Skip to main content
veriom
Menu

Explore Veriom products, resources, and account pages.

Free tool · No sign-in

CVE radar: the latest vulnerabilities, explained.

Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.

Updated 11 Nov, 21:27 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed

335Critical, last 7 days2,109High, last 7 days40Added to CISA KEV, 30 days1,779Exploited CVEs tracked

Patch first

Exploited in the wild, newest first.

CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.

  1. CVE-2026-124194

    Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

    Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEs

    Microsoft Office and 6 moreCVSS 3.1 · 6.5CWE-356

  2. CVE-2026-125350

    Google Chromium Use-After-Free Vulnerability

    High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEs

    Google Chromium and 1 moreCVSS 3.1 · 8.8CWE-416

  3. CVE-2026-116606

    Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Critical9.3Exploited, CISA due date 2026-11-13EPSS 8.9%, higher than 95% of scored CVEs

    Barracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288

  4. CVE-2026-111560

    Barracuda Networks Multiple Products OS Command Injection Vulnerability

    High8.6Exploited, CISA due date 2026-11-13EPSS 6.2%, higher than 94% of scored CVEs

    Barracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78

  5. CVE-2026-111793

    Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

    Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.64%, higher than 51% of scored CVEs

    Openwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669

Every exploited CVE

Trends

The last 30 days, by severity.

5,114 CVEs published, 371 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.

CriticalHighMediumLowNot scored13 Oct 2026 to 11 Nov 2026
Show the numbers
DayCriticalHighMediumLowNot scored
13 Oct 202612000
14 Oct 202622000
15 Oct 202612000
16 Oct 202600100
17 Oct 202600000
18 Oct 202600000
19 Oct 202600000
20 Oct 202600000
21 Oct 202620000
22 Oct 202620000
23 Oct 202600000
24 Oct 202600000
25 Oct 202600000
26 Oct 202600000
27 Oct 202600000
28 Oct 202601000
29 Oct 202600000
30 Oct 202600000
31 Oct 202601000
1 Nov 202600000
2 Nov 202611000
3 Nov 202600100
4 Nov 202635158138321
5 Nov 202655213148361
6 Nov 202640146205476
7 Nov 2026571612321113
8 Nov 202623128143260
9 Nov 2026221492184239
10 Nov 2026103115059043230
11 Nov 2026271432093044

Exploit likelihood (EPSS), last 30 days

  1. Under 1%4630
  2. 1% to 10%175
  3. 10% to 50%2
  4. 50% or more7
  5. Not scored yet300

Most affected vendors, last 30 days

  1. Microsoft1096
  2. IBM322
  3. Apache Software Foundation187
  4. Google167
  5. FFmpeg121
  6. Adobe112
  7. Mozilla108
  8. Red Hat95
  9. JetBrains89
  10. openemr60

Matching CVEs

6,866 CVEs match these filters, page 129 of 275.

  1. CVE-2026-124429

    craftcms cms incorrect privilege assignment

    High8.7EPSS 0.30%, higher than 23% of scored CVEs

    craftcms cmsCVSS 4.0 · 8.7CWE-266

    Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers can register using a deactivated account, set a new…

  2. CVE-2026-124428

    craftcms cms path traversal

    High7.1EPSS 0.34%, higher than 28% of scored CVEs

    craftcms cmsCVSS 4.0 · 7.1CWE-22

    Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths to the app/icon-svg endpoint. Attackers can supply aliases or absolute paths, which are resolved without…

