Skip to main content
cve.nowby Sazabi
Back

The cve.now Index

The worst CVEs published or escalated in the window, scored 0 to 100 on exploitation, exposure, reach, severity and patch status. How the score works. The packages board ranks open source packages by their worst CVE, and the charts show what drives the scores.

Severity
    Technology
      Ecosystem
        1. 1–95GitLabCVE-2026-97229GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. The fix is in 19.2.8, 19.3.5, and 19.4.2.KEVMetasploitEPSSFixed in 19.2.8, 19.3.5, 19.4.2Added to KEV
        2. 2–92Google Brotli · node +6CVE-2026-111497Affects Node.js 22.x, 24.x and 26.x applications that decompress attacker-supplied Brotli data with node:zlib. Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.KEVExploit publicEPSSFixed in 1.0.10, 1.1.1, 1.2.1, 22.23.4Added to KEV
        3. 3▲291BerriAI litellm · litellmCVE-2026-42208LiteLLM, an open-source proxy server that routes calls to LLM APIs in OpenAI-compatible format, is affected by this vulnerability. An unauthenticated attacker could exploit it to read, and possibly modify, data in the p…KEVEPSSFixed in 1.83.7EPSS crossed 10%
        4. 4▲291PGoogle ChromeCVE-2026-5281Google Chrome's Dawn graphics component contains a memory-safety flaw that could let an attacker who has already taken control of the browser's renderer process run arbitrary code on the affected system. The attack coul…KEVEPSSFixed in 146.0.7680.178ProvisionalEPSS crossed 10%
        5. 5▲290PMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1CVE-2026-42897Microsoft Exchange Server is affected by this vulnerability, which stems from improper handling of input in web page generation (cross-site scripting). An unauthorized attacker over a network could exploit it to perform…KEVEPSSFixed in 15.01.2507.069, 15.02.1544.041, 15.02.1748.046, 15.02.2562.043ProvisionalEPSS crossed 10%
        6. 6▲290PIvanti Endpoint Manager MobileCVE-2026-6973Ivanti Endpoint Manager Mobile (EPMM), a mobile device management product, is affected by this vulnerability. An attacker who already has administrative login access to the product could exploit improper input handling…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        7. 7▲288Ivanti Connect SecureCVE-2026-111357Affects Ivanti Connect Secure 22.8R2.4 (Build 19097) appliances, where an attacker who already has code execution as the cgi-server user can escalate to root. The checked facts name no fixed release.KEVNo patch listed yetAdded to KEV
        8. 8▲285Fortinet FortiNACCVE-2022-39952MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
        9. 9▲285GitLabCVE-2023-2825MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
        10. 10▲285Genetech Solutions WordPress Pie Register PluginCVE-2025-34077MetasploitExploit publicEPSSNucleiNo patch listed yetEPSS crossed 10%
        11. 11▲284LinuxCVE-2026-46300The Linux kernel's core networking packet-buffer code (sk_buff handling, specifically skb_try_coalesce() used during TCP receive coalescing) is affected. The flaw can cause packets carrying externally owned or page-cach…KEVMetasploitExploit publicEPSSFixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141Added to KEV
        12. 12▲281VMware Cloud Foundation · VMware vSphere Foundation +2CVE-2026-41709Affects VMware ESX 8.0, 9.0.x and 9.1.x builds before the fixed releases, and VMware Cloud Foundation 5.x before 5.2.4. Fixed in ESXi80U3j-25429389, ESXi-9.0.2.0100-25595025 and ESXi-9.1.0.0-25370933.KEVFixed in 5.2.4, ESXi-9.1.0.0-25370933, ESXi-9.0.2.0100-25595025, ESXi80U3j-25429389Added to KEV
