Total CVEs
5767
last 30 days
Avg Priority
34.1
of max 220
KEV
6
actively exploited
POC
804
public exploits
Unpatched
1586
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
124
CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an
119
CVE-2026-5281
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had co
117
CVE-2026-33634
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publi
117
CVE-2026-33017
## Summary
The `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows
117
CVE-2026-3055
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP l
109
CVE-2026-3502
TrueConf Client downloads application update code and applies it without performing verification. An
Priority Distribution
| Priority | CVE |
|---|---|
| 33 |
CVE-2026-25390
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-appr
|
| 33 |
CVE-2026-25365
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-tur
|
| 33 |
CVE-2026-25327
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservati
|
| 33 |
CVE-2026-25034
Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-ma
|
| 33 |
CVE-2026-25009
Missing Authorization vulnerability in raratheme Education Zone education-zone a
|
| 33 |
CVE-2026-24987
Missing Authorization vulnerability in activity-log.com WP System Log winterlock
|
| 33 |
CVE-2026-24972
Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing
|
| 33 |
CVE-2026-24376
Missing Authorization vulnerability in Javier Casares WPVulnerability wpvulnerab
|
| 33 |
CVE-2026-24364
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend
|
| 33 |
CVE-2026-23972
Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager
|
| 33 |
CVE-2026-22485
Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gall
|
| 33 |
CVE-2026-28835
A use-after-free issue was addressed with improved memory management. This issue
|
| 33 |
CVE-2026-3889
Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and
|
| 33 |
CVE-2026-30655
SQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and ea
|
| 33 |
CVE-2026-39639
Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-i
|
| 33 |
CVE-2026-26929
Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does
|
| 33 |
CVE-2026-33903
## Summary
Ella Core panics when processing a specially crafted NGAP LocationRe
|
| 33 |
CVE-2026-20110
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated
|
| 33 |
CVE-2026-34538
Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom re
|
| 33 |
CVE-2026-23481
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there
|
| 33 |
CVE-2026-3571
The Pie Register - User Registration, Profiles & Content Restriction plugin for
|
| 33 |
CVE-2026-32743
PX4 is an open-source autopilot stack for drones and unmanned vehicles. Versions
|
| 33 |
CVE-2026-33215
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native me
|
| 33 |
CVE-2026-33281
## Summary
Ella Core panics when processing NGAP messages with invalid PDU Sess
|
| 33 |
CVE-2026-35492
### Impact
PartitionedDataset in kedro-datasets was vulnerable to path traversa
|
| 33 |
CVE-2026-28522
arduino-TuyaOpen before version 1.2.1 contains a null pointer dereference vulner
|
| 33 |
CVE-2025-47374
Memory Corruption when accessing freed memory due to concurrent fence deregistra
|
| 33 |
CVE-2026-28863
A permissions issue was addressed with additional restrictions. This issue is fi
|
| 33 |
CVE-2026-34613
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AV
|
| 33 |
CVE-2026-34611
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AV
|
| 33 |
CVE-2026-39366
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Pa
|
| 33 |
CVE-2026-4749
NVD-CWE-noinfo vulnerability in albfan miraclecast.This issue affects miraclecas
|
| 33 |
CVE-2026-33123
### Impact
An attacker who uses this vulnerability can craft a PDF which leads t
|
| 33 |
CVE-2026-33904
## Summary
A deadlock in the AMF's SCTP notification handler causes the entire
|
| 33 |
CVE-2026-25792
Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and bel
|
| 33 |
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana.
|
| 33 |
CVE-2025-69196
While testing the OAuth Proxy implementation, it was noticed that the server doe
|
| 33 |
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana.
