Vulnerability Database
Curated CVE records with CVSS severity, EPSS exploit probability, and CISA KEV exploitation status. The database covers every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05.
Updated
Actively Exploited (CISA KEV)
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Integer Overflow or Wraparound in GitLab
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
net: skbuff: preserve shared-frag marker during coalescing
ESX insufficient logging vulnerability
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Highest Exploit Probability
Windows Netlogon Remote Code Execution Vulnerability
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability
Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read
Recently Published
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
Security Advisory 0199
Out-of-Bounds Write in Google Brotli Decoder
RCE via stale global state
RCE via OOM corruption
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Browse by Vendor
Browse by Weakness
Browse by Port
Named Vulnerabilities
55About This Vulnerability Database
This vulnerability database is built from four public data sources: the official CVE List for record data, the CISA KEV catalog for confirmed exploitation, FIRST EPSS for exploitation probability, and CISA alerts, which typically cover newly exploited or disclosed vulnerabilities. Records sync every 6 hours.
Each record shows the CVSS base score from the assigning CNA or CISA, the EPSS percentile, affected vendor and product versions, and references grouped by type. KEV entries additionally carry the federal remediation due date and the required action CISA publishes.
Frequently Asked Questions
What is a vulnerability database?→
A vulnerability database collects records of publicly disclosed security flaws, identified by CVE IDs, with severity scores, affected products, and references. This database focuses on exploited, likely exploited, and critical CVEs rather than every published record.
What is the CISA Known Exploited Vulnerabilities catalog?→
The CISA KEV catalog lists CVEs confirmed as exploited in the wild. US federal civilian executive branch agencies must remediate listed vulnerabilities within the time frames CISA sets, and CISA advises all organizations to use the catalog as an input to vulnerability management prioritization.
What is an EPSS score?→
EPSS (Exploit Prediction Scoring System) is a FIRST-maintained model that estimates the probability a CVE will be exploited in the next 30 days. Scores range from 0 to 1 and update daily as new threat data arrives.
Which vulnerabilities are included in this database?→
- +Every CVE in the CISA KEV catalog, from any year.
- +CVEs from any year that a CISA alert names and that have a headline CVSS score of at least 9.0. The sync skips alerts that only announce KEV additions.
- +CVE IDs from 2026 onward with an EPSS score of at least 0.1. A CVE listed under this rule stays listed until its score falls below 0.08.
- +CVE IDs from 2026 onward with a headline CVSS score of at least 9.0 and an EPSS score of at least 0.05. A CVE listed under this rule stays listed until its EPSS score falls below 0.04.
- +The headline CVSS score of a record is its highest CVSS v3.x or v4 base score from the assigning CNA or CISA. A CVSS v2 score is the headline only when the record has no newer one.
How often is this vulnerability database updated?→
Records sync every 6 hours from the CVE List, the CISA KEV catalog, FIRST EPSS, and the CISA alerts feed. New KEV additions, EPSS score changes, and new CISA alerts appear on the next sync.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert data from CISA cybersecurity alerts. Coverage: every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.