Total CVEs
16287
last 90 days
Avg Priority
36.5
of max 220
KEV
37
actively exploited
POC
3550
public exploits
Unpatched
5444
CRIT/HIGH without patch
How is Priority Score calculated?
Priority Score is a composite risk metric (0-220) combining multiple real-world threat signals:
KEV +50
CISA Known Exploited Vulnerability — confirmed active exploitation in the wild
EPSS x100
Exploit Prediction Scoring System — probability of exploitation in next 30 days (0-100)
CVSS x5
Common Vulnerability Scoring System — technical severity (0-50)
POC +20
Public exploit code exists — lowers barrier for attackers
0-40 Low
40-80 Medium
80-120 High
120+ Critical
Patch Now — Known Exploited Vulnerabilities
194
CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for t
185
CVE-2026-1731
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain
184
CVE-2026-23760
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability
180
CVE-2025-40551
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerabil
170
CVE-2026-1340
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated rem
164
CVE-2026-1281
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated rem
160
CVE-2025-40536
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that
141
CVE-2026-20131
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FM
137
CVE-2026-1603
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthen
134
CVE-2026-22769
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credentia
Priority Distribution
| Priority | CVE |
|---|---|
| 15 |
CVE-2026-1762
A vulnerability in GE Vernova Enervista UR Setup on Windows allows File Manipula
|
| 15 |
CVE-2026-0992
A flaw was found in the libxml2 library. This uncontrolled resource consumption
|
| 15 |
CVE-2026-23553
In the context switch logic Xen attempts to skip an IBPB in the case of
a vCPU r
|
| 15 |
CVE-2026-23749
Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, c
|
| 15 |
CVE-2026-40354
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Fla
|
| 15 |
CVE-2026-32778
libexpat before 2.7.5 allows a NULL pointer dereference in the function setConte
|
| 15 |
CVE-2026-25046
Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent
|
| 15 |
CVE-2026-24515
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown e
|
| 15 |
CVE-2026-0121
In VPU, there is a possible use-after-free read due to a race condition. This co
|
| 14 |
CVE-2026-40228
In systemd 259, systemd-journald can send ANSI escape sequences to the terminals
|
| 14 |
CVE-2025-52659
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This
|
| 14 |
CVE-2025-32739
Improper conditions check in some firmware for some Intel(R) Graphics Drivers an
|
| 14 |
CVE-2026-34781
### Impact
Apps that call `clipboard.readImage()` may be vulnerable to a denial
|
| 14 |
CVE-2026-33762
### Impact
`go-git`’s index decoder for format version 4 fails to validate the
|
| 14 |
CVE-2026-0520
A potential vulnerability was reported in the Lenovo FileZ Android application t
|
| 14 |
CVE-2026-2239
A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread
|
| 14 |
CVE-2026-1485
A flaw was found in Glib's content type parsing logic. This buffer underflow vul
|
| 14 |
CVE-2025-36194
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51,
|
| 14 |
CVE-2025-59383
A buffer overflow vulnerability has been reported to affect Media Streaming Add-
|
| 14 |
CVE-2026-3469
A denial-of-service (DoS) vulnerability exists due to improper input validation
|
| 14 |
CVE-2026-32946
## Summary
A vulnerability exists in the Community Tier of Harden-Runner that a
|
| 14 |
CVE-2026-24641
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet For
|
| 14 |
CVE-2025-52660
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allo
|
| 14 |
CVE-2026-4285
A vulnerability was identified in taoofagi easegen-admin up to 8f87936ac774065b9
|
| 14 |
CVE-2026-1791
Unrestricted Upload of File with Dangerous Type vulnerability in Hillstone Netwo
|
| 14 |
CVE-2026-33160
### Summary
An unauthenticated user can call `assets/generate-transform` with a
|
| 14 |
CVE-2026-23859
Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enf
|
| 14 |
CVE-2026-21965
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pl
|
| 14 |
CVE-2026-3339
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Travers
|
| 14 |
CVE-2026-34520
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
|
| 14 |
CVE-2026-34514
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
|
| 14 |
CVE-2026-34519
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
|
| 14 |
CVE-2026-34947
Discourse is an open-source discussion platform. From versions 2026.1.0-latest t
|
| 14 |
CVE-2026-33879
Federated Learning and Interoperability Platform (FLIP) is an open-source platfo
|
| 14 |
CVE-2026-34517
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
|
| 14 |
CVE-2026-34518
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
|
| 14 |
CVE-2026-34513
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
|
| 14 |
CVE-2026-34762
## Summary
The `PUT /api/v1/subscriber/{imsi}` API accepts an IMSI identifier f
|
| 14 |
CVE-2025-31966
HCL Sametime is vulnerable to broken server-side validation. While the applicati
|
| 14 |
CVE-2025-14270
The OneClick Chat to Order plugin for WordPress is vulnerable to authorization b
|
| 14 |
CVE-2025-66487
IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequenc
|
| 14 |
CVE-2025-15321
Tanium addressed an improper input validation vulnerability in Tanium Appliance.
