Free tool · No sign-in
CVE radar: the latest vulnerabilities, explained.
Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.
Updated 13 Nov, 17:15 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed
Patch first
Exploited in the wild, newest first.
CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
Medium6.5Exploited, CISA due date 2026-11-24EPSS 1.6%, higher than 76% of scored CVEsMicrosoft Office and 6 moreCVSS 3.1 · 6.5CWE-356
Google Chromium Use-After-Free Vulnerability
High8.8Exploited, CISA due date 2026-11-24EPSS 0.96%, higher than 62% of scored CVEsGoogle Chromium and 1 moreCVSS 3.1 · 8.8CWE-416
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
Critical9.3Exploited, CISA due date 2026-11-13EPSS 11%, higher than 96% of scored CVEsBarracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 9.3CWE-288
Barracuda Networks Multiple Products OS Command Injection Vulnerability
High8.6Exploited, CISA due date 2026-11-13EPSS 9.1%, higher than 95% of scored CVEsBarracuda Email Security Gateway (ESG) and 9 moreCVSS 4.0 · 8.6CWE-78
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.64%, higher than 51% of scored CVEsOpenwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669
Trends
The last 30 days, by severity.
6,287 CVEs published, 490 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.
Show the numbers
| Day | Critical | High | Medium | Low | Not scored |
|---|---|---|---|---|---|
| 15 Oct 2026 | 1 | 2 | 0 | 0 | 0 |
| 16 Oct 2026 | 0 | 0 | 1 | 0 | 0 |
| 17 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 18 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 20 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 21 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 22 Oct 2026 | 2 | 0 | 0 | 0 | 0 |
| 23 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 24 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 25 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 27 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 28 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 29 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 30 Oct 2026 | 0 | 0 | 0 | 0 | 0 |
| 31 Oct 2026 | 0 | 1 | 0 | 0 | 0 |
| 1 Nov 2026 | 0 | 0 | 0 | 0 | 0 |
| 2 Nov 2026 | 1 | 1 | 0 | 0 | 0 |
| 3 Nov 2026 | 0 | 0 | 1 | 0 | 0 |
| 4 Nov 2026 | 35 | 158 | 142 | 29 | 0 |
| 5 Nov 2026 | 55 | 213 | 149 | 36 | 0 |
| 6 Nov 2026 | 40 | 148 | 203 | 47 | 6 |
| 7 Nov 2026 | 54 | 164 | 232 | 11 | 13 |
| 8 Nov 2026 | 23 | 128 | 143 | 26 | 0 |
| 9 Nov 2026 | 31 | 165 | 231 | 42 | 1 |
| 10 Nov 2026 | 117 | 1216 | 621 | 61 | 99 |
| 11 Nov 2026 | 51 | 285 | 237 | 44 | 47 |
| 12 Nov 2026 | 28 | 172 | 129 | 23 | 6 |
| 13 Nov 2026 | 50 | 249 | 247 | 42 | 25 |
Exploit likelihood (EPSS), last 30 days
- Under 1%5904
- 1% to 10%217
- 10% to 50%4
- 50% or more4
- Not scored yet158
Most affected vendors, last 30 days
Most common weaknesses, last 30 days
- Cross-site scripting (CWE-79)493
- Missing authorization (CWE-862)371
- Heap-based buffer overflow (CWE-122)362
- Use after free (CWE-416)340
- Insecure direct object reference (CWE-639)222
- Out-of-bounds read (CWE-125)202
- Incorrect authorization (CWE-863)199
- Server-side request forgery (CWE-918)179
- Path traversal (CWE-22)177
- Out-of-bounds write (CWE-787)177
Matching CVEs
8,046 CVEs match these filters, page 250 of 322.
