Skip to main content
veriom
Menu

Explore Veriom products, resources, and account pages.

Free tool · No sign-in

CVE radar: the latest vulnerabilities, explained.

Every new CVE from NVD, with whether it is exploited in the wild (CISA KEV), how likely it is to be (FIRST EPSS), and what it means for your architecture in plain language.

Updated 11 Nov, 13:27 UTC from NVD, CISA KEV and FIRST EPSSMarkdownRSSJSON Feed

341Critical, last 7 days2,098High, last 7 days40Added to CISA KEV, 30 days1,779Exploited CVEs tracked

Patch first

Exploited in the wild, newest first.

CISA adds a CVE to its Known Exploited Vulnerabilities catalog when attackers are using it. Patch these first, then CVEs with a high EPSS score, then the most severe, starting with anything reachable from the internet.

  1. CVE-2026-124194

    Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

    Medium6.5Exploited, CISA due date 2026-11-24EPSS not scored yet

    Microsoft Office and 6 moreCVSS 3.1 · 6.5CWE-356

  2. CVE-2026-125350

    Google Chromium Use-After-Free Vulnerability

    High8.8Exploited, CISA due date 2026-11-24EPSS not scored yet

    Google Chromium and 1 moreCVSS 3.1 · 8.8CWE-416

  3. CVE-2026-116606

    Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Critical9.3Exploited, CISA due date 2026-11-13EPSS 1.6%, higher than 76% of scored CVEs

    Barracuda Email Security Gateway (ESG)CVSS 4.0 · 9.3CWE-288

  4. CVE-2026-111560

    Barracuda Networks Multiple Products OS Command Injection Vulnerability

    High8.6Exploited, CISA due date 2026-11-13EPSS 1.1%, higher than 65% of scored CVEs

    Barracuda Email Security Gateway (ESG) and 5 moreCVSS 4.0 · 8.6CWE-78

  5. CVE-2026-111793

    Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

    Medium4.3Exploited, CISA due date 2026-11-24EPSS 0.27%, higher than 20% of scored CVEs

    Openwave Messaging Limited Webtop Media Transcoder and 2 moreCVSS 3.1 · 4.3CWE-669

Every exploited CVE

Trends

The last 30 days, by severity.

4,922 CVEs published, 360 of them critical. Many arrive without a score yet: NVD and the reporting organisations add CVSS over the following days.

CriticalHighMediumLowNot scored13 Oct 2026 to 11 Nov 2026
Show the numbers
DayCriticalHighMediumLowNot scored
13 Oct 202612000
14 Oct 202622000
15 Oct 202612000
16 Oct 202600100
17 Oct 202600000
18 Oct 202600000
19 Oct 202600000
20 Oct 202600000
21 Oct 202620000
22 Oct 202620000
23 Oct 202600000
24 Oct 202600000
25 Oct 202600000
26 Oct 202600000
27 Oct 202600000
28 Oct 202601000
29 Oct 202600000
30 Oct 202600000
31 Oct 202601000
1 Nov 202600000
2 Nov 202611000
3 Nov 202600100
4 Nov 202635158138321
5 Nov 202655213148361
6 Nov 202640146205476
7 Nov 2026571612321113
8 Nov 202623128143260
9 Nov 2026221492184239
10 Nov 2026103115159043230
11 Nov 202616631411624

Exploit likelihood (EPSS), last 30 days

  1. Under 1%713
  2. 1% to 10%25
  3. 10% to 50%2
  4. 50% or more7
  5. Not scored yet4175

Most affected vendors, last 30 days

  1. Microsoft1096
  2. IBM322
  3. Apache Software Foundation179
  4. Google168
  5. FFmpeg121
  6. Adobe112
  7. Mozilla108
  8. JetBrains89
  9. Red Hat88
  10. openemr60

Matching CVEs

6,674 CVEs match these filters, page 80 of 267.

