Skip to main content
cve.nowby Sazabi
The cve.now Index

Charts: the cve.now Index

How the CVEs on the board score, and why. How the score works.

Chart

Score against CVSS

Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.

02550751000246810CVSS base scorecve.now Index scoreCVE-2026-97229 GitLab: score 95, CVSS 10CVE-2026-111497 Google Brotli · node +6: score 92, CVSS 9.2CVE-2026-42208 BerriAI litellm · litellm: score 91, CVSS 9.3CVE-2026-5281 Google Chrome: score 91, CVSS 8.8CVE-2026-42897 Microsoft Exchange Server 2016 Cumulative Update · Micro… +1: score 90, CVSS 8.1CVE-2026-6973 Ivanti Endpoint Manager Mobile: score 90, CVSS 7.2CVE-2026-111357 Ivanti Connect Secure: score 88, CVSS 7CVE-2022-39952 Fortinet FortiNAC: score 85, CVSS 9.8CVE-2023-2825 GitLab: score 85, CVSS 10CVE-2025-34077 Genetech Solutions WordPress Pie Register Plugin: score 85, CVSS 10CVE-2026-46300 Linux: score 84, CVSS 7.8CVE-2026-41709 VMware Cloud Foundation · VMware vSphere Foundation +2: score 81, CVSS 2.7CVE-2023-48022 ray: score 81, CVSS 9.8CVE-2026-34486 Apache Software Foundation Apache Tomcat · org.apache.to… +1: score 80, CVSS 7.5CVE-2025-29927 vercel next.js · next: score 80, CVSS 9.1CVE-2026-66066 rails · activestorage: score 80, CVSS 9.5CVE-2026-76418 Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…: score 79, CVSS 8.6CVE-2021-4374 ValvePress WordPress Automatic Plugin: score 79, CVSS 9.1CVE-2026-33634 aquasecurity setup-trivy · aquasecurity trivy-action +6: score 77, CVSS 9.4CVE-2026-46817 Oracle Payments: score 77, CVSS 9.8CVE-2025-1094 PostgreSQL: score 76, CVSS 8.1CVE-2023-25826 OpenTSDB · net.opentsdb:opentsdb: score 75, CVSS 9.8CVE-2024-39205 pyload-ng: score 75, CVSS 9.8CVE-2025-64155 Fortinet FortiSIEM: score 75, CVSS 9.4CVE-2026-33032 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI: score 75, CVSS 9.8CVE-2026-39813 Fortinet FortiSandbox: score 75, CVSS 9.1CVE-2023-6019 ray-project/ray · ray: score 73, CVSS 9.8CVE-2026-21710 nodejs node: score 73, CVSS 7.5CVE-2026-49975 Apache Software Foundation Apache HTTP Server: score 73, CVSS 7.5CVE-2026-102489 Zammad: score 72, CVSS 8.7CVE-2026-34909 Ubiquiti UniFi OS Server · Ubiquiti Express +29: score 72, CVSS 10CVE-2026-48356 Adobe Commerce · Adobe Magento Open Source: score 72, CVSS 9.3CVE-2026-94127 F5 BIG-IP: score 72, CVSS 9.8CVE-2021-4191 GitLab: score 72, CVSS 5.3CVE-2026-22778 vllm-project vllm · vllm: score 72, CVSS 9.8CVE-2025-64459 djangoproject Django · django: score 72, CVSS 9.1CVE-2025-43529 Apple Safari · Apple iOS and iPadOS +4: score 71, CVSS 8.8CVE-2026-3055 NetScaler ADC · NetScaler Gateway: score 71, CVSS 9.3CVE-2026-45247 Mirasvit Full Page Cache Warmer for Magento: score 71, CVSS 9.3CVE-2023-6020 ray-project/ray · ray: score 71, CVSS 7.5CVE-2026-45829 ChromaDB: score 71, CVSS 10CVE-2022-2992 GitLab: score 70, CVSS 9.9CVE-2023-0297 pyload/pyload · pyload-ng: score 70, CVSS 9.8CVE-2023-36812 opentsdb · net.opentsdb:opentsdb: score 70, CVSS 9.8CVE-2023-43654 pytorch serve · torchserve: score 70, CVSS 10CVE-2024-31819 wwbn/avideo: score 70, CVSS 9.8CVE-2024-3408 man-group/dtale · dtale: score 70, CVSS 9.8CVE-2025-27520 BentoML: score 70, CVSS 9.8CVE-2025-32375 BentoML: score 70, CVSS 9.8CVE-2025-49132 pterodactyl panel · pterodactyl/panel: score 70, CVSS 10CVE-2025-58434 FlowiseAI Flowise · flowise: score 70, CVSS 9.8CVE-2025-59528 FlowiseAI Flowise · flowise: score 70, CVSS 10CVE-2025-8943 flowise: score 70, CVSS 9.8CVE-2026-23744 MCPJam inspector · @mcpjam/inspector: score 70, CVSS 9.8CVE-2026-27966 langflow-ai langflow · langflow: score 70, CVSS 9.8CVE-2026-41679 paperclipai paperclip · @paperclipai/server +1: score 70, CVSS 10CVE-2026-27944 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI: score 70, CVSS 9.8CVE-2026-44492 axios: score 69, CVSS 8.6CVE-2026-44578 vercel next.js · next: score 69, CVSS 8.6CVE-2025-55184 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: score 68, CVSS 7.5CVE-2025-67779 Meta react-server-dom-parcel · Meta react-server-dom-tur… +4: score 68, CVSS 7.5CVE-2026-27654 F5 NGINX Open Source · F5 NGINX Plus: score 68, CVSS 8.2CVE-2026-119283 authlib joserfc · joserfc: score 68, CVSS 7.5CVE-2026-45659 Microsoft SharePoint Enterprise Server · Microsoft SharePoi…: score 67, CVSS 8.8CVE-2017-13098 Legion of the Bouncy Castle BouncyCastle TLS · org.bouncyca…: score 67, CVSS 7.5CVE-2021-32682 Studio-42 elFinder · studio-42/elfinder: score 67, CVSS 9.8CVE-2023-41892 craftcms cms · craftcms/cms: score 67, CVSS 10CVE-2020-16875 Microsoft Exchange Server 2019 Cumulative Update · Microsof…: score 66, CVSS 8.4CVE-2024-43425 moodle · moodle/moodle: score 66, CVSS 8.1CVE-2025-68154 sebhildebrandt systeminformation · systeminformation: score 66, CVSS 8.1CVE-2026-42945 F5 NGINX Plus · F5 NGINX Open Source: score 66, CVSS 8.1CVE-2026-9256 F5 NGINX Plus · F5 NGINX Open Source: score 66, CVSS 8.1CVE-2026-102490 Zammad: score 65, CVSS 8.5CVE-2011-0657 DNSAPI.dll in the DNS client in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Go: score 65, CVSS 9.8CVE-2012-6664 Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read: score 65, CVSS 9.1CVE-2013-10037 Eppler Software WebTester: score 65, CVSS 9.3CVE-2013-10048 D-Link DIR-600 · D-Link DIR-300: score 65, CVSS 9.3CVE-2013-10069 D-Link DIR-600 rev B · D-Link DIR-300 rev B: score 65, CVSS 10CVE-2014-5470 Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data: score 65, CVSS 9.8CVE-2016-20016 MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.: score 65, CVSS 9.8CVE-2016-9361 Moxa NPort: score 65, CVSS 9.8CVE-2018-15439 Cisco Small Business 300 Series Managed Switches: score 65, CVSS 9.8CVE-2019-15975 Cisco Data Center Network Manager: score 65, CVSS 9.8CVE-2020-3243 Cisco UCS Director: score 65, CVSS 9.8CVE-2020-3250 Cisco UCS Director: score 65, CVSS 9.8CVE-2022-20705 Cisco Small Business RV Series Router Firmware: score 65, CVSS 10CVE-2022-20707 Cisco Small Business RV Series Router Firmware: score 65, CVSS 10CVE-2022-31704 vRealize Log Insight: score 65, CVSS 9.8CVE-2022-31706 vRealize Log Insight: score 65, CVSS 9.8CVE-2022-31814 pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP H: score 65, CVSS 9.8CVE-2022-3229 Unified Intents AB Unified Remote: score 65, CVSS 9.8CVE-2022-40022 Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.: score 65, CVSS 9.8CVE-2022-40471 Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture uploa: score 65, CVSS 9.8CVE-2022-43781 Atlassian Bitbucket Data Center · Atlassian Bitbucket Server: score 65, CVSS 9.8CVE-2023-26068 Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).: score 65, CVSS 9.8CVE-2023-27372 SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.: score 65, CVSS 9.8CVE-2023-27855 Rockwell Automation ThinManager ThinServer: score 65, CVSS 9.8CVE-2023-2917 Rockwell Automation ThinManager ThinServer: score 65, CVSS 9.8CVE-2023-30013 TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg.: score 65, CVSS 9.8
In CISA KEVOther