|
| 14 |
CVE-2026-29185
Backstage is an open framework for building developer portals. Prior to version
|
| 14 |
CVE-2025-13459
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a
|
| 14 |
CVE-2026-28227
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 20
|
| 14 |
CVE-2026-26979
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 20
|
| 14 |
CVE-2026-26964
Windmill is an open-source developer platform for internal code: APIs, backgroun
|
| 14 |
CVE-2026-0925
Tanium addressed an improper input validation vulnerability in Discover.
|
| 14 |
CVE-2025-14083
A flaw was found in the Keycloak Admin REST API. This vulnerability allows the e
|
| 14 |
CVE-2026-2543
A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerab
|
| 14 |
CVE-2026-21640
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format strin
|
| 14 |
CVE-2026-27153
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 20
|
| 14 |
CVE-2026-33394
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-late
|
| 14 |
CVE-2026-29104
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (C
|
| 14 |
CVE-2026-34203
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to
|
| 14 |
CVE-2026-3911
A flaw was found in Keycloak. An authenticated user with the view-users role cou
|
| 14 |
CVE-2026-5375
An issue that could allow a user with access to a credential to view sensitive f
|
| 14 |
CVE-2026-32717
AnythingLLM is an application that turns pieces of content into context that any
|
| 14 |
CVE-2026-27151
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 20
|
| 14 |
CVE-2026-32638
## Summary
The REST API `getUsers` endpoint in StudioCMS uses the attacker-cont
|
| 14 |
CVE-2026-22717
Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any plat
|
| 14 |
CVE-2026-32445
Missing Authorization vulnerability in Elementor Elementor Website Builder eleme
|
| 14 |
CVE-2026-2419
The WP-DownloadManager plugin for WordPress is vulnerable to Path Traversal in a
|
| 14 |
CVE-2025-61643
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associate
|
| 14 |
CVE-2026-25517
Wagtail is an open source content management system built on Django. Prior to ve
|
| 14 |
CVE-2026-1831
The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to
|
| 14 |
CVE-2025-13881
A flaw was found in Keycloak Admin API. This vulnerability allows an administrat
|
| 14 |
CVE-2026-1518
A flaw was found in Keycloak’s CIBA feature where insufficient validation of cli
|
| 14 |
CVE-2026-4292
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4
|
| 14 |
CVE-2025-15480
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user cr
|
| 14 |
CVE-2025-14551
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials durin
|
| 14 |
CVE-2026-4916
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2
|
| 13 |
CVE-2026-22735
Spring MVC and WebFlux applications are vulnerable to stream corruption when usi
|
| 13 |
CVE-2026-21725
A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-the
|
| 13 |
CVE-2025-61873
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV In
|
| 13 |
CVE-2025-55274
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability.
|
| 13 |
CVE-2025-55277
HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerabi
|
| 13 |
CVE-2026-20757
Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows
|
| 13 |
CVE-2026-35388
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode mu
|
| 13 |
CVE-2026-4243
A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts
|
| 13 |
CVE-2026-2974
A vulnerability was identified in AliasVault App up to 0.25.3 on Android/iOS. Th
|
| 13 |
CVE-2026-23901
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects
|
| 13 |
CVE-2026-24508
Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Im
|
| 13 |
CVE-2026-27139
On Unix platforms, when listing the contents of a directory using File.ReadDir o
|
| 12 |
CVE-2026-1705
A vulnerability was detected in D-Link DSL-6641K N8.TR069.20131126. Affected by
|
| 12 |
CVE-2025-52661
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. Thi
|
| 12 |
CVE-2026-1444
A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37
|
| 12 |
CVE-2026-4474
A flaw has been found in itsourcecode University Management System 1.0. Impacted
|
| 12 |
CVE-2026-2965
A security flaw has been discovered in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.
|
| 12 |
CVE-2025-31703
A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker
|
Oldest Unpatched Critical/High CVEs
| CVE | Severity | CVSS | Priority | Days Open |
|---|---|---|---|---|
| CVE-2024-3400 | CRITICAL | 10.0 | 224 | 730d |
| CVE-2019-19781 | CRITICAL | 9.8 | 223 | 2298d |
| CVE-2020-5902 | CRITICAL | 9.8 | 223 | 2111d |
| CVE-2021-35464 | CRITICAL | 9.8 | 223 | 1725d |
| CVE-2020-10189 | CRITICAL | 9.8 | 223 | 2228d |
| CVE-2012-4681 | CRITICAL | 9.8 | 223 | 4976d |
| CVE-2022-42475 | CRITICAL | 9.8 | 223 | 1196d |
| CVE-2023-3519 | CRITICAL | 9.8 | 223 | 998d |
| CVE-2015-7450 | CRITICAL | 9.8 | 222 | 3753d |
| CVE-2023-34048 | CRITICAL | 9.8 | 222 | 900d |