  1. CVE-2026-123178

    NETGEAR RBR350 improper input validation

    Medium4.3EPSS not scored yet

    NETGEAR RBR350 and 1 moreCVSS 4.0 · 4.3CWE-20

    An insufficient input validation vulnerability in the listed NETGEAR Orbi Models router allows an authenticated administrator connected to the local network to execute unauthorized commands and modify the router’s software and functionality, potentially compromising the…

  2. CVE-2026-115791

    Python Software Foundation CPython inclusion of untrusted functionality

    Medium5.3EPSS not scored yet

    Python Software Foundation CPythonCVSS 4.0 · 5.3CWE-829

    When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the…

  3. CVE-2026-112186

    Eclipse Kura uncontrolled recursion

    High8.7EPSS not scored yet

    Eclipse KuraCVSS 4.0 · 8.7CWE-674, CWE-696

    In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the body before they check whether the caller is authenticated. A remote attacker without valid…

  4. CVE-2026-112185

    Eclipse Kura insufficiently protected credentials

    High8.6EPSS not scored yet

    Eclipse KuraCVSS 4.0 · 8.6CWE-522, CWE-668

    In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provider) does not restrict access to the configuration of the UserAdmin persistence component to identities holding the kura.admin permission. An authenticated…

  5. CVE-2026-111729

    Eclipse Kura path traversal

    High7.0EPSS not scored yet

    Eclipse KuraCVSS 4.0 · 7.0CWE-22

    In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.directory`. The path-containment check `validateFileName()` compares canonical paths with…

  6. CVE-2026-107405

    Ivanti Endpoint Manager Mobile exposed dangerous method

    Medium5.5EPSS not scored yet

    Ivanti Endpoint Manager MobileCVSS 3.1 · 5.5CWE-749

    An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.

  7. CVE-2026-102803

    j2commerce.com J2Store extension for Joomla time-of-check to time-of-use race

    Medium6.0EPSS not scored yet

    j2commerce.com J2Store extension for JoomlaCVSS 4.0 · 6.0CWE-367

    Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By…

  8. CVE-2026-97890

    Apache TomEE session fixation

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-384

    The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended…

  9. CVE-2026-97888

    Apache TomEE vulnerability

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-488

    The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of a previously authenticated user, gaining that…

  10. CVE-2026-97881

    Apache TomEE path traversal

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-22

    The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP…

  11. CVE-2026-97880

    Apache TomEE improper authentication

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-287

    The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded…

  12. CVE-2026-97874

    Apache TomEE improper authentication

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-287

    When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users…

  13. CVE-2026-97872

    Apache TomEE missing authentication

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-306

    When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using…

  14. CVE-2026-97870

    Apache TomEE missing authentication

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-306

    When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted…

  15. CVE-2026-97867

    Apache TomEE insufficiently protected credentials

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-522

    The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource. A remote client able to reach the EJBd endpoint can obtain the database credentials and connect to the database directly. Users are…

  16. CVE-2026-97849

    Apache TomEE vulnerability

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-1327

    The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to…

  17. CVE-2026-97402

    Eclipse Kura infinite loop

    Low2.3EPSS not scored yet

    Eclipse KuraCVSS 4.0 · 2.3CWE-194, CWE-835

    In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD-structure length field of an over-the-air BLE advertising payload. Any unauthenticated attacker within BLE radio range can broadcast a two-byte advertising payload…

  18. CVE-2026-87758

    Apache TomEE vulnerability

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-297

    The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to intercept network traffic between an EJB client and server can impersonate the server and read or modify the traffic, including…

  19. CVE-2026-86531

    Apache TomEE allocation without limits

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-770

    The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of…

  20. CVE-2026-86336

    Apache TomEE missing authorization

    Not scoredEPSS not scored yet

    Apache TomEENot scored yetCWE-862

    Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

  21. CVE-2026-18128

    ivanti Endpoint Manager cleartext transmission

    Medium6.8EPSS not scored yet

    ivanti Endpoint ManagerCVSS 3.1 · 6.8CWE-319

    Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in a MITM position to read and modify HTTP traffic.

