Total CVEs
2374
last 14 days
Avg Priority
26.2
of max 220
KEV
7
actively exploited
POC
137
public exploits
Unpatched
389
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
126
CVE-2026-41091
Improper link resolution before file access ('link following') in Microsoft Defender allows an autho
120
CVE-2026-48172
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exp
117
CVE-2026-8398
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows v
116
CVE-2026-48027
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console,
108
CVE-2026-9082
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i
92
CVE-2026-45498
Microsoft Defender Denial of Service Vulnerability
89
CVE-2026-34926
A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authentica
Priority Distribution
| Priority | CVE |
|---|---|
| 48 |
CVE-2026-9584
A security vulnerability has been detected in code-projects Project Management S
|
| 48 |
CVE-2026-9603
A security vulnerability has been detected in SourceCodester eDoc Doctor Appoint
|
| 48 |
CVE-2026-9580
A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is
|
| 47 |
CVE-2026-9102
A path traversal vulnerability exists in the Altium Enterprise Server Comparison
|
| 47 |
CVE-2026-8134
Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the p
|
| 47 |
CVE-2026-44590
Sherlock hunts down social media accounts by username across social networks. Pr
|
| 47 |
CVE-2026-39405
Frappe Learning Management System (LMS) is a learning system that helps users st
|
| 47 |
CVE-2026-45035
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1
|
| 47 |
CVE-2026-9129
A path traversal vulnerability exists in the Altium Enterprise Server Viewer Sto
|
| 47 |
CVE-2026-1631
The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plu
|
| 47 |
CVE-2026-9739
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During
|
| 47 |
CVE-2026-49103
Webmin before 2.640 does not safely construct a filename for saving of an attach
|
| 47 |
CVE-2026-32998
This vulnerability in Veeam Service Provider Console allows for remote code exec
|
| 47 |
CVE-2026-9141
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication
|
| 47 |
CVE-2026-9139
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded crede
|
| 47 |
CVE-2026-45010
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authenticati
|
| 47 |
CVE-2026-48906
The vulnerability in the Tassos Framework Plugin allows users to delete arbitrar
|
| 47 |
CVE-2026-8838
Unsafe use of Python's eval() on server-received data in the vector_in() functio
|
| 47 |
CVE-2026-46364
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in
|
| 47 |
CVE-2026-41090
Improper neutralization of special elements used in a command ('command injectio
|
| 47 |
CVE-2026-23734
XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.
|
| 47 |
CVE-2026-33137
XWiki Platform is a generic wiki platform offering runtime services for applicat
|
| 47 |
CVE-2026-9058
Szafir SDK returns a success status code from the cryptographic digital signatur
|
| 47 |
CVE-2026-42755
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
|
| 47 |
CVE-2026-42747
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
|
| 47 |
CVE-2026-9065
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection vi
|
| 47 |
CVE-2026-9059
NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injec
|
| 47 |
CVE-2026-8631
A potential security vulnerability has been identified in the HP Linux Imaging a
|
| 47 |
CVE-2026-8950
Same-origin policy bypass in the Networking: HTTP component. This vulnerability
|
| 46 |
CVE-2026-42097
Sparx Pro Cloud Server requires authentication based on requested URL. An attack
|
| 46 |
CVE-2026-4320
Authorization Bypass vulnerability in Creartia's ICMS software could allow an at
|
| 46 |
CVE-2026-35090
In Slican telephone exchanges it is possible to manage the control panel remotel
|
| 46 |
CVE-2026-35087
Slican telephone exchanges allow administrative protocol authentication bypass.
