Total CVEs
16298
last 90 days
Avg Priority
36.5
of max 220
KEV
37
actively exploited
POC
3544
public exploits
Unpatched
5446
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
194
CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for t
185
CVE-2026-1731
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain
184
CVE-2026-23760
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability
180
CVE-2025-40551
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerabil
170
CVE-2026-1340
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated rem
164
CVE-2026-1281
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated rem
160
CVE-2025-40536
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that
141
CVE-2026-20131
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FM
137
CVE-2026-1603
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthen
134
CVE-2026-22769
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credentia
Priority Distribution
| Priority | CVE |
|---|---|
| 68 |
CVE-2026-34205
Home Assistant is open source home automation software that puts local control a
|
| 68 |
CVE-2026-28446
OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and
|
| 67 |
CVE-2026-33696
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.
|
| 67 |
CVE-2025-70141
SourceCodester Customer Support System 1.0 contains an incorrect access control
|
| 67 |
CVE-2026-26722
An issue in Key Systems Inc Global Facilities Management Software v.20230721a al
|
| 67 |
CVE-2026-33660
n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.
|
| 67 |
CVE-2026-23696
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vul
|
| 67 |
CVE-2026-1678
dns_unpack_name() caches the buffer tailroom once and reuses it while appending
|
| 67 |
CVE-2026-33579
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /
|
| 67 |
CVE-2025-71275
A critical security vulnerability exists in Zimbra Collaboration Suite (ZCS) Pos
|
| 67 |
CVE-2025-70328
TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnera
|
| 67 |
CVE-2026-29014
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injec
|
| 67 |
CVE-2026-23841
Movary is a web application to track, rate and explore your movie watch history.
|
| 67 |
CVE-2026-23840
Movary is a web application to track, rate and explore your movie watch history.
|
| 67 |
CVE-2026-23839
Movary is a web application to track, rate and explore your movie watch history.
|
| 67 |
CVE-2026-27614
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.13, an un
|
| 67 |
CVE-2026-30562
A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sa
|
| 67 |
CVE-2026-25896
fast-xml-parser allows users to validate XML, parse XML to JS object, or build X
|
| 67 |
CVE-2026-29183
SiYuan is a personal knowledge management system. Prior to version 3.5.9, an una
|
| 67 |
CVE-2025-60949
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployme
|
| 67 |
CVE-2026-25921
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwri
|
| 67 |
CVE-2026-24834
Kata Containers is an open source project focusing on a standard implementation
|
| 67 |
CVE-2026-24399
ChatterMate is a no-code AI chatbot agent framework. In versions 1.0.8 and below
|
| 66 |
CVE-2026-22679
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthentica
|
| 66 |
CVE-2026-35022
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection v
|
| 66 |
CVE-2026-26279
Froxlor is open source server administration software. Prior to 2.3.4, a typo in
|
| 66 |
CVE-2026-25539
SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /a
|
| 66 |
CVE-2026-28697
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-bet
|
| 66 |
CVE-2026-25769
Wazuh is a free and open source platform used for threat prevention, detection,
|
| 66 |
CVE-2026-25548
InvoicePlane is a self-hosted open source application for managing invoices, cli
|
| 66 |
CVE-2025-70146
Missing authentication in multiple administrative action scripts under /admin/ i
|
| 66 |
CVE-2026-25643
Frigate is a network video recorder (NVR) with realtime local object detection f
|
| 66 |
CVE-2026-2701
Authenticated user can upload a malicious file to the server and execute it, whi
|
| 66 |
CVE-2026-25139
RIOT is an open-source microcontroller operating system, designed to match the r
|
| 66 |
CVE-2025-66945
A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x.
