CVE Database
Every record in the index: all CISA KEV entries plus high-signal CVEs from 2026 onward, with CVSS severity and EPSS exploit probability.
CVEsCVE Records
1910
SyncedLast Synced
2026-10-13
Records
1910 totalSeverity
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|
No records match the selected filters.
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-88779KEV Memory overflow vulnerability leading to Denial of Service | Memory overflow vulnerability leading to Denial of Service | NetScaler | 8.7 | 0.6% | KEV | 2026-10-04 |
| CVE-2026-104286KEV Fortinet FortiMail Path Traversal Vulnerability | Fortinet FortiMail Path Traversal Vulnerability | Fortinet | 9.8 | 2.2% | KEV | 2026-10-01 |
| CVE-2026-102490KEV Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package | Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package | Zammad GmbH | 9.4 | 0.5% | KEV | 2026-09-30 |
| CVE-2026-102489KEV Undisclosed RCE in Zammad v6.3 and higher | Undisclosed RCE in Zammad v6.3 and higher | Zammad GmbH | 9.4 | 1.3% | KEV | 2026-09-30 |
| CVE-2026-76504KEV Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | Cisco | 9.8 | 1.8% | KEV | 2026-09-30 |
| CVE-2026-86950KEV Apple Multiple Products Out-of-Bounds Write Vulnerability | Apple Multiple Products Out-of-Bounds Write Vulnerability | Apple | 8.8 | 1.2% | KEV | 2026-09-28 |
| CVE-2026-88772KEV Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Citrix NetScaler | 9.5 | 1.3% | KEV | 2026-09-27 |
| CVE-2026-88771KEV A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | Citrix NetScaler | 9.5 | 1.1% | KEV | 2026-09-27 |
| CVE-2026-87902KEV WordPress Core Remote File Inclusion Vulnerability | WordPress Core Remote File Inclusion Vulnerability | WordPress | 8.1 | 40.0% | KEV | 2026-09-22 |
| CVE-2026-94127KEV BIG-IP APM OAuth vulnerability | BIG-IP APM OAuth vulnerability | F5 | 9.8 | 2.2% | KEV | 2026-09-22 |
| CVE-2026-93616KEV Directory Traversal and File upload allows execution of arbitrary script on the Management Server | Directory Traversal and File upload allows execution of arbitrary script on the Management Server | checkpoint | 9.8 | 19.7% | KEV | 2026-09-22 |
| CVE-2026-93952KEV Security Advisory 0183 | Security Advisory 0183 | Arista Networks | 10.0 | 1.1% | KEV | 2026-09-22 |
| CVE-2026-87886KEV Acronis Backup Incorrect Default Permissions Vulnerability | Acronis Backup Incorrect Default Permissions Vulnerability | Acronis | 7.8 | 0.2% | KEV | 2026-09-17 |
| CVE-2026-76460KEV Cisco Identity Services Engine Authentication Bypass Vulnerability | Cisco Identity Services Engine Authentication Bypass Vulnerability | Cisco | 10.0 | 14.0% | KEV | 2026-09-16 |
| CVE-2026-58704KEV Google Pixel Improper Authorization Vulnerability | Google Pixel Improper Authorization Vulnerability | 8.8 | 0.6% | KEV | 2026-09-15 | |
| CVE-2026-76461KEV Cisco Secure Email Gateway SQL Injection Vulnerability | Cisco Secure Email Gateway SQL Injection Vulnerability | Cisco | 9.8 | 28.3% | KEV | 2026-09-14 |
| CVE-2026-85706KEV Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab | 10.0 | 93.0% | KEV | 2026-09-12 |
| CVE-2026-85102KEV Improper Certificate Validation in Quantum Security Gateway | Improper Certificate Validation in Quantum Security Gateway | checkpoint | 9.8 | 7.5% | KEV | 2026-09-09 |
| CVE-2026-87491KEV Google Chromium V8 Out of Bounds Write Vulnerability | Google Chromium V8 Out of Bounds Write Vulnerability | 8.8 | 3.1% | KEV | 2026-09-09 | |
| CVE-2026-84869KEV ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | ConnectWise | 9.9 | 0.9% | KEV | 2026-09-08 |
| CVE-2026-81963KEV Windows Update Stack Elevation of Privilege Vulnerability | Windows Update Stack Elevation of Privilege Vulnerability | Microsoft | 7.8 | 0.4% | KEV | 2026-09-08 |
| CVE-2026-85880KEV Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Microsoft | 7.8 | 3.6% | KEV | 2026-09-08 |
| CVE-2026-75650KEV Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Adobe | 10.0 | 3.9% | KEV | 2026-09-07 |
| CVE-2026-86218KEV pre-authentication remote code execution | pre-authentication remote code execution | N-able | 10.0 | 14.5% | KEV | 2026-09-06 |
| CVE-2026-86060KEV SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Mikrotik | 9.2 | 6.4% | KEV | 2026-09-05 |
| CVE-2026-67279KEV SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Mikrotik | 6.9 | 1.0% | KEV | 2026-09-05 |
