Total CVEs
2758
last 14 days
Avg Priority
35.7
of max 220
KEV
3
actively exploited
POC
318
public exploits
Unpatched
554
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
118
CVE-2026-34621
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Control
114
CVE-2026-34197
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability i
109
CVE-2026-32201
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform
Priority Distribution
| Priority | CVE |
|---|---|
| 18 |
CVE-2026-40341
libgphoto2 is a camera access and control library. In versions up to and includi
|
| 18 |
CVE-2026-40334
libgphoto2 is a camera access and control library. In versions up to and includi
|
| 18 |
CVE-2026-35400
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web app
|
| 17 |
CVE-2026-33404
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level
|
| 17 |
CVE-2026-28264
Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorre
|
| 17 |
CVE-2026-21727
---
title: Cross-Tenant Legacy Correlation Disclosure and Deletion
draft: false
|
| 16 |
CVE-2026-39419
MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below
|
| 16 |
CVE-2026-3155
The OneSignal - Web Push Notifications plugin for WordPress is vulnerable to aut
|
| 16 |
CVE-2026-33212
Weblate is a web based localization tool. In versions prior to 5.17, the tasks A
|
| 16 |
CVE-2026-33405
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level
|
| 16 |
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher
|
| 16 |
CVE-2026-6313
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101
|
| 16 |
CVE-2026-6312
Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.772
|
| 16 |
CVE-2026-33436
Stirling-PDF is a locally hosted web application that facilitates various operat
|
| 15 |
CVE-2026-5382
An issue that could expose records outside of the authorized organization scope
|
| 15 |
CVE-2026-5379
An issue that allowed MCP agents to access certificate information from outside
|
| 15 |
CVE-2026-33948
jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db284
|
| 15 |
CVE-2026-40354
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Fla
|
| 15 |
CVE-2026-41080
libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occu
|
| 15 |
CVE-2026-40947
Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager be
|
| 15 |
CVE-2026-40228
In systemd 259, systemd-journald can send ANSI escape sequences to the terminals
|
| 15 |
CVE-2025-52641
HCL AION is affected by a vulnerability where certain system behaviours may allo
|
| 14 |
CVE-2026-34781
### Impact
Apps that call `clipboard.readImage()` may be vulnerable to a denial
|
| 14 |
CVE-2026-37598
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitr
|
| 14 |
CVE-2025-15480
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user cr
|
| 14 |
CVE-2025-14551
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials durin
|
| 14 |
CVE-2026-37592
Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL i
|
| 14 |
CVE-2026-27316
A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.
|
| 14 |
CVE-2026-5375
An issue that could allow a user with access to a credential to view sensitive f
|
| 14 |
CVE-2026-27769
Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were corr
|
| 14 |
CVE-2026-37596
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnera
|
| 14 |
CVE-2026-36922
Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the
|
| 14 |
CVE-2026-36872
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /libr
|
| 14 |
CVE-2026-36873
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /libr
|
| 14 |
CVE-2026-36938
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injecti
|
| 14 |
CVE-2026-36947
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnera
|
| 14 |
CVE-2026-36923
Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the f
|
| 14 |
CVE-2026-36943
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnera
|
| 14 |
CVE-2026-36944
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnera
|
| 14 |
CVE-2026-36945
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnera
|
| 14 |
CVE-2026-36941
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injecti
|
| 14 |
CVE-2026-36937
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injecti
|
| 14 |
CVE-2026-37600
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL In
|
| 14 |
CVE-2026-37597
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnera
|
| 14 |
CVE-2026-37595
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnera
|
| 14 |
CVE-2026-37594
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnera
|
| 14 |
CVE-2026-37593
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnera
|
| 14 |
CVE-2026-37602
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL In
|
| 14 |
CVE-2026-37591
Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL i
|
| 14 |
CVE-2026-37590
SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL I
|
| 14 |
CVE-2026-37589
SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL I
|
| 14 |
CVE-2026-37601
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL In
|
| 14 |
CVE-2026-36942
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injecti
|
| 14 |
CVE-2026-36946
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnera
|
| 14 |
CVE-2026-36919
Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the
|
| 14 |
CVE-2026-36874
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /libr
|
| 14 |
CVE-2026-36920
Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the
|
| 14 |
CVE-2026-39510
Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image
|
| 14 |
CVE-2026-36952
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injectio
|
| 14 |
CVE-2026-36950
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injectio
|
| 14 |
CVE-2026-4916
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2
|
| 14 |
CVE-2026-4292
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4
|
| 13 |
CVE-2026-34849
UAF vulnerability in the screen management module.
Impact: Successful exploitati
|
| 12 |
CVE-2026-21741
An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] v
|
| 12 |
CVE-2026-27307
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled
|
| 12 |
CVE-2026-27308
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled
|
| 12 |
CVE-2026-2401
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists th
|
| 12 |
CVE-2026-40336
libgphoto2 is a camera access and control library. Versions up to and including
|
| 12 |
CVE-2026-35624
OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room auth
|
| 12 |
CVE-2026-35617
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Goog
|
| 12 |
CVE-2026-5187
Two potential heap out-of-bounds write locations existed in DecodeObjectId() in
|
| 12 |
CVE-2026-39957
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL opera
|
| 12 |
CVE-2026-5188
An integer underflow issue exists in wolfSSL when parsing the Subject Alternativ
|
| 12 |
CVE-2026-35648
OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued no
|
| 12 |
CVE-2026-34720
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0
|
| 12 |
CVE-2026-5448
X.509 date buffer overflow in wolfSSL_X509_notAfter / wolfSSL_X509_notBefore. A
|
| 12 |
CVE-2026-5392
Heap out-of-bounds read in PKCS7 parsing. A crafted PKCS7 message can trigger an
|
| 12 |
CVE-2026-34945
Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and
|
| 12 |
CVE-2026-34988
Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and
|
| 12 |
CVE-2026-35402
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j dat
|
| 11 |
CVE-2026-5381
An issue that could expose task information outside of the authorized organizati
|
| 11 |
CVE-2026-34851
Race condition vulnerability in the event notification module.
Impact: Successfu
|
| 11 |
CVE-2026-5778
Integer underflow in wolfSSL packet sniffer <= 5.9.0 allows an attacker to cause
|
| 11 |
CVE-2026-30812
Improper Neutralization of Input During Web Page Generation vulnerability allows
|
| 11 |
CVE-2026-5772
A 1-byte stack buffer over-read was identified in the MatchDomainName function (
|
| 11 |
CVE-2026-35200
### Impact
A file can be uploaded with a filename extension that passes the fil
|
| 11 |
CVE-2026-34248
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0
|
| 11 |
CVE-2026-39349
OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to
|
| 10 |
CVE-2026-27949
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerabil
|
| 10 |
CVE-2026-27675
SAP Landscape Transformation contains a vulnerability in an RFC-exposed function
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 735d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2303d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2116d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1730d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2233d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 4980d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1201d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 1003d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3758d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 905d |