Skip to main content
cve.nowby Sazabi
The cve.now Index

Charts: the cve.now Index

How the CVEs on the board score, and why. How the score works.

Chart

Score against CVSS

Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.

02550751000246810CVSS base scorecve.now Index scoreCVE-2025-59718 Fortinet FortiSwitchManager · Fortinet FortiOS +1: score 100, CVSS 9.1CVE-2026-10520 ivanti Sentry: score 100, CVSS 10CVE-2026-1281 Ivanti Endpoint Manager Mobile: score 100, CVSS 9.8CVE-2024-21762 Fortinet FortiOS · Fortinet FortiProxy: score 100, CVSS 9.6CVE-2026-104935 Ivanti Connect Secure: score 100, CVSS 8.6CVE-2023-46805 Ivanti ICS · Ivanti IPS: score 98, CVSS 8.2CVE-2020-0618 Microsoft SQL Server: score 97, CVSS 9.8CVE-2023-20198 Cisco IOS XE Software: score 97, CVSS 10CVE-2023-35078 Ivanti Endpoint Manager Mobile: score 97, CVSS 10CVE-2023-35082 Ivanti EPMM: score 97, CVSS 10CVE-2024-13159 Ivanti Endpoint Manager: score 97, CVSS 9.8CVE-2024-13160 Ivanti Endpoint Manager: score 97, CVSS 9.8CVE-2024-13161 Ivanti Endpoint Manager: score 97, CVSS 9.8CVE-2024-23113 Fortinet FortiSwitchManager · Fortinet FortiOS +2: score 97, CVSS 9.8CVE-2024-55591 Fortinet FortiOS · Fortinet FortiProxy: score 97, CVSS 9.6CVE-2024-7593 Ivanti vTM: score 97, CVSS 9.8CVE-2025-0282 Ivanti Connect Secure · Ivanti Policy Secure +1: score 97, CVSS 9CVE-2026-1340 Ivanti Endpoint Manager Mobile: score 97, CVSS 9.8CVE-2022-27518 Citrix Gateway, Citrix ADC: score 97, CVSS 9.8CVE-2016-5198 Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.284…: score 96, CVSS 8.8CVE-2023-27997 Fortinet FortiOS-6K7K · Fortinet FortiProxy +1: score 96, CVSS 9.2CVE-2024-38475 Apache Software Foundation Apache HTTP Server: score 96, CVSS 9.1CVE-2024-8963 Ivanti CSA: score 96, CVSS 9.4CVE-2025-22457 Ivanti Connect Secure · Ivanti Policy Secure +1: score 96, CVSS 9CVE-2026-1603 Ivanti Endpoint Manager: score 96, CVSS 8.6CVE-2026-24858 Fortinet FortiWeb · Fortinet FortiNAC-F +4: score 96, CVSS 9.4CVE-2020-3566 Cisco IOS XR Software: score 96, CVSS 8.6CVE-2020-3569 Cisco IOS XR Software: score 96, CVSS 8.6CVE-2026-97229 GitLab: score 95, CVSS 10CVE-2026-88771 Citrix NetScaler ADC · Citrix NetScaler Gateway: score 95, CVSS 9.5CVE-2018-6961 VMware NSX SD-WAN by VeloCloud: score 95, CVSS 8.1CVE-2021-41773 Apache Software Foundation Apache HTTP Server: score 95, CVSS 7.5CVE-2024-21893 Ivanti ICS · Ivanti IPS: score 95, CVSS 8.2CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: score 95, CVSS 10CVE-2026-0300 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 95, CVSS 9.3CVE-2026-63030 WordPress: score 95, CVSS 9.8CVE-2026-104286 Fortinet FortiMail: score 95, CVSS 9.8CVE-2025-39682 Linux · :linux_kernel:: score 95, CVSS 9.8CVE-2018-8581 Microsoft Exchange Server: score 94, CVSS 7.4CVE-2021-26858 Microsoft Exchange Server 2013 Cumulative Update · Micro… +1: score 94, CVSS 7.8CVE-2021-27065 Microsoft Exchange Server 2013 Cumulative Update · Micro… +2: score 94, CVSS 7.8CVE-2026-111497 Google Brotli · node +6: score 92, CVSS 9.2CVE-2026-109618 PHP Group PHP: score 92, CVSS 9.2CVE-2026-109619 PHP Group PHP: score 92, CVSS 9.2CVE-2026-88772 Citrix NetScaler ADC · Citrix NetScaler Gateway: score 92, CVSS 9.5CVE-2017-6736 Cisco IOS · IntelliShield Universal Product: score 92, CVSS 8.8CVE-2017-6737 Cisco IOS: score 92, CVSS 8.8CVE-2017-6738 Cisco IOS: score 92, CVSS 8.8CVE-2017-6740 Cisco IOS · IntelliShield Universal Product: score 92, CVSS 8.8CVE-2017-6742 Cisco IOS XE Software · IntelliShield Universal Product: score 92, CVSS 8.8CVE-2017-6743 Cisco IOS · IntelliShield Universal Product: score 92, CVSS 8.8CVE-2018-1273 Spring by Pivotal Spring Framework · org.springframework.da…: score 92, CVSS 9.8CVE-2019-1068 Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems…: score 92, CVSS 8.8CVE-2020-0688 Microsoft Exchange Server: score 92, CVSS 8.8CVE-2020-15999 Google Chrome · CefSharp.Common +3: score 92, CVSS 9.6CVE-2021-22205 GitLab: score 92, CVSS 10CVE-2021-30633 Google Chrome: score 92, CVSS 9.6CVE-2021-37973 Google Chrome: score 92, CVSS 9.6CVE-2021-42013 Apache Software Foundation Apache HTTP Server: score 92, CVSS 9.8CVE-2021-44228 Apache Software Foundation Apache Log4j2 · org.apache.lo… +4: score 92, CVSS 10CVE-2022-22947 Spring Cloud Gateway · org.springframework.cloud:spring-clo…: score 92, CVSS 10CVE-2022-22963 Spring Cloud Function · org.springframework.cloud:spring-cl…: score 92, CVSS 9.8CVE-2022-22965 Spring Framework · org.springframework:spring-beans +4: score 92, CVSS 9.8CVE-2022-40684 Fortinet FortiOS, FortiProxy, FortiSwitchManager: score 92, CVSS 9.8CVE-2022-4135 Google Chrome · electron: score 92, CVSS 9.6CVE-2023-24489 Citrix ShareFile Storage Zones Controller: score 92, CVSS 9.8CVE-2023-34048 VMware vCenter Server · VMware Cloud Foundation: score 92, CVSS 9.8CVE-2023-3519 Citrix NetScaler ADC · Citrix NetScaler Gateway: score 92, CVSS 9.8CVE-2023-38035 Ivanti MobileIron Sentry: score 92, CVSS 9.8CVE-2023-6345 Google Chrome: score 92, CVSS 9.6CVE-2023-7028 GitLab: score 92, CVSS 10CVE-2024-21410 Microsoft Exchange Server 2016 Cumulative Update · Microsof…: score 92, CVSS 9.8CVE-2024-21887 Ivanti ICS · Ivanti IPS: score 92, CVSS 9.1CVE-2024-23897 Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core: score 92, CVSS 9.8CVE-2024-3400 Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1: score 92, CVSS 10CVE-2024-4577 PHP Group PHP: score 92, CVSS 9.8CVE-2024-47575 Fortinet FortiManager: score 92, CVSS 9.8CVE-2024-4947 Google Chrome: score 92, CVSS 9.6CVE-2025-25257 Fortinet FortiWeb: score 92, CVSS 9.6CVE-2025-32756 Fortinet FortiNDR · Fortinet FortiCamera +3: score 92, CVSS 9.6CVE-2025-4427 Ivanti Endpoint Manager Mobile: score 92, CVSS 5.3CVE-2025-6558 Google Chrome: score 92, CVSS 8.8CVE-2026-85706 GitLab: score 92, CVSS 10CVE-2026-48710 Kludex starlette · starlette: score 92, CVSS 6.5CVE-2026-59310 VMware Cloud Foundation · VMware vSphere Foundation +3: score 92, CVSS 9.8CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: score 92, CVSS 9.6CVE-2024-4671 Google Chrome: score 92, CVSS 9.6CVE-2023-2136 Google Chrome: score 92, CVSS 9.6CVE-2022-3075 Google Chrome: score 92, CVSS 9.6CVE-2020-2021 Palo Alto Networks PAN-OS: score 92, CVSS 10CVE-2017-6744 Cisco IOS · IntelliShield Universal Product: score 92, CVSS 8.8CVE-2020-16010 Google Chrome: score 92, CVSS 9.6CVE-2020-16017 Google Chrome · CefSharp.Common +3: score 92, CVSS 9.6CVE-2026-42208 BerriAI litellm · litellm: score 91, CVSS 9.3CVE-2026-5281 Google Chrome: score 91, CVSS 8.8CVE-2017-5030 Google Chrome prior to 57.0.2987.98 for Linux, Windows and…: score 91, CVSS 8.8CVE-2017-5070 Google Chrome prior to 59.0.3071.86 for Linux, Windows and…: score 91, CVSS 8.8CVE-2018-13379 Fortinet FortiOS, FortiProxy: score 91, CVSS 9.1CVE-2018-13382 Fortinet FortiOS, FortiProxy: score 91, CVSS 9.1CVE-2018-17463 Google Chrome: score 91, CVSS 8.8
In CISA KEVOther