| CVE-2026-67277KEV Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | Mikrotik | 8.8 | 1.6% | KEV | 2026-09-05 |
| CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS | SSH user impersonation possible in Mikrotik RouterOS | Mikrotik | 9.2 | 6.5% | 2026-09-05 | |
| CVE-2026-85046KEV Google Chromium V8 Type Confusion Vulnerability | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 48.9% | KEV | 2026-09-03 | |
| CVE-2026-83549KEV SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SonicWall | 7.8 | 9.9% | KEV | 2026-09-01 |
| CVE-2026-83548KEV SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SonicWall | 10.0 | 8.0% | KEV | 2026-09-01 |
| CVE-2026-82329KEV Potential authentication bypass leading to administrative access in Artifactory | Potential authentication bypass leading to administrative access in Artifactory | jfrog | 9.8 | 14.1% | KEV | 2026-08-28 |
| CVE-2026-82078KEV PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | PaperCut | 9.4 | 63.5% | KEV | 2026-08-28 |
| CVE-2026-81578KEV PaperCut MF/NG: Authentication Bypass | PaperCut MF/NG: Authentication Bypass | PaperCut | 8.8 | 85.6% | KEV | 2026-08-28 |
| CVE-2026-60004KEV Gitea Code Injection Vulnerability | Gitea Code Injection Vulnerability | Gitea | 9.8 | 24.0% | KEV | 2026-08-26 |
| CVE-2026-72530KEV TrueConf Server Code Injection Vulnerability | TrueConf Server Code Injection Vulnerability | TrueConf | 9.5 | 1.7% | KEV | 2026-08-19 |
| CVE-2026-72529KEV TrueConf Server Missing Authentication for Critical Function Vulnerability | TrueConf Server Missing Authentication for Critical Function Vulnerability | TrueConf | 9.8 | 1.5% | KEV | 2026-08-19 |
| CVE-2026-19490KEV NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | NetScaler | 9.3 | 23.2% | KEV | 2026-08-19 |
| CVE-2026-64849KEV MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | mlflow | 9.3 | 9.8% | KEV | 2026-08-17 |
| CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab | Improper Control of Generation of Code ('Code Injection') in GitLab | GitLab | 9.4 | 60.2% | 2026-08-17 | |
| CVE-2026-73570KEV Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Zimbra | 8.9 | 71.7% | KEV | 2026-08-13 |
| CVE-2026-42018KEV Anonymous user token generation exposure in JFrog Artifactory | Anonymous user token generation exposure in JFrog Artifactory | jfrog | 7.5 | 9.8% | KEV | 2026-08-12 |
| CVE-2026-66384KEV Authenticated users may write data outside the intended Docker cache path | Authenticated users may write data outside the intended Docker cache path | jfrog | 5.3 | 0.7% | KEV | 2026-08-12 |
| CVE-2026-71362KEV Adobe Commerce | Incorrect Authorization (CWE-863) | Adobe Commerce | Incorrect Authorization (CWE-863) | Adobe | 9.1 | 87.5% | KEV | 2026-08-11 |
| CVE-2026-20349KEV Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability | Cisco | 8.6 | 1.0% | KEV | 2026-08-11 |
| CVE-2026-68820KEV Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Microsoft | 7.0 | 0.3% | KEV | 2026-08-11 |
| CVE-2026-65660KEV Microsoft SharePoint Server Remote Code Execution Vulnerability | Microsoft SharePoint Server Remote Code Execution Vulnerability | Microsoft | 8.8 | 2.1% | KEV | 2026-08-11 |
| CVE-2026-72898KEV Metabase SQL injection via password reset endpoint | Metabase SQL injection via password reset endpoint | Metabase | 10.0 | 19.0% | KEV | 2026-08-10 |
| CVE-2026-15733 WGDashboard Remote Code Execution vulnerability | WGDashboard Remote Code Execution vulnerability | WGDashboard | 9.8 | 10.0% | 2026-08-06 | |
| CVE-2026-65400KEV Apple macOS Improper Authentication Vulnerability | Apple macOS Improper Authentication Vulnerability | Apple | 9.8 | 1.7% | KEV | 2026-08-06 |
| CVE-2026-5430KEV Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | WSO2 | 10.0 | 0.6% | KEV | 2026-08-06 |
| CVE-2026-18577KEV Incomplete patch leads to administrative account takeover | Incomplete patch leads to administrative account takeover | N-able | 8.2 | 14.6% | KEV | 2026-08-02 |
| CVE-2026-18556KEV Unauthenticated administrative account takeover | Unauthenticated administrative account takeover | N-able | 8.2 | 7.9% | KEV | 2026-08-01 |
| CVE-2026-66066 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing | rails | 9.5 | 27.9% | 2026-07-30 | |
| CVE-2026-59310KEV vCenter directory-traversal vulnerability | vCenter directory-traversal vulnerability | VMware | 9.8 | 2.6% | KEV | 2026-07-30 |
