CVE Database
Every record in the index, with CVSS severity and EPSS exploit probability. The index covers every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05.
Updated
Records
2083 totalSeverity
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|
No records match the selected filters.
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-124194KEV Microsoft Outlook Spoofing Vulnerability | Microsoft Outlook Spoofing Vulnerability | Microsoft | 6.5 | 1.6% | KEV | 2026-11-10 |
| CVE-2026-125350KEV Google Chromium Use-After-Free Vulnerability | Google Chromium Use-After-Free Vulnerability | 8.8 | 1.0% | KEV | 2026-11-10 | |
| CVE-2026-123218KEV IBM Aspera Faspex Authorization Bypass | IBM Aspera Faspex Authorization Bypass | IBM | 9.8 | 0.5% | KEV | 2026-11-07 |
| CVE-2026-19868KEV SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | SonicWall | 7.5 | 0.5% | KEV | 2026-11-06 |
| CVE-2026-116779KEV FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | signalwire | 9.8 | 2.5% | KEV | 2026-11-05 |
| CVE-2026-123158KEV OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability | OpenBSD | 8.1 | 18.9% | KEV | 2026-11-05 |
| CVE-2026-102895KEV GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin | GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin | gpustack | 9.8 | 0.5% | KEV | 2026-11-04 |
| CVE-2026-77690 Command injection vulnerability | Command injection vulnerability | Zohocorp | 8.8 | 15.6% | 2026-11-04 | |
| CVE-2026-118527KEV Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Ivanti | 4.3 | 0.8% | KEV | 2026-11-03 |
| CVE-2026-116606KEV Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway | Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway | Barracuda Networks | 9.3 | 8.9% | KEV | 2026-11-02 |
| CVE-2026-111560KEV OS Command Injection in Barracuda Appliances | OS Command Injection in Barracuda Appliances | Barracuda Networks | 8.6 | 6.2% | KEV | 2026-11-02 |
| CVE-2026-119977KEV WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | WordPress Foundation | 8.1 | 1.2% | KEV | 2026-10-31 |
| CVE-2026-76418KEV Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability | Cisco | 8.6 | 0.8% | KEV | 2026-10-28 |
| CVE-2026-114625KEV Security Advisory 0199 | Security Advisory 0199 | Arista Networks | 9.9 | 1.0% | KEV | 2026-10-22 |
| CVE-2026-111497KEV Out-of-Bounds Write in Google Brotli Decoder | Out-of-Bounds Write in Google Brotli Decoder | 9.2 | 82.6% | KEV | 2026-10-22 | |
| CVE-2026-109619KEV RCE via stale global state | RCE via stale global state | PHP Group | 9.2 | 99.999% | KEV | 2026-10-21 |
| CVE-2026-109618KEV RCE via OOM corruption | RCE via OOM corruption | PHP Group | 9.2 | 99.999% | KEV | 2026-10-21 |
| CVE-2026-111793KEV Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability | Openwave Messaging (Ireland) Limited | 4.3 | 0.6% | KEV | 2026-10-16 |
| CVE-2026-111357KEV Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | Ivanti | 7.0 | 0.5% | KEV | 2026-10-15 |
| CVE-2026-102764KEV Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support | BeyondTrust | 9.3 | 79.5% | KEV | 2026-10-15 |
| CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php | Netgate | 8.6 | 10.8% | 2026-10-15 | |
| CVE-2026-110936KEV Siemens Software Center Uncontrolled Search Path Element Vulnerability | Siemens Software Center Uncontrolled Search Path Element Vulnerability | Siemens | 8.4 | 1.0% | KEV | 2026-10-15 |
| CVE-2026-0322KEV PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | Palo Alto Networks | 8.6 | 2.1% | KEV | 2026-10-14 |
| CVE-2026-76519KEV Cisco Secure Email Gateway Arbitrary File Write Vulnerability | Cisco Secure Email Gateway Arbitrary File Write Vulnerability | Cisco | 9.8 | 6.2% | KEV | 2026-10-14 |
| CVE-2026-59774 Gitea Org-mode file disclosure and code execution | Gitea Org-mode file disclosure and code execution | Gitea | 9.8 | 28.3% | 2026-10-14 | |
| CVE-2026-106931KEV EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability | EG Secure Solutions Inc. | 8.5 | 2.5% | KEV | 2026-10-14 |
| CVE-2026-110447KEV Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | Collabora | 9.2 | 73.3% | KEV | 2026-10-14 |
| CVE-2026-96951KEV Windows Shell Security Feature Bypass Vulnerability | Windows Shell Security Feature Bypass Vulnerability | Microsoft | 8.8 | 9.8% | KEV | 2026-10-13 |
