Analysis
Fix First
A severity score alone does not show what is being attacked. This page combines severity, CISA KEV and EPSS to help you decide what to patch first.
Computed from the whole catalog when the site is built.
Known to be attacked
1,779
Listed in CISA KEV
Likely but not in KEV
16,203
EPSS of 10% or higher, not listed in KEV
Critical but rarely attacked
64.8%
15,593 of 24,071 Critical records: EPSS below 1%, not in KEV
Severity against chance of attack
How many records sit in each box. Darker boxes hold more records. EPSS estimates the chance of attack in the next 30 days.
| Severity | EPSS under 1% | EPSS 1-10% | EPSS 10-50% | EPSS 50% or more | No EPSS | Total | Known Exploited |
|---|---|---|---|---|---|---|---|
| Critical | 15,596 | 6,634 | 898 | 860 | 83 | 24,071 | 627 |
| High | 74,431 | 15,253 | 1,438 | 868 | 1,095 | 93,085 | 931 |
| Medium | 92,570 | 8,280 | 607 | 250 | 585 | 102,292 | 211 |
| Low | 11,160 | 751 | 23 | 14 | 29 | 11,977 | 10 |
| None or not scored | 60,363 | 100,193 | 10,192 | 2,391 | 300 | 173,439 | 0 |
Known to be attacked
The newest records listed in CISA KEV, by publication date. Attacks have been observed, so these come first.
| CVE | Title | Vendor | Published | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2026-125350 | Google Chrome: Memory Corruption | High | n/a | ||
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | Microsoft | Medium | n/a | |
| CVE-2026-123218 | IBM Aspera Faspex Authorization Bypass | IBM | Critical | 0.7% | |
| CVE-2026-19868 | SonicWall SonicOS vulnerability | SonicWall | High | 0.5% | |
| CVE-2026-123158 | OpenBSD OpenSSH vulnerability | OpenBSD | High | 16.5% | |
| CVE-2026-116779 | FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | signalwire | Critical | 2.2% | |
| CVE-2026-102895 | GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin | gpustack | Critical | 0.6% | |
| CVE-2026-118527 | Ivanti Connect Secure vulnerability | Ivanti | Medium | 0.8% | |
| CVE-2026-116606 | Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway | Barracuda Networks | Critical | 1.6% | |
| CVE-2026-111560 | OS Command Injection in Barracuda Appliances | Barracuda Networks | High | 1.1% | |
| CVE-2026-119977 | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | WordPress | High | 1.2% | |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability | Cisco | High | 0.8% | |
| CVE-2026-114625 | Security Advisory 0199 | Arista Networks | Critical | 1.0% | |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | Critical | 82.6% | ||
| CVE-2026-109619 | RCE via stale global state | PHP Group | Critical | 100.0% | |
| CVE-2026-109618 | RCE via OOM corruption | PHP Group | Critical | 100.0% | |
| CVE-2026-111793 | Openwave Messaging (Ireland) Webtop Media Transcoder vulnerability | Openwave Messaging (Ireland) | Medium | 0.3% | |
| CVE-2026-111357 | Ivanti Connect Secure vulnerability | Ivanti | High | 0.5% | |
| CVE-2026-110936 | Siemens Software Center vulnerability | Siemens | Medium | 1.0% | |
| CVE-2026-102764 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support | BeyondTrust | Critical | 78.0% | |
| CVE-2026-76519 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability | Cisco | Critical | 6.2% | |
| CVE-2026-110447 | Collabora Online - Built-in CODE Server: Command Injection | Collabora | Critical | 73.3% | |
| CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition for Apache httpd: Command Injection | EG Secure Solutions | High | 2.5% | |
| CVE-2026-0322 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | Palo Alto Networks | High | 1.7% | |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | GitLab | Critical | 65.2% | |
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | Microsoft | High | 9.8% | |
| CVE-2026-104935 | Ivanti Connect Secure vulnerability | Ivanti | High | 88.9% | |
| CVE-2026-21589 | Atlassian Bamboo Data Center vulnerability | Atlassian | Critical | 99.7% | |
| CVE-2026-88779 | Memory overflow vulnerability leading to Denial of Service | NetScaler | High | 11.4% | |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | Ahsay | Critical | 81.8% |
High chance of attack, not yet in KEV
Records from the last two years that are not in KEV, highest EPSS first.