| CVE-2026-20316KEV Cisco Secure Firewall Management Center Software Static Credential Vulnerability | Cisco Secure Firewall Management Center Software Static Credential Vulnerability | Cisco | 5.3 | 35.1% | KEV | 2026-07-29 |
| CVE-2026-42016KEV Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | jfrog | 8.1 | 8.6% | KEV | 2026-07-27 |
| CVE-2026-63077KEV JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability | JetBrains | 9.8 | 89.6% | KEV | 2026-07-27 |
| CVE-2026-16812KEV VeloCloud Orchestrator OS Command Injection | VeloCloud Orchestrator OS Command Injection | Arista Networks | 10.0 | 1.0% | KEV | 2026-07-27 |
| CVE-2026-61511 vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php | vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php | vBulletin | 9.8 | 5.6% | 2026-07-27 | |
| CVE-2026-16232KEV Authentication Bypass in the SmartConsole Login Process Using an Application Token | Authentication Bypass in the SmartConsole Login Process Using an Application Token | checkpoint | 9.3 | 78.0% | KEV | 2026-07-22 |
| CVE-2026-8985 Unauthenticated Command Injection | Unauthenticated Command Injection | Autel | 10.0 | 7.1% | 2026-07-21 | |
| CVE-2026-63030KEV WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | WordPress | 9.8 | 10.6% | KEV | 2026-07-17 |
| CVE-2026-60137KEV WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | WordPress | 5.9 | 5.3% | KEV | 2026-07-17 |
| CVE-2026-9198KEV Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation | IBM | 9.8 | 28.7% | KEV | 2026-07-17 |
| CVE-2026-9586KEV Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB | Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB | Sangoma | 9.3 | 19.0% | KEV | 2026-07-17 |
| CVE-2021-27137KEV DD-WRT Stack-Based Buffer Overflow Vulnerability | DD-WRT Stack-Based Buffer Overflow Vulnerability | DD-WRT | 8.1 | 4.0% | KEV | 2026-07-16 |
| CVE-2026-15410KEV SonicWall SMA1000 Appliances Code Injection Vulnerability | SonicWall SMA1000 Appliances Code Injection Vulnerability | SonicWall | 7.2 | 11.8% | KEV | 2026-07-14 |
| CVE-2026-15409KEV SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SonicWall | 10.0 | 6.8% | KEV | 2026-07-14 |
| CVE-2026-55040KEV Microsoft SharePoint Server Security Feature Bypass Vulnerability | Microsoft SharePoint Server Security Feature Bypass Vulnerability | Microsoft | 9.1 | 69.5% | KEV | 2026-07-14 |
| CVE-2026-58644KEV Microsoft SharePoint Remote Code Execution Vulnerability | Microsoft SharePoint Remote Code Execution Vulnerability | Microsoft | 9.8 | 15.9% | KEV | 2026-07-14 |
| CVE-2026-50522KEV Microsoft SharePoint Remote Code Execution Vulnerability | Microsoft SharePoint Remote Code Execution Vulnerability | Microsoft | 9.8 | 3.0% | KEV | 2026-07-14 |
| CVE-2026-56164KEV Microsoft SharePoint Server Elevation of Privilege Vulnerability | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Microsoft | 5.3 | 1.0% | KEV | 2026-07-14 |
| CVE-2026-56155KEV Active Directory Federation Services Elevation of Privilege Vulnerability | Active Directory Federation Services Elevation of Privilege Vulnerability | Microsoft | 7.8 | 0.3% | KEV | 2026-07-14 |
| CVE-2026-56291KEV Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 | balbooa.com | 10.0 | 14.9% | KEV | 2026-07-09 |
| CVE-2026-59822KEV LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | BerriAI | 8.8 | 0.8% | KEV | 2026-07-08 |
| CVE-2026-43825 Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel | Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel | Apache Software Foundation | 7.3 | 13.9% | 2026-07-06 | |
| CVE-2026-53362KEV ipv6: account for fraggap on the paged allocation path | ipv6: account for fraggap on the paged allocation path | Linux | 7.8 | 0.7% | KEV | 2026-07-04 |
| CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators | Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators | conductor-oss | 9.8 | 14.7% | 2026-06-30 | |
| CVE-2026-48282KEV ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Adobe | 10.0 | 42.4% | KEV | 2026-06-30 |
| CVE-2026-8452KEV Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service | NetScaler | 8.8 | 1.0% | KEV | 2026-06-30 |
| CVE-2026-56290KEV Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 | Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 | joomlack.fr | 10.0 | 30.9% | KEV | 2026-06-29 |