| CVE-2026-104935KEV Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability | Ivanti | 8.6 | 88.9% | KEV | 2026-10-13 |
| CVE-2026-97229KEV Integer Overflow or Wraparound in GitLab | Integer Overflow or Wraparound in GitLab | GitLab | 10.0 | 69.3% | KEV | 2026-10-13 |
| CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | NetScaler | 9.5 | 1.9% | 2026-10-08 | |
| CVE-2026-76268 Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise | Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise | Splunk | 9.8 | 5.7% | 2026-10-07 | |
| CVE-2026-93674 Langflow OSS is affected by multiple vulnerabilities | Langflow OSS is affected by multiple vulnerabilities | IBM | 9.8 | 15.3% | 2026-10-07 | |
| CVE-2026-21589KEV Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability | Atlassian | 9.3 | 99.7% | KEV | 2026-10-05 |
| CVE-2026-105134KEV Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | Ahsay | 10.0 | 81.8% | KEV | 2026-10-04 |
| CVE-2026-105133KEV Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication | Ahsay | 7.3 | 84.5% | KEV | 2026-10-04 |
| CVE-2026-88779KEV Memory overflow vulnerability leading to Denial of Service | Memory overflow vulnerability leading to Denial of Service | NetScaler | 8.7 | 11.4% | KEV | 2026-10-04 |
| CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway | Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway | GitLab | 9.9 | 17.5% | 2026-10-02 | |
| CVE-2026-104286KEV Fortinet FortiMail Path Traversal Vulnerability | Fortinet FortiMail Path Traversal Vulnerability | Fortinet | 9.8 | 4.6% | KEV | 2026-10-01 |
| CVE-2026-102490KEV Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package | Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package | Zammad GmbH | 9.4 | 10.9% | KEV | 2026-09-30 |
| CVE-2026-102489KEV Undisclosed RCE in Zammad v6.3 and higher | Undisclosed RCE in Zammad v6.3 and higher | Zammad GmbH | 9.4 | 49.9% | KEV | 2026-09-30 |
| CVE-2026-76504KEV Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | Cisco | 9.8 | 38.9% | KEV | 2026-09-30 |
| CVE-2026-86950KEV Apple Multiple Products Out-of-Bounds Write Vulnerability | Apple Multiple Products Out-of-Bounds Write Vulnerability | Apple | 8.8 | 26.2% | KEV | 2026-09-28 |
| CVE-2026-88773 HTTP Request Smuggling | HTTP Request Smuggling | Citrix NetScaler | 9.3 | 3.1% | 2026-09-27 | |
| CVE-2026-88772KEV Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | Citrix NetScaler | 9.5 | 76.6% | KEV | 2026-09-27 |
| CVE-2026-88771KEV A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands | Citrix NetScaler | 9.5 | 81.9% | KEV | 2026-09-27 |
| CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection | HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection | rejetto | 10.0 | 5.5% | 2026-09-24 | |
| CVE-2026-96656KEV Plex Media Server arbitrary file write | Plex Media Server arbitrary file write | Plex | 8.6 | 1.8% | KEV | 2026-09-23 |
| CVE-2026-96655KEV Plex Media Server arbitrary-host SSRF | Plex Media Server arbitrary-host SSRF | Plex | 5.3 | 10.7% | KEV | 2026-09-23 |
| CVE-2026-96654KEV Plex Media Server URL injection | Plex Media Server URL injection | Plex | 6.9 | 1.9% | KEV | 2026-09-23 |
| CVE-2026-96652KEV Plex Media Server SSRF | Plex Media Server SSRF | Plex | 5.3 | 11.9% | KEV | 2026-09-23 |
| CVE-2026-19599 Remote Code Execution vulnerability | Remote Code Execution vulnerability | Zohocorp | 9.9 | 5.1% | 2026-09-23 | |
| CVE-2026-87902KEV WordPress Core Remote File Inclusion Vulnerability | WordPress Core Remote File Inclusion Vulnerability | WordPress | 8.1 | 95.8% | KEV | 2026-09-22 |
| CVE-2026-94127KEV BIG-IP APM OAuth vulnerability | BIG-IP APM OAuth vulnerability | F5 | 9.8 | 26.6% | KEV | 2026-09-22 |
| CVE-2026-93616KEV Directory Traversal and File upload allows execution of arbitrary script on the Management Server | Directory Traversal and File upload allows execution of arbitrary script on the Management Server | checkpoint | 9.8 | 91.6% | KEV | 2026-09-22 |
| CVE-2026-93952KEV Security Advisory 0183 | Security Advisory 0183 | Arista Networks | 10.0 | 1.4% | KEV | 2026-09-22 |
| CVE-2026-87886KEV Acronis Backup Incorrect Default Permissions Vulnerability | Acronis Backup Incorrect Default Permissions Vulnerability | Acronis | 7.8 | 0.2% | KEV | 2026-09-17 |
