Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 11 Nov, 23:28 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEsMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEsGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 8.9%, higher than 95% of scored CVEsBarracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 6.2%, higher than 94% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.64%, higher than 51% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
5,325 CVEs published, 388 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 13 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 14 Oct 2026 | 2 | 2 | 0 | 0 | 0 |
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 138 | 32 | 1 |
| 5 Nov 2026 | 55 | 213 | 148 | 36 | 1 |
| 6 Nov 2026 | 40 | 146 | 205 | 47 | 6 |
| 7 Nov 2026 | 57 | 161 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 22 | 149 | 218 | 42 | 39 |
| 10 Nov 2026 | 103 | 1150 | 590 | 43 | 230 |
| 11 Nov 2026 | 44 | 233 | 221 | 34 | 132 |
Exploit likelihood (EPSS), last 30 days
- Under 1%4630
- 1% to 10%175
- 10% to 50%2
- 50% or more7
- Not scored yet511
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)398
- Heap-based buffer overflow (CWE-122)348
- Use after free (CWE-416)309
- Missing authorization (CWE-862)291
- Insecure direct object reference (CWE-639)188
- Out-of-bounds read (CWE-125)182
- Server-side request forgery (CWE-918)162
- Incorrect authorization (CWE-863)156
- Path traversal (CWE-22)145
- Out-of-bounds write (CWE-787)138
Matching CVEs
7,077 CVEs match these filters, page 140 of 284.
hickory-dns authentication bypass by spoofing
High8.9EPSS 0.24%, higher than 15% of scored CVEshickory-dnsCVSS 4.0 · 8.9CWE-290
The DNSSEC validation in the Hickory DNS hickory-net crate 0.26.0 before 0.26.2 identifies wraparound NSEC records by comparing the next domain name to an SOA record in the response, accepting that SOA even if it fails validation. Attackers who can supply DNS responses can…
hickory-dns uncontrolled resource consumption
High8.7EPSS 0.34%, higher than 28% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-400
Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which mishandles cyclic sibling name server referrals that lack glue records. Attackers controlling two zones whose name servers reference each other without glue…
hickory-dns uncontrolled resource consumption
Medium6.9EPSS 0.30%, higher than 23% of scored CVEshickory-dnsCVSS 4.0 · 6.9CWE-400
The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving recursive queries, sending queries that are unnecessary to answer the original request. Attackers controlling DNS responses can include CNAME records in the…
hickory-dns vulnerability
High8.2EPSS 0.37%, higher than 31% of scored CVEshickory-dnsCVSS 4.0 · 8.2CWE-696
The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP connection receives a datagram that cannot be parsed as a DNS message. Remote attackers who guess the query's source port, without knowing the transaction ID, can…
hickory-dns vulnerability
Medium6.3EPSS 0.12%, higher than 2% of scored CVEshickory-dnsCVSS 4.0 · 6.3CWE-349
The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2 does not apply out-of-bailiwick filtering to negative responses. Attackers able to supply crafted negative responses can include out-of-bailiwick records to…
hickory-dns insufficient verification of data authenticity
Medium6.3EPSS 0.12%, higher than 2% of scored CVEshickory-dnsCVSS 4.0 · 6.3CWE-345
The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not check whether the SOA record passed DNSSEC validation when assembling NXDOMAIN or NODATA responses. An attacker able to supply forged DNS responses can have a…
hickory-dns insufficient verification of data authenticity
Medium6.9EPSS 0.13%, higher than 2% of scored CVEshickory-dnsCVSS 4.0 · 6.9CWE-345
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw that accepts a response as a positive answer when any valid RRset appears in the answer section, without checking that the RRset is responsive to the…
hickory-dns authentication bypass by spoofing
High8.7EPSS 0.26%, higher than 17% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-290
Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can…
hickory-dns vulnerability
Medium6.3EPSS 0.22%, higher than 12% of scored CVEshickory-dnsCVSS 4.0 · 6.3CWE-358
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a zone with wildcard records, an attacker…
hickory-dns authentication bypass by spoofing
Medium6.3EPSS 0.28%, higher than 21% of scored CVEshickory-dnsCVSS 4.0 · 6.3CWE-290
Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section matches the query when the response has an empty question section (QDCOUNT=0), and also skip the case-randomization check. Remote attackers…
hickory-dns allocation without limits
High8.7EPSS 0.41%, higher than 36% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-770
Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via unbounded DoH request bodies. Attackers can send large request bodies over HTTP/2 or HTTP/3 to a DNS over HTTP server, causing memory…
hickory-dns allocation without limits
High8.7EPSS 0.41%, higher than 36% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-770
Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sending incomplete DNS-over-QUIC request bodies. Attackers can open many connections and send only large length prefixes, causing…
hickory-dns allocation without limits
High8.7EPSS 0.41%, higher than 36% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-770
Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections…
hickory-dns improper input validation
High8.7EPSS 0.34%, higher than 28% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-20
The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes or longer. Attackers who can supply untrusted zone files to an application using the parser can trigger the panic to cause a denial of…
hickory-dns improper input validation
High8.7EPSS 0.34%, higher than 28% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-20
hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a…
hickory-dns vulnerability
High8.7EPSS 0.34%, higher than 28% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-1286
Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser, which panics on malformed alpn values. Attackers can supply untrusted zone files with unbalanced quotes, consecutive commas,…
hickory-dns integer underflow
High8.7EPSS 0.41%, higher than 36% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-191
Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to trigger a panic via malformed records. Attackers can send a crafted TSIG record in DNS wire format to cause unchecked subtraction underflow,…
hickory-dns uncontrolled resource consumption
High8.7EPSS 0.41%, higher than 36% of scored CVEshickory-dnsCVSS 4.0 · 8.7CWE-400
The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCOUNT, NSCOUNT, and ARCOUNT header fields before reading record data. Remote attackers can send a UDP datagram, or a spoofed response to a…
sveltejs devalue allocation without limits
High8.7EPSS 0.34%, higher than 28% of scored CVEssveltejs devalueCVSS 4.0 · 8.7CWE-770
The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause…
sveltejs devalue prototype pollution
Low2.1EPSS 0.20%, higher than 10% of scored CVEssveltejs devalueCVSS 4.0 · 2.1CWE-1321
Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data…
sveltejs devalue prototype pollution
Medium6.3EPSS 0.24%, higher than 15% of scored CVEssveltejs devalueCVSS 4.0 · 6.3CWE-1321
Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges…
sveltejs devalue uncontrolled resource consumption
High8.7EPSS 0.34%, higher than 28% of scored CVEssveltejs devalueCVSS 4.0 · 8.7CWE-400
Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array…
sveltejs devalue uncontrolled resource consumption
High8.7EPSS 0.34%, higher than 28% of scored CVEssveltejs devalueCVSS 4.0 · 8.7CWE-400
Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized…
sveltejs devalue allocation without limits
High8.7EPSS 0.34%, higher than 28% of scored CVEssveltejs devalueCVSS 4.0 · 8.7CWE-770
Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an…
sveltejs devalue excessive memory allocation
High8.7EPSS 0.38%, higher than 32% of scored CVEssveltejs devalueCVSS 4.0 · 8.7CWE-789
Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.