        13. 13▲281rayCVE-2023-48022MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
        14. 14▲280PApache Software Foundation Apache Tomcat · org.apache.to… +1CVE-2026-34486Apache Tomcat, a widely used open-source Java web server, is affected. A flaw in a fix for an earlier issue allows the EncryptInterceptor protection to be bypassed, so sensitive data sent between clustered Tomcat nodes…KEVEPSSFixed in 11.0.21, 10.1.54, 9.0.117ProvisionalEPSS crossed 10%
        15. 15▲280vercel next.js · nextCVE-2025-29927MetasploitExploit publicEPSSNucleiFixed in 12.3.5, 14.2.25, 15.2.3, 13.5.9EPSS crossed 10%
        16. 16▲280rails · activestorageCVE-2026-66066MetasploitEPSSFixed in 7.2.3.2, 8.0.5.1, 8.1.3.1EPSS crossed 10%
        17. 17▲279Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…CVE-2026-76418Affects Cisco ASA and Secure Firewall Threat Defense software with SSL VPN enabled and secondary authentication set in a tunnel group. CVSS rates it 8.6 (high). Cisco has released fixes, with no fixed versions listed in…KEVNo patch listed yetAdded to KEV
        18. 18▲279ValvePress WordPress Automatic PluginCVE-2021-4374MetasploitEPSSNucleiFixed in 3.53.3EPSS crossed 10%
        19. 19▲277aquasecurity setup-trivy · aquasecurity trivy-action +6CVE-2026-33634Affects Trivy v0.69.4 (or latest during the exposure window), trivy-action tags 0.0.1 to 0.34.2, and setup-trivy used without version or SHA pinning. Fixed in Trivy 0.69.2 and 0.69.3, trivy-action 0.35.0, and setup-triv…KEVEPSSFixed in 0.2.6, 0.35.0EPSS crossed 10%
        20. 20▲277POracle PaymentsCVE-2026-46817The vulnerability affects the Oracle Payments module of Oracle E-Business Suite, specifically its File Transmission component. An unauthenticated remote attacker over the network can easily exploit it to take over Oracl…KEVEPSSNo patch listed yetProvisionalEPSS crossed 10%
        21. 21▲276PostgreSQLCVE-2025-1094MetasploitEPSSFixed in 17.3, 16.7, 15.11, 14.16EPSS crossed 10%
        22. 22▲275OpenTSDB · net.opentsdb:opentsdbCVE-2023-25826MetasploitEPSSNucleiNo patch listed yetEPSS crossed 10%
        23. 23▲275pyload-ngCVE-2024-39205MetasploitEPSSNo patch listed yetEPSS crossed 10%
        24. 24New75Fortinet FortiSIEMCVE-2025-64155EPSSNo patch listed yetEPSS crossed 10%
        25. 25New750xJacky nginx-ui · github.com/0xJacky/Nginx-UICVE-2026-33032EPSSNucleiNo patch listed yetEPSS crossed 10%
        26. 26New75Fortinet FortiSandboxCVE-2026-39813EPSSNo patch listed yetEPSS crossed 10%
        27. 27New73Pray-project/ray · rayCVE-2023-6019MetasploitExploit publicEPSSFixed in 2.8.1ProvisionalEPSS crossed 10%
        28. 28New73nodejs nodeCVE-2026-21710EPSSNo patch listed yetEPSS crossed 10%
        29. 29New73Apache Software Foundation Apache HTTP ServerCVE-2026-49975EPSSNo patch listed yetEPSS crossed 10%
        30. 30New72ZammadCVE-2026-102489Affects Zammad 6.5 and earlier versions because of the runtime environment those versions use. The fix is included in Zammad 7.2.0. Zammad has not published a vendor severity rating.KEVEPSSFixed in 6.5.4EPSS crossed 10%
