CVE Database
Search a CVE ID to read the official record, its CVSS score explained, the EPSS exploit prediction and whether CISA lists it as exploited in the wild.
Recently added to CISA KEV
The latest entries of the Known Exploited Vulnerabilities catalog.
- CVE-2026-111560Added Nov 10, 2026Barracuda Networks Multiple Products OS Command Injection VulnerabilityBarracuda Networks / Multiple Products
- CVE-2026-111793Added Nov 10, 2026Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres VulnerabilityOpenwave Messaging Limited / Webtop Media Transcoder
- CVE-2026-116606Added Nov 10, 2026Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel VulnerabilityBarracuda Networks / Barracuda Email Security Gateway (ESG)
- CVE-2026-124194Added Nov 10, 2026Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action VulnerabilityMicrosoft / Office
- CVE-2026-125350Added Nov 10, 2026Google Chromium Use-After-Free VulnerabilityGoogle / Chromium
- CVE-2026-20320Added Nov 10, 2026Cisco BroadWorks Improper Restriction of XML External Entity Reference VulnerabilityCisco / BroadWorks
- CVE-2026-102895Added Nov 9, 2026GPUStack Improper Authentication VulnerabilityGPUStack / GPUStack
- CVE-2026-116779Added Nov 9, 2026SignalWire FreeSwitch Code Injection VulnerabilitySignalWire / FreeSwitch
- CVE-2026-123158Added Nov 9, 2026OpenBSD OpenSSH Unexpected Status Code or Return Value VulnerabilityOpenBSD / OpenSSH
- CVE-2026-123218Added Nov 9, 2026IBM Aspera Faspex Incorrect Authorization VulnerabilityIBM / Aspera Faspex
- CVE-2026-19868Added Nov 6, 2026SonicWall SonicOS SSLVPN Use of Single-factor Authentication VulnerabilitySonicWall / SonicOS SSLVPN
- CVE-2024-27834Added Nov 4, 2026Apple Multiple Products Improper Authentication VulnerabilityApple / Multiple Products
- CVE-2026-119977Added Nov 3, 2026WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition VulnerabilityWordPress / WordPress Core
- CVE-2026-111357Added Oct 30, 2026Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityIvanti / Connect Secure
- CVE-2026-118527Added Oct 30, 2026Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityIvanti / Connect Secure
- CVE-2026-76418Added Oct 29, 2026Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityCisco / Secure Firewall ASA Software and Cisco Secure FTD Software
- CVE-2026-97229Added Oct 29, 2026GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityGitLab / Community Edition and Enterprise Edition
- CVE-2026-41709Added Oct 28, 2026Broadcom VMWare ESX Insufficient Logging VulnerabilityBroadcom / VMware ESX
- CVE-2026-46300Added Oct 28, 2026Linux Kernel Missing Initialization of a Variable VulnerabilityLinux / Kernel
- CVE-2026-111497Added Oct 27, 2026Google Brotli Unchecked Return Value VulnerabilityGoogle / Brotli
- CVE-2026-48356Added Oct 27, 2026Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type VulnerabilityAdobe / Commerce and Magento
- CVE-2026-109618Added Oct 26, 2026PHP Memory Corruption VulnerabilityPHP Group / PHP
- CVE-2026-109619Added Oct 26, 2026PHP Stale Internal Request-State VulnerabilityPHP Group / PHP
- CVE-2026-110447Added Oct 23, 2026Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora / Collabora Online – Built-in CODE Server
- CVE-2026-114625Added Oct 23, 2026Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista / VeloCloud Orchestrator
Where the data comes from
Each page combines three public sources and keeps no database of its own.
Records (description, CVSS, affected products and references) come from the CVE Program and are read when someone opens the page, with copies kept for up to 75 minutes. Known exploited status comes from the CISA KEV catalog, refreshed every 6 hours. Exploit prediction comes from FIRST EPSS, refreshed daily.
Known Exploited Vulnerabilities catalog · Sources and licenses
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses