Total CVEs
5773
last 30 days
Avg Priority
34.0
of max 220
KEV
6
actively exploited
POC
805
public exploits
Unpatched
1587
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
124
CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an
119
CVE-2026-5281
Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had co
117
CVE-2026-33634
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publi
117
CVE-2026-33017
## Summary
The `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows
117
CVE-2026-3055
Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP l
109
CVE-2026-3502
TrueConf Client downloads application update code and applies it without performing verification. An
Priority Distribution
| Priority | CVE |
|---|---|
| 41 |
CVE-2026-4478
A vulnerability was identified in Yi Technology YI Home Camera 2 2.1.1_201710241
|
| 41 |
CVE-2026-4396
Improper certificate validation in Devolutions Hub Reporting Service
2025.3.1.1
|
| 41 |
CVE-2026-2370
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3
|
| 41 |
CVE-2026-32634
## Summary
In Central Browser mode, Glances stores both the Zeroconf-advertised
|
| 41 |
CVE-2026-4718
Undefined behavior in the WebRTC: Signaling component. This vulnerability affect
|
| 41 |
CVE-2026-39371
RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver
|
| 40 |
CVE-2026-35442
### Summary
Aggregate functions (`min`, `max`) applied to fields with the `conc
|
| 40 |
CVE-2026-5436
The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in
|
| 40 |
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level Access Control which
|
| 40 |
CVE-2026-34402
ChurchCRM is an open-source church management system. Prior to 7.1.0, authentica
|
| 40 |
CVE-2026-25208
Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow B
|
| 40 |
CVE-2026-40393
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occu
|
| 40 |
CVE-2025-58913
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP
|
| 40 |
CVE-2026-25773
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize categor
|
| 40 |
CVE-2026-40070
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2,
|
| 40 |
CVE-2026-40259
## Summary
An authenticated publish-service reader can invoke `/api/av/removeUn
|
| 40 |
CVE-2026-40200
An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory co
|
| 40 |
CVE-2026-40093
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementati
|
| 40 |
CVE-2026-39393
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
|
| 40 |
CVE-2026-39394
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
|
| 40 |
CVE-2026-33466
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash
|
| 40 |
CVE-2026-1961
A flaw was found in Foreman. A remote attacker could exploit a command injection
|
| 40 |
CVE-2026-20155
A vulnerability in the web-based management interface of Cisco Evolved Programma
|
| 40 |
CVE-2025-24818
Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to
|
| 40 |
CVE-2025-24817
Nokia MantaRay NM is vulnerable to an OS command injection vulnerability due to
|
| 40 |
CVE-2026-20432
In Modem, there is a possible out of bounds write due to a missing bounds check.
|
| 40 |
CVE-2026-3108
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.
|
| 40 |
CVE-2026-35575
ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored C
|
| 40 |
CVE-2026-4248
The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information
|
| 40 |
CVE-2025-41258
LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechan
|
| 40 |
CVE-2026-32813
## Summary
The MyList configuration feature in Admidio allows authenticated use
|
| 40 |
CVE-2026-32014
OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability w
|
| 40 |
CVE-2025-55041
MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functi
|
| 40 |
CVE-2026-33183
### Impact
Users with MockResponse fixtures that use path traversal.