  3. CVE-2026-124427

    craftcms cms missing authorization

    Critical9.3EPSS 0.37%, higher than 32% of scored CVEs

    craftcms cmsCVSS 4.0 · 9.3CWE-862

    Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles,…

  4. CVE-2026-124426

    craftcms cms missing authorization

    Medium6.9EPSS 0.27%, higher than 19% of scored CVEs

    craftcms cmsCVSS 4.0 · 6.9CWE-862

    Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field…

  5. CVE-2026-124425

    parse-community parse-server observable discrepancy

    Low2.3EPSS 0.21%, higher than 11% of scored CVEs

    parse-community parse-serverCVSS 4.0 · 2.3CWE-203

    Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an…

  6. CVE-2026-124424

    WWBN AVideo path traversal

    High7.1EPSS 0.38%, higher than 33% of scored CVEs

    WWBN AVideoCVSS 4.0 · 7.1CWE-22

    WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation…

  7. CVE-2026-124331

    Jinher OA SQL injection

    Medium5.5EPSS 0.25%, higher than 17% of scored CVEs

    Jinher OACVSS 4.0 · 5.5CWE-74, CWE-89

    A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The…

  8. CVE-2026-124330

    FlowCI flow-core-x path traversal

    Low1.3EPSS 0.31%, higher than 24% of scored CVEs

    FlowCI flow-core-xCVSS 4.0 · 1.3CWE-22

    A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path…

  9. CVE-2026-124329

    FlowCI flow-core-x path traversal

    Low1.3EPSS 0.31%, higher than 24% of scored CVEs

    FlowCI flow-core-xCVSS 4.0 · 1.3CWE-22

    A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A…

  10. CVE-2026-124328

    FlowCI flow-core-x code injection

    Low2.1EPSS 0.38%, higher than 32% of scored CVEs

    FlowCI flow-core-xCVSS 4.0 · 2.1CWE-74, CWE-94

    A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation…

  11. CVE-2026-124326

    DataLinkDC Dinky path traversal

    Low2.1EPSS 0.45%, higher than 39% of scored CVEs

    DataLinkDC DinkyCVSS 4.0 · 2.1CWE-22

    A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be…

  12. CVE-2026-97195

    Secure Custom Fields cross-site scripting

    Low3.5EPSS 0.14%, higher than 4% of scored CVEs

    Secure Custom FieldsCVSS 3.1 · 3.5CWE-79

    The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who…

  13. CVE-2026-97194

    Secure Custom Fields information exposure

    Low2.7EPSS 0.19%, higher than 9% of scored CVEs

    Secure Custom FieldsCVSS 3.1 · 2.7CWE-200

    The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of…

  14. CVE-2026-97193

    Secure Custom Fields insecure direct object reference

    Low2.7EPSS 0.17%, higher than 6% of scored CVEs

    Secure Custom FieldsCVSS 3.1 · 2.7CWE-639

    The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to…

  15. CVE-2026-97192

    Secure Custom Fields improper access control

    Low2.7EPSS 0.17%, higher than 6% of scored CVEs

    Secure Custom FieldsCVSS 3.1 · 2.7CWE-284

    The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to…

  16. CVE-2026-96963

    Pie Register missing authorization

    Low2.7EPSS 0.17%, higher than 6% of scored CVEs

    Pie RegisterCVSS 3.1 · 2.7CWE-862

    The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.

  17. CVE-2026-96961

    Pie Register missing authorization

    Medium6.5EPSS 0.25%, higher than 16% of scored CVEs

    Pie RegisterCVSS 3.1 · 6.5CWE-862

    The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults…

  18. CVE-2026-85344

    FV Flowplayer Video Player missing authorization

    Medium4.3EPSS 0.15%, higher than 4% of scored CVEs

    FV Flowplayer Video PlayerCVSS 3.1 · 4.3CWE-862

    The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they…

  19. CVE-2026-122085

    Event Tickets Manager for WooCommerce insecure direct object reference

    Medium6.5EPSS 0.16%, higher than 6% of scored CVEs

    Event Tickets Manager for WooCommerceCVSS 3.1 · 6.5CWE-639

    The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an…

  20. CVE-2026-122062

    Pronamic Pay information exposure

    Medium5.3EPSS 0.21%, higher than 11% of scored CVEs

    Pronamic Pay and 1 moreCVSS 3.1 · 5.3CWE-200

    The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled…

  21. CVE-2026-122060

    WP Recipe Maker information exposure

    Medium5.3EPSS 0.21%, higher than 11% of scored CVEs

    WP Recipe MakerCVSS 3.1 · 5.3CWE-200

    The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in…

  22. CVE-2026-114432

    Contact Form 7 unrestricted file upload

    Critical9.8EPSS 0.46%, higher than 40% of scored CVEs

    Contact Form 7CVSS 3.1 · 9.8CWE-434

    The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site.…

  23. CVE-2026-110963

    Userplace improper privilege management

    Critical9.8EPSS 0.28%, higher than 20% of scored CVEs

    UserplaceCVSS 3.1 · 9.8CWE-269

    The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site…

  24. CVE-2026-110132

    Sync Post With Other Site incorrect authorization

    Medium4.9EPSS 0.19%, higher than 9% of scored CVEs

    Sync Post With Other SiteCVSS 3.1 · 4.9CWE-863

    The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning…

  25. CVE-2026-109925

    Productive Commerce SQL injection

    High8.6EPSS 0.26%, higher than 18% of scored CVEs

    Productive CommerceCVSS 3.1 · 8.6CWE-89

    The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Reading the radar

CVSS, KEV and EPSS, briefly.

What is a CVE?

A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.

What does the CVSS score tell me?

CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.

What is EPSS?

FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.

How should I prioritise?

Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.

Where do the explanations come from?

Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.

How fresh is the data?

New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.

Know where a vulnerable component would sit in your systems.

A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.

See how Veriom maps an architectureTake the interactive tour

Sources

  • CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
  • Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
  • Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
  • Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.