Skip to main content
veriom
Menu

Explore Veriom products, resources, and account pages.

Free tool · No sign-in

CVE radar: the latest vulnerabilities, explained.

Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.

Updated 11 Nov, 02:49 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed

332Critical, last 7 days2,103High, last 7 days40Added to CISA KEV, 30 days1,779Exploited CVEs tracked

Patch first

Exploited in the wild, newest first.

CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.

  1. CVE-2026-124194

    Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

    Medium6.5Exploited, CISA due date 2026-11-24EPSS not scored yet

    Microsoft Office and 6 moreCVSS 3.1 · 6.5CWE-356

  2. CVE-2026-125350

    Google Chromium Use-After-Free Vulnerability

    High8.8Exploited, CISA due date 2026-11-24EPSS not scored yet

    Google Chromium and 1 moreCVSS 3.1 · 8.8CWE-416

  3. CVE-2026-116606

    Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Critical9.3Exploited, CISA due date 2026-11-13EPSS 1.6%, higher than 76% of scored CVEs

    Barracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288

  4. CVE-2026-111560

    Barracuda Networks Multiple Products OS Command Injection Vulnerability

    High8.6Exploited, CISA due date 2026-11-13EPSS 1.1%, higher than 65% of scored CVEs

    Barracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78

  5. CVE-2026-111793

    Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

    Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.27%, higher than 20% of scored CVEs

    Openwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669

Every exploited CVE

Trends

The last 30 days, by severity.

4,675 CVEs published, 346 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.

CriticalHighMediumLowNot scored13 Oct 2026 to 11 Nov 2026
Show the numbers
DayCriticalHighMediumLowNot scored
13 Oct 202612000
14 Oct 202622000
15 Oct 202612000
16 Oct 202600100
17 Oct 202600000
18 Oct 202600000
19 Oct 202600000
20 Oct 202600000
21 Oct 202620000
22 Oct 202620000
23 Oct 202600000
24 Oct 202600000
25 Oct 202600000
26 Oct 202600000
27 Oct 202600000
28 Oct 202601000
29 Oct 202600000
30 Oct 202600000
31 Oct 202601000
1 Nov 202600000
2 Nov 202611000
3 Nov 202600100
4 Nov 202635158138321
5 Nov 202655213148361
6 Nov 202640146205476
7 Nov 2026571612321113
8 Nov 202623128143260
9 Nov 2026221492184239
10 Nov 2026103115158743233
11 Nov 202624610

Exploit likelihood (EPSS), last 30 days

  1. Under 1%713
  2. 1% to 10%25
  3. 10% to 50%2
  4. 50% or more7
  5. Not scored yet3928

Most affected vendors, last 30 days

  1. Microsoft1096
  2. IBM322
  3. Google168
  4. Apache Software Foundation157
  5. FFmpeg121
  6. Adobe112
  7. Mozilla108
  8. JetBrains89
  9. Red Hat77
  10. openemr60

Matching CVEs

186 CVEs match these filters, page 7 of 8.

  1. CVE-2026-100302

    Apache ZooKeeper allocation without limits

    High7.1EPSS 0.53%, higher than 45% of scored CVEs

    Apache ZooKeeperCVSS 4.0 · 7.1CWE-770

    Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bundled read operations…

  2. CVE-2026-100300

    Apache ZooKeeper improper exception handling

    High8.7EPSS 0.48%, higher than 42% of scored CVEs

    Apache ZooKeeperCVSS 4.0 · 8.7CWE-755

    Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's critical…

  3. CVE-2026-100252

    Apache ZooKeeper incorrect authorization

    High8.6EPSS 0.53%, higher than 45% of scored CVEs

    Apache ZooKeeperCVSS 4.0 · 8.6CWE-863

    Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client…

  4. CVE-2026-100235

    Apache ZooKeeper time-of-check to time-of-use race

    Medium6.0EPSS 0.34%, higher than 27% of scored CVEs

    Apache ZooKeeperCVSS 4.0 · 6.0CWE-367

    Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any…

  5. CVE-2026-111822

    Apache ActiveMQ missing authentication

    High8.1EPSS 0.22%, higher than 12% of scored CVEs

    Apache ActiveMQ and 1 moreCVSS 3.1 · 8.1CWE-306

    Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change can keep sending to…

  6. CVE-2026-111821

    Apache ActiveMQ improper input validation

    High7.5EPSS 0.22%, higher than 12% of scored CVEs

    Apache ActiveMQ and 1 moreCVSS 3.1 · 7.5CWE-20

    Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB which can cause the…

  7. CVE-2026-108949

    Apache ActiveMQ memory leak

    Medium6.5EPSS 0.47%, higher than 41% of scored CVEs

    Apache ActiveMQ and 1 moreCVSS 3.1 · 6.5CWE-401

    Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left…

  8. CVE-2026-34486

    Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

    High7.5Exploited, CISA due date 2026-08-07EPSS 99%, higher than 100% of scored CVEs

    Apache Tomcat and 9 moreCVSS 3.1 · 7.5CWE-311, CWE-807

    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or…

  9. CVE-2026-34197

    Apache ActiveMQ Improper Input Validation Vulnerability

    High8.8Exploited, CISA due date 2026-04-30EPSS 98%, higher than 100% of scored CVEs