Chart

What drives the top scores

The top 15 CVEs, with each score split into its parts.

  1. GitLabCVE-2026-97229Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 095
  2. Google Brotli · node +6CVE-2026-111497Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 092
  3. BerriAI litellm · litellmCVE-2026-42208Exploitation 40, Exposure 22, Reach 20, Severity 9.3, No patch 091
  4. Google ChromeCVE-2026-5281Exploitation 40, Exposure 22, Reach 20, Severity 8.8, No patch 091
  5. Microsoft Exchange Server 2016 Cumulative Update · Micro… +1CVE-2026-42897Exploitation 40, Exposure 22, Reach 20, Severity 8.1, No patch 090
  6. Ivanti Endpoint Manager MobileCVE-2026-6973Exploitation 40, Exposure 18, Reach 20, Severity 7.2, No patch 590
  7. Ivanti Connect SecureCVE-2026-111357Exploitation 40, Exposure 15, Reach 20, Severity 8, No patch 588
  8. Fortinet FortiNACCVE-2022-39952Exploitation 30, Exposure 20, Reach 20, Severity 10, No patch 585
  9. GitLabCVE-2023-2825Exploitation 30, Exposure 20, Reach 20, Severity 10, No patch 585
  10. Genetech Solutions WordPress Pie Register PluginCVE-2025-34077Exploitation 30, Exposure 20, Reach 20, Severity 10, No patch 585
  11. LinuxCVE-2026-46300Exploitation 40, Exposure 15, Reach 20, Severity 8.8, No patch 084
  12. VMware Cloud Foundation · VMware vSphere Foundation +2CVE-2026-41709Exploitation 40, Exposure 18, Reach 20, Severity 2.7, No patch 081
  13. rayCVE-2023-48022Exploitation 30, Exposure 20, Reach 16, Severity 10, No patch 581
  14. Apache Software Foundation Apache Tomcat · org.apache.to… +1CVE-2026-34486Exploitation 40, Exposure 22, Reach 10, Severity 7.5, No patch 080
  15. vercel next.js · nextCVE-2025-29927Exploitation 30, Exposure 20, Reach 20, Severity 10, No patch 080
ExploitationExposureReachSeverityNo patch