Total CVEs
16518
last 90 days
Avg Priority
35.8
of max 220
KEV
37
actively exploited
POC
3186
public exploits
Unpatched
4143
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
185
CVE-2026-1731
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain
170
CVE-2026-1340
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated rem
164
CVE-2026-1281
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated rem
141
CVE-2026-20131
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FM
137
CVE-2026-1603
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthen
134
CVE-2026-22769
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credentia
129
CVE-2026-33825
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to el
124
CVE-2026-21643
An improper neutralization of special elements used in an sql command ('sql injection') vulnerabilit
124
CVE-2026-35616
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an
119
CVE-2026-39987
## Summary
Marimo (19.6k stars) has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint `
Priority Distribution
| Priority | CVE |
|---|---|
| 24 |
CVE-2025-53608
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scri
|
| 24 |
CVE-2026-20132
Multiple vulnerabilities in the web-based management interface of Cisco Identity
|
| 24 |
CVE-2026-20087
A vulnerability in the web-based management interface of Cisco IMC could allow a
|
| 24 |
CVE-2026-20088
A vulnerability in the web-based management interface of Cisco IMC could allow a
|
| 24 |
CVE-2026-20089
A vulnerability in the web-based management interface of Cisco IMC could allow a
|
| 24 |
CVE-2026-20090
A vulnerability in the web-based management interface of Cisco IMC could allow a
|
| 24 |
CVE-2026-0947
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti
|
| 24 |
CVE-2026-31823
Sylius is an Open Source eCommerce Framework on Symfony. An authenticated stored
|
| 24 |
CVE-2026-26291
Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If
|
| 24 |
CVE-2026-27447
OpenPrinting CUPS is an open source printing system for Linux and other Unix-lik
|
| 24 |
CVE-2026-20112
A vulnerability in the web-based Cisco IOx application hosting environment manag
|
| 24 |
CVE-2026-34321
Vulnerability in the Oracle Financial Services Analytical Applications Infrastru
|
| 24 |
CVE-2025-66486
IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote
|
| 24 |
CVE-2025-2274
Improper Neutralization of Input During Web Page Generation in Forcepoint Web Se
|
| 24 |
CVE-2026-3218
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti
|
| 24 |
CVE-2025-63354
Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option whe
|
| 24 |
CVE-2025-40895
A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map fun
|
| 24 |
CVE-2026-32762
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before
|
| 24 |
CVE-2026-34831
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a
|
| 24 |
CVE-2026-39812
A improper neutralization of input during web page generation ('cross-site scrip
|
| 24 |
CVE-2026-4169
A security flaw has been discovered in Tecnick TCExam up to 16.6.0. Affected is
|
| 24 |
CVE-2026-34441
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library
|
| 24 |
CVE-2026-40975
Values produced by ${random.value} are not suitable for use as secrets. ${random
|
| 24 |
CVE-2026-33732
## Summary
A pathname parsing discrepancy in srvx's `FastURL` allows middleware
|
| 24 |
CVE-2026-31813
Supabase Auth is a JWT based API for managing users and issuing JWT tokens. Prio
|
| 24 |
CVE-2026-23753
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability
|
| 24 |
CVE-2026-23752
GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability
|
| 24 |
CVE-2026-35571
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache n
|
| 24 |
CVE-2026-31351
An authenticated stored cross-site scripting (XSS) vulnerability in the creation
|
| 24 |
CVE-2024-51225
A stored cross-site scripting (XSS) vulnerability in the component /admin/add-br
|
| 24 |
CVE-2024-51224
Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit
|
| 24 |
CVE-2024-51223
A stored cross-site scripting (XSS) vulnerability in the component /admin/profil
|
| 24 |
CVE-2024-51222
A stored cross-site scripting (XSS) vulnerability in the component /admin/profil
|
| 24 |
CVE-2026-22751
Vulnerability in Spring Spring Security. Applications that explicitly configure
|
| 24 |
CVE-2026-2721
The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripti
|
| 24 |
CVE-2026-2485
IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to sto
|
| 24 |
CVE-2026-4919
IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vu
|
| 24 |
CVE-2026-25101
Bludit allows user's session identifier to be set before authentication. The val
|
| 24 |
CVE-2026-2722
The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripti
|
| 24 |
CVE-2026-31890
Inspektor Gadget is a set of tools and framework for data collection and system
|
| 24 |
CVE-2026-26351
GetSimpleCMS Community Edition (CE) version 3.3.16 contains a stored cross-site
|
| 24 |
CVE-2026-28714
Unnecessary transmission of sensitive cryptographic material. The following prod
|
| 24 |