    Apache ActiveMQ and 9 moreCVSS 3.1 · 8.8CWE-20, CWE-94

    Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy…

  10. CVE-2025-24813

    Apache Tomcat Path Equivalence Vulnerability

    Critical9.8Exploited, CISA due date 2025-04-22EPSS 100%, higher than 100% of scored CVEs

    Apache Tomcat and 3 moreCVSS 3.1 · 9.8CWE-502, CWE-706

    Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from…

  11. CVE-2024-45195

    Apache OFBiz Forced Browsing Vulnerability

    High7.5Exploited, CISA due date 2025-02-25EPSS 100%, higher than 100% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 7.5CWE-425

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

  12. CVE-2024-38856

    Apache OFBiz Incorrect Authorization Vulnerability

    Critical9.8Exploited, CISA due date 2024-09-17EPSS 99%, higher than 100% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 9.8CWE-863

    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some…

  13. CVE-2024-38475

    Apache HTTP Server Improper Escaping of Output Vulnerability

    Critical9.1Exploited, CISA due date 2025-05-22EPSS 100%, higher than 100% of scored CVEs

    Apache HTTP Server and 7 moreCVSS 3.1 · 9.1CWE-116

    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or…

  14. CVE-2024-32113

    Apache OFBiz Path Traversal Vulnerability

    Critical9.8Exploited, CISA due date 2024-08-28EPSS 100%, higher than 100% of scored CVEs

    Apache OFBiz and 1 moreCVSS 3.1 · 9.8CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

  15. CVE-2024-27348

    Apache HugeGraph-Server Improper Access Control Vulnerability

    Critical9.8Exploited, CISA due date 2024-10-09EPSS 99%, higher than 100% of scored CVEs

    Apache HugeGraph-Server and 2 moreCVSS 3.1 · 9.8CWE-284

    RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

  16. CVE-2023-46604

    Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

    Critical9.8Exploited, CISA due date 2023-11-23EPSS 100%, higher than 100% of scored CVEs

    Apache ActiveMQ and 7 moreCVSS 3.1 · 9.8CWE-502

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the…

  17. CVE-2023-33246

    Apache RocketMQ Command Execution Vulnerability

    Critical9.8Exploited, CISA due date 2023-09-27EPSS 97%, higher than 100% of scored CVEs

    Apache RocketMQ and 1 moreCVSS 3.1 · 9.8CWE-94

    For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this…

  18. CVE-2023-27524

    Apache Superset Insecure Default Initialization of Resource Vulnerability

    Critical9.8Exploited, CISA due date 2024-01-29EPSS 98%, higher than 100% of scored CVEs

    Apache Superset and 1 moreCVSS 3.1 · 9.8CWE-1188

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not…

  19. CVE-2022-33891

    Apache Spark Command Injection Vulnerability

    High8.8Exploited, CISA due date 2023-03-28EPSS 93%, higher than 100% of scored CVEs

    Apache Spark and 1 moreCVSS 3.1 · 8.8CWE-78

    The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter…

  20. CVE-2022-24706

    Apache CouchDB Insecure Default Initialization of Resource Vulnerability

    Critical9.8Exploited, CISA due date 2022-09-15EPSS 93%, higher than 100% of scored CVEs

    Apache CouchDB and 1 moreCVSS 3.1 · 9.8CWE-1188

    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a…

  21. CVE-2022-24112

    Apache APISIX Authentication Bypass Vulnerability

    Critical9.8Exploited, CISA due date 2022-09-15EPSS 96%, higher than 100% of scored CVEs

    Apache APISIX and 1 moreCVSS 3.1 · 9.8CWE-290

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was…

  22. CVE-2021-45046

    Apache Log4j2 Deserialization of Untrusted Data Vulnerability

    Critical9.0Exploited, CISA due date 2023-05-22EPSS 100%, higher than 100% of scored CVEs

    Apache Log4j2 and 9 moreCVSS 3.1 · 9.0CWE-917

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout…

  23. CVE-2021-44228

    Apache Log4j2 Remote Code Execution Vulnerability

    Critical10.0Exploited, CISA due date 2021-12-24EPSS 100%, higher than 100% of scored CVEs

    Apache Log4j2 and 9 moreCVSS 3.1 · 10.0CWE-20, CWE-400

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log…

  24. CVE-2021-42013

    Apache HTTP Server Path Traversal Vulnerability

    Critical9.8Exploited, CISA due date 2021-11-17EPSS 100%, higher than 100% of scored CVEs

    Apache HTTP Server and 6 moreCVSS 3.1 · 9.8CWE-22

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by…

  25. CVE-2021-41773

    Apache HTTP Server Path Traversal Vulnerability

    Critical9.8Exploited, CISA due date 2021-11-17EPSS 100%, higher than 100% of scored CVEs

    Apache HTTP Server and 4 moreCVSS 3.1 · 9.8CWE-22

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the…

Reading the radar

CVSS, KEV and EPSS, briefly.

What is a CVE?

A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.

What does the CVSS score tell me?

CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.

What is EPSS?

FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.

How should I prioritise?

Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.

Where do the explanations come from?

Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.

How fresh is the data?

New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.

Know where a vulnerable component would sit in your systems.

A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.

See how Veriom maps an architectureTake the interactive tour

Sources

  • CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
  • Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
  • Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
  • Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.