| CVE-2026-13545 D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection | D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection | D-Link | 9.0 | 5.5% | 2026-06-29 | |
| CVE-2026-49869KEV Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` | kestra-io | 10.0 | 2.1% | KEV | 2026-06-26 |
| CVE-2026-53266KEV netfilter: bridge: make ebt_snat ARP rewrite writable | netfilter: bridge: make ebt_snat ARP rewrite writable | Linux | 8.8 | 0.8% | KEV | 2026-06-25 |
| CVE-2026-55255KEV Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | langflow-ai | 8.4 | 0.9% | KEV | 2026-06-23 |
| CVE-2026-48908KEV Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 | Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 | joomshaper.net | 10.0 | 88.5% | KEV | 2026-06-20 |
| CVE-2026-48939KEV Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 | Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 | icagenda.com | 10.0 | 20.1% | KEV | 2026-06-20 |
| CVE-2026-12569KEV Remote Code Execution (RCE) vulnerability in Windchill PDMlink | Remote Code Execution (RCE) vulnerability in Windchill PDMlink | PTC | 9.3 | 46.0% | KEV | 2026-06-18 |
| CVE-2026-7273KEV Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability | Zyxel | 8.8 | 2.5% | KEV | 2026-06-16 |
| CVE-2026-20262KEV Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability | Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability | Cisco | 6.5 | 28.2% | KEV | 2026-06-15 |
| CVE-2026-54420KEV LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | LiteSpeed Technologies | 8.5 | 0.8% | KEV | 2026-06-14 |
| CVE-2026-48558KEV SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification | SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification | SimpleHelp | 10.0 | 5.7% | KEV | 2026-06-12 |
| CVE-2026-35273KEV Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | Oracle Corporation | 9.8 | 96.7% | KEV | 2026-06-11 |
| CVE-2026-20253KEV Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise | Splunk | 9.8 | 96.9% | KEV | 2026-06-10 |
| CVE-2026-20251 Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway | Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway | Splunk | 8.8 | 32.2% | 2026-06-10 | |
| CVE-2026-10727 | - | Ivanti | 7.2 | 13.6% | 2026-06-09 | |
| CVE-2026-25089KEV Fortinet FortiSandbox OS Command Injection Vulnerability | Fortinet FortiSandbox OS Command Injection Vulnerability | Fortinet | 9.1 | 76.1% | KEV | 2026-06-09 |
| CVE-2026-10523 | - | ivanti | 9.9 | 53.1% | 2026-06-09 | |
| CVE-2026-10520KEV Ivanti Sentry OS Command Injection Vulnerability | Ivanti Sentry OS Command Injection Vulnerability | ivanti | 10.0 | 99.9% | KEV | 2026-06-09 |
Frequently Asked Questions
What is a CVE?→
CVE (Common Vulnerabilities and Exposures) is the standard identifier for a publicly known security flaw. Each record has a unique ID, a description, affected products, and references. The CVE Board oversees the program, MITRE serves as its Secretariat and maintains the infrastructure, and CVE Numbering Authorities assign the IDs.
What does a CVE number mean?→
A CVE ID has the format CVE-YYYY-NNNNN: a year, followed by a number of four or more digits. CNAs base the year on when the vulnerability was first publicly disclosed, when the record was first published, or when the ID was reserved. The number identifies the vulnerability; it says nothing about severity.
What is the difference between CVE, NVD, and CISA KEV?→
- +CVE is the identifier and base record, published by a CVE Numbering Authority.
- +NVD is the US National Vulnerability Database, run by NIST. It enriches CVE records within its scope of coverage with CVSS scores, CWE weakness data, and affected-product data.
- +CISA KEV is a catalog of CVEs confirmed as exploited in the wild. It is a small subset of all CVEs and carries remediation deadlines for federal agencies.
How do I read a CVE entry?→
Start with the description and the affected vendor, product, and version ranges. Check the CVSS score for severity, the EPSS score for exploitation probability, and the KEV flag for confirmed exploitation. References link to advisories, patches, and technical writeups.
How do I find a specific CVE here?→
Records live at /vulnerabilities/{cve-id}/ in lowercase, for example /vulnerabilities/cve-2026-1234/. This index only covers KEV entries and high-signal records from 2026 onward; for anything else use NVD or MITRE.