Trending Vulnerabilities
Real-time threat radar – CVEs ranked by multi-signal trending score
10
Trending CVEs
14
Advisories
6
Critical
4
High
6
KEV
9
POC Available
How trending scores work
Each CVE is scored by accumulating heat signals within 48h of publication. Score decays 20%/day after 3 days.
+5 CISA KEV
+4 EPSS > 0.5
+4 POC < 48h
+3 CISA/CERT-EU advisory
+3 SSVC active exploitation
+2 Multi-vendor patches
+2 User stacks affected
+2 ZDI advisory
+1–3 News mentions
17
Score
Authentication bypass in Cisco Catalyst SD-WAN Manager (vManage) allows an unauthenticated remote attacker to reach a restricted HTTP API endpoint with the privileges of the admin user by submitting a crafted request whose URI encoding evades the authentication rule guarding that endpoint. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, no user interaction and no special complexity are required - the single real prerequisite is network reachability to the SD-WAN Manager management/API interface, so exposure is materially lower for deployments that keep that interface on trusted management networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the impact of a successful bypass is complete administrative compromise of the controller, which drives the high priority of this issue.
KEV
Poc
Active Exploitation
CVSS 9+
News Buzz
Social Buzz
Authentication Bypass
Cisco
Cisco Catalyst Sd Wan Manager
KEV
PoC
No patch available
9.8
CVSS 3.1
1.1%
EPSS
125
Priority
17
Score
Unauthenticated path traversal in Fortinet FortiMail (7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1) lets a remote attacker write arbitrary files on the underlying system via crafted HTTP or HTTPS requests, yielding CVSS 9.8 with full confidentiality, integrity and availability impact. CISA has added the CVE to its Known Exploited Vulnerabilities catalog, so it is confirmed actively exploited (CISA KEV), and publicly available exploit code exists, making unpatched internet-reachable gateways an urgent remediation priority. Exploitation requires only that the FortiMail HTTP/HTTPS interface be network-reachable - no authentication (PR:N) and no user interaction (UI:N) - so environments that confine management/web access to trusted networks or a VPN substantially reduce exposure.
KEV
Euvd Kev
Poc
CVSS 9+
News Buzz
Social Buzz
Path Traversal
Fortinet
Fortimail
KEV
PoC
No patch available
9.8
CVSS 3.1
1.8%
EPSS
126
Priority
10
Score
An unauthenticated arbitrary file access vulnerability affects a broad set of Atlassian Data Center and Server products - Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye - allowing a remote attacker to retrieve specific files that reside inside the web application root directory. Exploitation requires the attacker to already know the exact file name and full path of the target; the flaw provides no directory enumeration or listing capability, so it cannot be used to discover files opportunistically. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), and impact is configuration-dependent because meaningful damage only occurs when sensitive files such as secret- or credential-bearing configurations sit inside the reachable web root; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Poc
CVSS 9+
News Buzz
Social Buzz
Information Disclosure
Path Traversal
Atlassian
Bamboo Data Center
PoC
No patch available
9.3
CVSS 4.0
0.7%
EPSS
67
Priority
7
Score
GHSA
GHSA-vcvr-r3jv-pc5j
CRITICAL
A critical remote code execution vulnerability exists in the Node.js `ImageResponse` implementation within `next/og`, affecting Next.js versions 16.2.0 through 16.3.5 on npm. The flaw is rooted in an upstream vulnerability that is triggered when applications pass attacker-controlled input directly into SVG content, attributes, or styles during server-side image generation - for example, reading a query parameter and rendering it inside an SVG element without sanitization. Exploitation allows an attacker to achieve arbitrary code execution on the server hosting the affected Next.js application; notably, applications using the Edge runtime `ImageResponse` or those that do not incorporate user-controlled values into SVG rendering are not affected. The patch is available in Next.js 16.3.6, and operators who cannot upgrade immediately should audit all usages of `next/og` to ensure no user-supplied data flows into SVG content, attributes, or style properties rendered by the Node.js implementation.
News Buzz
Cvss 9plus
10 news
10
News
7
Score
GHSA
GHSA-vhjp-6vjm-vq35
CRITICAL
The npm package `@design-system-coopeuch/web` has been identified as containing malicious code, classifying it as a supply chain compromise affecting all published versions (>= 0). Any system that has installed or executed this package should be treated as fully compromised, with attackers potentially having gained persistent, unrestricted access to the host environment.
The severity is rated Critical, and because the malware may establish persistence mechanisms beyond the package itself, simply removing the package cannot be assumed to fully remediate the threat. All secrets, API keys, credentials, and tokens stored on or accessed from an affected machine must be rotated immediately from a separate, unaffected system.
Organizations and developers using this package should remove it immediately, conduct a full forensic review of affected systems, and audit any pipelines or CI/CD environments where the package may have executed. There is no patched version available; the entire package should be considered unsafe and avoided entirely. Dependency lockfiles and build logs should be reviewed to determine the blast radius of any exposure.
News Buzz
Cvss 9plus
7 news
7
News
7
Score
MAL
MAL-2026-17699
CRITICAL
Malicious code in @dransay/secrets (npm)
News Buzz
Cvss 9plus
Supply Chain
4 news
4
News
7
Score
MAL
MAL-2026-17187
CRITICAL
Malicious code in @digift/cli (npm)
News Buzz
Cvss 9plus
Supply Chain
4 news
4
News
7
Score
MAL
MAL-2026-17495
CRITICAL
Malicious code in @angulra/cli (npm)
News Buzz
Cvss 9plus
Supply Chain
3 news
3
News
7
Score
MAL
MAL-2026-17536
CRITICAL
Malicious code in @angulaar/cli (npm)
News Buzz
Cvss 9plus
Supply Chain
3 news
3
News
7
Score
MAL
MAL-2026-17492
CRITICAL
Malicious code in @angularr/cli (npm)
News Buzz
Cvss 9plus
Supply Chain
3 news
3
News
6
Score
GHSA
4
News
6
Score
GHSA
4
News
6
Score
GHSA
GHSA-44hm-95r4-wcrf
CRITICAL
Malware in @woodpecker-web-shared/components
News Buzz
Cvss 9plus
4 news
4
News
6
Score
GHSA
3
News
6
Score
GHSA
3
News
6
Score
GHSA
3
News
5
Score
Citrix NetScaler ADC and NetScaler Gateway deployments running builds prior to 14.1-73.37 or 13.1-64.23 (including the corresponding FIPS and NDcPP builds 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP) can be driven by an unauthenticated remote attacker to achieve remote code execution or cause a denial-of-service condition. Per the available CVSS 4.0 vector the attack is network-reachable with no privileges or user interaction required, but Attack Complexity is High, meaning the attacker must first satisfy a specific, non-default precondition or timing/state condition rather than issuing a single trivial request. The vendor assigns a 9.5 base score with high impact to both the vulnerable appliance and subsequent systems; no confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, and the underlying weakness class was not disclosed (CWE: N/A).
KEV
Euvd Kev
Circl Kev
Poc
Cisa
Certeu
Active Exploitation
CVSS 9+
News Buzz
Social Buzz
RCE
Buffer Overflow
Denial Of Service
Citrix
KEV
PoC
9.5
CVSS 4.0
1.3%
EPSS
149
Priority