|
| 66 |
CVE-2019-25456
Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthent
|
| 66 |
CVE-2025-69990
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability
|
| 66 |
CVE-2026-23722
WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected
|
| 66 |
CVE-2026-31816
Budibase is a low code platform for creating internal tools, workflows, and admi
|
| 66 |
CVE-2026-29000
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication by
|
| 66 |
CVE-2026-22858
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
|
| 66 |
CVE-2026-22859
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
|
| 66 |
CVE-2026-22855
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
|
| 66 |
CVE-2026-27586
Caddy is an extensible server platform that uses TLS by default. Prior to versio
|
| 66 |
CVE-2026-24736
Squidex is an open source headless content management system and content managem
|
| 66 |
CVE-2026-27699
The `basic-ftp` FTP client library for Node.js contains a path traversal vulnera
|
| 66 |
CVE-2026-28370
In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0
|
| 66 |
CVE-2019-25444
Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows un
|
| 66 |
CVE-2026-28215
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.
|
| 66 |
CVE-2026-29065
changedetection.io is a free open source web page change detection tool. Prior t
|
| 66 |
CVE-2025-69602
A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, wher
|
| 66 |
CVE-2025-50199
Chamilo is a learning management system. Prior to version 1.11.30, there is a bl
|
| 66 |
CVE-2026-28231
pillow_heif is a Python library for working with HEIF images and plugin for Pill
|
| 66 |
CVE-2026-33475
Langflow is a tool for building and deploying AI-powered agents and workflows. A
|
| 66 |
CVE-2026-26747
A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper han
|
| 66 |
CVE-2025-66719
An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation log
|
| 66 |
CVE-2026-29188
File Browser provides a file managing interface within a specified directory and
|
| 66 |
CVE-2026-27809
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior
|
| 66 |
CVE-2026-30832
Soft Serve is a self-hostable Git server for the command line. From version 0.6.
|
| 66 |
CVE-2026-23552
Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycl
|
| 66 |
CVE-2026-27587
Caddy is an extensible server platform that uses TLS by default. Prior to versio
|
| 66 |
CVE-2026-27588
Caddy is an extensible server platform that uses TLS by default. Prior to versio
|
| 66 |
CVE-2019-25298
html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attac
|
| 66 |
CVE-2021-47811
Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parame
|
| 66 |
CVE-2025-70985
Incorrect access control in the update function of RuoYi v4.8.2 allows unauthori
|
| 66 |
CVE-2026-26219
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing alg
|
| 66 |
CVE-2023-54337
Sysax Multi Server 6.95 contains a denial of service vulnerability in the admini
|
| 66 |
CVE-2026-27575
Vikunja is an open-source self-hosted task management platform. Prior to version
|
| 66 |
CVE-2026-25160
Alist is a file list program that supports multiple storages, powered by Gin and
|
| 66 |
CVE-2026-26988
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Ve
|
| 66 |
CVE-2026-39912
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication token
|
| 65 |
CVE-2026-5994
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Th
|
| 65 |
CVE-2026-6029
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The affec
|
| 65 |
CVE-2026-5995
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacte
|
| 65 |
CVE-2026-6026
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Th
|
| 65 |
CVE-2026-6112
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affecte
|
| 65 |
CVE-2026-6115
A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the
|
| 65 |
CVE-2026-5850
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This af
|
| 65 |
CVE-2026-5853
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191
|
| 65 |
CVE-2026-6025
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This af
|
| 65 |
CVE-2026-5851
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. Th
|
| 65 |
CVE-2026-5997
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impac
|
| 65 |
CVE-2026-5996
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191
|
| 65 |
CVE-2026-6028
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191
|
| 65 |
CVE-2026-6113
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191
|
| 65 |
CVE-2026-5993
A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vu
|
| 65 |
CVE-2026-5852
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affecte
|
| 65 |
CVE-2026-6027
A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This is
|
| 65 |
CVE-2026-6114
A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected
|
| 65 |
CVE-2026-6116
A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This vu
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 730d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2298d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2111d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1725d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2228d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 4976d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1196d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 998d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3753d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 900d |