### Patche
|
| 40 |
CVE-2026-32768
### Impact
Due to a mis-written NetworkPolicy, a malicious actor can pivot from
|
| 40 |
CVE-2026-40149
PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/ap
|
| 40 |
CVE-2026-34444
Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier,
|
| 39 |
CVE-2026-0634
Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows
|
| 39 |
CVE-2025-33247
NVIDIA Megatron LM contains a vulnerability in quantization configuration loadin
|
| 39 |
CVE-2025-63261
AWStats 8.0 is vulnerable to Command Injection via the open function
|
| 39 |
CVE-2026-24157
NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an at
|
| 39 |
CVE-2026-24159
NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remot
|
| 39 |
CVE-2026-29143
SEPPmail Secure Email Gateway before version 15.0.3 does not properly authentica
|
| 39 |
CVE-2026-29144
SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to bypass
|
| 39 |
CVE-2026-33874
Gematik Authenticator securely authenticates users for login to digital health a
|
| 39 |
CVE-2026-35043
Commit ce53491 (March 24) fixed command injection via `system_packages` in Docke
|
| 39 |
CVE-2026-4151
GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability. This
|
| 39 |
CVE-2026-4154
GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This
|
| 39 |
CVE-2026-4150
GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This
|
| 39 |
CVE-2025-33248
NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script wher
|
| 39 |
CVE-2026-24151
NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may
|
| 39 |
CVE-2026-24150
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attac
|
| 39 |
CVE-2026-24152
NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attac
|
| 39 |
CVE-2026-34054
vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3,
|
| 39 |
CVE-2026-24141
NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONN
|
| 39 |
CVE-2026-4152
GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerabi
|
| 39 |
CVE-2026-4153
GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerabi
|
| 39 |
CVE-2026-23862
Dell ThinOS 10 versions prior to ThinOS 2602_10.0573, contain an Improper Neutra
|
| 39 |
CVE-2026-4775
A flaw was found in the libtiff library. A remote attacker could exploit a signe
|
| 39 |
CVE-2026-24165
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserializati
|
| 39 |
CVE-2026-30309
InfCode's terminal auto-execution module contains a critical command filtering v
|
| 39 |
CVE-2026-5493
Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Cod
|
| 39 |
CVE-2026-5494
Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Cod
|
| 39 |
CVE-2026-5495
Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Cod
|
| 39 |
CVE-2026-5496
Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Exe
|
| 39 |
CVE-2026-33298
llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an int
|
| 39 |
CVE-2026-29139
SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by a
|
| 39 |
CVE-2026-32857
Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) p
|
| 39 |
CVE-2026-27309
Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free
|
| 39 |
CVE-2026-23351
In the Linux kernel, the following vulnerability has been resolved:
netfilter:
|
| 39 |
CVE-2026-34937
### Summary
`run_python()` in `praisonai` constructs a shell command string by
|
| 39 |
CVE-2026-33139
### Summary
PySpector versions `<= 0.1.6` are affected by a security validation
|
| 39 |
CVE-2026-23392
In the Linux kernel, the following vulnerability has been resolved:
netfilter:
|
| 39 |
CVE-2026-23317
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx:
|
| 39 |
CVE-2026-23391
In the Linux kernel, the following vulnerability has been resolved:
netfilter:
|
| 39 |
CVE-2026-23372
In the Linux kernel, the following vulnerability has been resolved:
nfc: rawsoc
|
| 39 |
CVE-2026-23378
In the Linux kernel, the following vulnerability has been resolved:
net/sched:
|
| 39 |
CVE-2026-23340
In the Linux kernel, the following vulnerability has been resolved:
net: sched:
|
| 39 |
CVE-2026-23336
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80
|
| 39 |
CVE-2026-23306
In the Linux kernel, the following vulnerability has been resolved:
scsi: pm800
|
| 39 |
CVE-2026-23243
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umad:
|
| 39 |
CVE-2026-23273
In the Linux kernel, the following vulnerability has been resolved:
macvlan: ob
|
| 39 |
CVE-2026-3476
A Code Injection vulnerability affecting in SOLIDWORKS Desktop from Release 202
|
| 39 |
CVE-2026-33744
## Summary
The `docker.system_packages` field in `bentofile.yaml` accepts arbit
|
| 39 |
CVE-2026-3779
The application's list box calculate array logic keeps stale references to page
|
| 39 |
CVE-2026-23407
In the Linux kernel, the following vulnerability has been resolved:
apparmor: f
|
| 39 |
CVE-2026-23383
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64:
|
| 39 |
CVE-2026-23408
In the Linux kernel, the following vulnerability has been resolved:
apparmor: F
|
| 39 |
CVE-2026-33641
## Summary
Glances supports dynamic configuration values in which substrings enc
|
| 39 |
CVE-2026-23411
In the Linux kernel, the following vulnerability has been resolved:
apparmor: f
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 731d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2298d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2111d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1725d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2228d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 4976d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1197d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 998d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3753d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 900d |