7736
CVEs
756
Critical
3252
High
9
KEV
648
PoC
234
Unpatched C/H
94.9%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
756
HIGH
3252
MEDIUM
3723
LOW
1
Monthly CVE Trend
Affected Products (30)
Linux Kernel
2886
Ubuntu
628
Debian Linux
588
Opensuse
477
Chrome
469
Linux Enterprise Desktop
373
Linux Enterprise Server
346
Ubuntu Linux
319
Enterprise Linux Server
306
Enterprise Linux Desktop
303
Enterprise Linux Workstation
292
Python
289
Linux Enterprise Software Development Kit
251
Thunderbird
189
Enterprise Linux Eus
184
Kubernetes
176
Firefox
175
Docker
166
Leap
157
Seamonkey
147
Mattermost
124
MySQL
120
Enterprise Linux Server Aus
118
Suse Linux Enterprise Server
111
Fedora
111
Imagemagick
103
Linux Enterprise Workstation Extension
101
Node.js
94
Flash Player
92
Java
88
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-24061 | GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain root access by setting the USER environment variable to '-f root' during TELNET negotiation. With EPSS 75% and KEV listing, this trivially exploitable vulnerability (CVE-2026-24061) has been widely weaponized. Public PoC is available and patches exist. | CRITICAL | 9.8 | 75.3% | 209 |
KEV
PoC
|
| CVE-2026-85046 | Type confusion in V8 (Chrome's JavaScript engine) in versions prior to 152.0.7977.82 enables unauthenticated remote attackers to execute arbitrary code within Chrome's renderer sandbox by enticing a user to visit a specially crafted HTML page. The flaw exploits V8's type system, allowing an attacker to manipulate object type metadata in the JavaScript heap to gain controlled memory access and code execution inside the renderer process. No public exploit or CISA KEV listing has been identified at time of analysis, though V8 type confusion vulnerabilities in Chrome have historically attracted rapid weaponization given the browser's enormous attack surface and attacker interest. | HIGH | 8.8 | 0.5% | 119 |
KEV
PoC
|
| CVE-2026-3910 | Chrome's V8 JavaScript engine contains an inappropriate implementation (CVE-2026-3910, CVSS 8.8) that allows remote attackers to execute arbitrary code within the browser sandbox via crafted HTML pages. KEV-listed with public PoC, this V8 vulnerability affects all Chromium-based browsers and enables drive-by exploitation through any web page containing malicious JavaScript. | HIGH | 8.8 | 0.1% | 119 |
KEV
PoC
|
| CVE-2026-3909 | Google Chrome's Skia graphics library contains an out-of-bounds write (CVE-2026-3909, CVSS 8.8) enabling remote attackers to perform memory corruption through crafted HTML pages. KEV-listed with public PoC and patches available, this vulnerability in the core graphics rendering engine affects all Chromium-based browsers. | HIGH | 8.8 | 0.1% | 119 |
KEV
PoC
|
| CVE-2026-33634 | Trivy security scanner v0.69.4 was compromised in a supply chain attack where a threat actor used stolen credentials to publish malicious releases and force-push credential-stealing malware to GitHub Actions repositories. | CRITICAL | 9.4 | 0.0% | 117 |
KEV
PoC
|
| CVE-2026-2441 | Google Chrome's CSS engine contains a use-after-free vulnerability (CVE-2026-2441, CVSS 8.8) that allows remote attackers to execute arbitrary code within the browser sandbox through crafted HTML pages. KEV-listed with public PoC, this vulnerability enables drive-by exploitation when users visit malicious or compromised websites. | HIGH | 8.8 | 0.1% | 114 |
KEV
PoC
|
| CVE-2023-43000 | A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available. | HIGH | 8.8 | 0.1% | 114 |
KEV
PoC
|
| CVE-2026-27771 | Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers read private or internal Composer package source links they should not be authorized to see, leaking internal repository/source metadata. The flaw is a missing-authorization (CWE-862) issue reported by the Gitea project itself and fixed in v1.26.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With a CVSS 3.0 base score of 8.2 driven by high confidentiality impact, the practical effect is unauthorized disclosure of otherwise-private package sourcing information. | HIGH | 8.2 | 40.7% | 102 |
PoC
|
| CVE-2025-43529 | WebKit arbitrary code execution via use-after-free memory corruption affects Safari 26.2, iOS/iPadOS 18.7.3 through 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, and watchOS 26.2, allowing remote attackers to execute arbitrary code by convincing users to visit malicious websites. This vulnerability is confirmed actively exploited (CISA KEV) in extremely sophisticated targeted attacks against specific individuals on iOS versions prior to iOS 26, per Apple's security bulletin. EPSS score of 0.12% (32nd percentile) significantly understates real-world risk given confirmed exploitation. Related vulnerability CVE-2025-14174 was issued for the same exploitation campaign, suggesting a complex attack chain targeting Apple ecosystem users. | HIGH | 8.8 | 0.1% | 94 |
KEV
|
| CVE-2025-49844 | UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available. | CRITICAL | 9.9 | 12.4% | 92 |
PoC
|
| CVE-2026-52806 | Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-configured instances with open registration) to execute arbitrary commands as the Gogs server process by crafting a pull request whose base branch name injects a `--exec` flag into the underlying `git rebase` invocation. A working Python proof-of-concept exists and has been validated end-to-end against Docker, Linux binary, and Windows installations, yielding shell access as the `git` user. No CISA KEV listing or EPSS data is provided, so this is treated as publicly available exploit code rather than confirmed active exploitation. | CRITICAL | 9.9 | 1.0% | 86 |
PoC
|
| CVE-2026-45087 | Unauthenticated remote code execution in Dalfox REST API server mode (versions ≤2.12.0) allows network attackers to execute arbitrary OS commands by injecting shell payloads via the `found-action` parameter in POST /scan requests. The server binds to 0.0.0.0:6664 by default with no API key enforcement unless explicitly configured, and deserializes attacker-controlled JSON directly into execution-control options without sanitization. Attackers trivially guarantee exploitation by hosting a reflective XSS endpoint to trigger the injected command. Fixed in version 2.13.0. CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). EPSS data not available; no CISA KEV listing at time of analysis. Public exploit code exists (detailed proof-of-concept published in GitHub advisory GHSA-v25v-m36w-jp4h). | CRITICAL | 10.0 | 0.0% | 85 |
PoC
|
| CVE-2025-46817 | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. | HIGH | 7.0 | 13.2% | 78 |
PoC
|
| CVE-2026-54735 | Server-side request forgery in Prebid Server (Go) versions before 4.4.0 lets remote unauthenticated attackers coerce the ad server into making HTTP requests to attacker-chosen destinations. Multiple bidder adapters (e.g. acuityads, adhese, bidmachine) interpolate an unvalidated user-supplied 'host'/'account' bid-request parameter directly into outbound URLs, enabling extraction of host-environment data and access to internal network services. No public exploit identified at time of analysis, but the fix commit and GHSA advisory are public; EPSS was not provided. | CRITICAL | 10.0 | 0.4% | 70 |
PoC
|
| CVE-2025-59360 | The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 1.1% | 70 |
PoC
|