|
| 33 |
CVE-2026-25627
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to v
|
| 33 |
CVE-2026-28282
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-late
|
| 33 |
CVE-2025-36375
IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway
|
| 33 |
CVE-2026-33375
The Grafana MSSQL data source plugin contains a logic flaw that allows a low-pri
|
| 33 |
CVE-2025-12736
in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive i
|
| 33 |
CVE-2026-3119
Under certain conditions, `named` may crash when processing a correctly signed q
|
| 33 |
CVE-2026-1672
The BEAR - Bulk Editor and Products Manager Professional for WooCommerce by Plug
|
| 33 |
CVE-2026-27877
When using public dashboards and direct data-sources, all direct data-sources' p
|
| 33 |
CVE-2026-4668
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress i
|
| 33 |
CVE-2026-33345
solidtime is an open-source time-tracking app. Prior to version 0.11.6, the proj
|
| 33 |
CVE-2026-39633
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental g
|
| 33 |
CVE-2026-39641
Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyr
|
| 33 |
CVE-2026-33314
### Summary
A Host Header Spoofing vulnerability in the `@local_check` decorato
|
| 33 |
CVE-2026-4728
Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability affec
|
| 33 |
CVE-2026-24029
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is ena
|
| 32 |
CVE-2026-33141
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Di
|
| 32 |
CVE-2026-34897
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti
|
| 32 |
CVE-2026-34756
### Summary
A Denial of Service vulnerability exists in the vLLM OpenAI-compatib
|
| 32 |
CVE-2026-35441
### Summary
Directus' GraphQL endpoints (`/graphql` and `/graphql/system`) did
|
| 32 |
CVE-2026-2377
A flaw was found in mirror-registry. Authenticated users can exploit the log exp
|
| 32 |
CVE-2026-34755
## Summary
The `VideoMediaIO.load_base64()` method at `vllm/multimodal/media/vi
|
| 32 |
CVE-2026-40148
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall(
|
| 32 |
CVE-2026-39943
Directus is a real-time API and App dashboard for managing SQL database content.
|
| 32 |
CVE-2026-35594
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0,
|
| 32 |
CVE-2026-25209
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource
|
| 32 |
CVE-2026-35403
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web app
|
| 32 |
CVE-2026-1101
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 bef
|
| 32 |
CVE-2026-33323
### Impact
The Pages route and legacy PublicAPI route for resending email verif
|
| 32 |
CVE-2026-35173
Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR /
|
| 32 |
CVE-2026-35599
## Summary
The `addRepeatIntervalToTime` function uses an O(n) loop that advanc
|
| 32 |
CVE-2026-33459
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of serv
|
| 32 |
CVE-2026-6068
NASM contains a heap use after free vulnerability in response file (-@) processi
|
| 32 |
CVE-2025-55265
HCL Aftermarket DPC is affected by File Discovery which allows attacker could ex
|
| 32 |
CVE-2026-33708
Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info
|
| 32 |
CVE-2026-27460
Tandoor Recipes is an application for managing recipes, planning meals, and buil
|
| 32 |
CVE-2026-33736
Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authentica
|
| 32 |
CVE-2026-4022
The Show Posts list - Easy designs, filters and more plugin for WordPress is vul
|
| 32 |
CVE-2026-4278
The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-S
|
| 32 |
CVE-2025-13535
The King Addons for Elementor plugin for WordPress is vulnerable to multiple Con
|
| 32 |
CVE-2026-3618
The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Si
|
| 32 |
CVE-2026-5742
The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in
|
| 32 |
CVE-2026-4429
The OSM - OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site
|
| 32 |
CVE-2026-3997
The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scriptin
|
| 32 |
CVE-2026-3996
The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scrip
|
| 32 |
CVE-2026-34716
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AV
|
| 32 |
CVE-2026-4075
The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored C
|
| 32 |
CVE-2026-3516
The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripti
|
| 32 |
CVE-2026-2352
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scriptin
|
| 32 |
CVE-2026-4083
The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored
|
| 32 |
CVE-2026-4336
The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Si
|
| 32 |
CVE-2026-2305
The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cros
|
| 32 |
CVE-2026-4303
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 731d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2298d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2111d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1725d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2228d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 4976d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1197d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 998d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3753d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 900d |