Chart

What drives the top scores

The top 15 CVEs, with each score split into its parts.

  1. Fortinet FortiSwitchManager · Fortinet FortiOS +1CVE-2025-59718Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 5100
  2. ivanti SentryCVE-2026-10520Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 5100
  3. Ivanti Endpoint Manager MobileCVE-2026-1281Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 5100
  4. Fortinet FortiOS · Fortinet FortiProxyCVE-2024-21762Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 5100
  5. Ivanti Connect SecureCVE-2026-104935Exploitation 40, Exposure 25, Reach 20, Severity 9.6, No patch 5100
  6. Ivanti ICS · Ivanti IPSCVE-2023-46805Exploitation 40, Exposure 25, Reach 20, Severity 8.2, No patch 598
  7. Microsoft SQL ServerCVE-2020-0618Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 597
  8. Cisco IOS XE SoftwareCVE-2023-20198Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 597
  9. Ivanti Endpoint Manager MobileCVE-2023-35078Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 597
  10. Ivanti EPMMCVE-2023-35082Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 597
  11. Ivanti Endpoint ManagerCVE-2024-13159Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 597
  12. Ivanti Endpoint ManagerCVE-2024-13160Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 597
  13. Ivanti Endpoint ManagerCVE-2024-13161Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 597
  14. Fortinet FortiSwitchManager · Fortinet FortiOS +2CVE-2024-23113Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 597
  15. Fortinet FortiOS · Fortinet FortiProxyCVE-2024-55591Exploitation 40, Exposure 22, Reach 20, Severity 9.6, No patch 597
ExploitationExposureReachSeverityNo patch