        31. 31New72PUbiquiti UniFi OS Server · Ubiquiti Express +29CVE-2026-34909Ubiquiti UniFi OS devices are affected by a path traversal flaw that allows a attacker with network access to read files on the underlying system. Those files could potentially be used to gain access to an underlying us…KEVEPSSFixed in 5.0.8, 4.0.14, 5.1.12, 5.1.11ProvisionalEPSS crossed 10%
        32. 32New72Adobe Commerce · Adobe Magento Open SourceCVE-2026-48356Magento Open Source through 2.4.8-p5 is exposed via an unauthenticated guest-cart REST endpoint that accepts file uploads. Fixed in 2.4.8-2026-jul and APSB26-73.KEVEPSSFix availableAdded to KEV
        33. 33New72PF5 BIG-IPCVE-2026-94127F5 BIG-IP Access Policy Manager (APM) is affected when it is configured as an OAuth Authorization Server with an access policy and OAuth profile on a virtual server, but not when it is used only as an OAuth Client or Re…KEVEPSSFixed in Hotfix-BIGIP-21.1.0.2.0.30.22-ENG, Hotfix-BIGIP-17.5.1.9.0.160.12-ENG, Hotfix-BIGIP-17.1.3.5.0.41.14-ENGProvisionalEPSS crossed 10%
        34. 34New72PGitLabCVE-2021-4191MetasploitEPSSNucleiFixed in 14.8.2, 14.7.4, 14.6.5ProvisionalEPSS crossed 10%
        35. 35New72vllm-project vllm · vllmCVE-2026-22778MetasploitEPSSNucleiFixed in 0.14.1EPSS crossed 10%
        36. 36New72djangoproject Django · djangoCVE-2025-64459Exploit publicEPSSFixed in 5.2.8, 5.1.14, 4.2.26EPSS crossed 10%
        37. 37New71Apple Safari · Apple iOS and iPadOS +4CVE-2025-43529Apple's Safari web browser and its iPhone, iPad, Mac, Apple TV, Vision Pro, and Apple Watch operating systems are affected. A flaw in memory handling means that opening maliciously crafted web content could allow an att…KEVEPSSFixed in 26.2, 18.7.3EPSS crossed 10%
        38. 38New71PNetScaler ADC · NetScaler GatewayCVE-2026-3055NetScaler ADC and NetScaler Gateway products are affected when configured as a SAML Identity Provider (IdP). Due to insufficient input validation, an attacker could cause the system to read memory beyond its intended bo…KEVEPSSFixed in 66.59, 62.23, 37.262ProvisionalEPSS crossed 10%
        39. 39New71Mirasvit Full Page Cache Warmer for MagentoCVE-2026-45247Mirasvit Cache Warmer (Full Page Cache Warmer for Magento 2) versions before 1.11.12 are affected. The fix is in version 1.11.12.KEVEPSSFixed in 1.11.12EPSS crossed 10%
        40. 40New71Pray-project/ray · rayCVE-2023-6020MetasploitEPSSNucleiFixed in 2.8.1ProvisionalEPSS crossed 10%
        41. 41New71ChromaDBCVE-2026-45829EPSSNo patch listed yetEPSS crossed 10%
        42. 42New70GitLabCVE-2022-2992MetasploitEPSSFixed in 15.1.6, 15.2.4, 15.3.2EPSS crossed 10%
        43. 43New70pyload/pyload · pyload-ngCVE-2023-0297MetasploitExploit publicEPSSNucleiFixed in 0.5.0b3.dev31EPSS crossed 10%
        44. 44New70opentsdb · net.opentsdb:opentsdbCVE-2023-36812MetasploitEPSSFixed in 2.4.2EPSS crossed 10%
        45. 45New70pytorch serve · torchserveCVE-2023-43654MetasploitEPSSNucleiFixed in 0.8.2EPSS crossed 10%
        46. 46New70wwbn/avideoCVE-2024-31819MetasploitEPSSFixed in 14.3EPSS crossed 10%
        47. 47New70man-group/dtale · dtaleCVE-2024-3408MetasploitEPSSNucleiFixed in 3.13.1EPSS crossed 10%
        48. 48New70BentoMLCVE-2025-27520MetasploitEPSSFixed in 1.4.3EPSS crossed 10%
        49. 49New70BentoMLCVE-2025-32375MetasploitEPSSFixed in 1.4.8EPSS crossed 10%
        50. 50New70pterodactyl panel · pterodactyl/panelCVE-2025-49132MetasploitExploit publicEPSSNucleiFixed in 1.11.11EPSS crossed 10%

        Past weeks: 2026-W44

        Is one of these in your stack? Scan your lockfile, or let Sazabi watch production for you.