Medium6.0EPSS not scored yetTÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputerCVSS 3.1 · 6.0CWE-367
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus MyComputer: from 0.8.0 before 0.8.1.
Chengdu Feiyuxing Technology VW2100 command injection
High8.6EPSS not scored yetChengdu Feiyuxing Technology VW2100 and 1 moreCVSS 4.0 · 8.6CWE-77, CWE-78
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This issue affects the function add_expmac of the file var/html/webserver of the component Web Administration Interface. The manipulation of the argument mac results in os…
wummel patool link following
Medium4.8EPSS not scored yetwummel patoolCVSS 4.0 · 4.8CWE-59, CWE-61
A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack.…
WebTorrent path traversal
Low2.1EPSS not scored yetWebTorrentCVSS 4.0 · 2.1CWE-22
A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be…
itsourcecode Airline Reservation System SQL injection
Medium5.5EPSS not scored yetitsourcecode Airline Reservation SystemCVSS 4.0 · 5.5CWE-74, CWE-89
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. Affected is an unknown function of the file /admin/manage_flight.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has…
Eclipse Foundation otterdog eval injection
Critical9.5EPSS not scored yetEclipse Foundation otterdogCVSS 4.0 · 9.5CWE-95
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an…
Qt Framework allocation without limits
Low0.6EPSS not scored yetQt FrameworkCVSS 4.0 · 0.6CWE-770
Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module.
Chengdu Feiyuxing Technology VW2100 command injection
Critical9.3EPSS not scored yetChengdu Feiyuxing Technology VW2100 and 1 moreCVSS 4.0 · 9.3CWE-77, CWE-78
A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r11775. This impacts the function handle_wechat_cn_wifi of the file var/html/webserver of the component Weixin Auth Endpoint. The manipulation of the argument extend results in os…
aaPanel BillionMail injection
Low2.1EPSS not scored yetaaPanel BillionMailCVSS 4.0 · 2.1CWE-74, CWE-707
A vulnerability was determined in aaPanel BillionMail up to 4.9. Affected by this issue is some unknown functionality of the file core/api/relay/v1/relay.go of the component Relay Configuration API. Executing a manipulation of the argument helo_name can lead to injection. The…
Pantum BP5100DW improper authentication
Medium6.9EPSS not scored yetPantum BP5100DWCVSS 4.0 · 6.9CWE-287, CWE-306
A security vulnerability has been detected in Pantum BP5100DW 3.A.4.7. The impacted element is an unknown function of the file /shtml/omDB.shtml of the component Web Interface. The manipulation leads to missing authentication. The attack may be initiated remotely. The vendor…
Intelbras SG 2404 PoE L2+ improper authentication
High8.9EPSS not scored yetIntelbras SG 2404 PoE L2+CVSS 4.0 · 8.9CWE-287
A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.72. The affected element is an unknown function of the file /EXCU_SHELL of the component Web Management Interface. Executing a manipulation can lead to improper authentication. The attack can be launched…
Effekseer vulnerability
Medium5.1EPSS not scored yetEffekseerCVSS 4.0 · 5.1CWE-237
Effekseer improperly validates "effect" files. When a crafted effect file is loaded to the affected runtime, the host process may be forced to crash.
DOS Co., Ltd. SS1 path traversal
Medium6.9EPSS not scored yetDOS Co., Ltd. SS1 and 2 moreCVSS 4.0 · 6.9CWE-22
Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted.
DOS Co., Ltd. SS1 vulnerability
Medium5.1EPSS not scored yetDOS Co., Ltd. SS1CVSS 4.0 · 5.1CWE-922
Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd. Sensitive information used by the product may be obtained.
Advanced Appointment Booking & Scheduling missing authorization
Medium5.3EPSS not scored yetAdvanced Appointment Booking & SchedulingCVSS 3.1 · 5.3CWE-862
The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration setting before creating accounts through a publicly accessible shortcode, allowing unauthenticated attackers to register arbitrary user accounts, and be…
BeikeShop vulnerability
Medium6.9EPSS not scored yetBeikeShopCVSS 4.0 · 6.9CWE-840, CWE-841
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement…
SiteServer SSCMS unlimited sign-in attempts
Medium6.3EPSS not scored yetSiteServer SSCMSCVSS 4.0 · 6.3CWE-307, CWE-799
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument…
chenyme grok2api incorrect privilege assignment
Low2.1EPSS not scored yetchenyme grok2apiCVSS 4.0 · 2.1CWE-266, CWE-285
A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It…
logseq improper authentication
Medium5.5EPSS not scored yetlogseqCVSS 4.0 · 5.5CWE-287, CWE-306
A vulnerability was found in logseq 2.0.1/2.0.2. This affects the function validate-auth-token of the file src/electron/electron/server.cljs of the component Local HTTP API. The manipulation results in missing authentication. The attack may be performed from remote. The exploit…
DataLinkDC dinky path traversal
Medium5.3EPSS not scored yetDataLinkDC dinkyCVSS 4.0 · 5.3CWE-22
A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to…
WP Duplicate unrestricted file upload
Critical9.8EPSS not scored yetWP DuplicateCVSS 3.1 · 9.8CWE-434
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not validate the path or type of uploaded files, making it possible for unauthenticated attackers to write arbitrary files to the server and achieve remote code…
WooCommerce Stripe Payment Gateway information exposure
Medium4.4EPSS not scored yetWooCommerce Stripe Payment GatewayCVSS 3.1 · 4.4CWE-200
The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.