Vulnerability Database
Curated CVE records with CVSS severity, EPSS exploit probability, and CISA KEV exploitation status. The database covers every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05.
Updated
Actively Exploited (CISA KEV)
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
OS Command Injection in Barracuda Appliances
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
Google Chromium Use-After-Free Vulnerability
Microsoft Outlook Spoofing Vulnerability
Highest Exploit Probability
Windows Netlogon Remote Code Execution Vulnerability
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability
Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read
Recently Published
Microsoft Outlook Spoofing Vulnerability
Google Chromium Use-After-Free Vulnerability
IBM Aspera Faspex Authorization Bypass
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability
Browse by Vendor
Browse by Weakness
Browse by Port
Named Vulnerabilities
45About This Vulnerability Database
This vulnerability database is built from four public data sources: the official CVE List for record data, the CISA KEV catalog for confirmed exploitation, FIRST EPSS for exploitation probability, and CISA alerts, which typically cover newly exploited or disclosed vulnerabilities. Records sync every 6 hours.
Each record shows the CVSS base score from the assigning CNA or CISA, the EPSS percentile, affected vendor and product versions, and references grouped by type. KEV entries additionally carry the federal remediation due date and the required action CISA publishes.
Frequently Asked Questions
What is a vulnerability database?→
A vulnerability database collects records of publicly disclosed security flaws, identified by CVE IDs, with severity scores, affected products, and references. This database focuses on exploited, likely exploited, and critical CVEs rather than every published record.
What is the CISA Known Exploited Vulnerabilities catalog?→
The CISA KEV catalog lists CVEs confirmed as exploited in the wild. US federal civilian executive branch agencies must remediate listed vulnerabilities within the time frames CISA sets, and CISA advises all organizations to use the catalog as an input to vulnerability management prioritization.
What is an EPSS score?→
EPSS (Exploit Prediction Scoring System) is a FIRST-maintained model that estimates the probability a CVE will be exploited in the next 30 days. Scores range from 0 to 1 and update daily as new threat data arrives.
Which vulnerabilities are included in this database?→
- +Every CVE in the CISA KEV catalog, from any year.
- +CVEs from any year that a CISA alert names and that have a headline CVSS score of at least 9.0. The sync skips alerts that only announce KEV additions.
- +CVE IDs from 2026 onward with an EPSS score of at least 0.1.
- +CVE IDs from 2026 onward with a headline CVSS score of at least 9.0 and an EPSS score of at least 0.05.
- +A CVE stays listed once it is added, even if its scores later fall below these thresholds. A record is removed only when the CVE Program rejects it.
- +The headline CVSS score of a record is its highest CVSS v3.x or v4 score as published by the assigning CNA or CISA, usually the base score. A CVSS v2 score is the headline only when the record has no newer one.
How often is this vulnerability database updated?→
Records sync every 6 hours from the CVE List, the CISA KEV catalog, FIRST EPSS, and the CISA alerts feed. New KEV additions, EPSS score changes, and new CISA alerts appear on the next sync.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert data from CISA cybersecurity alerts. Coverage: every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.