|
| 46 |
CVE-2026-8979
The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an auth
|
| 46 |
CVE-2026-44451
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component
|
| 46 |
CVE-2026-8980
The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privile
|
| 46 |
CVE-2026-45261
GitButler is a modern Git-based version control interface for AI-powered workflo
|
| 46 |
CVE-2026-42761
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
|
| 46 |
CVE-2026-9037
A firmware update mechanism in the affected charging controller fails to validat
|
| 46 |
CVE-2026-42727
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
|
| 46 |
CVE-2026-42740
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
|
| 46 |
CVE-2026-8836
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_par
|
| 46 |
CVE-2026-44159
Tyler Identity Local (TID-L) uses documented, default administrative credentials
|
| 46 |
CVE-2026-39531
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
|
| 46 |
CVE-2026-46725
The extension passes an attacker-controlled cookie directly to PHP's unserialize
|
| 46 |
CVE-2026-0481
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosyst
|
| 46 |
CVE-2026-8711
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is config
|
| 46 |
CVE-2026-41552
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to
|
| 46 |
CVE-2026-47358
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF)
|
| 46 |
CVE-2026-47357
Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF)
|
| 46 |
CVE-2026-7182
Diagram's export module is vulnerable to Path Traversal in src attribute due to
|
| 46 |
CVE-2026-9054
An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than
|
| 46 |
CVE-2026-48241
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in
|
| 46 |
CVE-2026-48242
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection cre
|
| 46 |
CVE-2026-9312
A server-side request forgery (SSRF) vulnerability was identified in GitHub Ente
|
| 46 |
CVE-2026-33278
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability
|
| 46 |
CVE-2026-5433
Honeywell Control
Network Module (CNM) contains command injection vulnerability
|
| 46 |
CVE-2026-2586
An authenticated Remote Code Execution (RCE) vulnerability was identified in Gla
|
| 46 |
CVE-2026-8450
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_f
|
| 46 |
CVE-2026-7302
SGLangs multimodal generation runtime is vulnerable to an unauthenticated path t
|
| 46 |
CVE-2026-33843
Authentication bypass using an alternate path or channel in Microsoft Azure Acti
|
| 46 |
CVE-2026-44699
LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA
|
| 46 |
CVE-2026-49002
Access control failure means that an application does not effectively check user
|
| 46 |
CVE-2026-41919
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injecti
|
| 46 |
CVE-2026-8948
Same-origin policy bypass in the DOM: Networking component. This vulnerability w
|
| 46 |
CVE-2026-39833
The in-memory keyring returned by NewKeyring() silently accepted keys with the C
|
| 46 |
CVE-2026-42496
Pre-NVD disclosure via oss-security: oss-security mailing list - 2026/05/26. pen
|
| 46 |
CVE-2026-39834
When writing data larger than 4GB in a single Write call on an SSH channel, an i
|
| 46 |
CVE-2026-7876
IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19
|
| 46 |
CVE-2026-31986
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.
This issue a
|
| 46 |
CVE-2026-42508
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked
|
| 46 |
CVE-2026-39832
When adding a key to a remote agent constraint extensions such as restrict-desti
|
| 46 |
CVE-2026-47372
Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values
|
| 46 |
CVE-2026-44449
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the prima
|
| 46 |
CVE-2026-44632
### Summary
A Server-Side Code Injection vulnerability exists in the Yamcs algor
|
| 46 |
CVE-2026-46354
## Summary
`azureidentity.Validate()` verifies that the PKCS#7 signer certifica
|
| 46 |
CVE-2026-8598
An undocumented configuration export port is accessible on some models
of ZKTec
|
| 46 |
CVE-2026-46819
Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-B
|
| 46 |
CVE-2026-33000
A malicious actor with access to the network and high privileges could exploit a
|
| 46 |
CVE-2026-46621
### Summary
A Server-Side Code Injection vulnerability exists in the Yamcs scrip
|
| 45 |
CVE-2026-22314
Improper Control of Generation of Code ('Code Injection') vulnerability in Mesal
|
| 45 |
CVE-2026-48150
Budibase is an open-source low-code platform. Prior to 3.39.0, /api/public/v1/ro
|
| 45 |
CVE-2026-45721
### Summary
When Algernon is asked for any URL path that resolves to a director
|
| 45 |
CVE-2026-46833
Vulnerability in the Net Service component of Oracle Database Server. Supported
|
| 45 |
CVE-2026-32999
Insufficient character filtering in backup agent signing module on Comet Backup
|
| 45 |
CVE-2026-8135
Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to inse
|
| 45 |
CVE-2026-45659
Deserialization of untrusted data in Microsoft Office SharePoint allows an autho
|
| 44 |
CVE-2026-8832
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code
|
| 44 |
CVE-2026-27648
in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code ex
|
| 44 |
CVE-2026-44048
In Netatalk 2.0.4 through 4.4.2, stack buffer overflow via ucs-2 type confusion
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 776d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2344d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2157d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1771d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2274d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 5021d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1242d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 1044d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3798d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 946d |