| CVE-2026-76460KEV Cisco Identity Services Engine Authentication Bypass Vulnerability | Cisco Identity Services Engine Authentication Bypass Vulnerability | Cisco | 10.0 | 75.6% | KEV | 2026-09-16 |
| CVE-2026-58704KEV Google Pixel Improper Authorization Vulnerability | Google Pixel Improper Authorization Vulnerability | 8.8 | 0.6% | KEV | 2026-09-15 | |
| CVE-2026-76461KEV Cisco Secure Email Gateway SQL Injection Vulnerability | Cisco Secure Email Gateway SQL Injection Vulnerability | Cisco | 9.8 | 40.2% | KEV | 2026-09-14 |
| CVE-2026-85706KEV Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | GitLab | 10.0 | 97.4% | KEV | 2026-09-12 |
| CVE-2026-17176 OS Command Injection Vulnerability in Deco Devices | OS Command Injection Vulnerability in Deco Devices | TP-Link Systems Inc. | 7.7 | 15.0% | 2026-09-10 | |
| CVE-2026-85102KEV Improper Certificate Validation in Quantum Security Gateway | Improper Certificate Validation in Quantum Security Gateway | checkpoint | 9.8 | 54.1% | KEV | 2026-09-09 |
| CVE-2026-87491KEV Google Chromium V8 Out of Bounds Write Vulnerability | Google Chromium V8 Out of Bounds Write Vulnerability | 8.8 | 3.5% | KEV | 2026-09-09 | |
| CVE-2026-84869KEV ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | ConnectWise | 9.9 | 0.9% | KEV | 2026-09-08 |
| CVE-2026-81963KEV Windows Update Stack Elevation of Privilege Vulnerability | Windows Update Stack Elevation of Privilege Vulnerability | Microsoft | 7.8 | 7.1% | KEV | 2026-09-08 |
| CVE-2026-85880KEV Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Microsoft | 7.8 | 0.4% | KEV | 2026-09-08 |
| CVE-2026-75650KEV Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Adobe | 10.0 | 99.4% | KEV | 2026-09-07 |
| CVE-2026-86218KEV pre-authentication remote code execution | pre-authentication remote code execution | N-able | 10.0 | 15.4% | KEV | 2026-09-06 |
| CVE-2026-86060KEV SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | Mikrotik | 9.2 | 6.4% | KEV | 2026-09-05 |
| CVE-2026-67279KEV SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | Mikrotik | 6.9 | 2.3% | KEV | 2026-09-05 |
| CVE-2026-67277KEV Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | Mikrotik | 8.8 | 1.6% | KEV | 2026-09-05 |
| CVE-2026-67276 SSH user impersonation possible in Mikrotik RouterOS | SSH user impersonation possible in Mikrotik RouterOS | Mikrotik | 9.2 | 8.9% | 2026-09-05 | |
| CVE-2026-85046KEV Google Chromium V8 Type Confusion Vulnerability | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 1.8% | KEV | 2026-09-03 | |
| CVE-2026-83549KEV SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SonicWall SMA1000 Appliances OS Command Injection Vulnerability | SonicWall | 7.8 | 9.9% | KEV | 2026-09-01 |
| CVE-2026-83548KEV SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability | SonicWall | 10.0 | 8.0% | KEV | 2026-09-01 |
| CVE-2026-82329KEV Potential authentication bypass leading to administrative access in Artifactory | Potential authentication bypass leading to administrative access in Artifactory | jfrog | 9.8 | 14.4% | KEV | 2026-08-28 |
| CVE-2026-82078KEV PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | PaperCut | 9.4 | 63.0% | KEV | 2026-08-28 |
| CVE-2026-81578KEV PaperCut MF/NG: Authentication Bypass | PaperCut MF/NG: Authentication Bypass | PaperCut | 8.8 | 84.7% | KEV | 2026-08-28 |
| CVE-2026-74820 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause | Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause | ServiceNow | 10.0 | 5.1% | 2026-08-27 | |
| CVE-2026-18886 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor | Unauthenticated Privilege Escalation via System Configuration Image Upload Processor | ServiceNow | 10.0 | 5.0% | 2026-08-27 | |
| CVE-2026-18885 Unauthenticated Remote Code Execution in GraphQL Composite Data API | Unauthenticated Remote Code Execution in GraphQL Composite Data API | ServiceNow | 10.0 | 7.2% | 2026-08-27 | |
| CVE-2026-60004KEV Gitea Code Injection Vulnerability | Gitea Code Injection Vulnerability | Gitea | 9.8 | 24.0% | KEV | 2026-08-26 |
| CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure | TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure | cozmoslabs | 9.8 | 4.5% | 2026-08-26 | |
| CVE-2026-19586 Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways | Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways | TP-Link Systems Inc. | 9.3 | 5.8% | 2026-08-20 | |