| CVE | Title | Vendor | Published | Severity | EPSS |
|---|---|---|---|---|---|
| CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability | Microsoft | Medium | 99.9% | |
| CVE-2025-1974 | ingress-nginx admission controller RCE escalation | kubernetes | Critical | 99.4% | |
| CVE-2025-29927 | Authorization Bypass in Next.js Middleware | vercel | Critical | 99.2% | |
| CVE-2025-27636 | Apache Camel: Camel Message Header Injection via Improper Filtering | Apache | Medium | 97.1% | |
| CVE-2025-4123 | Grafana: Cross-Site Scripting | Grafana | High | 97.1% | |
| CVE-2025-34037 | Linksys Routers E/WAG/WAP/WES/WET/WRT-Series | Linksys | Critical | 96.2% | |
| CVE-2026-43284 | xfrm: esp: avoid in-place decrypt on shared skb frags | Linux | High | 94.2% | |
| CVE-2024-8856 | Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload | revmakx | Critical | 94.1% | |
| CVE-2026-43500 | rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present | Linux | High | 94.1% | |
| CVE-2024-11320 | Command Injection leading to RCE via LDAP Misconfiguration | Pandora FMS | Medium | 91.2% | |
| CVE-2025-1094 | PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation | High | 90.0% | ||
| CVE-2025-66516 | Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected | Apache | High | 89.0% | |
| CVE-2025-59528 | Flowise has Remote Code Execution vulnerability | FlowiseAI | Critical | 87.0% | |
| CVE-2025-24799 | GLPI allows unauthenticated SQL injection through the inventory endpoint | glpi-project | High | 86.8% | |
| CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | kubernetes | High | 86.1% | |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter | xwiki | Critical | 85.5% | |
| CVE-2024-12856 | Four-Faith Industrial Router adjust_sys_time OS Command Injection | Four-Faith | High | 84.3% | |
| CVE-2025-47916 | invisioncommunity Invision Power Board vulnerability | invisioncommunity | Critical | 84.3% | |
| CVE-2024-49113 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | Microsoft | High | 83.8% | |
| CVE-2025-34152 | Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter | Shenzhen Aitemi E Commerce | Critical | 83.8% | |
| CVE-2024-10400 | Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter | themeum | High | 83.1% | |
| CVE-2025-49844 | Redis Lua Use-After-Free may lead to remote code execution | redis | Critical | 82.6% | |
| CVE-2025-58434 | Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover | FlowiseAI | Critical | 82.6% | |
| CVE-2024-10924 | Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass | Really Simple Plugins | Critical | 82.2% | |
| CVE-2025-34300 | Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE | Sawtooth Software | Critical | 81.3% | |
| CVE-2024-54003 | Jenkins Project Jenkins Simple Queue Plugin: Cross-Site Scripting | Jenkins Project | High | 81.2% | |
| CVE-2024-53675 | Hewlett Packard Enterprise (HPE) HPE Insight Remote Support vulnerability | Hewlett Packard Enterprise (HPE) | High | 81.0% | |
| CVE-2024-56325 | Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required | Apache | Critical | 80.2% | |
| CVE-2024-4990 | Unsafe Reflection in base Component class in yiisoft/yii2 | yiisoft | High | 80.1% | |
| CVE-2025-32969 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API | xwiki | Critical | 80.0% |
Known attacked vulnerabilities by vendor
EPSS is a statistical estimate from FIRST, not proof of attack. A low score does not mean a flaw is safe to ignore.