CVE-2025-10539
Due to improper TLS certificate validation in the DeskTime Time Tracking App bef
|
| 24 |
CVE-2026-33205
calibre is a cross-platform e-book manager for viewing, converting, editing, and
|
| 24 |
CVE-2026-41312
pypdf is a free and open-source pure-python PDF library. An attacker who uses a
|
| 24 |
CVE-2026-41314
pypdf is a free and open-source pure-python PDF library. An attacker who uses a
|
| 24 |
CVE-2026-41313
pypdf is a free and open-source pure-python PDF library. An attacker who uses a
|
| 24 |
CVE-2026-40025
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in th
|
| 24 |
CVE-2026-40026
The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in th
|
| 24 |
CVE-2026-35206
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 a
|
| 24 |
CVE-2026-6042
A security flaw has been discovered in musl libc up to 1.2.6. Affected is the fu
|
| 24 |
CVE-2026-20993
Improper export of android application components in Samsung Assistant prior to
|
| 24 |
CVE-2026-25133
October is a Content Management System (CMS) and web platform. Versions prior to
|
| 24 |
CVE-2026-6830
nesquena hermes-webui contains an environment variable leakage vulnerability whe
|
| 24 |
CVE-2026-34450
The Claude SDK for Python provides access to the Claude API from Python applicat
|
| 24 |
CVE-2026-40505
MuPDF mutool does not sanitize PDF metadata fields before writing them to termin
|
| 24 |
CVE-2026-33472
Cryptomator is an open-source client-side encryption application for cloud stora
|
| 24 |
CVE-2026-24325
SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inpu
|
| 24 |
CVE-2026-40593
ChurchCRM is an open-source church management system. In versions prior to 7.2.0
|
| 24 |
CVE-2025-52648
HCL AION is affected by a vulnerability where offering images are not digitally
|
| 24 |
CVE-2026-27126
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.1
|
| 24 |
CVE-2026-33598
A cached crafted response can cause an out-of-bounds read if custom Lua code cal
|
| 24 |
CVE-2026-27854
An attacker might be able to trigger a use-after-free by sending crafted DNS que
|
| 24 |
CVE-2026-39391
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
|
| 24 |
CVE-2026-27128
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.1
|
| 24 |
CVE-2026-29176
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored
|
| 24 |
CVE-2026-24921
Address read vulnerability in the HDC module.
Impact: Successful exploitation of
|
| 24 |
CVE-2026-1726
IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1
|
| 24 |
CVE-2026-40594
## Summary
The `set_session_cookie_secure` `before_request` handler in `src/pyl
|
| 24 |
CVE-2026-32794
Improper Certificate Validation vulnerability in Apache Airflow Provider for Dat
|
| 24 |
CVE-2026-5362
An authenticated attacker with permission to edit document content can store cra
|
| 24 |
CVE-2026-42430
OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in
|
| 24 |
CVE-2026-41912
OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vu
|
| 24 |
CVE-2026-32012
OpenClaw before 2026.2.25 lacks durable replay state for Nextcloud Talk webhook
|
| 24 |
CVE-2026-27101
Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.
|
| 24 |
CVE-2026-26079
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style She
|
| 24 |
CVE-2026-21359
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15,
|
| 24 |
CVE-2026-3714
A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is th
|
| 24 |
CVE-2026-22269
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Imprope
|
| 24 |
CVE-2025-36597
Dell Avamar, versions prior to 19.12 with patch 338905, contains an Improper Lim
|
| 24 |
CVE-2026-34562
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
|
| 24 |
CVE-2025-69725
An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes functio
|
| 24 |
CVE-2026-34561
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
|
| 24 |
CVE-2026-23071
In the Linux kernel, the following vulnerability has been resolved:
regmap: Fix
|
| 24 |
CVE-2026-23110
In the Linux kernel, the following vulnerability has been resolved:
scsi: core:
|
| 24 |
CVE-2026-34298
Vulnerability in the Oracle Applications Framework product of Oracle E-Business
|
| 24 |
CVE-2026-23167
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: F
|
| 24 |
CVE-2026-32106
StudioCMS is a server-side-rendered, Astro native, headless content management s
|
| 24 |
CVE-2026-25392
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoder
|
| 24 |
CVE-2026-28106
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kings Plugi
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 747d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2314d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2127d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1741d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2244d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 4992d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1213d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 1014d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3769d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 916d |