| CVE-2026-72530KEV TrueConf Server Code Injection Vulnerability | TrueConf Server Code Injection Vulnerability | TrueConf | 9.5 | 1.7% | KEV | 2026-08-19 |
| CVE-2026-72529KEV TrueConf Server Missing Authentication for Critical Function Vulnerability | TrueConf Server Missing Authentication for Critical Function Vulnerability | TrueConf | 9.8 | 1.5% | KEV | 2026-08-19 |
| CVE-2026-20320KEV Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability | Cisco | 7.5 | 0.8% | KEV | 2026-08-19 |
| CVE-2026-19490KEV NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | NetScaler | 9.3 | 33.3% | KEV | 2026-08-19 |
| CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass | Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass | Red Hat | 9.1 | 6.6% | 2026-08-18 | |
| CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration | Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration | wpmudev | 9.8 | 4.1% | 2026-08-18 | |
| CVE-2026-64849KEV MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | mlflow | 9.3 | 10.0% | KEV | 2026-08-17 |
| CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab | Improper Control of Generation of Code ('Code Injection') in GitLab | GitLab | 9.4 | 2.2% | 2026-08-17 | |
| CVE-2026-19681 Command Injection | Command Injection | Tenable, Inc. | 9.9 | 4.2% | 2026-08-14 | |
| CVE-2026-73570KEV Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability | Zimbra | 8.9 | 76.6% | KEV | 2026-08-13 |
| CVE-2026-42018KEV Anonymous user token generation exposure in JFrog Artifactory | Anonymous user token generation exposure in JFrog Artifactory | jfrog | 7.5 | 10.0% | KEV | 2026-08-12 |
| CVE-2026-66384KEV Authenticated users may write data outside the intended Docker cache path | Authenticated users may write data outside the intended Docker cache path | jfrog | 5.3 | 0.7% | KEV | 2026-08-12 |
| CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header | DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header | eosphoros-ai | 9.8 | 5.7% | 2026-08-11 | |
| CVE-2026-71362KEV Adobe Commerce | Incorrect Authorization (CWE-863) | Adobe Commerce | Incorrect Authorization (CWE-863) | Adobe | 9.1 | 91.7% | KEV | 2026-08-11 |
| CVE-2026-20349KEV Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability | Cisco | 8.6 | 1.0% | KEV | 2026-08-11 |
Frequently Asked Questions
What is a CVE?→
CVE (Common Vulnerabilities and Exposures) is the standard identifier for a publicly known security flaw. Each record has a unique ID, a description, affected products, and references. The CVE Board oversees the program, MITRE serves as its Secretariat and maintains the infrastructure, and CVE Numbering Authorities assign the IDs.
What does a CVE number mean?→
A CVE ID has the format CVE-YYYY-NNNNN: a year, followed by a number of four or more digits. CNAs base the year on when the vulnerability was first publicly disclosed, when the record was first published, or when the ID was reserved. The number identifies the vulnerability; it says nothing about severity.
What is the difference between CVE, NVD, and CISA KEV?→
- +CVE is the identifier and base record, published by a CVE Numbering Authority.
- +NVD is the US National Vulnerability Database, run by NIST. It enriches CVE records within its scope of coverage with CVSS scores, CWE weakness data, and affected-product data.
- +CISA KEV is a catalog of CVEs confirmed as exploited in the wild. It is a small subset of all CVEs and carries remediation deadlines for federal agencies.
How do I read a CVE entry?→
Start with the description and the affected vendor, product, and version ranges. Check the CVSS score for severity, the EPSS score for exploitation probability, and the KEV flag for confirmed exploitation. References link to advisories, patches, and technical writeups.
How do I find a specific CVE here?→
Records live at /vulnerabilities/{cve-id}/ in lowercase, for example /vulnerabilities/cve-2026-1234/. This index covers every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05. For any other CVE, use NVD or MITRE.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert data from CISA cybersecurity alerts. Coverage: every CISA KEV entry, critical CVEs named in CISA alerts, and CVEs from 2026 onward with a high EPSS score, or with a critical CVSS score and an EPSS score of at least 0.05. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.