  22. CVE-2026-125759

    NangoHQ nango SQL injection

    High7.7EPSS not scored yet

    NangoHQ nangoCVSS 4.0 · 7.7CWE-89

    Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/immediate, which…

  23. CVE-2026-125758

    aptabase insecure default

    Critical9.1EPSS not scored yet

    aptabaseCVSS 4.0 · 9.1CWE-1188

    Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links by using the publicly known example AUTH_SECRET. Attackers can enumerate registered e-mails via /api/_auth/signin, forge HS256 JWTs…

  24. CVE-2026-125757

    mailcow mailcow: dockerized template injection

    Critical9.4EPSS not scored yet

    mailcow mailcow: dockerizedCVSS 4.0 · 9.4CWE-1336

    mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute…

  25. CVE-2026-125756

    postalsys postal-mime interpretation conflict

    High8.2EPSS not scored yet

    postalsys postal-mimeCVSS 4.0 · 8.2CWE-436

    postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace or comments preceding a dot. Remote attackers can craft From headers that pass SPF/DKIM/DMARC alignment for their own subdomain while…

Reading the radar

CVSS, KEV and EPSS, briefly.

What is a CVE?

A CVE is a public identifier for one vulnerability in one product, such as CVE-2026-59310. The CVE program assigns it; NVD, run by the US National Institute of Standards and Technology, adds scores, weakness classes and affected product lists.

What does the CVSS score tell me?

CVSS rates how severe a vulnerability is on its own, from 0 to 10, and its vector says how it is reached: over the network or locally, with or without an account, with or without someone clicking. It says nothing about whether anyone is exploiting it. The radar shows the newest CVSS version scored and names it, because version 4.0 and 3.1 scores differ.

What is CISA KEV?

The Known Exploited Vulnerabilities catalog is CISA's list of CVEs with reliable evidence of exploitation in the wild. US federal agencies must fix each one by its due date, and it is the strongest signal of what to patch first.

What is EPSS?

FIRST's Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days, recomputed daily. Most CVEs score well under 1%, so the radar also shows the percentile: how a CVE ranks against every scored CVE.

How should I prioritise?

Patch what CISA lists as exploited first. Then CVEs with a high EPSS score, then the most severe by CVSS. Within each group, start with whatever is reachable from the internet without an account.

Where do the explanations come from?

Veriom writes them from fixed templates over each record: the weakness class says what went wrong and where in an architecture it lives, the CVSS vector says how it is reached and what it affects, and KEV, EPSS and CISA's assessment say whether it is exploited. Nobody reviews each CVE by hand, so read the description and the references before acting.

How fresh is the data?

New and changed CVEs arrive from NVD every hour, the KEV catalog every six hours and EPSS scores once a day. Each page shows when the data was last updated.

Know where a vulnerable component would sit in your systems.

A CVE names a product. Whether it matters depends on where that product sits in your systems: what reaches it, which trust boundary it guards and what it can reach once compromised. Veriom maps your components, their relationships and your trust boundaries from your code, cloud and delivery evidence, so you can see where a component like this sits. The radar itself does not look at your systems.

See how Veriom maps an architectureTake the interactive tour

Sources

  • CVE records and CVSS scores from the NVD CVE API. This product uses the NVD API but is not endorsed or certified by the NVD.
  • Exploitation status from CISA’s Known Exploited Vulnerabilities catalog.
  • Exploit likelihood from FIRST’s Exploit Prediction Scoring System (EPSS), refreshed daily.
  • Explanations are written by Veriom from fixed templates over each record’s data, not by a person reviewing each CVE. Descriptions are quoted from the records as published. The radar covers CVEs published since 4 Nov 2026, plus every CVE in the KEV catalog.