Stape Conversion Tracking server-side request forgery
High7.1EPSS 0.18%, higher than 8% of scored CVEsStape Conversion TrackingCVSS 3.1 · 7.1CWE-918
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its…
Premium Packages insecure direct object reference
Medium5.4EPSS 0.14%, higher than 3% of scored CVEsPremium PackagesCVSS 3.1 · 5.4CWE-639
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased…
Premium Packages information exposure
Medium5.3EPSS 0.21%, higher than 11% of scored CVEsPremium PackagesCVSS 3.1 · 5.3CWE-200
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including…
Premium Packages insecure direct object reference
Low3.7EPSS 0.16%, higher than 5% of scored CVEsPremium PackagesCVSS 3.1 · 3.7CWE-639
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
WPvivid — Backup, Migration & Staging path traversal
Medium5.5EPSS 0.28%, higher than 21% of scored CVEsWPvivid — Backup, Migration & StagingCVSS 3.1 · 5.5CWE-22
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the…
Duplicator SQL injection
Medium4.8EPSS 0.18%, higher than 8% of scored CVEsDuplicator and 1 moreCVSS 3.1 · 4.8CWE-89
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal…
WP Roster improper access control
Medium5.3EPSS 0.22%, higher than 13% of scored CVEsWP RosterCVSS 3.1 · 5.3CWE-284
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
Text Typing cross-site scripting
Medium6.8EPSS 0.29%, higher than 22% of scored CVEsText TypingCVSS 3.1 · 6.8CWE-79
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform…
WPvivid — Backup, Migration & Staging unrestricted file upload
Medium6.7EPSS 0.31%, higher than 24% of scored CVEsWPvivid — Backup, Migration & StagingCVSS 3.1 · 6.7CWE-434
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's…
WPvivid — Backup, Migration & Staging path traversal
Medium5.5EPSS 0.28%, higher than 21% of scored CVEsWPvivid — Backup, Migration & StagingCVSS 3.1 · 5.5CWE-22
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename…
WPvivid — Backup, Migration & Staging improper access control
Medium6.5EPSS 0.29%, higher than 21% of scored CVEsWPvivid — Backup, Migration & StagingCVSS 3.1 · 6.5CWE-284
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table…
Enable Media Replace cross-site scripting
Medium6.4EPSS 0.24%, higher than 15% of scored CVEsEnable Media ReplaceCVSS 3.1 · 6.4CWE-79
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user…
Duplicator error message exposure
Medium5.3EPSS 0.25%, higher than 17% of scored CVEsDuplicator and 1 moreCVSS 3.1 · 5.3CWE-209
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the…
Duplicator cross-site scripting
Medium5.8EPSS 0.15%, higher than 4% of scored CVEsDuplicator and 1 moreCVSS 3.1 · 5.8CWE-79
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the…
WP Remote Users Sync information exposure
Low3.7EPSS 0.26%, higher than 18% of scored CVEsWP Remote Users SyncCVSS 3.1 · 3.7CWE-200
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated…
Post Duplicator information exposure
Low2.7EPSS 0.23%, higher than 14% of scored CVEsPost DuplicatorCVSS 3.1 · 2.7CWE-200
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private…
Essential Real Estate insecure direct object reference
Medium6.5EPSS 0.21%, higher than 12% of scored CVEsEssential Real EstateCVSS 3.1 · 6.5CWE-639
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by…
PowerPack Addons for Elementor server-side request forgery
Medium4.1EPSS 0.22%, higher than 12% of scored CVEsPowerPack Addons for Elementor: Widgets, Form Styler and TemplatesCVSS 3.1 · 4.1CWE-918
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request…
FV Flowplayer Video Player missing authorization
Low3.8EPSS 0.19%, higher than 8% of scored CVEsFV Flowplayer Video PlayerCVSS 3.1 · 3.8CWE-862
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify…
FV Flowplayer Video Player insecure direct object reference
Low3.8EPSS 0.19%, higher than 8% of scored CVEsFV Flowplayer Video PlayerCVSS 3.1 · 3.8CWE-639
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records…
SEOPress cross-site scripting
High7.1EPSS 0.29%, higher than 22% of scored CVEsSEOPressCVSS 3.1 · 7.1CWE-79
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an…
Kali Forms cross-site scripting
Medium6.8EPSS 0.36%, higher than 30% of scored CVEsKali Forms — Contact Form & Drag-and-Drop BuilderCVSS 3.1 · 6.8CWE-79
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in…
Booking Package improper access control
Medium5.3EPSS 0.28%, higher than 21% of scored CVEsBooking PackageCVSS 3.1 · 5.3CWE-284
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
Form Maker by 10Web cross-site scripting
High7.5EPSS 0.27%, higher than 19% of scored CVEsForm Maker by 10WebCVSS 3.1 · 7.5CWE-79
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an…
ERP information exposure
Medium4.3EPSS 0.27%, higher than 20% of scored CVEsERP: Complete HR, Accounting & CRM Suite Built for WooCommerceCVSS 3.1 · 4.3CWE-200
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers,…
Reading the radar
CVSS, KEV and EPSS, briefly.
What is a CVE?
A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.
What does the CVSS score tell me?
CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.
What is CISA KEV?
The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.
What is EPSS?
FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.
How should I prioritise?
Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.
Where do the explanations come from?
Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.
How fresh is the data?
New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.
Know where a vulnerable component would sit in your systems.
A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.
Sources
- CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
- Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
- Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
- Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.