Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 11 Nov, 22:28 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEsMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEsGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 8.9%, higher than 95% of scored CVEsBarracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 6.2%, higher than 94% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.64%, higher than 51% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
5,234 CVEs published, 388 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 13 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 14 Oct 2026 | 2 | 2 | 0 | 0 | 0 |
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 138 | 32 | 1 |
| 5 Nov 2026 | 55 | 213 | 148 | 36 | 1 |
| 6 Nov 2026 | 40 | 146 | 205 | 47 | 6 |
| 7 Nov 2026 | 57 | 161 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 22 | 149 | 218 | 42 | 39 |
| 10 Nov 2026 | 103 | 1150 | 590 | 43 | 230 |
| 11 Nov 2026 | 44 | 232 | 217 | 31 | 49 |
Exploit likelihood (EPSS), last 30 days
- Under 1%4630
- 1% to 10%175
- 10% to 50%2
- 50% or more7
- Not scored yet420
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)398
- Heap-based buffer overflow (CWE-122)346
- Missing authorization (CWE-862)288
- Use after free (CWE-416)280
- Insecure direct object reference (CWE-639)188
- Out-of-bounds read (CWE-125)174
- Server-side request forgery (CWE-918)162
- Incorrect authorization (CWE-863)151
- Path traversal (CWE-22)144
- Out-of-bounds write (CWE-787)136
Matching CVEs
6,986 CVEs match these filters, page 134 of 280.
WWBN AVideo path traversal
High7.1EPSS 0.38%, higher than 33% of scored CVEsWWBN AVideoCVSS 4.0 · 7.1CWE-22
WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting traversal sequences into the unsanitized response[lang] parameter. Attackers can send a type=translation…
Jinher OA SQL injection
Medium5.5EPSS 0.25%, higher than 17% of scored CVEsJinher OACVSS 4.0 · 5.5CWE-74, CWE-89
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The…
FlowCI flow-core-x path traversal
Low1.3EPSS 0.31%, higher than 24% of scored CVEsFlowCI flow-core-xCVSS 4.0 · 1.3CWE-22
A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path…
FlowCI flow-core-x path traversal
Low1.3EPSS 0.31%, higher than 24% of scored CVEsFlowCI flow-core-xCVSS 4.0 · 1.3CWE-22
A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A…
FlowCI flow-core-x code injection
Low2.1EPSS 0.38%, higher than 32% of scored CVEsFlowCI flow-core-xCVSS 4.0 · 2.1CWE-74, CWE-94
A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation…
DataLinkDC Dinky path traversal
Low2.1EPSS 0.45%, higher than 39% of scored CVEsDataLinkDC DinkyCVSS 4.0 · 2.1CWE-22
A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be…
Secure Custom Fields cross-site scripting
Low3.5EPSS 0.14%, higher than 4% of scored CVEsSecure Custom FieldsCVSS 3.1 · 3.5CWE-79
The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user able to configure its fields to store a payload that executes as JavaScript in the browser of any user who…
Secure Custom Fields information exposure
Low2.7EPSS 0.19%, higher than 9% of scored CVEsSecure Custom FieldsCVSS 3.1 · 2.7CWE-200
The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of…
Secure Custom Fields insecure direct object reference
Low2.7EPSS 0.17%, higher than 6% of scored CVEsSecure Custom FieldsCVSS 3.1 · 2.7CWE-639
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or remove a reference to…
Secure Custom Fields improper access control
Low2.7EPSS 0.17%, higher than 6% of scored CVEsSecure Custom FieldsCVSS 3.1 · 2.7CWE-284
The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, allowing users with contributor-level access and above to write custom fields the site restricted to…
Pie Register missing authorization
Low2.7EPSS 0.17%, higher than 6% of scored CVEsPie RegisterCVSS 3.1 · 2.7CWE-862
The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to modify existing administrator-created invitation-code records.
Pie Register missing authorization
Medium6.5EPSS 0.25%, higher than 16% of scored CVEsPie RegisterCVSS 3.1 · 6.5CWE-862
The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated attackers to reset the Pie Register WordPress plugin through 3.8.4.15's settings to their defaults…
FV Flowplayer Video Player missing authorization
Medium4.3EPSS 0.15%, higher than 4% of scored CVEsFV Flowplayer Video PlayerCVSS 3.1 · 4.3CWE-862
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, so any authenticated user, including subscriber-level, can trigger a bulk modification of posts they…
Event Tickets Manager for WooCommerce insecure direct object reference
Medium6.5EPSS 0.16%, higher than 6% of scored CVEsEvent Tickets Manager for WooCommerceCVSS 3.1 · 6.5CWE-639
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout tickets to an…
Pronamic Pay information exposure
Medium5.3EPSS 0.21%, higher than 11% of scored CVEsPronamic Pay and 1 moreCVSS 3.1 · 5.3CWE-200
The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled…
WP Recipe Maker information exposure
Medium5.3EPSS 0.21%, higher than 11% of scored CVEsWP Recipe MakerCVSS 3.1 · 5.3CWE-200
The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in…
Contact Form 7 unrestricted file upload
Critical9.8EPSS 0.46%, higher than 40% of scored CVEsContact Form 7CVSS 3.1 · 9.8CWE-434
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary files to the site.…
Userplace improper privilege management
Critical9.8EPSS 0.28%, higher than 20% of scored CVEsUserplaceCVSS 3.1 · 9.8CWE-269
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site…
Sync Post With Other Site incorrect authorization
Medium4.9EPSS 0.19%, higher than 9% of scored CVEsSync Post With Other SiteCVSS 3.1 · 4.9CWE-863
The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, including reassigning…
Productive Commerce SQL injection
High8.6EPSS 0.26%, higher than 18% of scored CVEsProductive CommerceCVSS 3.1 · 8.6CWE-89
The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Ecommerce Affiliate improper authentication
High8.1EPSS 0.23%, higher than 13% of scored CVEsEcommerce AffiliateCVSS 3.1 · 8.1CWE-287
The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including administrators.
Thanh Toán Quét Mã QR Code Tự Động improper access control
Medium5.3EPSS 0.24%, higher than 15% of scored CVEsThanh Toán Quét Mã QR Code Tự ĐộngCVSS 3.1 · 5.3CWE-284
The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid.
Razorpay for WooCommerce SQL injection
Medium4.1EPSS 0.19%, higher than 8% of scored CVEsRazorpay for WooCommerceCVSS 3.1 · 4.1CWE-89
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection attacks.
Razorpay for WooCommerce missing authorization
Low3.7EPSS 0.17%, higher than 6% of scored CVEsRazorpay for WooCommerceCVSS 3.1 · 3.7CWE-862
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as…
Razorpay for WooCommerce information exposure
Medium5.3EPSS 0.21%, higher than 11% of scored CVEsRazorpay for WooCommerceCVSS 3.1 · 5.3CWE-200
The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.