Skip to main content

Security Dashboard

7d 14d 30d 90d
Total CVEs
1372
last 7 days
Avg Priority
20.7
of max 220
KEV
1
actively exploited
POC
64
public exploits
Unpatched
217
CRIT/HIGH without patch
How is Priority Score calculated?

Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:

KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low 40-80 Medium 80-120 High 120+ Critical

Patch Now — Known Exploited Vulnerabilities

116
CVE-2026-48027
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console,
CRITICAL

Priority Distribution

CRITICAL HIGH MEDIUM LOW KEV Only POC Only Unpatched CRIT/HIGH
Priority CVE
63 CVE-2026-47114
IINA before 1.4.3 contains a user-assisted command execution vulnerability that
63 CVE-2026-7862
The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not proper
57 CVE-2026-9345
A vulnerability was detected in Edimax EW-7438RPn up to 1.31. This affects the f
57 CVE-2026-9346
A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function
57 CVE-2026-9360
A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this
57 CVE-2026-9344
A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The
57 CVE-2026-9348
A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vuln
57 CVE-2026-9294
A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is
57 CVE-2026-9295
A security flaw has been discovered in Edimax BR-6428NS 1.10. This affects the f
56 CVE-2026-31266
Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in th
56 CVE-2025-70103
Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to th
45 CVE-2026-8135
Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to inse
45 CVE-2026-45659
Deserialization of untrusted data in Microsoft Office SharePoint allows an autho
44 CVE-2026-8832
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code
44 CVE-2026-9207
Tanium addressed an unauthorized code execution vulnerability in Connect.
44 CVE-2026-35430
Authorization bypass through user-controlled key in Azure Privileged Identity Ma
44 CVE-2026-46414
Microsoft UFO open-source framework for intelligent automation across devices an
44 CVE-2026-47161
RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7
44 CVE-2026-8787
The Firebase Support & Chat Management plugin for WordPress is vulnerable to pri
44 CVE-2026-48920
Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining im
44 CVE-2026-38807
Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker
44 CVE-2026-6897
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modificat
44 CVE-2026-44988
LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and
44 CVE-2026-6895
The WishList Member plugin for WordPress is vulnerable to Missing Authorization
44 CVE-2026-6898
The Wishlist Member plugin for WordPress is vulnerable to unauthorized modificat
44 CVE-2026-6419
The WishList Member plugin for WordPress is vulnerable to Privilege Escalation v
44 CVE-2026-41075
RT is an open source, enterprise-grade issue and ticket tracking system. Version
44 CVE-2026-44713
pam_usb provides hardware authentication for Linux using ordinary removable medi
44 CVE-2026-9018
The Easy Elements for Elementor - Addons & Website Templates plugin for WordPres
44 CVE-2026-47125
## Summary The `PUT /api/environments/{id}/templates/variables` endpoint, which
44 CVE-2026-9208
Tanium addressed an unauthorized code execution vulnerability in Connect.
44 CVE-2026-8676
An attacker is able to downgrade the security of a Bluetooth LE connection by de
44 CVE-2026-36044
@pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enume
44 CVE-2026-8179
IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM A
44 CVE-2026-8915
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo
44 CVE-2026-6406
The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI)
44 CVE-2026-46519
## Summary `mcp-server-kubernetes` exposes three environment variables (`ALLOW_
44 CVE-2026-6226
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthent
44 CVE-2026-44741
# GM-369 ## Summary SQL injection in Pimcore's translation grid date filter - t
44 CVE-2026-46612
### Summary The Fission `storagesvc` component registers archive CRUD handlers
44 CVE-2026-35676
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability i
44 CVE-2026-45044
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta
44 CVE-2026-5065
IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credential
44 CVE-2026-35675
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the pas
44 CVE-2026-9009
The Crawlomatic Multipage Scraper Post Generator plugin for WordPress is vulnera
44 CVE-2026-4944
vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remot
44 CVE-2026-9227
The GutenBee - Gutenberg Blocks plugin for WordPress is vulnerable to Arbitrary
44 CVE-2026-8992
An improper certificate validation vulnerability in Ivanti Secure Access Client
44 CVE-2026-7802
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authoriza
44 CVE-2026-48544
Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in
44 CVE-2026-3294
An authentication logic vulnerability in multiple TP-Link range extenders allows
44 CVE-2026-44886
Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 202
44 CVE-2025-41669
The Web-based Management allows a remote low privileged Engineer user to install
44 CVE-2026-40813
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40812
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40818
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40811
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40815
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40850
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40810
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40816
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40819
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40814
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2026-40817
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection
44 CVE-2025-41670
A local user with low privileges may be able to influence the behavior of a priv
44 CVE-2026-44830
Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Serv
44 CVE-2026-47760
TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE
44 CVE-2026-47074
Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, E
44 CVE-2026-47102
LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /us
44 CVE-2026-42197
RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd
44 CVE-2026-44739
### Summary The columnConfigAction endpoint in the CustomReportsBundle is vulner
44 CVE-2026-47759
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, t
44 CVE-2026-47101
LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API key
44 CVE-2026-28445
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButto
44 CVE-2026-8697
Due to improper enforcement of authentication rate-limiting on a debug SSH servi
44 CVE-2026-35089
In Slican telephone exchanges secure key is generated in a predictable manner us
44 CVE-2026-35671
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability
44 CVE-2026-47762
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, t
44 CVE-2026-35672
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.
44 CVE-2026-25606
A SQL injection vulnerability has been identified in STER. Improper neutralizati
44 CVE-2026-47761
TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, t
44 CVE-2026-45041
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta
43 CVE-2026-42737
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v
43 CVE-2025-30028
A vulnerability in Active Backup for Business allows unauthorized remote attacke
43 CVE-2026-44463
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system ca
43 CVE-2026-44465
Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when
43 CVE-2026-44466
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system ca
43 CVE-2026-42089
### Impact `yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missi
43 CVE-2026-44461
Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a
43 CVE-2026-32997
A vulnerability allowing an authenticated user with the Backup Administrator rol

Oldest Unpatched Critical/High CVEs

CVE Severity CVSS Priority Days Open
CVE-2024-3400 CRITICAL 10.0 224 776d
CVE-2019-19781 CRITICAL 9.8 223 2344d
CVE-2020-5902 CRITICAL 9.8 223 2157d
CVE-2021-35464 CRITICAL 9.8 223 1771d
CVE-2020-10189 CRITICAL 9.8 223 2274d
CVE-2012-4681 CRITICAL 9.8 223 5021d
CVE-2022-42475 CRITICAL 9.8 223 1242d
CVE-2023-3519 CRITICAL 9.8 223 1044d
CVE-2015-7450 CRITICAL 9.8 222 3798d
CVE-2023-34048 CRITICAL 9.8 222 946d
1 / 4 Next

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy